Gitiles
Code Review Sign In
gerrit.hackerspace.pl / hscloud / 291f55416443ff09e07810c06240e5f9fcb9175b / . / cluster / kube / lib / calico_crd.yml
blob: f0ae4a663336972721372ef7292ca51f2f64af7c [file] [log] [blame]
Bartosz Stebel4d98cf52021-12-01 00:36:02 +0100[diff] [blame]1---
2# vendored from Calico's distribution, licensed under Apache 2.0
3# Source: https://github.com/projectcalico/calico/blob/v3.15.5/_includes/charts/calico/templates/kdd-crds.yaml
4# -> https://github.com/projectcalico/calico/tree/v3.15.5/_includes/charts/calico/crds/kdd
5
6
7---
8apiVersion: apiextensions.k8s.io/v1
9kind: CustomResourceDefinition
10metadata:
11 annotations:
12 controller-gen.kubebuilder.io/version: (devel)
13 creationTimestamp: null
14 name: bgpconfigurations.crd.projectcalico.org
15spec:
16 group: crd.projectcalico.org
17 names:
18 kind: BGPConfiguration
19 listKind: BGPConfigurationList
20 plural: bgpconfigurations
21 singular: bgpconfiguration
22 scope: Cluster
23 versions:
24 - name: v1
25 schema:
26 openAPIV3Schema:
27 description: BGPConfiguration contains the configuration for any BGP routing.
28 properties:
29 apiVersion:
30 description: 'APIVersion defines the versioned schema of this representation
31 of an object. Servers should convert recognized schemas to the latest
32 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
33 type: string
34 kind:
35 description: 'Kind is a string value representing the REST resource this
36 object represents. Servers may infer this from the endpoint the client
37 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
38 type: string
39 metadata:
40 type: object
41 spec:
42 description: BGPConfigurationSpec contains the values of the BGP configuration.
43 properties:
44 asNumber:
45 description: 'ASNumber is the default AS number used by a node. [Default:
46 64512]'
47 format: int32
48 type: integer
49 logSeverityScreen:
50 description: 'LogSeverityScreen is the log severity above which logs
51 are sent to the stdout. [Default: INFO]'
52 type: string
53 nodeToNodeMeshEnabled:
54 description: 'NodeToNodeMeshEnabled sets whether full node to node
55 BGP mesh is enabled. [Default: true]'
56 type: boolean
57 serviceClusterIPs:
58 description: ServiceClusterIPs are the CIDR blocks from which service
59 cluster IPs are allocated. If specified, Calico will advertise these
60 blocks, as well as any cluster IPs within them.
61 items:
62 description: ServiceClusterIPBlock represents a single whitelisted
63 CIDR block for ClusterIPs.
64 properties:
65 cidr:
66 type: string
67 type: object
68 type: array
69 serviceExternalIPs:
70 description: ServiceExternalIPs are the CIDR blocks for Kubernetes
71 Service External IPs. Kubernetes Service ExternalIPs will only be
72 advertised if they are within one of these blocks.
73 items:
74 description: ServiceExternalIPBlock represents a single whitelisted
75 CIDR External IP block.
76 properties:
77 cidr:
78 type: string
79 type: object
80 type: array
81 type: object
82 type: object
83 served: true
84 storage: true
85status:
86 acceptedNames:
87 kind: ""
88 plural: ""
89 conditions: []
90 storedVersions: []
91
92---
93
94---
95apiVersion: apiextensions.k8s.io/v1
96kind: CustomResourceDefinition
97metadata:
98 annotations:
99 controller-gen.kubebuilder.io/version: (devel)
100 creationTimestamp: null
101 name: bgppeers.crd.projectcalico.org
102spec:
103 group: crd.projectcalico.org
104 names:
105 kind: BGPPeer
106 listKind: BGPPeerList
107 plural: bgppeers
108 singular: bgppeer
109 scope: Cluster
110 versions:
111 - name: v1
112 schema:
113 openAPIV3Schema:
114 properties:
115 apiVersion:
116 description: 'APIVersion defines the versioned schema of this representation
117 of an object. Servers should convert recognized schemas to the latest
118 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
119 type: string
120 kind:
121 description: 'Kind is a string value representing the REST resource this
122 object represents. Servers may infer this from the endpoint the client
123 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
124 type: string
125 metadata:
126 type: object
127 spec:
128 description: BGPPeerSpec contains the specification for a BGPPeer resource.
129 properties:
130 asNumber:
131 description: The AS Number of the peer.
132 format: int32
133 type: integer
134 node:
135 description: The node name identifying the Calico node instance that
136 is peering with this peer. If this is not set, this represents a
137 global peer, i.e. a peer that peers with every node in the deployment.
138 type: string
139 nodeSelector:
140 description: Selector for the nodes that should have this peering. When
141 this is set, the Node field must be empty.
142 type: string
143 peerIP:
144 description: The IP address of the peer.
145 type: string
146 peerSelector:
147 description: Selector for the remote nodes to peer with. When this
148 is set, the PeerIP and ASNumber fields must be empty. For each
149 peering between the local node and selected remote nodes, we configure
150 an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
151 and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The
152 remote AS number comes from the remote node’s NodeBGPSpec.ASNumber,
153 or the global default if that is not set.
154 type: string
155 required:
156 - asNumber
157 - peerIP
158 type: object
159 type: object
160 served: true
161 storage: true
162status:
163 acceptedNames:
164 kind: ""
165 plural: ""
166 conditions: []
167 storedVersions: []
168
169---
170
171---
172apiVersion: apiextensions.k8s.io/v1
173kind: CustomResourceDefinition
174metadata:
175 annotations:
176 controller-gen.kubebuilder.io/version: (devel)
177 creationTimestamp: null
178 name: blockaffinities.crd.projectcalico.org
179spec:
180 group: crd.projectcalico.org
181 names:
182 kind: BlockAffinity
183 listKind: BlockAffinityList
184 plural: blockaffinities
185 singular: blockaffinity
186 scope: Cluster
187 versions:
188 - name: v1
189 schema:
190 openAPIV3Schema:
191 properties:
192 apiVersion:
193 description: 'APIVersion defines the versioned schema of this representation
194 of an object. Servers should convert recognized schemas to the latest
195 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
196 type: string
197 kind:
198 description: 'Kind is a string value representing the REST resource this
199 object represents. Servers may infer this from the endpoint the client
200 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
201 type: string
202 metadata:
203 type: object
204 spec:
205 description: BlockAffinitySpec contains the specification for a BlockAffinity
206 resource.
207 properties:
208 cidr:
209 type: string
210 deleted:
211 description: Deleted indicates that this block affinity is being deleted.
212 This field is a string for compatibility with older releases that
213 mistakenly treat this field as a string.
214 type: string
215 node:
216 type: string
217 state:
218 type: string
219 required:
220 - cidr
221 - deleted
222 - node
223 - state
224 type: object
225 type: object
226 served: true
227 storage: true
228status:
229 acceptedNames:
230 kind: ""
231 plural: ""
232 conditions: []
233 storedVersions: []
234
235---
236
237---
238apiVersion: apiextensions.k8s.io/v1
239kind: CustomResourceDefinition
240metadata:
241 annotations:
242 controller-gen.kubebuilder.io/version: (devel)
243 creationTimestamp: null
244 name: clusterinformations.crd.projectcalico.org
245spec:
246 group: crd.projectcalico.org
247 names:
248 kind: ClusterInformation
249 listKind: ClusterInformationList
250 plural: clusterinformations
251 singular: clusterinformation
252 scope: Cluster
253 versions:
254 - name: v1
255 schema:
256 openAPIV3Schema:
257 description: ClusterInformation contains the cluster specific information.
258 properties:
259 apiVersion:
260 description: 'APIVersion defines the versioned schema of this representation
261 of an object. Servers should convert recognized schemas to the latest
262 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
263 type: string
264 kind:
265 description: 'Kind is a string value representing the REST resource this
266 object represents. Servers may infer this from the endpoint the client
267 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
268 type: string
269 metadata:
270 type: object
271 spec:
272 description: ClusterInformationSpec contains the values of describing
273 the cluster.
274 properties:
275 calicoVersion:
276 description: CalicoVersion is the version of Calico that the cluster
277 is running
278 type: string
279 clusterGUID:
280 description: ClusterGUID is the GUID of the cluster
281 type: string
282 clusterType:
283 description: ClusterType describes the type of the cluster
284 type: string
285 datastoreReady:
286 description: DatastoreReady is used during significant datastore migrations
287 to signal to components such as Felix that it should wait before
288 accessing the datastore.
289 type: boolean
290 variant:
291 description: Variant declares which variant of Calico should be active.
292 type: string
293 type: object
294 type: object
295 served: true
296 storage: true
297status:
298 acceptedNames:
299 kind: ""
300 plural: ""
301 conditions: []
302 storedVersions: []
303
304---
305
306---
307apiVersion: apiextensions.k8s.io/v1
308kind: CustomResourceDefinition
309metadata:
310 annotations:
311 controller-gen.kubebuilder.io/version: (devel)
312 creationTimestamp: null
313 name: felixconfigurations.crd.projectcalico.org
314spec:
315 group: crd.projectcalico.org
316 names:
317 kind: FelixConfiguration
318 listKind: FelixConfigurationList
319 plural: felixconfigurations
320 singular: felixconfiguration
321 scope: Cluster
322 versions:
323 - name: v1
324 schema:
325 openAPIV3Schema:
326 description: Felix Configuration contains the configuration for Felix.
327 properties:
328 apiVersion:
329 description: 'APIVersion defines the versioned schema of this representation
330 of an object. Servers should convert recognized schemas to the latest
331 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
332 type: string
333 kind:
334 description: 'Kind is a string value representing the REST resource this
335 object represents. Servers may infer this from the endpoint the client
336 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
337 type: string
338 metadata:
339 type: object
340 spec:
341 description: FelixConfigurationSpec contains the values of the Felix configuration.
342 properties:
343 allowIPIPPacketsFromWorkloads:
344 description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
345 will add a rule to drop IPIP encapsulated traffic from workloads
346 [Default: false]'
347 type: boolean
348 allowVXLANPacketsFromWorkloads:
349 description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
350 will add a rule to drop VXLAN encapsulated traffic from workloads
351 [Default: false]'
352 type: boolean
353 bpfConnectTimeLoadBalancingEnabled:
354 description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
355 controls whether Felix installs the connection-time load balancer. The
356 connect-time load balancer is required for the host to be able to
357 reach Kubernetes services and it improves the performance of pod-to-service
358 connections. The only reason to disable it is for debugging purposes. [Default:
359 true]'
360 type: boolean
361 bpfDataIfacePattern:
362 description: 'BPFDataIfacePattern is a regular expression that controls
363 which interfaces Felix should attach BPF programs to in order to
364 catch traffic to/from the network. This needs to match the interfaces
365 that Calico workload traffic flows over as well as any interfaces
366 that handle incoming traffic to nodeports and services from outside
367 the cluster. It should not match the workload interfaces (usually
368 named cali...). [Default: ^(en.*|eth.*|tunl0$)]'
369 type: string
370 bpfDisableUnprivileged:
371 description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
372 sysctl to disable unprivileged use of BPF. This ensures that unprivileged
373 users cannot access Calico''s BPF maps and cannot insert their own
374 BPF programs to interfere with Calico''s. [Default: true]'
375 type: boolean
376 bpfEnabled:
377 description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
378 [Default: false]'
379 type: boolean
380 bpfExternalServiceMode:
381 description: 'BPFExternalServiceMode in BPF mode, controls how connections
382 from outside the cluster to services (node ports and cluster IPs)
383 are forwarded to remote workloads. If set to "Tunnel" then both
384 request and response traffic is tunneled to the remote node. If
385 set to "DSR", the request traffic is tunneled but the response traffic
386 is sent directly from the remote node. In "DSR" mode, the remote
387 node appears to use the IP of the ingress node; this requires a
388 permissive L2 network. [Default: Tunnel]'
389 type: string
390 bpfKubeProxyEndpointSlicesEnabled:
391 description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
392 whether Felix's embedded kube-proxy accepts EndpointSlices or not.
393 type: boolean
394 bpfKubeProxyIptablesCleanupEnabled:
395 description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
396 mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
397 iptables chains. Should only be enabled if kube-proxy is not running. [Default:
398 true]'
399 type: boolean
400 bpfKubeProxyMinSyncPeriod:
401 description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
402 minimum time between updates to the dataplane for Felix''s embedded
403 kube-proxy. Lower values give reduced set-up latency. Higher values
404 reduce Felix CPU usage by batching up more work. [Default: 1s]'
405 type: string
406 bpfLogLevel:
407 description: 'BPFLogLevel controls the log level of the BPF programs
408 when in BPF dataplane mode. One of "Off", "Info", or "Debug". The
409 logs are emitted to the BPF trace pipe, accessible with the command
410 `tc exec bpf debug`. [Default: Off].'
411 type: string
412 chainInsertMode:
413 description: 'ChainInsertMode controls whether Felix hooks the kernel’s
414 top-level iptables chains by inserting a rule at the top of the
415 chain or by appending a rule at the bottom. insert is the safe default
416 since it prevents Calico’s rules from being bypassed. If you switch
417 to append mode, be sure that the other rules in the chains signal
418 acceptance by falling through to the Calico rules, otherwise the
419 Calico policy will be bypassed. [Default: insert]'
420 type: string
421 dataplaneDriver:
422 type: string
423 debugDisableLogDropping:
424 type: boolean
425 debugMemoryProfilePath:
426 type: string
427 debugSimulateCalcGraphHangAfter:
428 type: string
429 debugSimulateDataplaneHangAfter:
430 type: string
431 defaultEndpointToHostAction:
432 description: 'DefaultEndpointToHostAction controls what happens to
433 traffic that goes from a workload endpoint to the host itself (after
434 the traffic hits the endpoint egress policy). By default Calico
435 blocks traffic from workload endpoints to the host itself with an
436 iptables “DROP” action. If you want to allow some or all traffic
437 from endpoint to host, set this parameter to RETURN or ACCEPT. Use
438 RETURN if you have your own rules in the iptables “INPUT” chain;
439 Calico will insert its rules at the top of that chain, then “RETURN”
440 packets to the “INPUT” chain once it has completed processing workload
441 endpoint egress policy. Use ACCEPT to unconditionally accept packets
442 from workloads after processing workload endpoint egress policy.
443 [Default: Drop]'
444 type: string
445 deviceRouteProtocol:
446 description: This defines the route protocol added to programmed device
447 routes, by default this will be RTPROT_BOOT when left blank.
448 type: integer
449 deviceRouteSourceAddress:
450 description: This is the source address to use on programmed device
451 routes. By default the source address is left blank, leaving the
452 kernel to choose the source address used.
453 type: string
454 disableConntrackInvalidCheck:
455 type: boolean
456 endpointReportingDelay:
457 type: string
458 endpointReportingEnabled:
459 type: boolean
460 externalNodesList:
461 description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
462 which may source tunnel traffic and have the tunneled traffic be
463 accepted at calico nodes.
464 items:
465 type: string
466 type: array
467 failsafeInboundHostPorts:
468 description: 'FailsafeInboundHostPorts is a comma-delimited list of
469 UDP/TCP ports that Felix will allow incoming traffic to host endpoints
470 on irrespective of the security policy. This is useful to avoid
471 accidentally cutting off a host with incorrect configuration. Each
472 port should be specified as tcp:<port-number> or udp:<port-number>.
473 For back-compatibility, if the protocol is not specified, it defaults
474 to “tcp”. To disable all inbound host ports, use the value none.
475 The default value allows ssh access and DHCP. [Default: tcp:22,
476 udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
477 items:
478 description: ProtoPort is combination of protocol and port, both
479 must be specified.
480 properties:
481 port:
482 type: integer
483 protocol:
484 type: string
485 required:
486 - port
487 - protocol
488 type: object
489 type: array
490 failsafeOutboundHostPorts:
491 description: 'FailsafeOutboundHostPorts is a comma-delimited list
492 of UDP/TCP ports that Felix will allow outgoing traffic from host
493 endpoints to irrespective of the security policy. This is useful
494 to avoid accidentally cutting off a host with incorrect configuration.
495 Each port should be specified as tcp:<port-number> or udp:<port-number>.
496 For back-compatibility, if the protocol is not specified, it defaults
497 to “tcp”. To disable all outbound host ports, use the value none.
498 The default value opens etcd’s standard ports to ensure that Felix
499 does not get cut off from etcd as well as allowing DHCP and DNS.
500 [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667,
501 udp:53, udp:67]'
502 items:
503 description: ProtoPort is combination of protocol and port, both
504 must be specified.
505 properties:
506 port:
507 type: integer
508 protocol:
509 type: string
510 required:
511 - port
512 - protocol
513 type: object
514 type: array
515 genericXDPEnabled:
516 description: 'GenericXDPEnabled enables Generic XDP so network cards
517 that don''t support XDP offload or driver modes can use XDP. This
518 is not recommended since it doesn''t provide better performance
519 than iptables. [Default: false]'
520 type: boolean
521 healthEnabled:
522 type: boolean
523 healthHost:
524 type: string
525 healthPort:
526 type: integer
527 interfaceExclude:
528 description: 'InterfaceExclude is a comma-separated list of interfaces
529 that Felix should exclude when monitoring for host endpoints. The
530 default value ensures that Felix ignores Kubernetes'' IPVS dummy
531 interface, which is used internally by kube-proxy. If you want to
532 exclude multiple interface names using a single value, the list
533 supports regular expressions. For regular expressions you must wrap
534 the value with ''/''. For example having values ''/^kube/,veth1''
535 will exclude all interfaces that begin with ''kube'' and also the
536 interface ''veth1''. [Default: kube-ipvs0]'
537 type: string
538 interfacePrefix:
539 description: 'InterfacePrefix is the interface name prefix that identifies
540 workload endpoints and so distinguishes them from host endpoint
541 interfaces. Note: in environments other than bare metal, the orchestrators
542 configure this appropriately. For example our Kubernetes and Docker
543 integrations set the ‘cali’ value, and our OpenStack integration
544 sets the ‘tap’ value. [Default: cali]'
545 type: string
546 ipipEnabled:
547 type: boolean
548 ipipMTU:
549 description: 'IPIPMTU is the MTU to set on the tunnel device. See
550 Configuring MTU [Default: 1440]'
551 type: integer
552 ipsetsRefreshInterval:
553 description: 'IpsetsRefreshInterval is the period at which Felix re-checks
554 all iptables state to ensure that no other process has accidentally
555 broken Calico’s rules. Set to 0 to disable iptables refresh. [Default:
556 90s]'
557 type: string
558 iptablesBackend:
559 description: IptablesBackend specifies which backend of iptables will
560 be used. The default is legacy.
561 type: string
562 iptablesFilterAllowAction:
563 type: string
564 iptablesLockFilePath:
565 description: 'IptablesLockFilePath is the location of the iptables
566 lock file. You may need to change this if the lock file is not in
567 its standard location (for example if you have mapped it into Felix’s
568 container at a different path). [Default: /run/xtables.lock]'
569 type: string
570 iptablesLockProbeInterval:
571 description: 'IptablesLockProbeInterval is the time that Felix will
572 wait between attempts to acquire the iptables lock if it is not
573 available. Lower values make Felix more responsive when the lock
574 is contended, but use more CPU. [Default: 50ms]'
575 type: string
576 iptablesLockTimeout:
577 description: 'IptablesLockTimeout is the time that Felix will wait
578 for the iptables lock, or 0, to disable. To use this feature, Felix
579 must share the iptables lock file with all other processes that
580 also take the lock. When running Felix inside a container, this
581 requires the /run directory of the host to be mounted into the calico/node
582 or calico/felix container. [Default: 0s disabled]'
583 type: string
584 iptablesMangleAllowAction:
585 type: string
586 iptablesMarkMask:
587 description: 'IptablesMarkMask is the mask that Felix selects its
588 IPTables Mark bits from. Should be a 32 bit hexadecimal number with
589 at least 8 bits set, none of which clash with any other mark bits
590 in use on the system. [Default: 0xff000000]'
591 format: int32
592 type: integer
593 iptablesNATOutgoingInterfaceFilter:
594 type: string
595 iptablesPostWriteCheckInterval:
596 description: 'IptablesPostWriteCheckInterval is the period after Felix
597 has done a write to the dataplane that it schedules an extra read
598 back in order to check the write was not clobbered by another process.
599 This should only occur if another application on the system doesn’t
600 respect the iptables lock. [Default: 1s]'
601 type: string
602 iptablesRefreshInterval:
603 description: 'IptablesRefreshInterval is the period at which Felix
604 re-checks the IP sets in the dataplane to ensure that no other process
605 has accidentally broken Calico’s rules. Set to 0 to disable IP sets
606 refresh. Note: the default for this value is lower than the other
607 refresh intervals as a workaround for a Linux kernel bug that was
608 fixed in kernel version 4.11. If you are using v4.11 or greater
609 you may want to set this to, a higher value to reduce Felix CPU
610 usage. [Default: 10s]'
611 type: string
612 ipv6Support:
613 type: boolean
614 kubeNodePortRanges:
615 description: 'KubeNodePortRanges holds list of port ranges used for
616 service node ports. Only used if felix detects kube-proxy running
617 in ipvs mode. Felix uses these ranges to separate host and workload
618 traffic. [Default: 30000:32767].'
619 items:
620 anyOf:
621 - type: integer
622 - type: string
623 pattern: ^.*
624 x-kubernetes-int-or-string: true
625 type: array
626 logFilePath:
627 description: 'LogFilePath is the full path to the Felix log. Set to
628 none to disable file logging. [Default: /var/log/calico/felix.log]'
629 type: string
630 logPrefix:
631 description: 'LogPrefix is the log prefix that Felix uses when rendering
632 LOG rules. [Default: calico-packet]'
633 type: string
634 logSeverityFile:
635 description: 'LogSeverityFile is the log severity above which logs
636 are sent to the log file. [Default: Info]'
637 type: string
638 logSeverityScreen:
639 description: 'LogSeverityScreen is the log severity above which logs
640 are sent to the stdout. [Default: Info]'
641 type: string
642 logSeveritySys:
643 description: 'LogSeveritySys is the log severity above which logs
644 are sent to the syslog. Set to None for no logging to syslog. [Default:
645 Info]'
646 type: string
647 maxIpsetSize:
648 type: integer
649 metadataAddr:
650 description: 'MetadataAddr is the IP address or domain name of the
651 server that can answer VM queries for cloud-init metadata. In OpenStack,
652 this corresponds to the machine running nova-api (or in Ubuntu,
653 nova-api-metadata). A value of none (case insensitive) means that
654 Felix should not set up any NAT rule for the metadata path. [Default:
655 127.0.0.1]'
656 type: string
657 metadataPort:
658 description: 'MetadataPort is the port of the metadata server. This,
659 combined with global.MetadataAddr (if not ‘None’), is used to set
660 up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
661 In most cases this should not need to be changed [Default: 8775].'
662 type: integer
663 natOutgoingAddress:
664 description: NATOutgoingAddress specifies an address to use when performing
665 source NAT for traffic in a natOutgoing pool that is leaving the
666 network. By default the address used is an address on the interface
667 the traffic is leaving on (ie it uses the iptables MASQUERADE target)
668 type: string
669 natPortRange:
670 anyOf:
671 - type: integer
672 - type: string
673 description: NATPortRange specifies the range of ports that is used
674 for port mapping when doing outgoing NAT. When unset the default
675 behavior of the network stack is used.
676 pattern: ^.*
677 x-kubernetes-int-or-string: true
678 netlinkTimeout:
679 type: string
680 openstackRegion:
681 description: 'OpenstackRegion is the name of the region that a particular
682 Felix belongs to. In a multi-region Calico/OpenStack deployment,
683 this must be configured somehow for each Felix (here in the datamodel,
684 or in felix.cfg or the environment on each compute node), and must
685 match the [calico] openstack_region value configured in neutron.conf
686 on each node. [Default: Empty]'
687 type: string
688 policySyncPathPrefix:
689 description: 'PolicySyncPathPrefix is used to by Felix to communicate
690 policy changes to external services, like Application layer policy.
691 [Default: Empty]'
692 type: string
693 prometheusGoMetricsEnabled:
694 description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
695 collection, which the Prometheus client does by default, when set
696 to false. This reduces the number of metrics reported, reducing
697 Prometheus load. [Default: true]'
698 type: boolean
699 prometheusMetricsEnabled:
700 description: 'PrometheusMetricsEnabled enables the Prometheus metrics
701 server in Felix if set to true. [Default: false]'
702 type: boolean
703 prometheusMetricsHost:
704 description: 'PrometheusMetricsHost is the host that the Prometheus
705 metrics server should bind to. [Default: empty]'
706 type: string
707 prometheusMetricsPort:
708 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
709 metrics server should bind to. [Default: 9091]'
710 type: integer
711 prometheusProcessMetricsEnabled:
712 description: 'PrometheusProcessMetricsEnabled disables process metrics
713 collection, which the Prometheus client does by default, when set
714 to false. This reduces the number of metrics reported, reducing
715 Prometheus load. [Default: true]'
716 type: boolean
717 removeExternalRoutes:
718 description: Whether or not to remove device routes that have not
719 been programmed by Felix. Disabling this will allow external applications
720 to also add device routes. This is enabled by default which means
721 we will remove externally added routes.
722 type: boolean
723 reportingInterval:
724 description: 'ReportingInterval is the interval at which Felix reports
725 its status into the datastore or 0 to disable. Must be non-zero
726 in OpenStack deployments. [Default: 30s]'
727 type: string
728 reportingTTL:
729 description: 'ReportingTTL is the time-to-live setting for process-wide
730 status reports. [Default: 90s]'
731 type: string
732 routeRefreshInterval:
733 description: 'RouterefreshInterval is the period at which Felix re-checks
734 the routes in the dataplane to ensure that no other process has
735 accidentally broken Calico’s rules. Set to 0 to disable route refresh.
736 [Default: 90s]'
737 type: string
738 routeSource:
739 description: 'RouteSource configures where Felix gets its routing
740 information. - WorkloadIPs: use workload endpoints to construct
741 routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
742 type: string
743 routeTableRange:
744 description: Calico programs additional Linux route tables for various
745 purposes. RouteTableRange specifies the indices of the route tables
746 that Calico should use.
747 properties:
748 max:
749 type: integer
750 min:
751 type: integer
752 required:
753 - max
754 - min
755 type: object
756 sidecarAccelerationEnabled:
757 description: 'SidecarAccelerationEnabled enables experimental sidecar
758 acceleration [Default: false]'
759 type: boolean
760 usageReportingEnabled:
761 description: 'UsageReportingEnabled reports anonymous Calico version
762 number and cluster size to projectcalico.org. Logs warnings returned
763 by the usage server. For example, if a significant security vulnerability
764 has been discovered in the version of Calico being used. [Default:
765 true]'
766 type: boolean
767 usageReportingInitialDelay:
768 description: 'UsageReportingInitialDelay controls the minimum delay
769 before Felix makes a report. [Default: 300s]'
770 type: string
771 usageReportingInterval:
772 description: 'UsageReportingInterval controls the interval at which
773 Felix makes reports. [Default: 86400s]'
774 type: string
775 useInternalDataplaneDriver:
776 type: boolean
777 vxlanEnabled:
778 type: boolean
779 vxlanMTU:
780 description: 'VXLANMTU is the MTU to set on the tunnel device. See
781 Configuring MTU [Default: 1440]'
782 type: integer
783 vxlanPort:
784 type: integer
785 vxlanVNI:
786 type: integer
787 wireguardEnabled:
788 description: 'WireguardEnabled controls whether Wireguard is enabled.
789 [Default: false]'
790 type: boolean
791 wireguardInterfaceName:
792 description: 'WireguardInterfaceName specifies the name to use for
793 the Wireguard interface. [Default: wg.calico]'
794 type: string
795 wireguardListeningPort:
796 description: 'WireguardListeningPort controls the listening port used
797 by Wireguard. [Default: 51820]'
798 type: integer
799 wireguardMTU:
800 description: 'WireguardMTU controls the MTU on the Wireguard interface.
801 See Configuring MTU [Default: 1420]'
802 type: integer
803 wireguardRoutingRulePriority:
804 description: 'WireguardRoutingRulePriority controls the priority value
805 to use for the Wireguard routing rule. [Default: 99]'
806 type: integer
807 xdpEnabled:
808 description: 'XDPEnabled enables XDP acceleration for suitable untracked
809 incoming deny rules. [Default: true]'
810 type: boolean
811 xdpRefreshInterval:
812 description: 'XDPRefreshInterval is the period at which Felix re-checks
813 all XDP state to ensure that no other process has accidentally broken
814 Calico''s BPF maps or attached programs. Set to 0 to disable XDP
815 refresh. [Default: 90s]'
816 type: string
817 required:
818 - bpfLogLevel
819 type: object
820 type: object
821 served: true
822 storage: true
823status:
824 acceptedNames:
825 kind: ""
826 plural: ""
827 conditions: []
828 storedVersions: []
829
830---
831
832---
833apiVersion: apiextensions.k8s.io/v1
834kind: CustomResourceDefinition
835metadata:
836 annotations:
837 controller-gen.kubebuilder.io/version: (devel)
838 creationTimestamp: null
839 name: globalnetworkpolicies.crd.projectcalico.org
840spec:
841 group: crd.projectcalico.org
842 names:
843 kind: GlobalNetworkPolicy
844 listKind: GlobalNetworkPolicyList
845 plural: globalnetworkpolicies
846 singular: globalnetworkpolicy
847 scope: Cluster
848 versions:
849 - name: v1
850 schema:
851 openAPIV3Schema:
852 properties:
853 apiVersion:
854 description: 'APIVersion defines the versioned schema of this representation
855 of an object. Servers should convert recognized schemas to the latest
856 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
857 type: string
858 kind:
859 description: 'Kind is a string value representing the REST resource this
860 object represents. Servers may infer this from the endpoint the client
861 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
862 type: string
863 metadata:
864 type: object
865 spec:
866 properties:
867 applyOnForward:
868 description: ApplyOnForward indicates to apply the rules in this policy
869 on forward traffic.
870 type: boolean
871 doNotTrack:
872 description: DoNotTrack indicates whether packets matched by the rules
873 in this policy should go through the data plane's connection tracking,
874 such as Linux conntrack. If True, the rules in this policy are
875 applied before any data plane connection tracking, and packets allowed
876 by this policy are marked as not to be tracked.
877 type: boolean
878 egress:
879 description: The ordered set of egress rules. Each rule contains
880 a set of packet match criteria and a corresponding action to apply.
881 items:
882 description: "A Rule encapsulates a set of match criteria and an
883 action. Both selector-based security Policy and security Profiles
884 reference rules - separated out as a list of rules for both ingress
885 and egress packet matching. \n Each positive match criteria has
886 a negated version, prefixed with ”Not”. All the match criteria
887 within a rule must be satisfied for a packet to match. A single
888 rule can contain the positive and negative version of a match
889 and both must be satisfied for the rule to match."
890 properties:
891 action:
892 type: string
893 destination:
894 description: Destination contains the match criteria that apply
895 to destination entity.
896 properties:
897 namespaceSelector:
898 description: "NamespaceSelector is an optional field that
899 contains a selector expression. Only traffic that originates
900 from (or terminates at) endpoints within the selected
901 namespaces will be matched. When both NamespaceSelector
902 and Selector are defined on the same rule, then only workload
903 endpoints that are matched by both selectors will be selected
904 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
905 implies that the Selector is limited to selecting only
906 workload endpoints in the same namespace as the NetworkPolicy.
907 \n For NetworkPolicy, `global()` NamespaceSelector implies
908 that the Selector is limited to selecting only GlobalNetworkSet
909 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
910 NamespaceSelector implies the Selector applies to workload
911 endpoints across all namespaces."
912 type: string
913 nets:
914 description: Nets is an optional field that restricts the
915 rule to only apply to traffic that originates from (or
916 terminates at) IP addresses in any of the given subnets.
917 items:
918 type: string
919 type: array
920 notNets:
921 description: NotNets is the negated version of the Nets
922 field.
923 items:
924 type: string
925 type: array
926 notPorts:
927 description: NotPorts is the negated version of the Ports
928 field. Since only some protocols have ports, if any ports
929 are specified it requires the Protocol match in the Rule
930 to be set to "TCP" or "UDP".
931 items:
932 anyOf:
933 - type: integer
934 - type: string
935 pattern: ^.*
936 x-kubernetes-int-or-string: true
937 type: array
938 notSelector:
939 description: NotSelector is the negated version of the Selector
940 field. See Selector field for subtleties with negated
941 selectors.
942 type: string
943 ports:
944 description: "Ports is an optional field that restricts
945 the rule to only apply to traffic that has a source (destination)
946 port that matches one of these ranges/values. This value
947 is a list of integers or strings that represent ranges
948 of ports. \n Since only some protocols have ports, if
949 any ports are specified it requires the Protocol match
950 in the Rule to be set to \"TCP\" or \"UDP\"."
951 items:
952 anyOf:
953 - type: integer
954 - type: string
955 pattern: ^.*
956 x-kubernetes-int-or-string: true
957 type: array
958 selector:
959 description: "Selector is an optional field that contains
960 a selector expression (see Policy for sample syntax).
961 \ Only traffic that originates from (terminates at) endpoints
962 matching the selector will be matched. \n Note that: in
963 addition to the negated version of the Selector (see NotSelector
964 below), the selector expression syntax itself supports
965 negation. The two types of negation are subtly different.
966 One negates the set of matched endpoints, the other negates
967 the whole match: \n \tSelector = \"!has(my_label)\" matches
968 packets that are from other Calico-controlled \tendpoints
969 that do not have the label “my_label”. \n \tNotSelector
970 = \"has(my_label)\" matches packets that are not from
971 Calico-controlled \tendpoints that do have the label “my_label”.
972 \n The effect is that the latter will accept packets from
973 non-Calico sources whereas the former is limited to packets
974 from Calico-controlled endpoints."
975 type: string
976 serviceAccounts:
977 description: ServiceAccounts is an optional field that restricts
978 the rule to only apply to traffic that originates from
979 (or terminates at) a pod running as a matching service
980 account.
981 properties:
982 names:
983 description: Names is an optional field that restricts
984 the rule to only apply to traffic that originates
985 from (or terminates at) a pod running as a service
986 account whose name is in the list.
987 items:
988 type: string
989 type: array
990 selector:
991 description: Selector is an optional field that restricts
992 the rule to only apply to traffic that originates
993 from (or terminates at) a pod running as a service
994 account that matches the given label selector. If
995 both Names and Selector are specified then they are
996 AND'ed.
997 type: string
998 type: object
999 type: object
1000 http:
1001 description: HTTP contains match criteria that apply to HTTP
1002 requests.
1003 properties:
1004 methods:
1005 description: Methods is an optional field that restricts
1006 the rule to apply only to HTTP requests that use one of
1007 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
1008 methods are OR'd together.
1009 items:
1010 type: string
1011 type: array
1012 paths:
1013 description: 'Paths is an optional field that restricts
1014 the rule to apply to HTTP requests that use one of the
1015 listed HTTP Paths. Multiple paths are OR''d together.
1016 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
1017 ONLY specify either a `exact` or a `prefix` match. The
1018 validator will check for it.'
1019 items:
1020 description: 'HTTPPath specifies an HTTP path to match.
1021 It may be either of the form: exact: <path>: which matches
1022 the path exactly or prefix: <path-prefix>: which matches
1023 the path prefix'
1024 properties:
1025 exact:
1026 type: string
1027 prefix:
1028 type: string
1029 type: object
1030 type: array
1031 type: object
1032 icmp:
1033 description: ICMP is an optional field that restricts the rule
1034 to apply to a specific type and code of ICMP traffic. This
1035 should only be specified if the Protocol field is set to "ICMP"
1036 or "ICMPv6".
1037 properties:
1038 code:
1039 description: Match on a specific ICMP code. If specified,
1040 the Type value must also be specified. This is a technical
1041 limitation imposed by the kernel’s iptables firewall,
1042 which Calico uses to enforce the rule.
1043 type: integer
1044 type:
1045 description: Match on a specific ICMP type. For example
1046 a value of 8 refers to ICMP Echo Request (i.e. pings).
1047 type: integer
1048 type: object
1049 ipVersion:
1050 description: IPVersion is an optional field that restricts the
1051 rule to only match a specific IP version.
1052 type: integer
1053 metadata:
1054 description: Metadata contains additional information for this
1055 rule
1056 properties:
1057 annotations:
1058 additionalProperties:
1059 type: string
1060 description: Annotations is a set of key value pairs that
1061 give extra information about the rule
1062 type: object
1063 type: object
1064 notICMP:
1065 description: NotICMP is the negated version of the ICMP field.
1066 properties:
1067 code:
1068 description: Match on a specific ICMP code. If specified,
1069 the Type value must also be specified. This is a technical
1070 limitation imposed by the kernel’s iptables firewall,
1071 which Calico uses to enforce the rule.
1072 type: integer
1073 type:
1074 description: Match on a specific ICMP type. For example
1075 a value of 8 refers to ICMP Echo Request (i.e. pings).
1076 type: integer
1077 type: object
1078 notProtocol:
1079 anyOf:
1080 - type: integer
1081 - type: string
1082 description: NotProtocol is the negated version of the Protocol
1083 field.
1084 pattern: ^.*
1085 x-kubernetes-int-or-string: true
1086 protocol:
1087 anyOf:
1088 - type: integer
1089 - type: string
1090 description: "Protocol is an optional field that restricts the
1091 rule to only apply to traffic of a specific IP protocol. Required
1092 if any of the EntityRules contain Ports (because ports only
1093 apply to certain protocols). \n Must be one of these string
1094 values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
1095 \"UDPLite\" or an integer in the range 1-255."
1096 pattern: ^.*
1097 x-kubernetes-int-or-string: true
1098 source:
1099 description: Source contains the match criteria that apply to
1100 source entity.
1101 properties:
1102 namespaceSelector:
1103 description: "NamespaceSelector is an optional field that
1104 contains a selector expression. Only traffic that originates
1105 from (or terminates at) endpoints within the selected
1106 namespaces will be matched. When both NamespaceSelector
1107 and Selector are defined on the same rule, then only workload
1108 endpoints that are matched by both selectors will be selected
1109 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
1110 implies that the Selector is limited to selecting only
1111 workload endpoints in the same namespace as the NetworkPolicy.
1112 \n For NetworkPolicy, `global()` NamespaceSelector implies
1113 that the Selector is limited to selecting only GlobalNetworkSet
1114 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
1115 NamespaceSelector implies the Selector applies to workload
1116 endpoints across all namespaces."
1117 type: string
1118 nets:
1119 description: Nets is an optional field that restricts the
1120 rule to only apply to traffic that originates from (or
1121 terminates at) IP addresses in any of the given subnets.
1122 items:
1123 type: string
1124 type: array
1125 notNets:
1126 description: NotNets is the negated version of the Nets
1127 field.
1128 items:
1129 type: string
1130 type: array
1131 notPorts:
1132 description: NotPorts is the negated version of the Ports
1133 field. Since only some protocols have ports, if any ports
1134 are specified it requires the Protocol match in the Rule
1135 to be set to "TCP" or "UDP".
1136 items:
1137 anyOf:
1138 - type: integer
1139 - type: string
1140 pattern: ^.*
1141 x-kubernetes-int-or-string: true
1142 type: array
1143 notSelector:
1144 description: NotSelector is the negated version of the Selector
1145 field. See Selector field for subtleties with negated
1146 selectors.
1147 type: string
1148 ports:
1149 description: "Ports is an optional field that restricts
1150 the rule to only apply to traffic that has a source (destination)
1151 port that matches one of these ranges/values. This value
1152 is a list of integers or strings that represent ranges
1153 of ports. \n Since only some protocols have ports, if
1154 any ports are specified it requires the Protocol match
1155 in the Rule to be set to \"TCP\" or \"UDP\"."
1156 items:
1157 anyOf:
1158 - type: integer
1159 - type: string
1160 pattern: ^.*
1161 x-kubernetes-int-or-string: true
1162 type: array
1163 selector:
1164 description: "Selector is an optional field that contains
1165 a selector expression (see Policy for sample syntax).
1166 \ Only traffic that originates from (terminates at) endpoints
1167 matching the selector will be matched. \n Note that: in
1168 addition to the negated version of the Selector (see NotSelector
1169 below), the selector expression syntax itself supports
1170 negation. The two types of negation are subtly different.
1171 One negates the set of matched endpoints, the other negates
1172 the whole match: \n \tSelector = \"!has(my_label)\" matches
1173 packets that are from other Calico-controlled \tendpoints
1174 that do not have the label “my_label”. \n \tNotSelector
1175 = \"has(my_label)\" matches packets that are not from
1176 Calico-controlled \tendpoints that do have the label “my_label”.
1177 \n The effect is that the latter will accept packets from
1178 non-Calico sources whereas the former is limited to packets
1179 from Calico-controlled endpoints."
1180 type: string
1181 serviceAccounts:
1182 description: ServiceAccounts is an optional field that restricts
1183 the rule to only apply to traffic that originates from
1184 (or terminates at) a pod running as a matching service
1185 account.
1186 properties:
1187 names:
1188 description: Names is an optional field that restricts
1189 the rule to only apply to traffic that originates
1190 from (or terminates at) a pod running as a service
1191 account whose name is in the list.
1192 items:
1193 type: string
1194 type: array
1195 selector:
1196 description: Selector is an optional field that restricts
1197 the rule to only apply to traffic that originates
1198 from (or terminates at) a pod running as a service
1199 account that matches the given label selector. If
1200 both Names and Selector are specified then they are
1201 AND'ed.
1202 type: string
1203 type: object
1204 type: object
1205 required:
1206 - action
1207 type: object
1208 type: array
1209 ingress:
1210 description: The ordered set of ingress rules. Each rule contains
1211 a set of packet match criteria and a corresponding action to apply.
1212 items:
1213 description: "A Rule encapsulates a set of match criteria and an
1214 action. Both selector-based security Policy and security Profiles
1215 reference rules - separated out as a list of rules for both ingress
1216 and egress packet matching. \n Each positive match criteria has
1217 a negated version, prefixed with ”Not”. All the match criteria
1218 within a rule must be satisfied for a packet to match. A single
1219 rule can contain the positive and negative version of a match
1220 and both must be satisfied for the rule to match."
1221 properties:
1222 action:
1223 type: string
1224 destination:
1225 description: Destination contains the match criteria that apply
1226 to destination entity.
1227 properties:
1228 namespaceSelector:
1229 description: "NamespaceSelector is an optional field that
1230 contains a selector expression. Only traffic that originates
1231 from (or terminates at) endpoints within the selected
1232 namespaces will be matched. When both NamespaceSelector
1233 and Selector are defined on the same rule, then only workload
1234 endpoints that are matched by both selectors will be selected
1235 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
1236 implies that the Selector is limited to selecting only
1237 workload endpoints in the same namespace as the NetworkPolicy.
1238 \n For NetworkPolicy, `global()` NamespaceSelector implies
1239 that the Selector is limited to selecting only GlobalNetworkSet
1240 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
1241 NamespaceSelector implies the Selector applies to workload
1242 endpoints across all namespaces."
1243 type: string
1244 nets:
1245 description: Nets is an optional field that restricts the
1246 rule to only apply to traffic that originates from (or
1247 terminates at) IP addresses in any of the given subnets.
1248 items:
1249 type: string
1250 type: array
1251 notNets:
1252 description: NotNets is the negated version of the Nets
1253 field.
1254 items:
1255 type: string
1256 type: array
1257 notPorts:
1258 description: NotPorts is the negated version of the Ports
1259 field. Since only some protocols have ports, if any ports
1260 are specified it requires the Protocol match in the Rule
1261 to be set to "TCP" or "UDP".
1262 items:
1263 anyOf:
1264 - type: integer
1265 - type: string
1266 pattern: ^.*
1267 x-kubernetes-int-or-string: true
1268 type: array
1269 notSelector:
1270 description: NotSelector is the negated version of the Selector
1271 field. See Selector field for subtleties with negated
1272 selectors.
1273 type: string
1274 ports:
1275 description: "Ports is an optional field that restricts
1276 the rule to only apply to traffic that has a source (destination)
1277 port that matches one of these ranges/values. This value
1278 is a list of integers or strings that represent ranges
1279 of ports. \n Since only some protocols have ports, if
1280 any ports are specified it requires the Protocol match
1281 in the Rule to be set to \"TCP\" or \"UDP\"."
1282 items:
1283 anyOf:
1284 - type: integer
1285 - type: string
1286 pattern: ^.*
1287 x-kubernetes-int-or-string: true
1288 type: array
1289 selector:
1290 description: "Selector is an optional field that contains
1291 a selector expression (see Policy for sample syntax).
1292 \ Only traffic that originates from (terminates at) endpoints
1293 matching the selector will be matched. \n Note that: in
1294 addition to the negated version of the Selector (see NotSelector
1295 below), the selector expression syntax itself supports
1296 negation. The two types of negation are subtly different.
1297 One negates the set of matched endpoints, the other negates
1298 the whole match: \n \tSelector = \"!has(my_label)\" matches
1299 packets that are from other Calico-controlled \tendpoints
1300 that do not have the label “my_label”. \n \tNotSelector
1301 = \"has(my_label)\" matches packets that are not from
1302 Calico-controlled \tendpoints that do have the label “my_label”.
1303 \n The effect is that the latter will accept packets from
1304 non-Calico sources whereas the former is limited to packets
1305 from Calico-controlled endpoints."
1306 type: string
1307 serviceAccounts:
1308 description: ServiceAccounts is an optional field that restricts
1309 the rule to only apply to traffic that originates from
1310 (or terminates at) a pod running as a matching service
1311 account.
1312 properties:
1313 names:
1314 description: Names is an optional field that restricts
1315 the rule to only apply to traffic that originates
1316 from (or terminates at) a pod running as a service
1317 account whose name is in the list.
1318 items:
1319 type: string
1320 type: array
1321 selector:
1322 description: Selector is an optional field that restricts
1323 the rule to only apply to traffic that originates
1324 from (or terminates at) a pod running as a service
1325 account that matches the given label selector. If
1326 both Names and Selector are specified then they are
1327 AND'ed.
1328 type: string
1329 type: object
1330 type: object
1331 http:
1332 description: HTTP contains match criteria that apply to HTTP
1333 requests.
1334 properties:
1335 methods:
1336 description: Methods is an optional field that restricts
1337 the rule to apply only to HTTP requests that use one of
1338 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
1339 methods are OR'd together.
1340 items:
1341 type: string
1342 type: array
1343 paths:
1344 description: 'Paths is an optional field that restricts
1345 the rule to apply to HTTP requests that use one of the
1346 listed HTTP Paths. Multiple paths are OR''d together.
1347 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
1348 ONLY specify either a `exact` or a `prefix` match. The
1349 validator will check for it.'
1350 items:
1351 description: 'HTTPPath specifies an HTTP path to match.
1352 It may be either of the form: exact: <path>: which matches
1353 the path exactly or prefix: <path-prefix>: which matches
1354 the path prefix'
1355 properties:
1356 exact:
1357 type: string
1358 prefix:
1359 type: string
1360 type: object
1361 type: array
1362 type: object
1363 icmp:
1364 description: ICMP is an optional field that restricts the rule
1365 to apply to a specific type and code of ICMP traffic. This
1366 should only be specified if the Protocol field is set to "ICMP"
1367 or "ICMPv6".
1368 properties:
1369 code:
1370 description: Match on a specific ICMP code. If specified,
1371 the Type value must also be specified. This is a technical
1372 limitation imposed by the kernel’s iptables firewall,
1373 which Calico uses to enforce the rule.
1374 type: integer
1375 type:
1376 description: Match on a specific ICMP type. For example
1377 a value of 8 refers to ICMP Echo Request (i.e. pings).
1378 type: integer
1379 type: object
1380 ipVersion:
1381 description: IPVersion is an optional field that restricts the
1382 rule to only match a specific IP version.
1383 type: integer
1384 metadata:
1385 description: Metadata contains additional information for this
1386 rule
1387 properties:
1388 annotations:
1389 additionalProperties:
1390 type: string
1391 description: Annotations is a set of key value pairs that
1392 give extra information about the rule
1393 type: object
1394 type: object
1395 notICMP:
1396 description: NotICMP is the negated version of the ICMP field.
1397 properties:
1398 code:
1399 description: Match on a specific ICMP code. If specified,
1400 the Type value must also be specified. This is a technical
1401 limitation imposed by the kernel’s iptables firewall,
1402 which Calico uses to enforce the rule.
1403 type: integer
1404 type:
1405 description: Match on a specific ICMP type. For example
1406 a value of 8 refers to ICMP Echo Request (i.e. pings).
1407 type: integer
1408 type: object
1409 notProtocol:
1410 anyOf:
1411 - type: integer
1412 - type: string
1413 description: NotProtocol is the negated version of the Protocol
1414 field.
1415 pattern: ^.*
1416 x-kubernetes-int-or-string: true
1417 protocol:
1418 anyOf:
1419 - type: integer
1420 - type: string
1421 description: "Protocol is an optional field that restricts the
1422 rule to only apply to traffic of a specific IP protocol. Required
1423 if any of the EntityRules contain Ports (because ports only
1424 apply to certain protocols). \n Must be one of these string
1425 values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
1426 \"UDPLite\" or an integer in the range 1-255."
1427 pattern: ^.*
1428 x-kubernetes-int-or-string: true
1429 source:
1430 description: Source contains the match criteria that apply to
1431 source entity.
1432 properties:
1433 namespaceSelector:
1434 description: "NamespaceSelector is an optional field that
1435 contains a selector expression. Only traffic that originates
1436 from (or terminates at) endpoints within the selected
1437 namespaces will be matched. When both NamespaceSelector
1438 and Selector are defined on the same rule, then only workload
1439 endpoints that are matched by both selectors will be selected
1440 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
1441 implies that the Selector is limited to selecting only
1442 workload endpoints in the same namespace as the NetworkPolicy.
1443 \n For NetworkPolicy, `global()` NamespaceSelector implies
1444 that the Selector is limited to selecting only GlobalNetworkSet
1445 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
1446 NamespaceSelector implies the Selector applies to workload
1447 endpoints across all namespaces."
1448 type: string
1449 nets:
1450 description: Nets is an optional field that restricts the
1451 rule to only apply to traffic that originates from (or
1452 terminates at) IP addresses in any of the given subnets.
1453 items:
1454 type: string
1455 type: array
1456 notNets:
1457 description: NotNets is the negated version of the Nets
1458 field.
1459 items:
1460 type: string
1461 type: array
1462 notPorts:
1463 description: NotPorts is the negated version of the Ports
1464 field. Since only some protocols have ports, if any ports
1465 are specified it requires the Protocol match in the Rule
1466 to be set to "TCP" or "UDP".
1467 items:
1468 anyOf:
1469 - type: integer
1470 - type: string
1471 pattern: ^.*
1472 x-kubernetes-int-or-string: true
1473 type: array
1474 notSelector:
1475 description: NotSelector is the negated version of the Selector
1476 field. See Selector field for subtleties with negated
1477 selectors.
1478 type: string
1479 ports:
1480 description: "Ports is an optional field that restricts
1481 the rule to only apply to traffic that has a source (destination)
1482 port that matches one of these ranges/values. This value
1483 is a list of integers or strings that represent ranges
1484 of ports. \n Since only some protocols have ports, if
1485 any ports are specified it requires the Protocol match
1486 in the Rule to be set to \"TCP\" or \"UDP\"."
1487 items:
1488 anyOf:
1489 - type: integer
1490 - type: string
1491 pattern: ^.*
1492 x-kubernetes-int-or-string: true
1493 type: array
1494 selector:
1495 description: "Selector is an optional field that contains
1496 a selector expression (see Policy for sample syntax).
1497 \ Only traffic that originates from (terminates at) endpoints
1498 matching the selector will be matched. \n Note that: in
1499 addition to the negated version of the Selector (see NotSelector
1500 below), the selector expression syntax itself supports
1501 negation. The two types of negation are subtly different.
1502 One negates the set of matched endpoints, the other negates
1503 the whole match: \n \tSelector = \"!has(my_label)\" matches
1504 packets that are from other Calico-controlled \tendpoints
1505 that do not have the label “my_label”. \n \tNotSelector
1506 = \"has(my_label)\" matches packets that are not from
1507 Calico-controlled \tendpoints that do have the label “my_label”.
1508 \n The effect is that the latter will accept packets from
1509 non-Calico sources whereas the former is limited to packets
1510 from Calico-controlled endpoints."
1511 type: string
1512 serviceAccounts:
1513 description: ServiceAccounts is an optional field that restricts
1514 the rule to only apply to traffic that originates from
1515 (or terminates at) a pod running as a matching service
1516 account.
1517 properties:
1518 names:
1519 description: Names is an optional field that restricts
1520 the rule to only apply to traffic that originates
1521 from (or terminates at) a pod running as a service
1522 account whose name is in the list.
1523 items:
1524 type: string
1525 type: array
1526 selector:
1527 description: Selector is an optional field that restricts
1528 the rule to only apply to traffic that originates
1529 from (or terminates at) a pod running as a service
1530 account that matches the given label selector. If
1531 both Names and Selector are specified then they are
1532 AND'ed.
1533 type: string
1534 type: object
1535 type: object
1536 required:
1537 - action
1538 type: object
1539 type: array
1540 namespaceSelector:
1541 description: NamespaceSelector is an optional field for an expression
1542 used to select a pod based on namespaces.
1543 type: string
1544 order:
1545 description: Order is an optional field that specifies the order in
1546 which the policy is applied. Policies with higher "order" are applied
1547 after those with lower order. If the order is omitted, it may be
1548 considered to be "infinite" - i.e. the policy will be applied last. Policies
1549 with identical order will be applied in alphanumerical order based
1550 on the Policy "Name".
1551 type: number
1552 preDNAT:
1553 description: PreDNAT indicates to apply the rules in this policy before
1554 any DNAT.
1555 type: boolean
1556 selector:
1557 description: "The selector is an expression used to pick pick out
1558 the endpoints that the policy should be applied to. \n Selector
1559 expressions follow this syntax: \n \tlabel == \"string_literal\"
1560 \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
1561 \ -> not equal; also matches if label is not present \tlabel in
1562 { \"a\", \"b\", \"c\", ... } -> true if the value of label X is
1563 one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
1564 ... } -> true if the value of label X is not one of \"a\", \"b\",
1565 \"c\" \thas(label_name) -> True if that label is present \t! expr
1566 -> negation of expr \texpr && expr -> Short-circuit and \texpr
1567 || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall()
1568 or the empty selector -> matches all endpoints. \n Label names are
1569 allowed to contain alphanumerics, -, _ and /. String literals are
1570 more permissive but they do not support escape characters. \n Examples
1571 (with made-up labels): \n \ttype == \"webserver\" && deployment
1572 == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
1573 \"dev\" \t! has(label_name)"
1574 type: string
1575 serviceAccountSelector:
1576 description: ServiceAccountSelector is an optional field for an expression
1577 used to select a pod based on service accounts.
1578 type: string
1579 types:
1580 description: "Types indicates whether this policy applies to ingress,
1581 or to egress, or to both. When not explicitly specified (and so
1582 the value on creation is empty or nil), Calico defaults Types according
1583 to what Ingress and Egress rules are present in the policy. The
1584 default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
1585 (including the case where there are also no Ingress rules) \n
1586 - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
1587 rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
1588 both Ingress and Egress rules. \n When the policy is read back again,
1589 Types will always be one of these values, never empty or nil."
1590 items:
1591 description: PolicyType enumerates the possible values of the PolicySpec
1592 Types field.
1593 type: string
1594 type: array
1595 type: object
1596 type: object
1597 served: true
1598 storage: true
1599status:
1600 acceptedNames:
1601 kind: ""
1602 plural: ""
1603 conditions: []
1604 storedVersions: []
1605
1606---
1607
1608---
1609apiVersion: apiextensions.k8s.io/v1
1610kind: CustomResourceDefinition
1611metadata:
1612 annotations:
1613 controller-gen.kubebuilder.io/version: (devel)
1614 creationTimestamp: null
1615 name: globalnetworksets.crd.projectcalico.org
1616spec:
1617 group: crd.projectcalico.org
1618 names:
1619 kind: GlobalNetworkSet
1620 listKind: GlobalNetworkSetList
1621 plural: globalnetworksets
1622 singular: globalnetworkset
1623 scope: Cluster
1624 versions:
1625 - name: v1
1626 schema:
1627 openAPIV3Schema:
1628 description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
1629 that share labels to allow rules to refer to them via selectors. The labels
1630 of GlobalNetworkSet are not namespaced.
1631 properties:
1632 apiVersion:
1633 description: 'APIVersion defines the versioned schema of this representation
1634 of an object. Servers should convert recognized schemas to the latest
1635 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1636 type: string
1637 kind:
1638 description: 'Kind is a string value representing the REST resource this
1639 object represents. Servers may infer this from the endpoint the client
1640 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1641 type: string
1642 metadata:
1643 type: object
1644 spec:
1645 description: GlobalNetworkSetSpec contains the specification for a NetworkSet
1646 resource.
1647 properties:
1648 nets:
1649 description: The list of IP networks that belong to this set.
1650 items:
1651 type: string
1652 type: array
1653 type: object
1654 type: object
1655 served: true
1656 storage: true
1657status:
1658 acceptedNames:
1659 kind: ""
1660 plural: ""
1661 conditions: []
1662 storedVersions: []
1663
1664---
1665
1666---
1667apiVersion: apiextensions.k8s.io/v1
1668kind: CustomResourceDefinition
1669metadata:
1670 annotations:
1671 controller-gen.kubebuilder.io/version: (devel)
1672 creationTimestamp: null
1673 name: hostendpoints.crd.projectcalico.org
1674spec:
1675 group: crd.projectcalico.org
1676 names:
1677 kind: HostEndpoint
1678 listKind: HostEndpointList
1679 plural: hostendpoints
1680 singular: hostendpoint
1681 scope: Cluster
1682 versions:
1683 - name: v1
1684 schema:
1685 openAPIV3Schema:
1686 properties:
1687 apiVersion:
1688 description: 'APIVersion defines the versioned schema of this representation
1689 of an object. Servers should convert recognized schemas to the latest
1690 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1691 type: string
1692 kind:
1693 description: 'Kind is a string value representing the REST resource this
1694 object represents. Servers may infer this from the endpoint the client
1695 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1696 type: string
1697 metadata:
1698 type: object
1699 spec:
1700 description: HostEndpointSpec contains the specification for a HostEndpoint
1701 resource.
1702 properties:
1703 expectedIPs:
1704 description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
1705 If \"InterfaceName\" is not present, Calico will look for an interface
1706 matching any of the IPs in the list and apply policy to that. Note:
1707 \tWhen using the selector match criteria in an ingress or egress
1708 security Policy \tor Profile, Calico converts the selector into
1709 a set of IP addresses. For host \tendpoints, the ExpectedIPs field
1710 is used for that purpose. (If only the interface \tname is specified,
1711 Calico does not learn the IPs of the interface for use in match
1712 \tcriteria.)"
1713 items:
1714 type: string
1715 type: array
1716 interfaceName:
1717 description: "Either \"*\", or the name of a specific Linux interface
1718 to apply policy to; or empty. \"*\" indicates that this HostEndpoint
1719 governs all traffic to, from or through the default network namespace
1720 of the host named by the \"Node\" field; entering and leaving that
1721 namespace via any interface, including those from/to non-host-networked
1722 local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
1723 only governs traffic that enters or leaves the host through the
1724 specific interface named by InterfaceName, or - when InterfaceName
1725 is empty - through the specific interface that has one of the IPs
1726 in ExpectedIPs. Therefore, when InterfaceName is empty, at least
1727 one expected IP must be specified. Only external interfaces (such
1728 as “eth0”) are supported here; it isn't possible for a HostEndpoint
1729 to protect traffic through a specific local workload interface.
1730 \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
1731 initially just pre-DNAT policy. Please check Calico documentation
1732 for the latest position."
1733 type: string
1734 node:
1735 description: The node name identifying the Calico node instance.
1736 type: string
1737 ports:
1738 description: Ports contains the endpoint's named ports, which may
1739 be referenced in security policy rules.
1740 items:
1741 properties:
1742 name:
1743 type: string
1744 port:
1745 type: integer
1746 protocol:
1747 anyOf:
1748 - type: integer
1749 - type: string
1750 pattern: ^.*
1751 x-kubernetes-int-or-string: true
1752 required:
1753 - name
1754 - port
1755 - protocol
1756 type: object
1757 type: array
1758 profiles:
1759 description: A list of identifiers of security Profile objects that
1760 apply to this endpoint. Each profile is applied in the order that
1761 they appear in this list. Profile rules are applied after the selector-based
1762 security policy.
1763 items:
1764 type: string
1765 type: array
1766 type: object
1767 type: object
1768 served: true
1769 storage: true
1770status:
1771 acceptedNames:
1772 kind: ""
1773 plural: ""
1774 conditions: []
1775 storedVersions: []
1776
1777---
1778
1779---
1780apiVersion: apiextensions.k8s.io/v1
1781kind: CustomResourceDefinition
1782metadata:
1783 annotations:
1784 controller-gen.kubebuilder.io/version: (devel)
1785 creationTimestamp: null
1786 name: ipamblocks.crd.projectcalico.org
1787spec:
1788 group: crd.projectcalico.org
1789 names:
1790 kind: IPAMBlock
1791 listKind: IPAMBlockList
1792 plural: ipamblocks
1793 singular: ipamblock
1794 scope: Cluster
1795 versions:
1796 - name: v1
1797 schema:
1798 openAPIV3Schema:
1799 properties:
1800 apiVersion:
1801 description: 'APIVersion defines the versioned schema of this representation
1802 of an object. Servers should convert recognized schemas to the latest
1803 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1804 type: string
1805 kind:
1806 description: 'Kind is a string value representing the REST resource this
1807 object represents. Servers may infer this from the endpoint the client
1808 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1809 type: string
1810 metadata:
1811 type: object
1812 spec:
1813 description: IPAMBlockSpec contains the specification for an IPAMBlock
1814 resource.
1815 properties:
1816 affinity:
1817 type: string
1818 allocations:
1819 items:
1820 type: integer
1821 # TODO: This nullable is manually added in. We should update controller-gen
1822 # to handle []*int properly itself.
1823 nullable: true
1824 type: array
1825 attributes:
1826 items:
1827 properties:
1828 handle_id:
1829 type: string
1830 secondary:
1831 additionalProperties:
1832 type: string
1833 type: object
1834 type: object
1835 type: array
1836 cidr:
1837 type: string
1838 deleted:
1839 type: boolean
1840 strictAffinity:
1841 type: boolean
1842 unallocated:
1843 items:
1844 type: integer
1845 type: array
1846 required:
1847 - allocations
1848 - attributes
1849 - cidr
1850 - deleted
1851 - strictAffinity
1852 - unallocated
1853 type: object
1854 type: object
1855 served: true
1856 storage: true
1857status:
1858 acceptedNames:
1859 kind: ""
1860 plural: ""
1861 conditions: []
1862 storedVersions: []
1863
1864---
1865
1866---
1867apiVersion: apiextensions.k8s.io/v1
1868kind: CustomResourceDefinition
1869metadata:
1870 annotations:
1871 controller-gen.kubebuilder.io/version: (devel)
1872 creationTimestamp: null
1873 name: ipamconfigs.crd.projectcalico.org
1874spec:
1875 group: crd.projectcalico.org
1876 names:
1877 kind: IPAMConfig
1878 listKind: IPAMConfigList
1879 plural: ipamconfigs
1880 singular: ipamconfig
1881 scope: Cluster
1882 versions:
1883 - name: v1
1884 schema:
1885 openAPIV3Schema:
1886 properties:
1887 apiVersion:
1888 description: 'APIVersion defines the versioned schema of this representation
1889 of an object. Servers should convert recognized schemas to the latest
1890 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1891 type: string
1892 kind:
1893 description: 'Kind is a string value representing the REST resource this
1894 object represents. Servers may infer this from the endpoint the client
1895 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1896 type: string
1897 metadata:
1898 type: object
1899 spec:
1900 description: IPAMConfigSpec contains the specification for an IPAMConfig
1901 resource.
1902 properties:
1903 autoAllocateBlocks:
1904 type: boolean
1905 strictAffinity:
1906 type: boolean
1907 required:
1908 - autoAllocateBlocks
1909 - strictAffinity
1910 type: object
1911 type: object
1912 served: true
1913 storage: true
1914status:
1915 acceptedNames:
1916 kind: ""
1917 plural: ""
1918 conditions: []
1919 storedVersions: []
1920
1921---
1922
1923---
1924apiVersion: apiextensions.k8s.io/v1
1925kind: CustomResourceDefinition
1926metadata:
1927 annotations:
1928 controller-gen.kubebuilder.io/version: (devel)
1929 creationTimestamp: null
1930 name: ipamhandles.crd.projectcalico.org
1931spec:
1932 group: crd.projectcalico.org
1933 names:
1934 kind: IPAMHandle
1935 listKind: IPAMHandleList
1936 plural: ipamhandles
1937 singular: ipamhandle
1938 scope: Cluster
1939 versions:
1940 - name: v1
1941 schema:
1942 openAPIV3Schema:
1943 properties:
1944 apiVersion:
1945 description: 'APIVersion defines the versioned schema of this representation
1946 of an object. Servers should convert recognized schemas to the latest
1947 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1948 type: string
1949 kind:
1950 description: 'Kind is a string value representing the REST resource this
1951 object represents. Servers may infer this from the endpoint the client
1952 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1953 type: string
1954 metadata:
1955 type: object
1956 spec:
1957 description: IPAMHandleSpec contains the specification for an IPAMHandle
1958 resource.
1959 properties:
1960 block:
1961 additionalProperties:
1962 type: integer
1963 type: object
1964 handleID:
1965 type: string
1966 required:
1967 - block
1968 - handleID
1969 type: object
1970 type: object
1971 served: true
1972 storage: true
1973status:
1974 acceptedNames:
1975 kind: ""
1976 plural: ""
1977 conditions: []
1978 storedVersions: []
1979
1980---
1981
1982---
1983apiVersion: apiextensions.k8s.io/v1
1984kind: CustomResourceDefinition
1985metadata:
1986 annotations:
1987 controller-gen.kubebuilder.io/version: (devel)
1988 creationTimestamp: null
1989 name: ippools.crd.projectcalico.org
1990spec:
1991 group: crd.projectcalico.org
1992 names:
1993 kind: IPPool
1994 listKind: IPPoolList
1995 plural: ippools
1996 singular: ippool
1997 scope: Cluster
1998 versions:
1999 - name: v1
2000 schema:
2001 openAPIV3Schema:
2002 properties:
2003 apiVersion:
2004 description: 'APIVersion defines the versioned schema of this representation
2005 of an object. Servers should convert recognized schemas to the latest
2006 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2007 type: string
2008 kind:
2009 description: 'Kind is a string value representing the REST resource this
2010 object represents. Servers may infer this from the endpoint the client
2011 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2012 type: string
2013 metadata:
2014 type: object
2015 spec:
2016 description: IPPoolSpec contains the specification for an IPPool resource.
2017 properties:
2018 blockSize:
2019 description: The block size to use for IP address assignments from
2020 this pool. Defaults to 26 for IPv4 and 112 for IPv6.
2021 type: integer
2022 cidr:
2023 description: The pool CIDR.
2024 type: string
2025 disabled:
2026 description: When disabled is true, Calico IPAM will not assign addresses
2027 from this pool.
2028 type: boolean
2029 ipip:
2030 description: 'Deprecated: this field is only used for APIv1 backwards
2031 compatibility. Setting this field is not allowed, this field is
2032 for internal use only.'
2033 properties:
2034 enabled:
2035 description: When enabled is true, ipip tunneling will be used
2036 to deliver packets to destinations within this pool.
2037 type: boolean
2038 mode:
2039 description: The IPIP mode. This can be one of "always" or "cross-subnet". A
2040 mode of "always" will also use IPIP tunneling for routing to
2041 destination IP addresses within this pool. A mode of "cross-subnet"
2042 will only use IPIP tunneling when the destination node is on
2043 a different subnet to the originating node. The default value
2044 (if not specified) is "always".
2045 type: string
2046 type: object
2047 ipipMode:
2048 description: Contains configuration for IPIP tunneling for this pool.
2049 If not specified, then this is defaulted to "Never" (i.e. IPIP tunelling
2050 is disabled).
2051 type: string
2052 nat-outgoing:
2053 description: 'Deprecated: this field is only used for APIv1 backwards
2054 compatibility. Setting this field is not allowed, this field is
2055 for internal use only.'
2056 type: boolean
2057 natOutgoing:
2058 description: When nat-outgoing is true, packets sent from Calico networked
2059 containers in this pool to destinations outside of this pool will
2060 be masqueraded.
2061 type: boolean
2062 nodeSelector:
2063 description: Allows IPPool to allocate for a specific node by label
2064 selector.
2065 type: string
2066 vxlanMode:
2067 description: Contains configuration for VXLAN tunneling for this pool.
2068 If not specified, then this is defaulted to "Never" (i.e. VXLAN
2069 tunelling is disabled).
2070 type: string
2071 required:
2072 - cidr
2073 type: object
2074 type: object
2075 served: true
2076 storage: true
2077status:
2078 acceptedNames:
2079 kind: ""
2080 plural: ""
2081 conditions: []
2082 storedVersions: []
2083
2084---
2085
2086---
2087apiVersion: apiextensions.k8s.io/v1
2088kind: CustomResourceDefinition
2089metadata:
2090 annotations:
2091 controller-gen.kubebuilder.io/version: (devel)
2092 creationTimestamp: null
2093 name: kubecontrollersconfigurations.crd.projectcalico.org
2094spec:
2095 group: crd.projectcalico.org
2096 names:
2097 kind: KubeControllersConfiguration
2098 listKind: KubeControllersConfigurationList
2099 plural: kubecontrollersconfigurations
2100 singular: kubecontrollersconfiguration
2101 scope: Cluster
2102 versions:
2103 - name: v1
2104 schema:
2105 openAPIV3Schema:
2106 properties:
2107 apiVersion:
2108 description: 'APIVersion defines the versioned schema of this representation
2109 of an object. Servers should convert recognized schemas to the latest
2110 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2111 type: string
2112 kind:
2113 description: 'Kind is a string value representing the REST resource this
2114 object represents. Servers may infer this from the endpoint the client
2115 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2116 type: string
2117 metadata:
2118 type: object
2119 spec:
2120 description: KubeControllersConfigurationSpec contains the values of the
2121 Kubernetes controllers configuration.
2122 properties:
2123 controllers:
2124 description: Controllers enables and configures individual Kubernetes
2125 controllers
2126 properties:
2127 namespace:
2128 description: Namespace enables and configures the namespace controller.
2129 Enabled by default, set to nil to disable.
2130 properties:
2131 reconcilerPeriod:
2132 description: 'ReconcilerPeriod is the period to perform reconciliation
2133 with the Calico datastore. [Default: 5m]'
2134 type: string
2135 type: object
2136 node:
2137 description: Node enables and configures the node controller.
2138 Enabled by default, set to nil to disable.
2139 properties:
2140 hostEndpoint:
2141 description: HostEndpoint controls syncing nodes to host endpoints.
2142 Disabled by default, set to nil to disable.
2143 properties:
2144 autoCreate:
2145 description: 'AutoCreate enables automatic creation of
2146 host endpoints for every node. [Default: Disabled]'
2147 type: string
2148 type: object
2149 reconcilerPeriod:
2150 description: 'ReconcilerPeriod is the period to perform reconciliation
2151 with the Calico datastore. [Default: 5m]'
2152 type: string
2153 syncLabels:
2154 description: 'SyncLabels controls whether to copy Kubernetes
2155 node labels to Calico nodes. [Default: Enabled]'
2156 type: string
2157 type: object
2158 policy:
2159 description: Policy enables and configures the policy controller.
2160 Enabled by default, set to nil to disable.
2161 properties:
2162 reconcilerPeriod:
2163 description: 'ReconcilerPeriod is the period to perform reconciliation
2164 with the Calico datastore. [Default: 5m]'
2165 type: string
2166 type: object
2167 serviceAccount:
2168 description: ServiceAccount enables and configures the service
2169 account controller. Enabled by default, set to nil to disable.
2170 properties:
2171 reconcilerPeriod:
2172 description: 'ReconcilerPeriod is the period to perform reconciliation
2173 with the Calico datastore. [Default: 5m]'
2174 type: string
2175 type: object
2176 workloadEndpoint:
2177 description: WorkloadEndpoint enables and configures the workload
2178 endpoint controller. Enabled by default, set to nil to disable.
2179 properties:
2180 reconcilerPeriod:
2181 description: 'ReconcilerPeriod is the period to perform reconciliation
2182 with the Calico datastore. [Default: 5m]'
2183 type: string
2184 type: object
2185 type: object
2186 etcdV3CompactionPeriod:
2187 description: 'EtcdV3CompactionPeriod is the period between etcdv3
2188 compaction requests. Set to 0 to disable. [Default: 10m]'
2189 type: string
2190 healthChecks:
2191 description: 'HealthChecks enables or disables support for health
2192 checks [Default: Enabled]'
2193 type: string
2194 logSeverityScreen:
2195 description: 'LogSeverityScreen is the log severity above which logs
2196 are sent to the stdout. [Default: Info]'
2197 type: string
2198 required:
2199 - controllers
2200 type: object
2201 status:
2202 description: KubeControllersConfigurationStatus represents the status
2203 of the configuration. It's useful for admins to be able to see the actual
2204 config that was applied, which can be modified by environment variables
2205 on the kube-controllers process.
2206 properties:
2207 environmentVars:
2208 additionalProperties:
2209 type: string
2210 description: EnvironmentVars contains the environment variables on
2211 the kube-controllers that influenced the RunningConfig.
2212 type: object
2213 runningConfig:
2214 description: RunningConfig contains the effective config that is running
2215 in the kube-controllers pod, after merging the API resource with
2216 any environment variables.
2217 properties:
2218 controllers:
2219 description: Controllers enables and configures individual Kubernetes
2220 controllers
2221 properties:
2222 namespace:
2223 description: Namespace enables and configures the namespace
2224 controller. Enabled by default, set to nil to disable.
2225 properties:
2226 reconcilerPeriod:
2227 description: 'ReconcilerPeriod is the period to perform
2228 reconciliation with the Calico datastore. [Default:
2229 5m]'
2230 type: string
2231 type: object
2232 node:
2233 description: Node enables and configures the node controller.
2234 Enabled by default, set to nil to disable.
2235 properties:
2236 hostEndpoint:
2237 description: HostEndpoint controls syncing nodes to host
2238 endpoints. Disabled by default, set to nil to disable.
2239 properties:
2240 autoCreate:
2241 description: 'AutoCreate enables automatic creation
2242 of host endpoints for every node. [Default: Disabled]'
2243 type: string
2244 type: object
2245 reconcilerPeriod:
2246 description: 'ReconcilerPeriod is the period to perform
2247 reconciliation with the Calico datastore. [Default:
2248 5m]'
2249 type: string
2250 syncLabels:
2251 description: 'SyncLabels controls whether to copy Kubernetes
2252 node labels to Calico nodes. [Default: Enabled]'
2253 type: string
2254 type: object
2255 policy:
2256 description: Policy enables and configures the policy controller.
2257 Enabled by default, set to nil to disable.
2258 properties:
2259 reconcilerPeriod:
2260 description: 'ReconcilerPeriod is the period to perform
2261 reconciliation with the Calico datastore. [Default:
2262 5m]'
2263 type: string
2264 type: object
2265 serviceAccount:
2266 description: ServiceAccount enables and configures the service
2267 account controller. Enabled by default, set to nil to disable.
2268 properties:
2269 reconcilerPeriod:
2270 description: 'ReconcilerPeriod is the period to perform
2271 reconciliation with the Calico datastore. [Default:
2272 5m]'
2273 type: string
2274 type: object
2275 workloadEndpoint:
2276 description: WorkloadEndpoint enables and configures the workload
2277 endpoint controller. Enabled by default, set to nil to disable.
2278 properties:
2279 reconcilerPeriod:
2280 description: 'ReconcilerPeriod is the period to perform
2281 reconciliation with the Calico datastore. [Default:
2282 5m]'
2283 type: string
2284 type: object
2285 type: object
2286 etcdV3CompactionPeriod:
2287 description: 'EtcdV3CompactionPeriod is the period between etcdv3
2288 compaction requests. Set to 0 to disable. [Default: 10m]'
2289 type: string
2290 healthChecks:
2291 description: 'HealthChecks enables or disables support for health
2292 checks [Default: Enabled]'
2293 type: string
2294 logSeverityScreen:
2295 description: 'LogSeverityScreen is the log severity above which
2296 logs are sent to the stdout. [Default: Info]'
2297 type: string
2298 required:
2299 - controllers
2300 type: object
2301 type: object
2302 type: object
2303 served: true
2304 storage: true
2305status:
2306 acceptedNames:
2307 kind: ""
2308 plural: ""
2309 conditions: []
2310 storedVersions: []
2311
2312---
2313
2314---
2315apiVersion: apiextensions.k8s.io/v1
2316kind: CustomResourceDefinition
2317metadata:
2318 annotations:
2319 controller-gen.kubebuilder.io/version: (devel)
2320 creationTimestamp: null
2321 name: networkpolicies.crd.projectcalico.org
2322spec:
2323 group: crd.projectcalico.org
2324 names:
2325 kind: NetworkPolicy
2326 listKind: NetworkPolicyList
2327 plural: networkpolicies
2328 singular: networkpolicy
2329 scope: Namespaced
2330 versions:
2331 - name: v1
2332 schema:
2333 openAPIV3Schema:
2334 properties:
2335 apiVersion:
2336 description: 'APIVersion defines the versioned schema of this representation
2337 of an object. Servers should convert recognized schemas to the latest
2338 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2339 type: string
2340 kind:
2341 description: 'Kind is a string value representing the REST resource this
2342 object represents. Servers may infer this from the endpoint the client
2343 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2344 type: string
2345 metadata:
2346 type: object
2347 spec:
2348 properties:
2349 egress:
2350 description: The ordered set of egress rules. Each rule contains
2351 a set of packet match criteria and a corresponding action to apply.
2352 items:
2353 description: "A Rule encapsulates a set of match criteria and an
2354 action. Both selector-based security Policy and security Profiles
2355 reference rules - separated out as a list of rules for both ingress
2356 and egress packet matching. \n Each positive match criteria has
2357 a negated version, prefixed with ”Not”. All the match criteria
2358 within a rule must be satisfied for a packet to match. A single
2359 rule can contain the positive and negative version of a match
2360 and both must be satisfied for the rule to match."
2361 properties:
2362 action:
2363 type: string
2364 destination:
2365 description: Destination contains the match criteria that apply
2366 to destination entity.
2367 properties:
2368 namespaceSelector:
2369 description: "NamespaceSelector is an optional field that
2370 contains a selector expression. Only traffic that originates
2371 from (or terminates at) endpoints within the selected
2372 namespaces will be matched. When both NamespaceSelector
2373 and Selector are defined on the same rule, then only workload
2374 endpoints that are matched by both selectors will be selected
2375 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
2376 implies that the Selector is limited to selecting only
2377 workload endpoints in the same namespace as the NetworkPolicy.
2378 \n For NetworkPolicy, `global()` NamespaceSelector implies
2379 that the Selector is limited to selecting only GlobalNetworkSet
2380 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
2381 NamespaceSelector implies the Selector applies to workload
2382 endpoints across all namespaces."
2383 type: string
2384 nets:
2385 description: Nets is an optional field that restricts the
2386 rule to only apply to traffic that originates from (or
2387 terminates at) IP addresses in any of the given subnets.
2388 items:
2389 type: string
2390 type: array
2391 notNets:
2392 description: NotNets is the negated version of the Nets
2393 field.
2394 items:
2395 type: string
2396 type: array
2397 notPorts:
2398 description: NotPorts is the negated version of the Ports
2399 field. Since only some protocols have ports, if any ports
2400 are specified it requires the Protocol match in the Rule
2401 to be set to "TCP" or "UDP".
2402 items:
2403 anyOf:
2404 - type: integer
2405 - type: string
2406 pattern: ^.*
2407 x-kubernetes-int-or-string: true
2408 type: array
2409 notSelector:
2410 description: NotSelector is the negated version of the Selector
2411 field. See Selector field for subtleties with negated
2412 selectors.
2413 type: string
2414 ports:
2415 description: "Ports is an optional field that restricts
2416 the rule to only apply to traffic that has a source (destination)
2417 port that matches one of these ranges/values. This value
2418 is a list of integers or strings that represent ranges
2419 of ports. \n Since only some protocols have ports, if
2420 any ports are specified it requires the Protocol match
2421 in the Rule to be set to \"TCP\" or \"UDP\"."
2422 items:
2423 anyOf:
2424 - type: integer
2425 - type: string
2426 pattern: ^.*
2427 x-kubernetes-int-or-string: true
2428 type: array
2429 selector:
2430 description: "Selector is an optional field that contains
2431 a selector expression (see Policy for sample syntax).
2432 \ Only traffic that originates from (terminates at) endpoints
2433 matching the selector will be matched. \n Note that: in
2434 addition to the negated version of the Selector (see NotSelector
2435 below), the selector expression syntax itself supports
2436 negation. The two types of negation are subtly different.
2437 One negates the set of matched endpoints, the other negates
2438 the whole match: \n \tSelector = \"!has(my_label)\" matches
2439 packets that are from other Calico-controlled \tendpoints
2440 that do not have the label “my_label”. \n \tNotSelector
2441 = \"has(my_label)\" matches packets that are not from
2442 Calico-controlled \tendpoints that do have the label “my_label”.
2443 \n The effect is that the latter will accept packets from
2444 non-Calico sources whereas the former is limited to packets
2445 from Calico-controlled endpoints."
2446 type: string
2447 serviceAccounts:
2448 description: ServiceAccounts is an optional field that restricts
2449 the rule to only apply to traffic that originates from
2450 (or terminates at) a pod running as a matching service
2451 account.
2452 properties:
2453 names:
2454 description: Names is an optional field that restricts
2455 the rule to only apply to traffic that originates
2456 from (or terminates at) a pod running as a service
2457 account whose name is in the list.
2458 items:
2459 type: string
2460 type: array
2461 selector:
2462 description: Selector is an optional field that restricts
2463 the rule to only apply to traffic that originates
2464 from (or terminates at) a pod running as a service
2465 account that matches the given label selector. If
2466 both Names and Selector are specified then they are
2467 AND'ed.
2468 type: string
2469 type: object
2470 type: object
2471 http:
2472 description: HTTP contains match criteria that apply to HTTP
2473 requests.
2474 properties:
2475 methods:
2476 description: Methods is an optional field that restricts
2477 the rule to apply only to HTTP requests that use one of
2478 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
2479 methods are OR'd together.
2480 items:
2481 type: string
2482 type: array
2483 paths:
2484 description: 'Paths is an optional field that restricts
2485 the rule to apply to HTTP requests that use one of the
2486 listed HTTP Paths. Multiple paths are OR''d together.
2487 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
2488 ONLY specify either a `exact` or a `prefix` match. The
2489 validator will check for it.'
2490 items:
2491 description: 'HTTPPath specifies an HTTP path to match.
2492 It may be either of the form: exact: <path>: which matches
2493 the path exactly or prefix: <path-prefix>: which matches
2494 the path prefix'
2495 properties:
2496 exact:
2497 type: string
2498 prefix:
2499 type: string
2500 type: object
2501 type: array
2502 type: object
2503 icmp:
2504 description: ICMP is an optional field that restricts the rule
2505 to apply to a specific type and code of ICMP traffic. This
2506 should only be specified if the Protocol field is set to "ICMP"
2507 or "ICMPv6".
2508 properties:
2509 code:
2510 description: Match on a specific ICMP code. If specified,
2511 the Type value must also be specified. This is a technical
2512 limitation imposed by the kernel’s iptables firewall,
2513 which Calico uses to enforce the rule.
2514 type: integer
2515 type:
2516 description: Match on a specific ICMP type. For example
2517 a value of 8 refers to ICMP Echo Request (i.e. pings).
2518 type: integer
2519 type: object
2520 ipVersion:
2521 description: IPVersion is an optional field that restricts the
2522 rule to only match a specific IP version.
2523 type: integer
2524 metadata:
2525 description: Metadata contains additional information for this
2526 rule
2527 properties:
2528 annotations:
2529 additionalProperties:
2530 type: string
2531 description: Annotations is a set of key value pairs that
2532 give extra information about the rule
2533 type: object
2534 type: object
2535 notICMP:
2536 description: NotICMP is the negated version of the ICMP field.
2537 properties:
2538 code:
2539 description: Match on a specific ICMP code. If specified,
2540 the Type value must also be specified. This is a technical
2541 limitation imposed by the kernel’s iptables firewall,
2542 which Calico uses to enforce the rule.
2543 type: integer
2544 type:
2545 description: Match on a specific ICMP type. For example
2546 a value of 8 refers to ICMP Echo Request (i.e. pings).
2547 type: integer
2548 type: object
2549 notProtocol:
2550 anyOf:
2551 - type: integer
2552 - type: string
2553 description: NotProtocol is the negated version of the Protocol
2554 field.
2555 pattern: ^.*
2556 x-kubernetes-int-or-string: true
2557 protocol:
2558 anyOf:
2559 - type: integer
2560 - type: string
2561 description: "Protocol is an optional field that restricts the
2562 rule to only apply to traffic of a specific IP protocol. Required
2563 if any of the EntityRules contain Ports (because ports only
2564 apply to certain protocols). \n Must be one of these string
2565 values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
2566 \"UDPLite\" or an integer in the range 1-255."
2567 pattern: ^.*
2568 x-kubernetes-int-or-string: true
2569 source:
2570 description: Source contains the match criteria that apply to
2571 source entity.
2572 properties:
2573 namespaceSelector:
2574 description: "NamespaceSelector is an optional field that
2575 contains a selector expression. Only traffic that originates
2576 from (or terminates at) endpoints within the selected
2577 namespaces will be matched. When both NamespaceSelector
2578 and Selector are defined on the same rule, then only workload
2579 endpoints that are matched by both selectors will be selected
2580 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
2581 implies that the Selector is limited to selecting only
2582 workload endpoints in the same namespace as the NetworkPolicy.
2583 \n For NetworkPolicy, `global()` NamespaceSelector implies
2584 that the Selector is limited to selecting only GlobalNetworkSet
2585 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
2586 NamespaceSelector implies the Selector applies to workload
2587 endpoints across all namespaces."
2588 type: string
2589 nets:
2590 description: Nets is an optional field that restricts the
2591 rule to only apply to traffic that originates from (or
2592 terminates at) IP addresses in any of the given subnets.
2593 items:
2594 type: string
2595 type: array
2596 notNets:
2597 description: NotNets is the negated version of the Nets
2598 field.
2599 items:
2600 type: string
2601 type: array
2602 notPorts:
2603 description: NotPorts is the negated version of the Ports
2604 field. Since only some protocols have ports, if any ports
2605 are specified it requires the Protocol match in the Rule
2606 to be set to "TCP" or "UDP".
2607 items:
2608 anyOf:
2609 - type: integer
2610 - type: string
2611 pattern: ^.*
2612 x-kubernetes-int-or-string: true
2613 type: array
2614 notSelector:
2615 description: NotSelector is the negated version of the Selector
2616 field. See Selector field for subtleties with negated
2617 selectors.
2618 type: string
2619 ports:
2620 description: "Ports is an optional field that restricts
2621 the rule to only apply to traffic that has a source (destination)
2622 port that matches one of these ranges/values. This value
2623 is a list of integers or strings that represent ranges
2624 of ports. \n Since only some protocols have ports, if
2625 any ports are specified it requires the Protocol match
2626 in the Rule to be set to \"TCP\" or \"UDP\"."
2627 items:
2628 anyOf:
2629 - type: integer
2630 - type: string
2631 pattern: ^.*
2632 x-kubernetes-int-or-string: true
2633 type: array
2634 selector:
2635 description: "Selector is an optional field that contains
2636 a selector expression (see Policy for sample syntax).
2637 \ Only traffic that originates from (terminates at) endpoints
2638 matching the selector will be matched. \n Note that: in
2639 addition to the negated version of the Selector (see NotSelector
2640 below), the selector expression syntax itself supports
2641 negation. The two types of negation are subtly different.
2642 One negates the set of matched endpoints, the other negates
2643 the whole match: \n \tSelector = \"!has(my_label)\" matches
2644 packets that are from other Calico-controlled \tendpoints
2645 that do not have the label “my_label”. \n \tNotSelector
2646 = \"has(my_label)\" matches packets that are not from
2647 Calico-controlled \tendpoints that do have the label “my_label”.
2648 \n The effect is that the latter will accept packets from
2649 non-Calico sources whereas the former is limited to packets
2650 from Calico-controlled endpoints."
2651 type: string
2652 serviceAccounts:
2653 description: ServiceAccounts is an optional field that restricts
2654 the rule to only apply to traffic that originates from
2655 (or terminates at) a pod running as a matching service
2656 account.
2657 properties:
2658 names:
2659 description: Names is an optional field that restricts
2660 the rule to only apply to traffic that originates
2661 from (or terminates at) a pod running as a service
2662 account whose name is in the list.
2663 items:
2664 type: string
2665 type: array
2666 selector:
2667 description: Selector is an optional field that restricts
2668 the rule to only apply to traffic that originates
2669 from (or terminates at) a pod running as a service
2670 account that matches the given label selector. If
2671 both Names and Selector are specified then they are
2672 AND'ed.
2673 type: string
2674 type: object
2675 type: object
2676 required:
2677 - action
2678 type: object
2679 type: array
2680 ingress:
2681 description: The ordered set of ingress rules. Each rule contains
2682 a set of packet match criteria and a corresponding action to apply.
2683 items:
2684 description: "A Rule encapsulates a set of match criteria and an
2685 action. Both selector-based security Policy and security Profiles
2686 reference rules - separated out as a list of rules for both ingress
2687 and egress packet matching. \n Each positive match criteria has
2688 a negated version, prefixed with ”Not”. All the match criteria
2689 within a rule must be satisfied for a packet to match. A single
2690 rule can contain the positive and negative version of a match
2691 and both must be satisfied for the rule to match."
2692 properties:
2693 action:
2694 type: string
2695 destination:
2696 description: Destination contains the match criteria that apply
2697 to destination entity.
2698 properties:
2699 namespaceSelector:
2700 description: "NamespaceSelector is an optional field that
2701 contains a selector expression. Only traffic that originates
2702 from (or terminates at) endpoints within the selected
2703 namespaces will be matched. When both NamespaceSelector
2704 and Selector are defined on the same rule, then only workload
2705 endpoints that are matched by both selectors will be selected
2706 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
2707 implies that the Selector is limited to selecting only
2708 workload endpoints in the same namespace as the NetworkPolicy.
2709 \n For NetworkPolicy, `global()` NamespaceSelector implies
2710 that the Selector is limited to selecting only GlobalNetworkSet
2711 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
2712 NamespaceSelector implies the Selector applies to workload
2713 endpoints across all namespaces."
2714 type: string
2715 nets:
2716 description: Nets is an optional field that restricts the
2717 rule to only apply to traffic that originates from (or
2718 terminates at) IP addresses in any of the given subnets.
2719 items:
2720 type: string
2721 type: array
2722 notNets:
2723 description: NotNets is the negated version of the Nets
2724 field.
2725 items:
2726 type: string
2727 type: array
2728 notPorts:
2729 description: NotPorts is the negated version of the Ports
2730 field. Since only some protocols have ports, if any ports
2731 are specified it requires the Protocol match in the Rule
2732 to be set to "TCP" or "UDP".
2733 items:
2734 anyOf:
2735 - type: integer
2736 - type: string
2737 pattern: ^.*
2738 x-kubernetes-int-or-string: true
2739 type: array
2740 notSelector:
2741 description: NotSelector is the negated version of the Selector
2742 field. See Selector field for subtleties with negated
2743 selectors.
2744 type: string
2745 ports:
2746 description: "Ports is an optional field that restricts
2747 the rule to only apply to traffic that has a source (destination)
2748 port that matches one of these ranges/values. This value
2749 is a list of integers or strings that represent ranges
2750 of ports. \n Since only some protocols have ports, if
2751 any ports are specified it requires the Protocol match
2752 in the Rule to be set to \"TCP\" or \"UDP\"."
2753 items:
2754 anyOf:
2755 - type: integer
2756 - type: string
2757 pattern: ^.*
2758 x-kubernetes-int-or-string: true
2759 type: array
2760 selector:
2761 description: "Selector is an optional field that contains
2762 a selector expression (see Policy for sample syntax).
2763 \ Only traffic that originates from (terminates at) endpoints
2764 matching the selector will be matched. \n Note that: in
2765 addition to the negated version of the Selector (see NotSelector
2766 below), the selector expression syntax itself supports
2767 negation. The two types of negation are subtly different.
2768 One negates the set of matched endpoints, the other negates
2769 the whole match: \n \tSelector = \"!has(my_label)\" matches
2770 packets that are from other Calico-controlled \tendpoints
2771 that do not have the label “my_label”. \n \tNotSelector
2772 = \"has(my_label)\" matches packets that are not from
2773 Calico-controlled \tendpoints that do have the label “my_label”.
2774 \n The effect is that the latter will accept packets from
2775 non-Calico sources whereas the former is limited to packets
2776 from Calico-controlled endpoints."
2777 type: string
2778 serviceAccounts:
2779 description: ServiceAccounts is an optional field that restricts
2780 the rule to only apply to traffic that originates from
2781 (or terminates at) a pod running as a matching service
2782 account.
2783 properties:
2784 names:
2785 description: Names is an optional field that restricts
2786 the rule to only apply to traffic that originates
2787 from (or terminates at) a pod running as a service
2788 account whose name is in the list.
2789 items:
2790 type: string
2791 type: array
2792 selector:
2793 description: Selector is an optional field that restricts
2794 the rule to only apply to traffic that originates
2795 from (or terminates at) a pod running as a service
2796 account that matches the given label selector. If
2797 both Names and Selector are specified then they are
2798 AND'ed.
2799 type: string
2800 type: object
2801 type: object
2802 http:
2803 description: HTTP contains match criteria that apply to HTTP
2804 requests.
2805 properties:
2806 methods:
2807 description: Methods is an optional field that restricts
2808 the rule to apply only to HTTP requests that use one of
2809 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
2810 methods are OR'd together.
2811 items:
2812 type: string
2813 type: array
2814 paths:
2815 description: 'Paths is an optional field that restricts
2816 the rule to apply to HTTP requests that use one of the
2817 listed HTTP Paths. Multiple paths are OR''d together.
2818 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
2819 ONLY specify either a `exact` or a `prefix` match. The
2820 validator will check for it.'
2821 items:
2822 description: 'HTTPPath specifies an HTTP path to match.
2823 It may be either of the form: exact: <path>: which matches
2824 the path exactly or prefix: <path-prefix>: which matches
2825 the path prefix'
2826 properties:
2827 exact:
2828 type: string
2829 prefix:
2830 type: string
2831 type: object
2832 type: array
2833 type: object
2834 icmp:
2835 description: ICMP is an optional field that restricts the rule
2836 to apply to a specific type and code of ICMP traffic. This
2837 should only be specified if the Protocol field is set to "ICMP"
2838 or "ICMPv6".
2839 properties:
2840 code:
2841 description: Match on a specific ICMP code. If specified,
2842 the Type value must also be specified. This is a technical
2843 limitation imposed by the kernel’s iptables firewall,
2844 which Calico uses to enforce the rule.
2845 type: integer
2846 type:
2847 description: Match on a specific ICMP type. For example
2848 a value of 8 refers to ICMP Echo Request (i.e. pings).
2849 type: integer
2850 type: object
2851 ipVersion:
2852 description: IPVersion is an optional field that restricts the
2853 rule to only match a specific IP version.
2854 type: integer
2855 metadata:
2856 description: Metadata contains additional information for this
2857 rule
2858 properties:
2859 annotations:
2860 additionalProperties:
2861 type: string
2862 description: Annotations is a set of key value pairs that
2863 give extra information about the rule
2864 type: object
2865 type: object
2866 notICMP:
2867 description: NotICMP is the negated version of the ICMP field.
2868 properties:
2869 code:
2870 description: Match on a specific ICMP code. If specified,
2871 the Type value must also be specified. This is a technical
2872 limitation imposed by the kernel’s iptables firewall,
2873 which Calico uses to enforce the rule.
2874 type: integer
2875 type:
2876 description: Match on a specific ICMP type. For example
2877 a value of 8 refers to ICMP Echo Request (i.e. pings).
2878 type: integer
2879 type: object
2880 notProtocol:
2881 anyOf:
2882 - type: integer
2883 - type: string
2884 description: NotProtocol is the negated version of the Protocol
2885 field.
2886 pattern: ^.*
2887 x-kubernetes-int-or-string: true
2888 protocol:
2889 anyOf:
2890 - type: integer
2891 - type: string
2892 description: "Protocol is an optional field that restricts the
2893 rule to only apply to traffic of a specific IP protocol. Required
2894 if any of the EntityRules contain Ports (because ports only
2895 apply to certain protocols). \n Must be one of these string
2896 values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
2897 \"UDPLite\" or an integer in the range 1-255."
2898 pattern: ^.*
2899 x-kubernetes-int-or-string: true
2900 source:
2901 description: Source contains the match criteria that apply to
2902 source entity.
2903 properties:
2904 namespaceSelector:
2905 description: "NamespaceSelector is an optional field that
2906 contains a selector expression. Only traffic that originates
2907 from (or terminates at) endpoints within the selected
2908 namespaces will be matched. When both NamespaceSelector
2909 and Selector are defined on the same rule, then only workload
2910 endpoints that are matched by both selectors will be selected
2911 by the rule. \n For NetworkPolicy, an empty NamespaceSelector
2912 implies that the Selector is limited to selecting only
2913 workload endpoints in the same namespace as the NetworkPolicy.
2914 \n For NetworkPolicy, `global()` NamespaceSelector implies
2915 that the Selector is limited to selecting only GlobalNetworkSet
2916 or HostEndpoint. \n For GlobalNetworkPolicy, an empty
2917 NamespaceSelector implies the Selector applies to workload
2918 endpoints across all namespaces."
2919 type: string
2920 nets:
2921 description: Nets is an optional field that restricts the
2922 rule to only apply to traffic that originates from (or
2923 terminates at) IP addresses in any of the given subnets.
2924 items:
2925 type: string
2926 type: array
2927 notNets:
2928 description: NotNets is the negated version of the Nets
2929 field.
2930 items:
2931 type: string
2932 type: array
2933 notPorts:
2934 description: NotPorts is the negated version of the Ports
2935 field. Since only some protocols have ports, if any ports
2936 are specified it requires the Protocol match in the Rule
2937 to be set to "TCP" or "UDP".
2938 items:
2939 anyOf:
2940 - type: integer
2941 - type: string
2942 pattern: ^.*
2943 x-kubernetes-int-or-string: true
2944 type: array
2945 notSelector:
2946 description: NotSelector is the negated version of the Selector
2947 field. See Selector field for subtleties with negated
2948 selectors.
2949 type: string
2950 ports:
2951 description: "Ports is an optional field that restricts
2952 the rule to only apply to traffic that has a source (destination)
2953 port that matches one of these ranges/values. This value
2954 is a list of integers or strings that represent ranges
2955 of ports. \n Since only some protocols have ports, if
2956 any ports are specified it requires the Protocol match
2957 in the Rule to be set to \"TCP\" or \"UDP\"."
2958 items:
2959 anyOf:
2960 - type: integer
2961 - type: string
2962 pattern: ^.*
2963 x-kubernetes-int-or-string: true
2964 type: array
2965 selector:
2966 description: "Selector is an optional field that contains
2967 a selector expression (see Policy for sample syntax).
2968 \ Only traffic that originates from (terminates at) endpoints
2969 matching the selector will be matched. \n Note that: in
2970 addition to the negated version of the Selector (see NotSelector
2971 below), the selector expression syntax itself supports
2972 negation. The two types of negation are subtly different.
2973 One negates the set of matched endpoints, the other negates
2974 the whole match: \n \tSelector = \"!has(my_label)\" matches
2975 packets that are from other Calico-controlled \tendpoints
2976 that do not have the label “my_label”. \n \tNotSelector
2977 = \"has(my_label)\" matches packets that are not from
2978 Calico-controlled \tendpoints that do have the label “my_label”.
2979 \n The effect is that the latter will accept packets from
2980 non-Calico sources whereas the former is limited to packets
2981 from Calico-controlled endpoints."
2982 type: string
2983 serviceAccounts:
2984 description: ServiceAccounts is an optional field that restricts
2985 the rule to only apply to traffic that originates from
2986 (or terminates at) a pod running as a matching service
2987 account.
2988 properties:
2989 names:
2990 description: Names is an optional field that restricts
2991 the rule to only apply to traffic that originates
2992 from (or terminates at) a pod running as a service
2993 account whose name is in the list.
2994 items:
2995 type: string
2996 type: array
2997 selector:
2998 description: Selector is an optional field that restricts
2999 the rule to only apply to traffic that originates
3000 from (or terminates at) a pod running as a service
3001 account that matches the given label selector. If
3002 both Names and Selector are specified then they are
3003 AND'ed.
3004 type: string
3005 type: object
3006 type: object
3007 required:
3008 - action
3009 type: object
3010 type: array
3011 order:
3012 description: Order is an optional field that specifies the order in
3013 which the policy is applied. Policies with higher "order" are applied
3014 after those with lower order. If the order is omitted, it may be
3015 considered to be "infinite" - i.e. the policy will be applied last. Policies
3016 with identical order will be applied in alphanumerical order based
3017 on the Policy "Name".
3018 type: number
3019 selector:
3020 description: "The selector is an expression used to pick pick out
3021 the endpoints that the policy should be applied to. \n Selector
3022 expressions follow this syntax: \n \tlabel == \"string_literal\"
3023 \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
3024 \ -> not equal; also matches if label is not present \tlabel in
3025 { \"a\", \"b\", \"c\", ... } -> true if the value of label X is
3026 one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
3027 ... } -> true if the value of label X is not one of \"a\", \"b\",
3028 \"c\" \thas(label_name) -> True if that label is present \t! expr
3029 -> negation of expr \texpr && expr -> Short-circuit and \texpr
3030 || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall()
3031 or the empty selector -> matches all endpoints. \n Label names are
3032 allowed to contain alphanumerics, -, _ and /. String literals are
3033 more permissive but they do not support escape characters. \n Examples
3034 (with made-up labels): \n \ttype == \"webserver\" && deployment
3035 == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
3036 \"dev\" \t! has(label_name)"
3037 type: string
3038 serviceAccountSelector:
3039 description: ServiceAccountSelector is an optional field for an expression
3040 used to select a pod based on service accounts.
3041 type: string
3042 types:
3043 description: "Types indicates whether this policy applies to ingress,
3044 or to egress, or to both. When not explicitly specified (and so
3045 the value on creation is empty or nil), Calico defaults Types according
3046 to what Ingress and Egress are present in the policy. The default
3047 is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
3048 the case where there are also no Ingress rules) \n - [ PolicyTypeEgress
3049 ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
3050 PolicyTypeEgress ], if there are both Ingress and Egress rules.
3051 \n When the policy is read back again, Types will always be one
3052 of these values, never empty or nil."
3053 items:
3054 description: PolicyType enumerates the possible values of the PolicySpec
3055 Types field.
3056 type: string
3057 type: array
3058 type: object
3059 type: object
3060 served: true
3061 storage: true
3062status:
3063 acceptedNames:
3064 kind: ""
3065 plural: ""
3066 conditions: []
3067 storedVersions: []
3068
3069---
3070
3071---
3072apiVersion: apiextensions.k8s.io/v1
3073kind: CustomResourceDefinition
3074metadata:
3075 annotations:
3076 controller-gen.kubebuilder.io/version: (devel)
3077 creationTimestamp: null
3078 name: networksets.crd.projectcalico.org
3079spec:
3080 group: crd.projectcalico.org
3081 names:
3082 kind: NetworkSet
3083 listKind: NetworkSetList
3084 plural: networksets
3085 singular: networkset
3086 scope: Namespaced
3087 versions:
3088 - name: v1
3089 schema:
3090 openAPIV3Schema:
3091 description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
3092 properties:
3093 apiVersion:
3094 description: 'APIVersion defines the versioned schema of this representation
3095 of an object. Servers should convert recognized schemas to the latest
3096 internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
3097 type: string
3098 kind:
3099 description: 'Kind is a string value representing the REST resource this
3100 object represents. Servers may infer this from the endpoint the client
3101 submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3102 type: string
3103 metadata:
3104 type: object
3105 spec:
3106 description: NetworkSetSpec contains the specification for a NetworkSet
3107 resource.
3108 properties:
3109 nets:
3110 description: The list of IP networks that belong to this set.
3111 items:
3112 type: string
3113 type: array
3114 type: object
3115 type: object
3116 served: true
3117 storage: true
3118status:
3119 acceptedNames:
3120 kind: ""
3121 plural: ""
3122 conditions: []
3123 storedVersions: []
3124
3125---
3126