Bartosz Stebel | 4d98cf5 | 2021-12-01 00:36:02 +0100 | [diff] [blame] | 1 | --- |
| 2 | # vendored from Calico's distribution, licensed under Apache 2.0 |
| 3 | # Source: https://github.com/projectcalico/calico/blob/v3.15.5/_includes/charts/calico/templates/kdd-crds.yaml |
| 4 | # -> https://github.com/projectcalico/calico/tree/v3.15.5/_includes/charts/calico/crds/kdd |
| 5 | |
| 6 | |
| 7 | --- |
| 8 | apiVersion: apiextensions.k8s.io/v1 |
| 9 | kind: CustomResourceDefinition |
| 10 | metadata: |
| 11 | annotations: |
| 12 | controller-gen.kubebuilder.io/version: (devel) |
| 13 | creationTimestamp: null |
| 14 | name: bgpconfigurations.crd.projectcalico.org |
| 15 | spec: |
| 16 | group: crd.projectcalico.org |
| 17 | names: |
| 18 | kind: BGPConfiguration |
| 19 | listKind: BGPConfigurationList |
| 20 | plural: bgpconfigurations |
| 21 | singular: bgpconfiguration |
| 22 | scope: Cluster |
| 23 | versions: |
| 24 | - name: v1 |
| 25 | schema: |
| 26 | openAPIV3Schema: |
| 27 | description: BGPConfiguration contains the configuration for any BGP routing. |
| 28 | properties: |
| 29 | apiVersion: |
| 30 | description: 'APIVersion defines the versioned schema of this representation |
| 31 | of an object. Servers should convert recognized schemas to the latest |
| 32 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 33 | type: string |
| 34 | kind: |
| 35 | description: 'Kind is a string value representing the REST resource this |
| 36 | object represents. Servers may infer this from the endpoint the client |
| 37 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 38 | type: string |
| 39 | metadata: |
| 40 | type: object |
| 41 | spec: |
| 42 | description: BGPConfigurationSpec contains the values of the BGP configuration. |
| 43 | properties: |
| 44 | asNumber: |
| 45 | description: 'ASNumber is the default AS number used by a node. [Default: |
| 46 | 64512]' |
| 47 | format: int32 |
| 48 | type: integer |
| 49 | logSeverityScreen: |
| 50 | description: 'LogSeverityScreen is the log severity above which logs |
| 51 | are sent to the stdout. [Default: INFO]' |
| 52 | type: string |
| 53 | nodeToNodeMeshEnabled: |
| 54 | description: 'NodeToNodeMeshEnabled sets whether full node to node |
| 55 | BGP mesh is enabled. [Default: true]' |
| 56 | type: boolean |
| 57 | serviceClusterIPs: |
| 58 | description: ServiceClusterIPs are the CIDR blocks from which service |
| 59 | cluster IPs are allocated. If specified, Calico will advertise these |
| 60 | blocks, as well as any cluster IPs within them. |
| 61 | items: |
| 62 | description: ServiceClusterIPBlock represents a single whitelisted |
| 63 | CIDR block for ClusterIPs. |
| 64 | properties: |
| 65 | cidr: |
| 66 | type: string |
| 67 | type: object |
| 68 | type: array |
| 69 | serviceExternalIPs: |
| 70 | description: ServiceExternalIPs are the CIDR blocks for Kubernetes |
| 71 | Service External IPs. Kubernetes Service ExternalIPs will only be |
| 72 | advertised if they are within one of these blocks. |
| 73 | items: |
| 74 | description: ServiceExternalIPBlock represents a single whitelisted |
| 75 | CIDR External IP block. |
| 76 | properties: |
| 77 | cidr: |
| 78 | type: string |
| 79 | type: object |
| 80 | type: array |
| 81 | type: object |
| 82 | type: object |
| 83 | served: true |
| 84 | storage: true |
| 85 | status: |
| 86 | acceptedNames: |
| 87 | kind: "" |
| 88 | plural: "" |
| 89 | conditions: [] |
| 90 | storedVersions: [] |
| 91 | |
| 92 | --- |
| 93 | |
| 94 | --- |
| 95 | apiVersion: apiextensions.k8s.io/v1 |
| 96 | kind: CustomResourceDefinition |
| 97 | metadata: |
| 98 | annotations: |
| 99 | controller-gen.kubebuilder.io/version: (devel) |
| 100 | creationTimestamp: null |
| 101 | name: bgppeers.crd.projectcalico.org |
| 102 | spec: |
| 103 | group: crd.projectcalico.org |
| 104 | names: |
| 105 | kind: BGPPeer |
| 106 | listKind: BGPPeerList |
| 107 | plural: bgppeers |
| 108 | singular: bgppeer |
| 109 | scope: Cluster |
| 110 | versions: |
| 111 | - name: v1 |
| 112 | schema: |
| 113 | openAPIV3Schema: |
| 114 | properties: |
| 115 | apiVersion: |
| 116 | description: 'APIVersion defines the versioned schema of this representation |
| 117 | of an object. Servers should convert recognized schemas to the latest |
| 118 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 119 | type: string |
| 120 | kind: |
| 121 | description: 'Kind is a string value representing the REST resource this |
| 122 | object represents. Servers may infer this from the endpoint the client |
| 123 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 124 | type: string |
| 125 | metadata: |
| 126 | type: object |
| 127 | spec: |
| 128 | description: BGPPeerSpec contains the specification for a BGPPeer resource. |
| 129 | properties: |
| 130 | asNumber: |
| 131 | description: The AS Number of the peer. |
| 132 | format: int32 |
| 133 | type: integer |
| 134 | node: |
| 135 | description: The node name identifying the Calico node instance that |
| 136 | is peering with this peer. If this is not set, this represents a |
| 137 | global peer, i.e. a peer that peers with every node in the deployment. |
| 138 | type: string |
| 139 | nodeSelector: |
| 140 | description: Selector for the nodes that should have this peering. When |
| 141 | this is set, the Node field must be empty. |
| 142 | type: string |
| 143 | peerIP: |
| 144 | description: The IP address of the peer. |
| 145 | type: string |
| 146 | peerSelector: |
| 147 | description: Selector for the remote nodes to peer with. When this |
| 148 | is set, the PeerIP and ASNumber fields must be empty. For each |
| 149 | peering between the local node and selected remote nodes, we configure |
| 150 | an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, |
| 151 | and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The |
| 152 | remote AS number comes from the remote node’s NodeBGPSpec.ASNumber, |
| 153 | or the global default if that is not set. |
| 154 | type: string |
| 155 | required: |
| 156 | - asNumber |
| 157 | - peerIP |
| 158 | type: object |
| 159 | type: object |
| 160 | served: true |
| 161 | storage: true |
| 162 | status: |
| 163 | acceptedNames: |
| 164 | kind: "" |
| 165 | plural: "" |
| 166 | conditions: [] |
| 167 | storedVersions: [] |
| 168 | |
| 169 | --- |
| 170 | |
| 171 | --- |
| 172 | apiVersion: apiextensions.k8s.io/v1 |
| 173 | kind: CustomResourceDefinition |
| 174 | metadata: |
| 175 | annotations: |
| 176 | controller-gen.kubebuilder.io/version: (devel) |
| 177 | creationTimestamp: null |
| 178 | name: blockaffinities.crd.projectcalico.org |
| 179 | spec: |
| 180 | group: crd.projectcalico.org |
| 181 | names: |
| 182 | kind: BlockAffinity |
| 183 | listKind: BlockAffinityList |
| 184 | plural: blockaffinities |
| 185 | singular: blockaffinity |
| 186 | scope: Cluster |
| 187 | versions: |
| 188 | - name: v1 |
| 189 | schema: |
| 190 | openAPIV3Schema: |
| 191 | properties: |
| 192 | apiVersion: |
| 193 | description: 'APIVersion defines the versioned schema of this representation |
| 194 | of an object. Servers should convert recognized schemas to the latest |
| 195 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 196 | type: string |
| 197 | kind: |
| 198 | description: 'Kind is a string value representing the REST resource this |
| 199 | object represents. Servers may infer this from the endpoint the client |
| 200 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 201 | type: string |
| 202 | metadata: |
| 203 | type: object |
| 204 | spec: |
| 205 | description: BlockAffinitySpec contains the specification for a BlockAffinity |
| 206 | resource. |
| 207 | properties: |
| 208 | cidr: |
| 209 | type: string |
| 210 | deleted: |
| 211 | description: Deleted indicates that this block affinity is being deleted. |
| 212 | This field is a string for compatibility with older releases that |
| 213 | mistakenly treat this field as a string. |
| 214 | type: string |
| 215 | node: |
| 216 | type: string |
| 217 | state: |
| 218 | type: string |
| 219 | required: |
| 220 | - cidr |
| 221 | - deleted |
| 222 | - node |
| 223 | - state |
| 224 | type: object |
| 225 | type: object |
| 226 | served: true |
| 227 | storage: true |
| 228 | status: |
| 229 | acceptedNames: |
| 230 | kind: "" |
| 231 | plural: "" |
| 232 | conditions: [] |
| 233 | storedVersions: [] |
| 234 | |
| 235 | --- |
| 236 | |
| 237 | --- |
| 238 | apiVersion: apiextensions.k8s.io/v1 |
| 239 | kind: CustomResourceDefinition |
| 240 | metadata: |
| 241 | annotations: |
| 242 | controller-gen.kubebuilder.io/version: (devel) |
| 243 | creationTimestamp: null |
| 244 | name: clusterinformations.crd.projectcalico.org |
| 245 | spec: |
| 246 | group: crd.projectcalico.org |
| 247 | names: |
| 248 | kind: ClusterInformation |
| 249 | listKind: ClusterInformationList |
| 250 | plural: clusterinformations |
| 251 | singular: clusterinformation |
| 252 | scope: Cluster |
| 253 | versions: |
| 254 | - name: v1 |
| 255 | schema: |
| 256 | openAPIV3Schema: |
| 257 | description: ClusterInformation contains the cluster specific information. |
| 258 | properties: |
| 259 | apiVersion: |
| 260 | description: 'APIVersion defines the versioned schema of this representation |
| 261 | of an object. Servers should convert recognized schemas to the latest |
| 262 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 263 | type: string |
| 264 | kind: |
| 265 | description: 'Kind is a string value representing the REST resource this |
| 266 | object represents. Servers may infer this from the endpoint the client |
| 267 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 268 | type: string |
| 269 | metadata: |
| 270 | type: object |
| 271 | spec: |
| 272 | description: ClusterInformationSpec contains the values of describing |
| 273 | the cluster. |
| 274 | properties: |
| 275 | calicoVersion: |
| 276 | description: CalicoVersion is the version of Calico that the cluster |
| 277 | is running |
| 278 | type: string |
| 279 | clusterGUID: |
| 280 | description: ClusterGUID is the GUID of the cluster |
| 281 | type: string |
| 282 | clusterType: |
| 283 | description: ClusterType describes the type of the cluster |
| 284 | type: string |
| 285 | datastoreReady: |
| 286 | description: DatastoreReady is used during significant datastore migrations |
| 287 | to signal to components such as Felix that it should wait before |
| 288 | accessing the datastore. |
| 289 | type: boolean |
| 290 | variant: |
| 291 | description: Variant declares which variant of Calico should be active. |
| 292 | type: string |
| 293 | type: object |
| 294 | type: object |
| 295 | served: true |
| 296 | storage: true |
| 297 | status: |
| 298 | acceptedNames: |
| 299 | kind: "" |
| 300 | plural: "" |
| 301 | conditions: [] |
| 302 | storedVersions: [] |
| 303 | |
| 304 | --- |
| 305 | |
| 306 | --- |
| 307 | apiVersion: apiextensions.k8s.io/v1 |
| 308 | kind: CustomResourceDefinition |
| 309 | metadata: |
| 310 | annotations: |
| 311 | controller-gen.kubebuilder.io/version: (devel) |
| 312 | creationTimestamp: null |
| 313 | name: felixconfigurations.crd.projectcalico.org |
| 314 | spec: |
| 315 | group: crd.projectcalico.org |
| 316 | names: |
| 317 | kind: FelixConfiguration |
| 318 | listKind: FelixConfigurationList |
| 319 | plural: felixconfigurations |
| 320 | singular: felixconfiguration |
| 321 | scope: Cluster |
| 322 | versions: |
| 323 | - name: v1 |
| 324 | schema: |
| 325 | openAPIV3Schema: |
| 326 | description: Felix Configuration contains the configuration for Felix. |
| 327 | properties: |
| 328 | apiVersion: |
| 329 | description: 'APIVersion defines the versioned schema of this representation |
| 330 | of an object. Servers should convert recognized schemas to the latest |
| 331 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 332 | type: string |
| 333 | kind: |
| 334 | description: 'Kind is a string value representing the REST resource this |
| 335 | object represents. Servers may infer this from the endpoint the client |
| 336 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 337 | type: string |
| 338 | metadata: |
| 339 | type: object |
| 340 | spec: |
| 341 | description: FelixConfigurationSpec contains the values of the Felix configuration. |
| 342 | properties: |
| 343 | allowIPIPPacketsFromWorkloads: |
| 344 | description: 'AllowIPIPPacketsFromWorkloads controls whether Felix |
| 345 | will add a rule to drop IPIP encapsulated traffic from workloads |
| 346 | [Default: false]' |
| 347 | type: boolean |
| 348 | allowVXLANPacketsFromWorkloads: |
| 349 | description: 'AllowVXLANPacketsFromWorkloads controls whether Felix |
| 350 | will add a rule to drop VXLAN encapsulated traffic from workloads |
| 351 | [Default: false]' |
| 352 | type: boolean |
| 353 | bpfConnectTimeLoadBalancingEnabled: |
| 354 | description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, |
| 355 | controls whether Felix installs the connection-time load balancer. The |
| 356 | connect-time load balancer is required for the host to be able to |
| 357 | reach Kubernetes services and it improves the performance of pod-to-service |
| 358 | connections. The only reason to disable it is for debugging purposes. [Default: |
| 359 | true]' |
| 360 | type: boolean |
| 361 | bpfDataIfacePattern: |
| 362 | description: 'BPFDataIfacePattern is a regular expression that controls |
| 363 | which interfaces Felix should attach BPF programs to in order to |
| 364 | catch traffic to/from the network. This needs to match the interfaces |
| 365 | that Calico workload traffic flows over as well as any interfaces |
| 366 | that handle incoming traffic to nodeports and services from outside |
| 367 | the cluster. It should not match the workload interfaces (usually |
| 368 | named cali...). [Default: ^(en.*|eth.*|tunl0$)]' |
| 369 | type: string |
| 370 | bpfDisableUnprivileged: |
| 371 | description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled |
| 372 | sysctl to disable unprivileged use of BPF. This ensures that unprivileged |
| 373 | users cannot access Calico''s BPF maps and cannot insert their own |
| 374 | BPF programs to interfere with Calico''s. [Default: true]' |
| 375 | type: boolean |
| 376 | bpfEnabled: |
| 377 | description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. |
| 378 | [Default: false]' |
| 379 | type: boolean |
| 380 | bpfExternalServiceMode: |
| 381 | description: 'BPFExternalServiceMode in BPF mode, controls how connections |
| 382 | from outside the cluster to services (node ports and cluster IPs) |
| 383 | are forwarded to remote workloads. If set to "Tunnel" then both |
| 384 | request and response traffic is tunneled to the remote node. If |
| 385 | set to "DSR", the request traffic is tunneled but the response traffic |
| 386 | is sent directly from the remote node. In "DSR" mode, the remote |
| 387 | node appears to use the IP of the ingress node; this requires a |
| 388 | permissive L2 network. [Default: Tunnel]' |
| 389 | type: string |
| 390 | bpfKubeProxyEndpointSlicesEnabled: |
| 391 | description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls |
| 392 | whether Felix's embedded kube-proxy accepts EndpointSlices or not. |
| 393 | type: boolean |
| 394 | bpfKubeProxyIptablesCleanupEnabled: |
| 395 | description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF |
| 396 | mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s |
| 397 | iptables chains. Should only be enabled if kube-proxy is not running. [Default: |
| 398 | true]' |
| 399 | type: boolean |
| 400 | bpfKubeProxyMinSyncPeriod: |
| 401 | description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the |
| 402 | minimum time between updates to the dataplane for Felix''s embedded |
| 403 | kube-proxy. Lower values give reduced set-up latency. Higher values |
| 404 | reduce Felix CPU usage by batching up more work. [Default: 1s]' |
| 405 | type: string |
| 406 | bpfLogLevel: |
| 407 | description: 'BPFLogLevel controls the log level of the BPF programs |
| 408 | when in BPF dataplane mode. One of "Off", "Info", or "Debug". The |
| 409 | logs are emitted to the BPF trace pipe, accessible with the command |
| 410 | `tc exec bpf debug`. [Default: Off].' |
| 411 | type: string |
| 412 | chainInsertMode: |
| 413 | description: 'ChainInsertMode controls whether Felix hooks the kernel’s |
| 414 | top-level iptables chains by inserting a rule at the top of the |
| 415 | chain or by appending a rule at the bottom. insert is the safe default |
| 416 | since it prevents Calico’s rules from being bypassed. If you switch |
| 417 | to append mode, be sure that the other rules in the chains signal |
| 418 | acceptance by falling through to the Calico rules, otherwise the |
| 419 | Calico policy will be bypassed. [Default: insert]' |
| 420 | type: string |
| 421 | dataplaneDriver: |
| 422 | type: string |
| 423 | debugDisableLogDropping: |
| 424 | type: boolean |
| 425 | debugMemoryProfilePath: |
| 426 | type: string |
| 427 | debugSimulateCalcGraphHangAfter: |
| 428 | type: string |
| 429 | debugSimulateDataplaneHangAfter: |
| 430 | type: string |
| 431 | defaultEndpointToHostAction: |
| 432 | description: 'DefaultEndpointToHostAction controls what happens to |
| 433 | traffic that goes from a workload endpoint to the host itself (after |
| 434 | the traffic hits the endpoint egress policy). By default Calico |
| 435 | blocks traffic from workload endpoints to the host itself with an |
| 436 | iptables “DROP” action. If you want to allow some or all traffic |
| 437 | from endpoint to host, set this parameter to RETURN or ACCEPT. Use |
| 438 | RETURN if you have your own rules in the iptables “INPUT” chain; |
| 439 | Calico will insert its rules at the top of that chain, then “RETURN” |
| 440 | packets to the “INPUT” chain once it has completed processing workload |
| 441 | endpoint egress policy. Use ACCEPT to unconditionally accept packets |
| 442 | from workloads after processing workload endpoint egress policy. |
| 443 | [Default: Drop]' |
| 444 | type: string |
| 445 | deviceRouteProtocol: |
| 446 | description: This defines the route protocol added to programmed device |
| 447 | routes, by default this will be RTPROT_BOOT when left blank. |
| 448 | type: integer |
| 449 | deviceRouteSourceAddress: |
| 450 | description: This is the source address to use on programmed device |
| 451 | routes. By default the source address is left blank, leaving the |
| 452 | kernel to choose the source address used. |
| 453 | type: string |
| 454 | disableConntrackInvalidCheck: |
| 455 | type: boolean |
| 456 | endpointReportingDelay: |
| 457 | type: string |
| 458 | endpointReportingEnabled: |
| 459 | type: boolean |
| 460 | externalNodesList: |
| 461 | description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes |
| 462 | which may source tunnel traffic and have the tunneled traffic be |
| 463 | accepted at calico nodes. |
| 464 | items: |
| 465 | type: string |
| 466 | type: array |
| 467 | failsafeInboundHostPorts: |
| 468 | description: 'FailsafeInboundHostPorts is a comma-delimited list of |
| 469 | UDP/TCP ports that Felix will allow incoming traffic to host endpoints |
| 470 | on irrespective of the security policy. This is useful to avoid |
| 471 | accidentally cutting off a host with incorrect configuration. Each |
| 472 | port should be specified as tcp:<port-number> or udp:<port-number>. |
| 473 | For back-compatibility, if the protocol is not specified, it defaults |
| 474 | to “tcp”. To disable all inbound host ports, use the value none. |
| 475 | The default value allows ssh access and DHCP. [Default: tcp:22, |
| 476 | udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' |
| 477 | items: |
| 478 | description: ProtoPort is combination of protocol and port, both |
| 479 | must be specified. |
| 480 | properties: |
| 481 | port: |
| 482 | type: integer |
| 483 | protocol: |
| 484 | type: string |
| 485 | required: |
| 486 | - port |
| 487 | - protocol |
| 488 | type: object |
| 489 | type: array |
| 490 | failsafeOutboundHostPorts: |
| 491 | description: 'FailsafeOutboundHostPorts is a comma-delimited list |
| 492 | of UDP/TCP ports that Felix will allow outgoing traffic from host |
| 493 | endpoints to irrespective of the security policy. This is useful |
| 494 | to avoid accidentally cutting off a host with incorrect configuration. |
| 495 | Each port should be specified as tcp:<port-number> or udp:<port-number>. |
| 496 | For back-compatibility, if the protocol is not specified, it defaults |
| 497 | to “tcp”. To disable all outbound host ports, use the value none. |
| 498 | The default value opens etcd’s standard ports to ensure that Felix |
| 499 | does not get cut off from etcd as well as allowing DHCP and DNS. |
| 500 | [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667, |
| 501 | udp:53, udp:67]' |
| 502 | items: |
| 503 | description: ProtoPort is combination of protocol and port, both |
| 504 | must be specified. |
| 505 | properties: |
| 506 | port: |
| 507 | type: integer |
| 508 | protocol: |
| 509 | type: string |
| 510 | required: |
| 511 | - port |
| 512 | - protocol |
| 513 | type: object |
| 514 | type: array |
| 515 | genericXDPEnabled: |
| 516 | description: 'GenericXDPEnabled enables Generic XDP so network cards |
| 517 | that don''t support XDP offload or driver modes can use XDP. This |
| 518 | is not recommended since it doesn''t provide better performance |
| 519 | than iptables. [Default: false]' |
| 520 | type: boolean |
| 521 | healthEnabled: |
| 522 | type: boolean |
| 523 | healthHost: |
| 524 | type: string |
| 525 | healthPort: |
| 526 | type: integer |
| 527 | interfaceExclude: |
| 528 | description: 'InterfaceExclude is a comma-separated list of interfaces |
| 529 | that Felix should exclude when monitoring for host endpoints. The |
| 530 | default value ensures that Felix ignores Kubernetes'' IPVS dummy |
| 531 | interface, which is used internally by kube-proxy. If you want to |
| 532 | exclude multiple interface names using a single value, the list |
| 533 | supports regular expressions. For regular expressions you must wrap |
| 534 | the value with ''/''. For example having values ''/^kube/,veth1'' |
| 535 | will exclude all interfaces that begin with ''kube'' and also the |
| 536 | interface ''veth1''. [Default: kube-ipvs0]' |
| 537 | type: string |
| 538 | interfacePrefix: |
| 539 | description: 'InterfacePrefix is the interface name prefix that identifies |
| 540 | workload endpoints and so distinguishes them from host endpoint |
| 541 | interfaces. Note: in environments other than bare metal, the orchestrators |
| 542 | configure this appropriately. For example our Kubernetes and Docker |
| 543 | integrations set the ‘cali’ value, and our OpenStack integration |
| 544 | sets the ‘tap’ value. [Default: cali]' |
| 545 | type: string |
| 546 | ipipEnabled: |
| 547 | type: boolean |
| 548 | ipipMTU: |
| 549 | description: 'IPIPMTU is the MTU to set on the tunnel device. See |
| 550 | Configuring MTU [Default: 1440]' |
| 551 | type: integer |
| 552 | ipsetsRefreshInterval: |
| 553 | description: 'IpsetsRefreshInterval is the period at which Felix re-checks |
| 554 | all iptables state to ensure that no other process has accidentally |
| 555 | broken Calico’s rules. Set to 0 to disable iptables refresh. [Default: |
| 556 | 90s]' |
| 557 | type: string |
| 558 | iptablesBackend: |
| 559 | description: IptablesBackend specifies which backend of iptables will |
| 560 | be used. The default is legacy. |
| 561 | type: string |
| 562 | iptablesFilterAllowAction: |
| 563 | type: string |
| 564 | iptablesLockFilePath: |
| 565 | description: 'IptablesLockFilePath is the location of the iptables |
| 566 | lock file. You may need to change this if the lock file is not in |
| 567 | its standard location (for example if you have mapped it into Felix’s |
| 568 | container at a different path). [Default: /run/xtables.lock]' |
| 569 | type: string |
| 570 | iptablesLockProbeInterval: |
| 571 | description: 'IptablesLockProbeInterval is the time that Felix will |
| 572 | wait between attempts to acquire the iptables lock if it is not |
| 573 | available. Lower values make Felix more responsive when the lock |
| 574 | is contended, but use more CPU. [Default: 50ms]' |
| 575 | type: string |
| 576 | iptablesLockTimeout: |
| 577 | description: 'IptablesLockTimeout is the time that Felix will wait |
| 578 | for the iptables lock, or 0, to disable. To use this feature, Felix |
| 579 | must share the iptables lock file with all other processes that |
| 580 | also take the lock. When running Felix inside a container, this |
| 581 | requires the /run directory of the host to be mounted into the calico/node |
| 582 | or calico/felix container. [Default: 0s disabled]' |
| 583 | type: string |
| 584 | iptablesMangleAllowAction: |
| 585 | type: string |
| 586 | iptablesMarkMask: |
| 587 | description: 'IptablesMarkMask is the mask that Felix selects its |
| 588 | IPTables Mark bits from. Should be a 32 bit hexadecimal number with |
| 589 | at least 8 bits set, none of which clash with any other mark bits |
| 590 | in use on the system. [Default: 0xff000000]' |
| 591 | format: int32 |
| 592 | type: integer |
| 593 | iptablesNATOutgoingInterfaceFilter: |
| 594 | type: string |
| 595 | iptablesPostWriteCheckInterval: |
| 596 | description: 'IptablesPostWriteCheckInterval is the period after Felix |
| 597 | has done a write to the dataplane that it schedules an extra read |
| 598 | back in order to check the write was not clobbered by another process. |
| 599 | This should only occur if another application on the system doesn’t |
| 600 | respect the iptables lock. [Default: 1s]' |
| 601 | type: string |
| 602 | iptablesRefreshInterval: |
| 603 | description: 'IptablesRefreshInterval is the period at which Felix |
| 604 | re-checks the IP sets in the dataplane to ensure that no other process |
| 605 | has accidentally broken Calico’s rules. Set to 0 to disable IP sets |
| 606 | refresh. Note: the default for this value is lower than the other |
| 607 | refresh intervals as a workaround for a Linux kernel bug that was |
| 608 | fixed in kernel version 4.11. If you are using v4.11 or greater |
| 609 | you may want to set this to, a higher value to reduce Felix CPU |
| 610 | usage. [Default: 10s]' |
| 611 | type: string |
| 612 | ipv6Support: |
| 613 | type: boolean |
| 614 | kubeNodePortRanges: |
| 615 | description: 'KubeNodePortRanges holds list of port ranges used for |
| 616 | service node ports. Only used if felix detects kube-proxy running |
| 617 | in ipvs mode. Felix uses these ranges to separate host and workload |
| 618 | traffic. [Default: 30000:32767].' |
| 619 | items: |
| 620 | anyOf: |
| 621 | - type: integer |
| 622 | - type: string |
| 623 | pattern: ^.* |
| 624 | x-kubernetes-int-or-string: true |
| 625 | type: array |
| 626 | logFilePath: |
| 627 | description: 'LogFilePath is the full path to the Felix log. Set to |
| 628 | none to disable file logging. [Default: /var/log/calico/felix.log]' |
| 629 | type: string |
| 630 | logPrefix: |
| 631 | description: 'LogPrefix is the log prefix that Felix uses when rendering |
| 632 | LOG rules. [Default: calico-packet]' |
| 633 | type: string |
| 634 | logSeverityFile: |
| 635 | description: 'LogSeverityFile is the log severity above which logs |
| 636 | are sent to the log file. [Default: Info]' |
| 637 | type: string |
| 638 | logSeverityScreen: |
| 639 | description: 'LogSeverityScreen is the log severity above which logs |
| 640 | are sent to the stdout. [Default: Info]' |
| 641 | type: string |
| 642 | logSeveritySys: |
| 643 | description: 'LogSeveritySys is the log severity above which logs |
| 644 | are sent to the syslog. Set to None for no logging to syslog. [Default: |
| 645 | Info]' |
| 646 | type: string |
| 647 | maxIpsetSize: |
| 648 | type: integer |
| 649 | metadataAddr: |
| 650 | description: 'MetadataAddr is the IP address or domain name of the |
| 651 | server that can answer VM queries for cloud-init metadata. In OpenStack, |
| 652 | this corresponds to the machine running nova-api (or in Ubuntu, |
| 653 | nova-api-metadata). A value of none (case insensitive) means that |
| 654 | Felix should not set up any NAT rule for the metadata path. [Default: |
| 655 | 127.0.0.1]' |
| 656 | type: string |
| 657 | metadataPort: |
| 658 | description: 'MetadataPort is the port of the metadata server. This, |
| 659 | combined with global.MetadataAddr (if not ‘None’), is used to set |
| 660 | up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. |
| 661 | In most cases this should not need to be changed [Default: 8775].' |
| 662 | type: integer |
| 663 | natOutgoingAddress: |
| 664 | description: NATOutgoingAddress specifies an address to use when performing |
| 665 | source NAT for traffic in a natOutgoing pool that is leaving the |
| 666 | network. By default the address used is an address on the interface |
| 667 | the traffic is leaving on (ie it uses the iptables MASQUERADE target) |
| 668 | type: string |
| 669 | natPortRange: |
| 670 | anyOf: |
| 671 | - type: integer |
| 672 | - type: string |
| 673 | description: NATPortRange specifies the range of ports that is used |
| 674 | for port mapping when doing outgoing NAT. When unset the default |
| 675 | behavior of the network stack is used. |
| 676 | pattern: ^.* |
| 677 | x-kubernetes-int-or-string: true |
| 678 | netlinkTimeout: |
| 679 | type: string |
| 680 | openstackRegion: |
| 681 | description: 'OpenstackRegion is the name of the region that a particular |
| 682 | Felix belongs to. In a multi-region Calico/OpenStack deployment, |
| 683 | this must be configured somehow for each Felix (here in the datamodel, |
| 684 | or in felix.cfg or the environment on each compute node), and must |
| 685 | match the [calico] openstack_region value configured in neutron.conf |
| 686 | on each node. [Default: Empty]' |
| 687 | type: string |
| 688 | policySyncPathPrefix: |
| 689 | description: 'PolicySyncPathPrefix is used to by Felix to communicate |
| 690 | policy changes to external services, like Application layer policy. |
| 691 | [Default: Empty]' |
| 692 | type: string |
| 693 | prometheusGoMetricsEnabled: |
| 694 | description: 'PrometheusGoMetricsEnabled disables Go runtime metrics |
| 695 | collection, which the Prometheus client does by default, when set |
| 696 | to false. This reduces the number of metrics reported, reducing |
| 697 | Prometheus load. [Default: true]' |
| 698 | type: boolean |
| 699 | prometheusMetricsEnabled: |
| 700 | description: 'PrometheusMetricsEnabled enables the Prometheus metrics |
| 701 | server in Felix if set to true. [Default: false]' |
| 702 | type: boolean |
| 703 | prometheusMetricsHost: |
| 704 | description: 'PrometheusMetricsHost is the host that the Prometheus |
| 705 | metrics server should bind to. [Default: empty]' |
| 706 | type: string |
| 707 | prometheusMetricsPort: |
| 708 | description: 'PrometheusMetricsPort is the TCP port that the Prometheus |
| 709 | metrics server should bind to. [Default: 9091]' |
| 710 | type: integer |
| 711 | prometheusProcessMetricsEnabled: |
| 712 | description: 'PrometheusProcessMetricsEnabled disables process metrics |
| 713 | collection, which the Prometheus client does by default, when set |
| 714 | to false. This reduces the number of metrics reported, reducing |
| 715 | Prometheus load. [Default: true]' |
| 716 | type: boolean |
| 717 | removeExternalRoutes: |
| 718 | description: Whether or not to remove device routes that have not |
| 719 | been programmed by Felix. Disabling this will allow external applications |
| 720 | to also add device routes. This is enabled by default which means |
| 721 | we will remove externally added routes. |
| 722 | type: boolean |
| 723 | reportingInterval: |
| 724 | description: 'ReportingInterval is the interval at which Felix reports |
| 725 | its status into the datastore or 0 to disable. Must be non-zero |
| 726 | in OpenStack deployments. [Default: 30s]' |
| 727 | type: string |
| 728 | reportingTTL: |
| 729 | description: 'ReportingTTL is the time-to-live setting for process-wide |
| 730 | status reports. [Default: 90s]' |
| 731 | type: string |
| 732 | routeRefreshInterval: |
| 733 | description: 'RouterefreshInterval is the period at which Felix re-checks |
| 734 | the routes in the dataplane to ensure that no other process has |
| 735 | accidentally broken Calico’s rules. Set to 0 to disable route refresh. |
| 736 | [Default: 90s]' |
| 737 | type: string |
| 738 | routeSource: |
| 739 | description: 'RouteSource configures where Felix gets its routing |
| 740 | information. - WorkloadIPs: use workload endpoints to construct |
| 741 | routes. - CalicoIPAM: the default - use IPAM data to construct routes.' |
| 742 | type: string |
| 743 | routeTableRange: |
| 744 | description: Calico programs additional Linux route tables for various |
| 745 | purposes. RouteTableRange specifies the indices of the route tables |
| 746 | that Calico should use. |
| 747 | properties: |
| 748 | max: |
| 749 | type: integer |
| 750 | min: |
| 751 | type: integer |
| 752 | required: |
| 753 | - max |
| 754 | - min |
| 755 | type: object |
| 756 | sidecarAccelerationEnabled: |
| 757 | description: 'SidecarAccelerationEnabled enables experimental sidecar |
| 758 | acceleration [Default: false]' |
| 759 | type: boolean |
| 760 | usageReportingEnabled: |
| 761 | description: 'UsageReportingEnabled reports anonymous Calico version |
| 762 | number and cluster size to projectcalico.org. Logs warnings returned |
| 763 | by the usage server. For example, if a significant security vulnerability |
| 764 | has been discovered in the version of Calico being used. [Default: |
| 765 | true]' |
| 766 | type: boolean |
| 767 | usageReportingInitialDelay: |
| 768 | description: 'UsageReportingInitialDelay controls the minimum delay |
| 769 | before Felix makes a report. [Default: 300s]' |
| 770 | type: string |
| 771 | usageReportingInterval: |
| 772 | description: 'UsageReportingInterval controls the interval at which |
| 773 | Felix makes reports. [Default: 86400s]' |
| 774 | type: string |
| 775 | useInternalDataplaneDriver: |
| 776 | type: boolean |
| 777 | vxlanEnabled: |
| 778 | type: boolean |
| 779 | vxlanMTU: |
| 780 | description: 'VXLANMTU is the MTU to set on the tunnel device. See |
| 781 | Configuring MTU [Default: 1440]' |
| 782 | type: integer |
| 783 | vxlanPort: |
| 784 | type: integer |
| 785 | vxlanVNI: |
| 786 | type: integer |
| 787 | wireguardEnabled: |
| 788 | description: 'WireguardEnabled controls whether Wireguard is enabled. |
| 789 | [Default: false]' |
| 790 | type: boolean |
| 791 | wireguardInterfaceName: |
| 792 | description: 'WireguardInterfaceName specifies the name to use for |
| 793 | the Wireguard interface. [Default: wg.calico]' |
| 794 | type: string |
| 795 | wireguardListeningPort: |
| 796 | description: 'WireguardListeningPort controls the listening port used |
| 797 | by Wireguard. [Default: 51820]' |
| 798 | type: integer |
| 799 | wireguardMTU: |
| 800 | description: 'WireguardMTU controls the MTU on the Wireguard interface. |
| 801 | See Configuring MTU [Default: 1420]' |
| 802 | type: integer |
| 803 | wireguardRoutingRulePriority: |
| 804 | description: 'WireguardRoutingRulePriority controls the priority value |
| 805 | to use for the Wireguard routing rule. [Default: 99]' |
| 806 | type: integer |
| 807 | xdpEnabled: |
| 808 | description: 'XDPEnabled enables XDP acceleration for suitable untracked |
| 809 | incoming deny rules. [Default: true]' |
| 810 | type: boolean |
| 811 | xdpRefreshInterval: |
| 812 | description: 'XDPRefreshInterval is the period at which Felix re-checks |
| 813 | all XDP state to ensure that no other process has accidentally broken |
| 814 | Calico''s BPF maps or attached programs. Set to 0 to disable XDP |
| 815 | refresh. [Default: 90s]' |
| 816 | type: string |
| 817 | required: |
| 818 | - bpfLogLevel |
| 819 | type: object |
| 820 | type: object |
| 821 | served: true |
| 822 | storage: true |
| 823 | status: |
| 824 | acceptedNames: |
| 825 | kind: "" |
| 826 | plural: "" |
| 827 | conditions: [] |
| 828 | storedVersions: [] |
| 829 | |
| 830 | --- |
| 831 | |
| 832 | --- |
| 833 | apiVersion: apiextensions.k8s.io/v1 |
| 834 | kind: CustomResourceDefinition |
| 835 | metadata: |
| 836 | annotations: |
| 837 | controller-gen.kubebuilder.io/version: (devel) |
| 838 | creationTimestamp: null |
| 839 | name: globalnetworkpolicies.crd.projectcalico.org |
| 840 | spec: |
| 841 | group: crd.projectcalico.org |
| 842 | names: |
| 843 | kind: GlobalNetworkPolicy |
| 844 | listKind: GlobalNetworkPolicyList |
| 845 | plural: globalnetworkpolicies |
| 846 | singular: globalnetworkpolicy |
| 847 | scope: Cluster |
| 848 | versions: |
| 849 | - name: v1 |
| 850 | schema: |
| 851 | openAPIV3Schema: |
| 852 | properties: |
| 853 | apiVersion: |
| 854 | description: 'APIVersion defines the versioned schema of this representation |
| 855 | of an object. Servers should convert recognized schemas to the latest |
| 856 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 857 | type: string |
| 858 | kind: |
| 859 | description: 'Kind is a string value representing the REST resource this |
| 860 | object represents. Servers may infer this from the endpoint the client |
| 861 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 862 | type: string |
| 863 | metadata: |
| 864 | type: object |
| 865 | spec: |
| 866 | properties: |
| 867 | applyOnForward: |
| 868 | description: ApplyOnForward indicates to apply the rules in this policy |
| 869 | on forward traffic. |
| 870 | type: boolean |
| 871 | doNotTrack: |
| 872 | description: DoNotTrack indicates whether packets matched by the rules |
| 873 | in this policy should go through the data plane's connection tracking, |
| 874 | such as Linux conntrack. If True, the rules in this policy are |
| 875 | applied before any data plane connection tracking, and packets allowed |
| 876 | by this policy are marked as not to be tracked. |
| 877 | type: boolean |
| 878 | egress: |
| 879 | description: The ordered set of egress rules. Each rule contains |
| 880 | a set of packet match criteria and a corresponding action to apply. |
| 881 | items: |
| 882 | description: "A Rule encapsulates a set of match criteria and an |
| 883 | action. Both selector-based security Policy and security Profiles |
| 884 | reference rules - separated out as a list of rules for both ingress |
| 885 | and egress packet matching. \n Each positive match criteria has |
| 886 | a negated version, prefixed with ”Not”. All the match criteria |
| 887 | within a rule must be satisfied for a packet to match. A single |
| 888 | rule can contain the positive and negative version of a match |
| 889 | and both must be satisfied for the rule to match." |
| 890 | properties: |
| 891 | action: |
| 892 | type: string |
| 893 | destination: |
| 894 | description: Destination contains the match criteria that apply |
| 895 | to destination entity. |
| 896 | properties: |
| 897 | namespaceSelector: |
| 898 | description: "NamespaceSelector is an optional field that |
| 899 | contains a selector expression. Only traffic that originates |
| 900 | from (or terminates at) endpoints within the selected |
| 901 | namespaces will be matched. When both NamespaceSelector |
| 902 | and Selector are defined on the same rule, then only workload |
| 903 | endpoints that are matched by both selectors will be selected |
| 904 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 905 | implies that the Selector is limited to selecting only |
| 906 | workload endpoints in the same namespace as the NetworkPolicy. |
| 907 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 908 | that the Selector is limited to selecting only GlobalNetworkSet |
| 909 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 910 | NamespaceSelector implies the Selector applies to workload |
| 911 | endpoints across all namespaces." |
| 912 | type: string |
| 913 | nets: |
| 914 | description: Nets is an optional field that restricts the |
| 915 | rule to only apply to traffic that originates from (or |
| 916 | terminates at) IP addresses in any of the given subnets. |
| 917 | items: |
| 918 | type: string |
| 919 | type: array |
| 920 | notNets: |
| 921 | description: NotNets is the negated version of the Nets |
| 922 | field. |
| 923 | items: |
| 924 | type: string |
| 925 | type: array |
| 926 | notPorts: |
| 927 | description: NotPorts is the negated version of the Ports |
| 928 | field. Since only some protocols have ports, if any ports |
| 929 | are specified it requires the Protocol match in the Rule |
| 930 | to be set to "TCP" or "UDP". |
| 931 | items: |
| 932 | anyOf: |
| 933 | - type: integer |
| 934 | - type: string |
| 935 | pattern: ^.* |
| 936 | x-kubernetes-int-or-string: true |
| 937 | type: array |
| 938 | notSelector: |
| 939 | description: NotSelector is the negated version of the Selector |
| 940 | field. See Selector field for subtleties with negated |
| 941 | selectors. |
| 942 | type: string |
| 943 | ports: |
| 944 | description: "Ports is an optional field that restricts |
| 945 | the rule to only apply to traffic that has a source (destination) |
| 946 | port that matches one of these ranges/values. This value |
| 947 | is a list of integers or strings that represent ranges |
| 948 | of ports. \n Since only some protocols have ports, if |
| 949 | any ports are specified it requires the Protocol match |
| 950 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 951 | items: |
| 952 | anyOf: |
| 953 | - type: integer |
| 954 | - type: string |
| 955 | pattern: ^.* |
| 956 | x-kubernetes-int-or-string: true |
| 957 | type: array |
| 958 | selector: |
| 959 | description: "Selector is an optional field that contains |
| 960 | a selector expression (see Policy for sample syntax). |
| 961 | \ Only traffic that originates from (terminates at) endpoints |
| 962 | matching the selector will be matched. \n Note that: in |
| 963 | addition to the negated version of the Selector (see NotSelector |
| 964 | below), the selector expression syntax itself supports |
| 965 | negation. The two types of negation are subtly different. |
| 966 | One negates the set of matched endpoints, the other negates |
| 967 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 968 | packets that are from other Calico-controlled \tendpoints |
| 969 | that do not have the label “my_label”. \n \tNotSelector |
| 970 | = \"has(my_label)\" matches packets that are not from |
| 971 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 972 | \n The effect is that the latter will accept packets from |
| 973 | non-Calico sources whereas the former is limited to packets |
| 974 | from Calico-controlled endpoints." |
| 975 | type: string |
| 976 | serviceAccounts: |
| 977 | description: ServiceAccounts is an optional field that restricts |
| 978 | the rule to only apply to traffic that originates from |
| 979 | (or terminates at) a pod running as a matching service |
| 980 | account. |
| 981 | properties: |
| 982 | names: |
| 983 | description: Names is an optional field that restricts |
| 984 | the rule to only apply to traffic that originates |
| 985 | from (or terminates at) a pod running as a service |
| 986 | account whose name is in the list. |
| 987 | items: |
| 988 | type: string |
| 989 | type: array |
| 990 | selector: |
| 991 | description: Selector is an optional field that restricts |
| 992 | the rule to only apply to traffic that originates |
| 993 | from (or terminates at) a pod running as a service |
| 994 | account that matches the given label selector. If |
| 995 | both Names and Selector are specified then they are |
| 996 | AND'ed. |
| 997 | type: string |
| 998 | type: object |
| 999 | type: object |
| 1000 | http: |
| 1001 | description: HTTP contains match criteria that apply to HTTP |
| 1002 | requests. |
| 1003 | properties: |
| 1004 | methods: |
| 1005 | description: Methods is an optional field that restricts |
| 1006 | the rule to apply only to HTTP requests that use one of |
| 1007 | the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple |
| 1008 | methods are OR'd together. |
| 1009 | items: |
| 1010 | type: string |
| 1011 | type: array |
| 1012 | paths: |
| 1013 | description: 'Paths is an optional field that restricts |
| 1014 | the rule to apply to HTTP requests that use one of the |
| 1015 | listed HTTP Paths. Multiple paths are OR''d together. |
| 1016 | e.g: - exact: /foo - prefix: /bar NOTE: Each entry may |
| 1017 | ONLY specify either a `exact` or a `prefix` match. The |
| 1018 | validator will check for it.' |
| 1019 | items: |
| 1020 | description: 'HTTPPath specifies an HTTP path to match. |
| 1021 | It may be either of the form: exact: <path>: which matches |
| 1022 | the path exactly or prefix: <path-prefix>: which matches |
| 1023 | the path prefix' |
| 1024 | properties: |
| 1025 | exact: |
| 1026 | type: string |
| 1027 | prefix: |
| 1028 | type: string |
| 1029 | type: object |
| 1030 | type: array |
| 1031 | type: object |
| 1032 | icmp: |
| 1033 | description: ICMP is an optional field that restricts the rule |
| 1034 | to apply to a specific type and code of ICMP traffic. This |
| 1035 | should only be specified if the Protocol field is set to "ICMP" |
| 1036 | or "ICMPv6". |
| 1037 | properties: |
| 1038 | code: |
| 1039 | description: Match on a specific ICMP code. If specified, |
| 1040 | the Type value must also be specified. This is a technical |
| 1041 | limitation imposed by the kernel’s iptables firewall, |
| 1042 | which Calico uses to enforce the rule. |
| 1043 | type: integer |
| 1044 | type: |
| 1045 | description: Match on a specific ICMP type. For example |
| 1046 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 1047 | type: integer |
| 1048 | type: object |
| 1049 | ipVersion: |
| 1050 | description: IPVersion is an optional field that restricts the |
| 1051 | rule to only match a specific IP version. |
| 1052 | type: integer |
| 1053 | metadata: |
| 1054 | description: Metadata contains additional information for this |
| 1055 | rule |
| 1056 | properties: |
| 1057 | annotations: |
| 1058 | additionalProperties: |
| 1059 | type: string |
| 1060 | description: Annotations is a set of key value pairs that |
| 1061 | give extra information about the rule |
| 1062 | type: object |
| 1063 | type: object |
| 1064 | notICMP: |
| 1065 | description: NotICMP is the negated version of the ICMP field. |
| 1066 | properties: |
| 1067 | code: |
| 1068 | description: Match on a specific ICMP code. If specified, |
| 1069 | the Type value must also be specified. This is a technical |
| 1070 | limitation imposed by the kernel’s iptables firewall, |
| 1071 | which Calico uses to enforce the rule. |
| 1072 | type: integer |
| 1073 | type: |
| 1074 | description: Match on a specific ICMP type. For example |
| 1075 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 1076 | type: integer |
| 1077 | type: object |
| 1078 | notProtocol: |
| 1079 | anyOf: |
| 1080 | - type: integer |
| 1081 | - type: string |
| 1082 | description: NotProtocol is the negated version of the Protocol |
| 1083 | field. |
| 1084 | pattern: ^.* |
| 1085 | x-kubernetes-int-or-string: true |
| 1086 | protocol: |
| 1087 | anyOf: |
| 1088 | - type: integer |
| 1089 | - type: string |
| 1090 | description: "Protocol is an optional field that restricts the |
| 1091 | rule to only apply to traffic of a specific IP protocol. Required |
| 1092 | if any of the EntityRules contain Ports (because ports only |
| 1093 | apply to certain protocols). \n Must be one of these string |
| 1094 | values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", |
| 1095 | \"UDPLite\" or an integer in the range 1-255." |
| 1096 | pattern: ^.* |
| 1097 | x-kubernetes-int-or-string: true |
| 1098 | source: |
| 1099 | description: Source contains the match criteria that apply to |
| 1100 | source entity. |
| 1101 | properties: |
| 1102 | namespaceSelector: |
| 1103 | description: "NamespaceSelector is an optional field that |
| 1104 | contains a selector expression. Only traffic that originates |
| 1105 | from (or terminates at) endpoints within the selected |
| 1106 | namespaces will be matched. When both NamespaceSelector |
| 1107 | and Selector are defined on the same rule, then only workload |
| 1108 | endpoints that are matched by both selectors will be selected |
| 1109 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 1110 | implies that the Selector is limited to selecting only |
| 1111 | workload endpoints in the same namespace as the NetworkPolicy. |
| 1112 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 1113 | that the Selector is limited to selecting only GlobalNetworkSet |
| 1114 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 1115 | NamespaceSelector implies the Selector applies to workload |
| 1116 | endpoints across all namespaces." |
| 1117 | type: string |
| 1118 | nets: |
| 1119 | description: Nets is an optional field that restricts the |
| 1120 | rule to only apply to traffic that originates from (or |
| 1121 | terminates at) IP addresses in any of the given subnets. |
| 1122 | items: |
| 1123 | type: string |
| 1124 | type: array |
| 1125 | notNets: |
| 1126 | description: NotNets is the negated version of the Nets |
| 1127 | field. |
| 1128 | items: |
| 1129 | type: string |
| 1130 | type: array |
| 1131 | notPorts: |
| 1132 | description: NotPorts is the negated version of the Ports |
| 1133 | field. Since only some protocols have ports, if any ports |
| 1134 | are specified it requires the Protocol match in the Rule |
| 1135 | to be set to "TCP" or "UDP". |
| 1136 | items: |
| 1137 | anyOf: |
| 1138 | - type: integer |
| 1139 | - type: string |
| 1140 | pattern: ^.* |
| 1141 | x-kubernetes-int-or-string: true |
| 1142 | type: array |
| 1143 | notSelector: |
| 1144 | description: NotSelector is the negated version of the Selector |
| 1145 | field. See Selector field for subtleties with negated |
| 1146 | selectors. |
| 1147 | type: string |
| 1148 | ports: |
| 1149 | description: "Ports is an optional field that restricts |
| 1150 | the rule to only apply to traffic that has a source (destination) |
| 1151 | port that matches one of these ranges/values. This value |
| 1152 | is a list of integers or strings that represent ranges |
| 1153 | of ports. \n Since only some protocols have ports, if |
| 1154 | any ports are specified it requires the Protocol match |
| 1155 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 1156 | items: |
| 1157 | anyOf: |
| 1158 | - type: integer |
| 1159 | - type: string |
| 1160 | pattern: ^.* |
| 1161 | x-kubernetes-int-or-string: true |
| 1162 | type: array |
| 1163 | selector: |
| 1164 | description: "Selector is an optional field that contains |
| 1165 | a selector expression (see Policy for sample syntax). |
| 1166 | \ Only traffic that originates from (terminates at) endpoints |
| 1167 | matching the selector will be matched. \n Note that: in |
| 1168 | addition to the negated version of the Selector (see NotSelector |
| 1169 | below), the selector expression syntax itself supports |
| 1170 | negation. The two types of negation are subtly different. |
| 1171 | One negates the set of matched endpoints, the other negates |
| 1172 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 1173 | packets that are from other Calico-controlled \tendpoints |
| 1174 | that do not have the label “my_label”. \n \tNotSelector |
| 1175 | = \"has(my_label)\" matches packets that are not from |
| 1176 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 1177 | \n The effect is that the latter will accept packets from |
| 1178 | non-Calico sources whereas the former is limited to packets |
| 1179 | from Calico-controlled endpoints." |
| 1180 | type: string |
| 1181 | serviceAccounts: |
| 1182 | description: ServiceAccounts is an optional field that restricts |
| 1183 | the rule to only apply to traffic that originates from |
| 1184 | (or terminates at) a pod running as a matching service |
| 1185 | account. |
| 1186 | properties: |
| 1187 | names: |
| 1188 | description: Names is an optional field that restricts |
| 1189 | the rule to only apply to traffic that originates |
| 1190 | from (or terminates at) a pod running as a service |
| 1191 | account whose name is in the list. |
| 1192 | items: |
| 1193 | type: string |
| 1194 | type: array |
| 1195 | selector: |
| 1196 | description: Selector is an optional field that restricts |
| 1197 | the rule to only apply to traffic that originates |
| 1198 | from (or terminates at) a pod running as a service |
| 1199 | account that matches the given label selector. If |
| 1200 | both Names and Selector are specified then they are |
| 1201 | AND'ed. |
| 1202 | type: string |
| 1203 | type: object |
| 1204 | type: object |
| 1205 | required: |
| 1206 | - action |
| 1207 | type: object |
| 1208 | type: array |
| 1209 | ingress: |
| 1210 | description: The ordered set of ingress rules. Each rule contains |
| 1211 | a set of packet match criteria and a corresponding action to apply. |
| 1212 | items: |
| 1213 | description: "A Rule encapsulates a set of match criteria and an |
| 1214 | action. Both selector-based security Policy and security Profiles |
| 1215 | reference rules - separated out as a list of rules for both ingress |
| 1216 | and egress packet matching. \n Each positive match criteria has |
| 1217 | a negated version, prefixed with ”Not”. All the match criteria |
| 1218 | within a rule must be satisfied for a packet to match. A single |
| 1219 | rule can contain the positive and negative version of a match |
| 1220 | and both must be satisfied for the rule to match." |
| 1221 | properties: |
| 1222 | action: |
| 1223 | type: string |
| 1224 | destination: |
| 1225 | description: Destination contains the match criteria that apply |
| 1226 | to destination entity. |
| 1227 | properties: |
| 1228 | namespaceSelector: |
| 1229 | description: "NamespaceSelector is an optional field that |
| 1230 | contains a selector expression. Only traffic that originates |
| 1231 | from (or terminates at) endpoints within the selected |
| 1232 | namespaces will be matched. When both NamespaceSelector |
| 1233 | and Selector are defined on the same rule, then only workload |
| 1234 | endpoints that are matched by both selectors will be selected |
| 1235 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 1236 | implies that the Selector is limited to selecting only |
| 1237 | workload endpoints in the same namespace as the NetworkPolicy. |
| 1238 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 1239 | that the Selector is limited to selecting only GlobalNetworkSet |
| 1240 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 1241 | NamespaceSelector implies the Selector applies to workload |
| 1242 | endpoints across all namespaces." |
| 1243 | type: string |
| 1244 | nets: |
| 1245 | description: Nets is an optional field that restricts the |
| 1246 | rule to only apply to traffic that originates from (or |
| 1247 | terminates at) IP addresses in any of the given subnets. |
| 1248 | items: |
| 1249 | type: string |
| 1250 | type: array |
| 1251 | notNets: |
| 1252 | description: NotNets is the negated version of the Nets |
| 1253 | field. |
| 1254 | items: |
| 1255 | type: string |
| 1256 | type: array |
| 1257 | notPorts: |
| 1258 | description: NotPorts is the negated version of the Ports |
| 1259 | field. Since only some protocols have ports, if any ports |
| 1260 | are specified it requires the Protocol match in the Rule |
| 1261 | to be set to "TCP" or "UDP". |
| 1262 | items: |
| 1263 | anyOf: |
| 1264 | - type: integer |
| 1265 | - type: string |
| 1266 | pattern: ^.* |
| 1267 | x-kubernetes-int-or-string: true |
| 1268 | type: array |
| 1269 | notSelector: |
| 1270 | description: NotSelector is the negated version of the Selector |
| 1271 | field. See Selector field for subtleties with negated |
| 1272 | selectors. |
| 1273 | type: string |
| 1274 | ports: |
| 1275 | description: "Ports is an optional field that restricts |
| 1276 | the rule to only apply to traffic that has a source (destination) |
| 1277 | port that matches one of these ranges/values. This value |
| 1278 | is a list of integers or strings that represent ranges |
| 1279 | of ports. \n Since only some protocols have ports, if |
| 1280 | any ports are specified it requires the Protocol match |
| 1281 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 1282 | items: |
| 1283 | anyOf: |
| 1284 | - type: integer |
| 1285 | - type: string |
| 1286 | pattern: ^.* |
| 1287 | x-kubernetes-int-or-string: true |
| 1288 | type: array |
| 1289 | selector: |
| 1290 | description: "Selector is an optional field that contains |
| 1291 | a selector expression (see Policy for sample syntax). |
| 1292 | \ Only traffic that originates from (terminates at) endpoints |
| 1293 | matching the selector will be matched. \n Note that: in |
| 1294 | addition to the negated version of the Selector (see NotSelector |
| 1295 | below), the selector expression syntax itself supports |
| 1296 | negation. The two types of negation are subtly different. |
| 1297 | One negates the set of matched endpoints, the other negates |
| 1298 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 1299 | packets that are from other Calico-controlled \tendpoints |
| 1300 | that do not have the label “my_label”. \n \tNotSelector |
| 1301 | = \"has(my_label)\" matches packets that are not from |
| 1302 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 1303 | \n The effect is that the latter will accept packets from |
| 1304 | non-Calico sources whereas the former is limited to packets |
| 1305 | from Calico-controlled endpoints." |
| 1306 | type: string |
| 1307 | serviceAccounts: |
| 1308 | description: ServiceAccounts is an optional field that restricts |
| 1309 | the rule to only apply to traffic that originates from |
| 1310 | (or terminates at) a pod running as a matching service |
| 1311 | account. |
| 1312 | properties: |
| 1313 | names: |
| 1314 | description: Names is an optional field that restricts |
| 1315 | the rule to only apply to traffic that originates |
| 1316 | from (or terminates at) a pod running as a service |
| 1317 | account whose name is in the list. |
| 1318 | items: |
| 1319 | type: string |
| 1320 | type: array |
| 1321 | selector: |
| 1322 | description: Selector is an optional field that restricts |
| 1323 | the rule to only apply to traffic that originates |
| 1324 | from (or terminates at) a pod running as a service |
| 1325 | account that matches the given label selector. If |
| 1326 | both Names and Selector are specified then they are |
| 1327 | AND'ed. |
| 1328 | type: string |
| 1329 | type: object |
| 1330 | type: object |
| 1331 | http: |
| 1332 | description: HTTP contains match criteria that apply to HTTP |
| 1333 | requests. |
| 1334 | properties: |
| 1335 | methods: |
| 1336 | description: Methods is an optional field that restricts |
| 1337 | the rule to apply only to HTTP requests that use one of |
| 1338 | the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple |
| 1339 | methods are OR'd together. |
| 1340 | items: |
| 1341 | type: string |
| 1342 | type: array |
| 1343 | paths: |
| 1344 | description: 'Paths is an optional field that restricts |
| 1345 | the rule to apply to HTTP requests that use one of the |
| 1346 | listed HTTP Paths. Multiple paths are OR''d together. |
| 1347 | e.g: - exact: /foo - prefix: /bar NOTE: Each entry may |
| 1348 | ONLY specify either a `exact` or a `prefix` match. The |
| 1349 | validator will check for it.' |
| 1350 | items: |
| 1351 | description: 'HTTPPath specifies an HTTP path to match. |
| 1352 | It may be either of the form: exact: <path>: which matches |
| 1353 | the path exactly or prefix: <path-prefix>: which matches |
| 1354 | the path prefix' |
| 1355 | properties: |
| 1356 | exact: |
| 1357 | type: string |
| 1358 | prefix: |
| 1359 | type: string |
| 1360 | type: object |
| 1361 | type: array |
| 1362 | type: object |
| 1363 | icmp: |
| 1364 | description: ICMP is an optional field that restricts the rule |
| 1365 | to apply to a specific type and code of ICMP traffic. This |
| 1366 | should only be specified if the Protocol field is set to "ICMP" |
| 1367 | or "ICMPv6". |
| 1368 | properties: |
| 1369 | code: |
| 1370 | description: Match on a specific ICMP code. If specified, |
| 1371 | the Type value must also be specified. This is a technical |
| 1372 | limitation imposed by the kernel’s iptables firewall, |
| 1373 | which Calico uses to enforce the rule. |
| 1374 | type: integer |
| 1375 | type: |
| 1376 | description: Match on a specific ICMP type. For example |
| 1377 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 1378 | type: integer |
| 1379 | type: object |
| 1380 | ipVersion: |
| 1381 | description: IPVersion is an optional field that restricts the |
| 1382 | rule to only match a specific IP version. |
| 1383 | type: integer |
| 1384 | metadata: |
| 1385 | description: Metadata contains additional information for this |
| 1386 | rule |
| 1387 | properties: |
| 1388 | annotations: |
| 1389 | additionalProperties: |
| 1390 | type: string |
| 1391 | description: Annotations is a set of key value pairs that |
| 1392 | give extra information about the rule |
| 1393 | type: object |
| 1394 | type: object |
| 1395 | notICMP: |
| 1396 | description: NotICMP is the negated version of the ICMP field. |
| 1397 | properties: |
| 1398 | code: |
| 1399 | description: Match on a specific ICMP code. If specified, |
| 1400 | the Type value must also be specified. This is a technical |
| 1401 | limitation imposed by the kernel’s iptables firewall, |
| 1402 | which Calico uses to enforce the rule. |
| 1403 | type: integer |
| 1404 | type: |
| 1405 | description: Match on a specific ICMP type. For example |
| 1406 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 1407 | type: integer |
| 1408 | type: object |
| 1409 | notProtocol: |
| 1410 | anyOf: |
| 1411 | - type: integer |
| 1412 | - type: string |
| 1413 | description: NotProtocol is the negated version of the Protocol |
| 1414 | field. |
| 1415 | pattern: ^.* |
| 1416 | x-kubernetes-int-or-string: true |
| 1417 | protocol: |
| 1418 | anyOf: |
| 1419 | - type: integer |
| 1420 | - type: string |
| 1421 | description: "Protocol is an optional field that restricts the |
| 1422 | rule to only apply to traffic of a specific IP protocol. Required |
| 1423 | if any of the EntityRules contain Ports (because ports only |
| 1424 | apply to certain protocols). \n Must be one of these string |
| 1425 | values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", |
| 1426 | \"UDPLite\" or an integer in the range 1-255." |
| 1427 | pattern: ^.* |
| 1428 | x-kubernetes-int-or-string: true |
| 1429 | source: |
| 1430 | description: Source contains the match criteria that apply to |
| 1431 | source entity. |
| 1432 | properties: |
| 1433 | namespaceSelector: |
| 1434 | description: "NamespaceSelector is an optional field that |
| 1435 | contains a selector expression. Only traffic that originates |
| 1436 | from (or terminates at) endpoints within the selected |
| 1437 | namespaces will be matched. When both NamespaceSelector |
| 1438 | and Selector are defined on the same rule, then only workload |
| 1439 | endpoints that are matched by both selectors will be selected |
| 1440 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 1441 | implies that the Selector is limited to selecting only |
| 1442 | workload endpoints in the same namespace as the NetworkPolicy. |
| 1443 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 1444 | that the Selector is limited to selecting only GlobalNetworkSet |
| 1445 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 1446 | NamespaceSelector implies the Selector applies to workload |
| 1447 | endpoints across all namespaces." |
| 1448 | type: string |
| 1449 | nets: |
| 1450 | description: Nets is an optional field that restricts the |
| 1451 | rule to only apply to traffic that originates from (or |
| 1452 | terminates at) IP addresses in any of the given subnets. |
| 1453 | items: |
| 1454 | type: string |
| 1455 | type: array |
| 1456 | notNets: |
| 1457 | description: NotNets is the negated version of the Nets |
| 1458 | field. |
| 1459 | items: |
| 1460 | type: string |
| 1461 | type: array |
| 1462 | notPorts: |
| 1463 | description: NotPorts is the negated version of the Ports |
| 1464 | field. Since only some protocols have ports, if any ports |
| 1465 | are specified it requires the Protocol match in the Rule |
| 1466 | to be set to "TCP" or "UDP". |
| 1467 | items: |
| 1468 | anyOf: |
| 1469 | - type: integer |
| 1470 | - type: string |
| 1471 | pattern: ^.* |
| 1472 | x-kubernetes-int-or-string: true |
| 1473 | type: array |
| 1474 | notSelector: |
| 1475 | description: NotSelector is the negated version of the Selector |
| 1476 | field. See Selector field for subtleties with negated |
| 1477 | selectors. |
| 1478 | type: string |
| 1479 | ports: |
| 1480 | description: "Ports is an optional field that restricts |
| 1481 | the rule to only apply to traffic that has a source (destination) |
| 1482 | port that matches one of these ranges/values. This value |
| 1483 | is a list of integers or strings that represent ranges |
| 1484 | of ports. \n Since only some protocols have ports, if |
| 1485 | any ports are specified it requires the Protocol match |
| 1486 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 1487 | items: |
| 1488 | anyOf: |
| 1489 | - type: integer |
| 1490 | - type: string |
| 1491 | pattern: ^.* |
| 1492 | x-kubernetes-int-or-string: true |
| 1493 | type: array |
| 1494 | selector: |
| 1495 | description: "Selector is an optional field that contains |
| 1496 | a selector expression (see Policy for sample syntax). |
| 1497 | \ Only traffic that originates from (terminates at) endpoints |
| 1498 | matching the selector will be matched. \n Note that: in |
| 1499 | addition to the negated version of the Selector (see NotSelector |
| 1500 | below), the selector expression syntax itself supports |
| 1501 | negation. The two types of negation are subtly different. |
| 1502 | One negates the set of matched endpoints, the other negates |
| 1503 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 1504 | packets that are from other Calico-controlled \tendpoints |
| 1505 | that do not have the label “my_label”. \n \tNotSelector |
| 1506 | = \"has(my_label)\" matches packets that are not from |
| 1507 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 1508 | \n The effect is that the latter will accept packets from |
| 1509 | non-Calico sources whereas the former is limited to packets |
| 1510 | from Calico-controlled endpoints." |
| 1511 | type: string |
| 1512 | serviceAccounts: |
| 1513 | description: ServiceAccounts is an optional field that restricts |
| 1514 | the rule to only apply to traffic that originates from |
| 1515 | (or terminates at) a pod running as a matching service |
| 1516 | account. |
| 1517 | properties: |
| 1518 | names: |
| 1519 | description: Names is an optional field that restricts |
| 1520 | the rule to only apply to traffic that originates |
| 1521 | from (or terminates at) a pod running as a service |
| 1522 | account whose name is in the list. |
| 1523 | items: |
| 1524 | type: string |
| 1525 | type: array |
| 1526 | selector: |
| 1527 | description: Selector is an optional field that restricts |
| 1528 | the rule to only apply to traffic that originates |
| 1529 | from (or terminates at) a pod running as a service |
| 1530 | account that matches the given label selector. If |
| 1531 | both Names and Selector are specified then they are |
| 1532 | AND'ed. |
| 1533 | type: string |
| 1534 | type: object |
| 1535 | type: object |
| 1536 | required: |
| 1537 | - action |
| 1538 | type: object |
| 1539 | type: array |
| 1540 | namespaceSelector: |
| 1541 | description: NamespaceSelector is an optional field for an expression |
| 1542 | used to select a pod based on namespaces. |
| 1543 | type: string |
| 1544 | order: |
| 1545 | description: Order is an optional field that specifies the order in |
| 1546 | which the policy is applied. Policies with higher "order" are applied |
| 1547 | after those with lower order. If the order is omitted, it may be |
| 1548 | considered to be "infinite" - i.e. the policy will be applied last. Policies |
| 1549 | with identical order will be applied in alphanumerical order based |
| 1550 | on the Policy "Name". |
| 1551 | type: number |
| 1552 | preDNAT: |
| 1553 | description: PreDNAT indicates to apply the rules in this policy before |
| 1554 | any DNAT. |
| 1555 | type: boolean |
| 1556 | selector: |
| 1557 | description: "The selector is an expression used to pick pick out |
| 1558 | the endpoints that the policy should be applied to. \n Selector |
| 1559 | expressions follow this syntax: \n \tlabel == \"string_literal\" |
| 1560 | \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" |
| 1561 | \ -> not equal; also matches if label is not present \tlabel in |
| 1562 | { \"a\", \"b\", \"c\", ... } -> true if the value of label X is |
| 1563 | one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", |
| 1564 | ... } -> true if the value of label X is not one of \"a\", \"b\", |
| 1565 | \"c\" \thas(label_name) -> True if that label is present \t! expr |
| 1566 | -> negation of expr \texpr && expr -> Short-circuit and \texpr |
| 1567 | || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() |
| 1568 | or the empty selector -> matches all endpoints. \n Label names are |
| 1569 | allowed to contain alphanumerics, -, _ and /. String literals are |
| 1570 | more permissive but they do not support escape characters. \n Examples |
| 1571 | (with made-up labels): \n \ttype == \"webserver\" && deployment |
| 1572 | == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != |
| 1573 | \"dev\" \t! has(label_name)" |
| 1574 | type: string |
| 1575 | serviceAccountSelector: |
| 1576 | description: ServiceAccountSelector is an optional field for an expression |
| 1577 | used to select a pod based on service accounts. |
| 1578 | type: string |
| 1579 | types: |
| 1580 | description: "Types indicates whether this policy applies to ingress, |
| 1581 | or to egress, or to both. When not explicitly specified (and so |
| 1582 | the value on creation is empty or nil), Calico defaults Types according |
| 1583 | to what Ingress and Egress rules are present in the policy. The |
| 1584 | default is: \n - [ PolicyTypeIngress ], if there are no Egress rules |
| 1585 | (including the case where there are also no Ingress rules) \n |
| 1586 | - [ PolicyTypeEgress ], if there are Egress rules but no Ingress |
| 1587 | rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are |
| 1588 | both Ingress and Egress rules. \n When the policy is read back again, |
| 1589 | Types will always be one of these values, never empty or nil." |
| 1590 | items: |
| 1591 | description: PolicyType enumerates the possible values of the PolicySpec |
| 1592 | Types field. |
| 1593 | type: string |
| 1594 | type: array |
| 1595 | type: object |
| 1596 | type: object |
| 1597 | served: true |
| 1598 | storage: true |
| 1599 | status: |
| 1600 | acceptedNames: |
| 1601 | kind: "" |
| 1602 | plural: "" |
| 1603 | conditions: [] |
| 1604 | storedVersions: [] |
| 1605 | |
| 1606 | --- |
| 1607 | |
| 1608 | --- |
| 1609 | apiVersion: apiextensions.k8s.io/v1 |
| 1610 | kind: CustomResourceDefinition |
| 1611 | metadata: |
| 1612 | annotations: |
| 1613 | controller-gen.kubebuilder.io/version: (devel) |
| 1614 | creationTimestamp: null |
| 1615 | name: globalnetworksets.crd.projectcalico.org |
| 1616 | spec: |
| 1617 | group: crd.projectcalico.org |
| 1618 | names: |
| 1619 | kind: GlobalNetworkSet |
| 1620 | listKind: GlobalNetworkSetList |
| 1621 | plural: globalnetworksets |
| 1622 | singular: globalnetworkset |
| 1623 | scope: Cluster |
| 1624 | versions: |
| 1625 | - name: v1 |
| 1626 | schema: |
| 1627 | openAPIV3Schema: |
| 1628 | description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs |
| 1629 | that share labels to allow rules to refer to them via selectors. The labels |
| 1630 | of GlobalNetworkSet are not namespaced. |
| 1631 | properties: |
| 1632 | apiVersion: |
| 1633 | description: 'APIVersion defines the versioned schema of this representation |
| 1634 | of an object. Servers should convert recognized schemas to the latest |
| 1635 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 1636 | type: string |
| 1637 | kind: |
| 1638 | description: 'Kind is a string value representing the REST resource this |
| 1639 | object represents. Servers may infer this from the endpoint the client |
| 1640 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 1641 | type: string |
| 1642 | metadata: |
| 1643 | type: object |
| 1644 | spec: |
| 1645 | description: GlobalNetworkSetSpec contains the specification for a NetworkSet |
| 1646 | resource. |
| 1647 | properties: |
| 1648 | nets: |
| 1649 | description: The list of IP networks that belong to this set. |
| 1650 | items: |
| 1651 | type: string |
| 1652 | type: array |
| 1653 | type: object |
| 1654 | type: object |
| 1655 | served: true |
| 1656 | storage: true |
| 1657 | status: |
| 1658 | acceptedNames: |
| 1659 | kind: "" |
| 1660 | plural: "" |
| 1661 | conditions: [] |
| 1662 | storedVersions: [] |
| 1663 | |
| 1664 | --- |
| 1665 | |
| 1666 | --- |
| 1667 | apiVersion: apiextensions.k8s.io/v1 |
| 1668 | kind: CustomResourceDefinition |
| 1669 | metadata: |
| 1670 | annotations: |
| 1671 | controller-gen.kubebuilder.io/version: (devel) |
| 1672 | creationTimestamp: null |
| 1673 | name: hostendpoints.crd.projectcalico.org |
| 1674 | spec: |
| 1675 | group: crd.projectcalico.org |
| 1676 | names: |
| 1677 | kind: HostEndpoint |
| 1678 | listKind: HostEndpointList |
| 1679 | plural: hostendpoints |
| 1680 | singular: hostendpoint |
| 1681 | scope: Cluster |
| 1682 | versions: |
| 1683 | - name: v1 |
| 1684 | schema: |
| 1685 | openAPIV3Schema: |
| 1686 | properties: |
| 1687 | apiVersion: |
| 1688 | description: 'APIVersion defines the versioned schema of this representation |
| 1689 | of an object. Servers should convert recognized schemas to the latest |
| 1690 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 1691 | type: string |
| 1692 | kind: |
| 1693 | description: 'Kind is a string value representing the REST resource this |
| 1694 | object represents. Servers may infer this from the endpoint the client |
| 1695 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 1696 | type: string |
| 1697 | metadata: |
| 1698 | type: object |
| 1699 | spec: |
| 1700 | description: HostEndpointSpec contains the specification for a HostEndpoint |
| 1701 | resource. |
| 1702 | properties: |
| 1703 | expectedIPs: |
| 1704 | description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. |
| 1705 | If \"InterfaceName\" is not present, Calico will look for an interface |
| 1706 | matching any of the IPs in the list and apply policy to that. Note: |
| 1707 | \tWhen using the selector match criteria in an ingress or egress |
| 1708 | security Policy \tor Profile, Calico converts the selector into |
| 1709 | a set of IP addresses. For host \tendpoints, the ExpectedIPs field |
| 1710 | is used for that purpose. (If only the interface \tname is specified, |
| 1711 | Calico does not learn the IPs of the interface for use in match |
| 1712 | \tcriteria.)" |
| 1713 | items: |
| 1714 | type: string |
| 1715 | type: array |
| 1716 | interfaceName: |
| 1717 | description: "Either \"*\", or the name of a specific Linux interface |
| 1718 | to apply policy to; or empty. \"*\" indicates that this HostEndpoint |
| 1719 | governs all traffic to, from or through the default network namespace |
| 1720 | of the host named by the \"Node\" field; entering and leaving that |
| 1721 | namespace via any interface, including those from/to non-host-networked |
| 1722 | local workloads. \n If InterfaceName is not \"*\", this HostEndpoint |
| 1723 | only governs traffic that enters or leaves the host through the |
| 1724 | specific interface named by InterfaceName, or - when InterfaceName |
| 1725 | is empty - through the specific interface that has one of the IPs |
| 1726 | in ExpectedIPs. Therefore, when InterfaceName is empty, at least |
| 1727 | one expected IP must be specified. Only external interfaces (such |
| 1728 | as “eth0”) are supported here; it isn't possible for a HostEndpoint |
| 1729 | to protect traffic through a specific local workload interface. |
| 1730 | \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; |
| 1731 | initially just pre-DNAT policy. Please check Calico documentation |
| 1732 | for the latest position." |
| 1733 | type: string |
| 1734 | node: |
| 1735 | description: The node name identifying the Calico node instance. |
| 1736 | type: string |
| 1737 | ports: |
| 1738 | description: Ports contains the endpoint's named ports, which may |
| 1739 | be referenced in security policy rules. |
| 1740 | items: |
| 1741 | properties: |
| 1742 | name: |
| 1743 | type: string |
| 1744 | port: |
| 1745 | type: integer |
| 1746 | protocol: |
| 1747 | anyOf: |
| 1748 | - type: integer |
| 1749 | - type: string |
| 1750 | pattern: ^.* |
| 1751 | x-kubernetes-int-or-string: true |
| 1752 | required: |
| 1753 | - name |
| 1754 | - port |
| 1755 | - protocol |
| 1756 | type: object |
| 1757 | type: array |
| 1758 | profiles: |
| 1759 | description: A list of identifiers of security Profile objects that |
| 1760 | apply to this endpoint. Each profile is applied in the order that |
| 1761 | they appear in this list. Profile rules are applied after the selector-based |
| 1762 | security policy. |
| 1763 | items: |
| 1764 | type: string |
| 1765 | type: array |
| 1766 | type: object |
| 1767 | type: object |
| 1768 | served: true |
| 1769 | storage: true |
| 1770 | status: |
| 1771 | acceptedNames: |
| 1772 | kind: "" |
| 1773 | plural: "" |
| 1774 | conditions: [] |
| 1775 | storedVersions: [] |
| 1776 | |
| 1777 | --- |
| 1778 | |
| 1779 | --- |
| 1780 | apiVersion: apiextensions.k8s.io/v1 |
| 1781 | kind: CustomResourceDefinition |
| 1782 | metadata: |
| 1783 | annotations: |
| 1784 | controller-gen.kubebuilder.io/version: (devel) |
| 1785 | creationTimestamp: null |
| 1786 | name: ipamblocks.crd.projectcalico.org |
| 1787 | spec: |
| 1788 | group: crd.projectcalico.org |
| 1789 | names: |
| 1790 | kind: IPAMBlock |
| 1791 | listKind: IPAMBlockList |
| 1792 | plural: ipamblocks |
| 1793 | singular: ipamblock |
| 1794 | scope: Cluster |
| 1795 | versions: |
| 1796 | - name: v1 |
| 1797 | schema: |
| 1798 | openAPIV3Schema: |
| 1799 | properties: |
| 1800 | apiVersion: |
| 1801 | description: 'APIVersion defines the versioned schema of this representation |
| 1802 | of an object. Servers should convert recognized schemas to the latest |
| 1803 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 1804 | type: string |
| 1805 | kind: |
| 1806 | description: 'Kind is a string value representing the REST resource this |
| 1807 | object represents. Servers may infer this from the endpoint the client |
| 1808 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 1809 | type: string |
| 1810 | metadata: |
| 1811 | type: object |
| 1812 | spec: |
| 1813 | description: IPAMBlockSpec contains the specification for an IPAMBlock |
| 1814 | resource. |
| 1815 | properties: |
| 1816 | affinity: |
| 1817 | type: string |
| 1818 | allocations: |
| 1819 | items: |
| 1820 | type: integer |
| 1821 | # TODO: This nullable is manually added in. We should update controller-gen |
| 1822 | # to handle []*int properly itself. |
| 1823 | nullable: true |
| 1824 | type: array |
| 1825 | attributes: |
| 1826 | items: |
| 1827 | properties: |
| 1828 | handle_id: |
| 1829 | type: string |
| 1830 | secondary: |
| 1831 | additionalProperties: |
| 1832 | type: string |
| 1833 | type: object |
| 1834 | type: object |
| 1835 | type: array |
| 1836 | cidr: |
| 1837 | type: string |
| 1838 | deleted: |
| 1839 | type: boolean |
| 1840 | strictAffinity: |
| 1841 | type: boolean |
| 1842 | unallocated: |
| 1843 | items: |
| 1844 | type: integer |
| 1845 | type: array |
| 1846 | required: |
| 1847 | - allocations |
| 1848 | - attributes |
| 1849 | - cidr |
| 1850 | - deleted |
| 1851 | - strictAffinity |
| 1852 | - unallocated |
| 1853 | type: object |
| 1854 | type: object |
| 1855 | served: true |
| 1856 | storage: true |
| 1857 | status: |
| 1858 | acceptedNames: |
| 1859 | kind: "" |
| 1860 | plural: "" |
| 1861 | conditions: [] |
| 1862 | storedVersions: [] |
| 1863 | |
| 1864 | --- |
| 1865 | |
| 1866 | --- |
| 1867 | apiVersion: apiextensions.k8s.io/v1 |
| 1868 | kind: CustomResourceDefinition |
| 1869 | metadata: |
| 1870 | annotations: |
| 1871 | controller-gen.kubebuilder.io/version: (devel) |
| 1872 | creationTimestamp: null |
| 1873 | name: ipamconfigs.crd.projectcalico.org |
| 1874 | spec: |
| 1875 | group: crd.projectcalico.org |
| 1876 | names: |
| 1877 | kind: IPAMConfig |
| 1878 | listKind: IPAMConfigList |
| 1879 | plural: ipamconfigs |
| 1880 | singular: ipamconfig |
| 1881 | scope: Cluster |
| 1882 | versions: |
| 1883 | - name: v1 |
| 1884 | schema: |
| 1885 | openAPIV3Schema: |
| 1886 | properties: |
| 1887 | apiVersion: |
| 1888 | description: 'APIVersion defines the versioned schema of this representation |
| 1889 | of an object. Servers should convert recognized schemas to the latest |
| 1890 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 1891 | type: string |
| 1892 | kind: |
| 1893 | description: 'Kind is a string value representing the REST resource this |
| 1894 | object represents. Servers may infer this from the endpoint the client |
| 1895 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 1896 | type: string |
| 1897 | metadata: |
| 1898 | type: object |
| 1899 | spec: |
| 1900 | description: IPAMConfigSpec contains the specification for an IPAMConfig |
| 1901 | resource. |
| 1902 | properties: |
| 1903 | autoAllocateBlocks: |
| 1904 | type: boolean |
| 1905 | strictAffinity: |
| 1906 | type: boolean |
| 1907 | required: |
| 1908 | - autoAllocateBlocks |
| 1909 | - strictAffinity |
| 1910 | type: object |
| 1911 | type: object |
| 1912 | served: true |
| 1913 | storage: true |
| 1914 | status: |
| 1915 | acceptedNames: |
| 1916 | kind: "" |
| 1917 | plural: "" |
| 1918 | conditions: [] |
| 1919 | storedVersions: [] |
| 1920 | |
| 1921 | --- |
| 1922 | |
| 1923 | --- |
| 1924 | apiVersion: apiextensions.k8s.io/v1 |
| 1925 | kind: CustomResourceDefinition |
| 1926 | metadata: |
| 1927 | annotations: |
| 1928 | controller-gen.kubebuilder.io/version: (devel) |
| 1929 | creationTimestamp: null |
| 1930 | name: ipamhandles.crd.projectcalico.org |
| 1931 | spec: |
| 1932 | group: crd.projectcalico.org |
| 1933 | names: |
| 1934 | kind: IPAMHandle |
| 1935 | listKind: IPAMHandleList |
| 1936 | plural: ipamhandles |
| 1937 | singular: ipamhandle |
| 1938 | scope: Cluster |
| 1939 | versions: |
| 1940 | - name: v1 |
| 1941 | schema: |
| 1942 | openAPIV3Schema: |
| 1943 | properties: |
| 1944 | apiVersion: |
| 1945 | description: 'APIVersion defines the versioned schema of this representation |
| 1946 | of an object. Servers should convert recognized schemas to the latest |
| 1947 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 1948 | type: string |
| 1949 | kind: |
| 1950 | description: 'Kind is a string value representing the REST resource this |
| 1951 | object represents. Servers may infer this from the endpoint the client |
| 1952 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 1953 | type: string |
| 1954 | metadata: |
| 1955 | type: object |
| 1956 | spec: |
| 1957 | description: IPAMHandleSpec contains the specification for an IPAMHandle |
| 1958 | resource. |
| 1959 | properties: |
| 1960 | block: |
| 1961 | additionalProperties: |
| 1962 | type: integer |
| 1963 | type: object |
| 1964 | handleID: |
| 1965 | type: string |
| 1966 | required: |
| 1967 | - block |
| 1968 | - handleID |
| 1969 | type: object |
| 1970 | type: object |
| 1971 | served: true |
| 1972 | storage: true |
| 1973 | status: |
| 1974 | acceptedNames: |
| 1975 | kind: "" |
| 1976 | plural: "" |
| 1977 | conditions: [] |
| 1978 | storedVersions: [] |
| 1979 | |
| 1980 | --- |
| 1981 | |
| 1982 | --- |
| 1983 | apiVersion: apiextensions.k8s.io/v1 |
| 1984 | kind: CustomResourceDefinition |
| 1985 | metadata: |
| 1986 | annotations: |
| 1987 | controller-gen.kubebuilder.io/version: (devel) |
| 1988 | creationTimestamp: null |
| 1989 | name: ippools.crd.projectcalico.org |
| 1990 | spec: |
| 1991 | group: crd.projectcalico.org |
| 1992 | names: |
| 1993 | kind: IPPool |
| 1994 | listKind: IPPoolList |
| 1995 | plural: ippools |
| 1996 | singular: ippool |
| 1997 | scope: Cluster |
| 1998 | versions: |
| 1999 | - name: v1 |
| 2000 | schema: |
| 2001 | openAPIV3Schema: |
| 2002 | properties: |
| 2003 | apiVersion: |
| 2004 | description: 'APIVersion defines the versioned schema of this representation |
| 2005 | of an object. Servers should convert recognized schemas to the latest |
| 2006 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 2007 | type: string |
| 2008 | kind: |
| 2009 | description: 'Kind is a string value representing the REST resource this |
| 2010 | object represents. Servers may infer this from the endpoint the client |
| 2011 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 2012 | type: string |
| 2013 | metadata: |
| 2014 | type: object |
| 2015 | spec: |
| 2016 | description: IPPoolSpec contains the specification for an IPPool resource. |
| 2017 | properties: |
| 2018 | blockSize: |
| 2019 | description: The block size to use for IP address assignments from |
| 2020 | this pool. Defaults to 26 for IPv4 and 112 for IPv6. |
| 2021 | type: integer |
| 2022 | cidr: |
| 2023 | description: The pool CIDR. |
| 2024 | type: string |
| 2025 | disabled: |
| 2026 | description: When disabled is true, Calico IPAM will not assign addresses |
| 2027 | from this pool. |
| 2028 | type: boolean |
| 2029 | ipip: |
| 2030 | description: 'Deprecated: this field is only used for APIv1 backwards |
| 2031 | compatibility. Setting this field is not allowed, this field is |
| 2032 | for internal use only.' |
| 2033 | properties: |
| 2034 | enabled: |
| 2035 | description: When enabled is true, ipip tunneling will be used |
| 2036 | to deliver packets to destinations within this pool. |
| 2037 | type: boolean |
| 2038 | mode: |
| 2039 | description: The IPIP mode. This can be one of "always" or "cross-subnet". A |
| 2040 | mode of "always" will also use IPIP tunneling for routing to |
| 2041 | destination IP addresses within this pool. A mode of "cross-subnet" |
| 2042 | will only use IPIP tunneling when the destination node is on |
| 2043 | a different subnet to the originating node. The default value |
| 2044 | (if not specified) is "always". |
| 2045 | type: string |
| 2046 | type: object |
| 2047 | ipipMode: |
| 2048 | description: Contains configuration for IPIP tunneling for this pool. |
| 2049 | If not specified, then this is defaulted to "Never" (i.e. IPIP tunelling |
| 2050 | is disabled). |
| 2051 | type: string |
| 2052 | nat-outgoing: |
| 2053 | description: 'Deprecated: this field is only used for APIv1 backwards |
| 2054 | compatibility. Setting this field is not allowed, this field is |
| 2055 | for internal use only.' |
| 2056 | type: boolean |
| 2057 | natOutgoing: |
| 2058 | description: When nat-outgoing is true, packets sent from Calico networked |
| 2059 | containers in this pool to destinations outside of this pool will |
| 2060 | be masqueraded. |
| 2061 | type: boolean |
| 2062 | nodeSelector: |
| 2063 | description: Allows IPPool to allocate for a specific node by label |
| 2064 | selector. |
| 2065 | type: string |
| 2066 | vxlanMode: |
| 2067 | description: Contains configuration for VXLAN tunneling for this pool. |
| 2068 | If not specified, then this is defaulted to "Never" (i.e. VXLAN |
| 2069 | tunelling is disabled). |
| 2070 | type: string |
| 2071 | required: |
| 2072 | - cidr |
| 2073 | type: object |
| 2074 | type: object |
| 2075 | served: true |
| 2076 | storage: true |
| 2077 | status: |
| 2078 | acceptedNames: |
| 2079 | kind: "" |
| 2080 | plural: "" |
| 2081 | conditions: [] |
| 2082 | storedVersions: [] |
| 2083 | |
| 2084 | --- |
| 2085 | |
| 2086 | --- |
| 2087 | apiVersion: apiextensions.k8s.io/v1 |
| 2088 | kind: CustomResourceDefinition |
| 2089 | metadata: |
| 2090 | annotations: |
| 2091 | controller-gen.kubebuilder.io/version: (devel) |
| 2092 | creationTimestamp: null |
| 2093 | name: kubecontrollersconfigurations.crd.projectcalico.org |
| 2094 | spec: |
| 2095 | group: crd.projectcalico.org |
| 2096 | names: |
| 2097 | kind: KubeControllersConfiguration |
| 2098 | listKind: KubeControllersConfigurationList |
| 2099 | plural: kubecontrollersconfigurations |
| 2100 | singular: kubecontrollersconfiguration |
| 2101 | scope: Cluster |
| 2102 | versions: |
| 2103 | - name: v1 |
| 2104 | schema: |
| 2105 | openAPIV3Schema: |
| 2106 | properties: |
| 2107 | apiVersion: |
| 2108 | description: 'APIVersion defines the versioned schema of this representation |
| 2109 | of an object. Servers should convert recognized schemas to the latest |
| 2110 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 2111 | type: string |
| 2112 | kind: |
| 2113 | description: 'Kind is a string value representing the REST resource this |
| 2114 | object represents. Servers may infer this from the endpoint the client |
| 2115 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 2116 | type: string |
| 2117 | metadata: |
| 2118 | type: object |
| 2119 | spec: |
| 2120 | description: KubeControllersConfigurationSpec contains the values of the |
| 2121 | Kubernetes controllers configuration. |
| 2122 | properties: |
| 2123 | controllers: |
| 2124 | description: Controllers enables and configures individual Kubernetes |
| 2125 | controllers |
| 2126 | properties: |
| 2127 | namespace: |
| 2128 | description: Namespace enables and configures the namespace controller. |
| 2129 | Enabled by default, set to nil to disable. |
| 2130 | properties: |
| 2131 | reconcilerPeriod: |
| 2132 | description: 'ReconcilerPeriod is the period to perform reconciliation |
| 2133 | with the Calico datastore. [Default: 5m]' |
| 2134 | type: string |
| 2135 | type: object |
| 2136 | node: |
| 2137 | description: Node enables and configures the node controller. |
| 2138 | Enabled by default, set to nil to disable. |
| 2139 | properties: |
| 2140 | hostEndpoint: |
| 2141 | description: HostEndpoint controls syncing nodes to host endpoints. |
| 2142 | Disabled by default, set to nil to disable. |
| 2143 | properties: |
| 2144 | autoCreate: |
| 2145 | description: 'AutoCreate enables automatic creation of |
| 2146 | host endpoints for every node. [Default: Disabled]' |
| 2147 | type: string |
| 2148 | type: object |
| 2149 | reconcilerPeriod: |
| 2150 | description: 'ReconcilerPeriod is the period to perform reconciliation |
| 2151 | with the Calico datastore. [Default: 5m]' |
| 2152 | type: string |
| 2153 | syncLabels: |
| 2154 | description: 'SyncLabels controls whether to copy Kubernetes |
| 2155 | node labels to Calico nodes. [Default: Enabled]' |
| 2156 | type: string |
| 2157 | type: object |
| 2158 | policy: |
| 2159 | description: Policy enables and configures the policy controller. |
| 2160 | Enabled by default, set to nil to disable. |
| 2161 | properties: |
| 2162 | reconcilerPeriod: |
| 2163 | description: 'ReconcilerPeriod is the period to perform reconciliation |
| 2164 | with the Calico datastore. [Default: 5m]' |
| 2165 | type: string |
| 2166 | type: object |
| 2167 | serviceAccount: |
| 2168 | description: ServiceAccount enables and configures the service |
| 2169 | account controller. Enabled by default, set to nil to disable. |
| 2170 | properties: |
| 2171 | reconcilerPeriod: |
| 2172 | description: 'ReconcilerPeriod is the period to perform reconciliation |
| 2173 | with the Calico datastore. [Default: 5m]' |
| 2174 | type: string |
| 2175 | type: object |
| 2176 | workloadEndpoint: |
| 2177 | description: WorkloadEndpoint enables and configures the workload |
| 2178 | endpoint controller. Enabled by default, set to nil to disable. |
| 2179 | properties: |
| 2180 | reconcilerPeriod: |
| 2181 | description: 'ReconcilerPeriod is the period to perform reconciliation |
| 2182 | with the Calico datastore. [Default: 5m]' |
| 2183 | type: string |
| 2184 | type: object |
| 2185 | type: object |
| 2186 | etcdV3CompactionPeriod: |
| 2187 | description: 'EtcdV3CompactionPeriod is the period between etcdv3 |
| 2188 | compaction requests. Set to 0 to disable. [Default: 10m]' |
| 2189 | type: string |
| 2190 | healthChecks: |
| 2191 | description: 'HealthChecks enables or disables support for health |
| 2192 | checks [Default: Enabled]' |
| 2193 | type: string |
| 2194 | logSeverityScreen: |
| 2195 | description: 'LogSeverityScreen is the log severity above which logs |
| 2196 | are sent to the stdout. [Default: Info]' |
| 2197 | type: string |
| 2198 | required: |
| 2199 | - controllers |
| 2200 | type: object |
| 2201 | status: |
| 2202 | description: KubeControllersConfigurationStatus represents the status |
| 2203 | of the configuration. It's useful for admins to be able to see the actual |
| 2204 | config that was applied, which can be modified by environment variables |
| 2205 | on the kube-controllers process. |
| 2206 | properties: |
| 2207 | environmentVars: |
| 2208 | additionalProperties: |
| 2209 | type: string |
| 2210 | description: EnvironmentVars contains the environment variables on |
| 2211 | the kube-controllers that influenced the RunningConfig. |
| 2212 | type: object |
| 2213 | runningConfig: |
| 2214 | description: RunningConfig contains the effective config that is running |
| 2215 | in the kube-controllers pod, after merging the API resource with |
| 2216 | any environment variables. |
| 2217 | properties: |
| 2218 | controllers: |
| 2219 | description: Controllers enables and configures individual Kubernetes |
| 2220 | controllers |
| 2221 | properties: |
| 2222 | namespace: |
| 2223 | description: Namespace enables and configures the namespace |
| 2224 | controller. Enabled by default, set to nil to disable. |
| 2225 | properties: |
| 2226 | reconcilerPeriod: |
| 2227 | description: 'ReconcilerPeriod is the period to perform |
| 2228 | reconciliation with the Calico datastore. [Default: |
| 2229 | 5m]' |
| 2230 | type: string |
| 2231 | type: object |
| 2232 | node: |
| 2233 | description: Node enables and configures the node controller. |
| 2234 | Enabled by default, set to nil to disable. |
| 2235 | properties: |
| 2236 | hostEndpoint: |
| 2237 | description: HostEndpoint controls syncing nodes to host |
| 2238 | endpoints. Disabled by default, set to nil to disable. |
| 2239 | properties: |
| 2240 | autoCreate: |
| 2241 | description: 'AutoCreate enables automatic creation |
| 2242 | of host endpoints for every node. [Default: Disabled]' |
| 2243 | type: string |
| 2244 | type: object |
| 2245 | reconcilerPeriod: |
| 2246 | description: 'ReconcilerPeriod is the period to perform |
| 2247 | reconciliation with the Calico datastore. [Default: |
| 2248 | 5m]' |
| 2249 | type: string |
| 2250 | syncLabels: |
| 2251 | description: 'SyncLabels controls whether to copy Kubernetes |
| 2252 | node labels to Calico nodes. [Default: Enabled]' |
| 2253 | type: string |
| 2254 | type: object |
| 2255 | policy: |
| 2256 | description: Policy enables and configures the policy controller. |
| 2257 | Enabled by default, set to nil to disable. |
| 2258 | properties: |
| 2259 | reconcilerPeriod: |
| 2260 | description: 'ReconcilerPeriod is the period to perform |
| 2261 | reconciliation with the Calico datastore. [Default: |
| 2262 | 5m]' |
| 2263 | type: string |
| 2264 | type: object |
| 2265 | serviceAccount: |
| 2266 | description: ServiceAccount enables and configures the service |
| 2267 | account controller. Enabled by default, set to nil to disable. |
| 2268 | properties: |
| 2269 | reconcilerPeriod: |
| 2270 | description: 'ReconcilerPeriod is the period to perform |
| 2271 | reconciliation with the Calico datastore. [Default: |
| 2272 | 5m]' |
| 2273 | type: string |
| 2274 | type: object |
| 2275 | workloadEndpoint: |
| 2276 | description: WorkloadEndpoint enables and configures the workload |
| 2277 | endpoint controller. Enabled by default, set to nil to disable. |
| 2278 | properties: |
| 2279 | reconcilerPeriod: |
| 2280 | description: 'ReconcilerPeriod is the period to perform |
| 2281 | reconciliation with the Calico datastore. [Default: |
| 2282 | 5m]' |
| 2283 | type: string |
| 2284 | type: object |
| 2285 | type: object |
| 2286 | etcdV3CompactionPeriod: |
| 2287 | description: 'EtcdV3CompactionPeriod is the period between etcdv3 |
| 2288 | compaction requests. Set to 0 to disable. [Default: 10m]' |
| 2289 | type: string |
| 2290 | healthChecks: |
| 2291 | description: 'HealthChecks enables or disables support for health |
| 2292 | checks [Default: Enabled]' |
| 2293 | type: string |
| 2294 | logSeverityScreen: |
| 2295 | description: 'LogSeverityScreen is the log severity above which |
| 2296 | logs are sent to the stdout. [Default: Info]' |
| 2297 | type: string |
| 2298 | required: |
| 2299 | - controllers |
| 2300 | type: object |
| 2301 | type: object |
| 2302 | type: object |
| 2303 | served: true |
| 2304 | storage: true |
| 2305 | status: |
| 2306 | acceptedNames: |
| 2307 | kind: "" |
| 2308 | plural: "" |
| 2309 | conditions: [] |
| 2310 | storedVersions: [] |
| 2311 | |
| 2312 | --- |
| 2313 | |
| 2314 | --- |
| 2315 | apiVersion: apiextensions.k8s.io/v1 |
| 2316 | kind: CustomResourceDefinition |
| 2317 | metadata: |
| 2318 | annotations: |
| 2319 | controller-gen.kubebuilder.io/version: (devel) |
| 2320 | creationTimestamp: null |
| 2321 | name: networkpolicies.crd.projectcalico.org |
| 2322 | spec: |
| 2323 | group: crd.projectcalico.org |
| 2324 | names: |
| 2325 | kind: NetworkPolicy |
| 2326 | listKind: NetworkPolicyList |
| 2327 | plural: networkpolicies |
| 2328 | singular: networkpolicy |
| 2329 | scope: Namespaced |
| 2330 | versions: |
| 2331 | - name: v1 |
| 2332 | schema: |
| 2333 | openAPIV3Schema: |
| 2334 | properties: |
| 2335 | apiVersion: |
| 2336 | description: 'APIVersion defines the versioned schema of this representation |
| 2337 | of an object. Servers should convert recognized schemas to the latest |
| 2338 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 2339 | type: string |
| 2340 | kind: |
| 2341 | description: 'Kind is a string value representing the REST resource this |
| 2342 | object represents. Servers may infer this from the endpoint the client |
| 2343 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 2344 | type: string |
| 2345 | metadata: |
| 2346 | type: object |
| 2347 | spec: |
| 2348 | properties: |
| 2349 | egress: |
| 2350 | description: The ordered set of egress rules. Each rule contains |
| 2351 | a set of packet match criteria and a corresponding action to apply. |
| 2352 | items: |
| 2353 | description: "A Rule encapsulates a set of match criteria and an |
| 2354 | action. Both selector-based security Policy and security Profiles |
| 2355 | reference rules - separated out as a list of rules for both ingress |
| 2356 | and egress packet matching. \n Each positive match criteria has |
| 2357 | a negated version, prefixed with ”Not”. All the match criteria |
| 2358 | within a rule must be satisfied for a packet to match. A single |
| 2359 | rule can contain the positive and negative version of a match |
| 2360 | and both must be satisfied for the rule to match." |
| 2361 | properties: |
| 2362 | action: |
| 2363 | type: string |
| 2364 | destination: |
| 2365 | description: Destination contains the match criteria that apply |
| 2366 | to destination entity. |
| 2367 | properties: |
| 2368 | namespaceSelector: |
| 2369 | description: "NamespaceSelector is an optional field that |
| 2370 | contains a selector expression. Only traffic that originates |
| 2371 | from (or terminates at) endpoints within the selected |
| 2372 | namespaces will be matched. When both NamespaceSelector |
| 2373 | and Selector are defined on the same rule, then only workload |
| 2374 | endpoints that are matched by both selectors will be selected |
| 2375 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 2376 | implies that the Selector is limited to selecting only |
| 2377 | workload endpoints in the same namespace as the NetworkPolicy. |
| 2378 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 2379 | that the Selector is limited to selecting only GlobalNetworkSet |
| 2380 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 2381 | NamespaceSelector implies the Selector applies to workload |
| 2382 | endpoints across all namespaces." |
| 2383 | type: string |
| 2384 | nets: |
| 2385 | description: Nets is an optional field that restricts the |
| 2386 | rule to only apply to traffic that originates from (or |
| 2387 | terminates at) IP addresses in any of the given subnets. |
| 2388 | items: |
| 2389 | type: string |
| 2390 | type: array |
| 2391 | notNets: |
| 2392 | description: NotNets is the negated version of the Nets |
| 2393 | field. |
| 2394 | items: |
| 2395 | type: string |
| 2396 | type: array |
| 2397 | notPorts: |
| 2398 | description: NotPorts is the negated version of the Ports |
| 2399 | field. Since only some protocols have ports, if any ports |
| 2400 | are specified it requires the Protocol match in the Rule |
| 2401 | to be set to "TCP" or "UDP". |
| 2402 | items: |
| 2403 | anyOf: |
| 2404 | - type: integer |
| 2405 | - type: string |
| 2406 | pattern: ^.* |
| 2407 | x-kubernetes-int-or-string: true |
| 2408 | type: array |
| 2409 | notSelector: |
| 2410 | description: NotSelector is the negated version of the Selector |
| 2411 | field. See Selector field for subtleties with negated |
| 2412 | selectors. |
| 2413 | type: string |
| 2414 | ports: |
| 2415 | description: "Ports is an optional field that restricts |
| 2416 | the rule to only apply to traffic that has a source (destination) |
| 2417 | port that matches one of these ranges/values. This value |
| 2418 | is a list of integers or strings that represent ranges |
| 2419 | of ports. \n Since only some protocols have ports, if |
| 2420 | any ports are specified it requires the Protocol match |
| 2421 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 2422 | items: |
| 2423 | anyOf: |
| 2424 | - type: integer |
| 2425 | - type: string |
| 2426 | pattern: ^.* |
| 2427 | x-kubernetes-int-or-string: true |
| 2428 | type: array |
| 2429 | selector: |
| 2430 | description: "Selector is an optional field that contains |
| 2431 | a selector expression (see Policy for sample syntax). |
| 2432 | \ Only traffic that originates from (terminates at) endpoints |
| 2433 | matching the selector will be matched. \n Note that: in |
| 2434 | addition to the negated version of the Selector (see NotSelector |
| 2435 | below), the selector expression syntax itself supports |
| 2436 | negation. The two types of negation are subtly different. |
| 2437 | One negates the set of matched endpoints, the other negates |
| 2438 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 2439 | packets that are from other Calico-controlled \tendpoints |
| 2440 | that do not have the label “my_label”. \n \tNotSelector |
| 2441 | = \"has(my_label)\" matches packets that are not from |
| 2442 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 2443 | \n The effect is that the latter will accept packets from |
| 2444 | non-Calico sources whereas the former is limited to packets |
| 2445 | from Calico-controlled endpoints." |
| 2446 | type: string |
| 2447 | serviceAccounts: |
| 2448 | description: ServiceAccounts is an optional field that restricts |
| 2449 | the rule to only apply to traffic that originates from |
| 2450 | (or terminates at) a pod running as a matching service |
| 2451 | account. |
| 2452 | properties: |
| 2453 | names: |
| 2454 | description: Names is an optional field that restricts |
| 2455 | the rule to only apply to traffic that originates |
| 2456 | from (or terminates at) a pod running as a service |
| 2457 | account whose name is in the list. |
| 2458 | items: |
| 2459 | type: string |
| 2460 | type: array |
| 2461 | selector: |
| 2462 | description: Selector is an optional field that restricts |
| 2463 | the rule to only apply to traffic that originates |
| 2464 | from (or terminates at) a pod running as a service |
| 2465 | account that matches the given label selector. If |
| 2466 | both Names and Selector are specified then they are |
| 2467 | AND'ed. |
| 2468 | type: string |
| 2469 | type: object |
| 2470 | type: object |
| 2471 | http: |
| 2472 | description: HTTP contains match criteria that apply to HTTP |
| 2473 | requests. |
| 2474 | properties: |
| 2475 | methods: |
| 2476 | description: Methods is an optional field that restricts |
| 2477 | the rule to apply only to HTTP requests that use one of |
| 2478 | the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple |
| 2479 | methods are OR'd together. |
| 2480 | items: |
| 2481 | type: string |
| 2482 | type: array |
| 2483 | paths: |
| 2484 | description: 'Paths is an optional field that restricts |
| 2485 | the rule to apply to HTTP requests that use one of the |
| 2486 | listed HTTP Paths. Multiple paths are OR''d together. |
| 2487 | e.g: - exact: /foo - prefix: /bar NOTE: Each entry may |
| 2488 | ONLY specify either a `exact` or a `prefix` match. The |
| 2489 | validator will check for it.' |
| 2490 | items: |
| 2491 | description: 'HTTPPath specifies an HTTP path to match. |
| 2492 | It may be either of the form: exact: <path>: which matches |
| 2493 | the path exactly or prefix: <path-prefix>: which matches |
| 2494 | the path prefix' |
| 2495 | properties: |
| 2496 | exact: |
| 2497 | type: string |
| 2498 | prefix: |
| 2499 | type: string |
| 2500 | type: object |
| 2501 | type: array |
| 2502 | type: object |
| 2503 | icmp: |
| 2504 | description: ICMP is an optional field that restricts the rule |
| 2505 | to apply to a specific type and code of ICMP traffic. This |
| 2506 | should only be specified if the Protocol field is set to "ICMP" |
| 2507 | or "ICMPv6". |
| 2508 | properties: |
| 2509 | code: |
| 2510 | description: Match on a specific ICMP code. If specified, |
| 2511 | the Type value must also be specified. This is a technical |
| 2512 | limitation imposed by the kernel’s iptables firewall, |
| 2513 | which Calico uses to enforce the rule. |
| 2514 | type: integer |
| 2515 | type: |
| 2516 | description: Match on a specific ICMP type. For example |
| 2517 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 2518 | type: integer |
| 2519 | type: object |
| 2520 | ipVersion: |
| 2521 | description: IPVersion is an optional field that restricts the |
| 2522 | rule to only match a specific IP version. |
| 2523 | type: integer |
| 2524 | metadata: |
| 2525 | description: Metadata contains additional information for this |
| 2526 | rule |
| 2527 | properties: |
| 2528 | annotations: |
| 2529 | additionalProperties: |
| 2530 | type: string |
| 2531 | description: Annotations is a set of key value pairs that |
| 2532 | give extra information about the rule |
| 2533 | type: object |
| 2534 | type: object |
| 2535 | notICMP: |
| 2536 | description: NotICMP is the negated version of the ICMP field. |
| 2537 | properties: |
| 2538 | code: |
| 2539 | description: Match on a specific ICMP code. If specified, |
| 2540 | the Type value must also be specified. This is a technical |
| 2541 | limitation imposed by the kernel’s iptables firewall, |
| 2542 | which Calico uses to enforce the rule. |
| 2543 | type: integer |
| 2544 | type: |
| 2545 | description: Match on a specific ICMP type. For example |
| 2546 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 2547 | type: integer |
| 2548 | type: object |
| 2549 | notProtocol: |
| 2550 | anyOf: |
| 2551 | - type: integer |
| 2552 | - type: string |
| 2553 | description: NotProtocol is the negated version of the Protocol |
| 2554 | field. |
| 2555 | pattern: ^.* |
| 2556 | x-kubernetes-int-or-string: true |
| 2557 | protocol: |
| 2558 | anyOf: |
| 2559 | - type: integer |
| 2560 | - type: string |
| 2561 | description: "Protocol is an optional field that restricts the |
| 2562 | rule to only apply to traffic of a specific IP protocol. Required |
| 2563 | if any of the EntityRules contain Ports (because ports only |
| 2564 | apply to certain protocols). \n Must be one of these string |
| 2565 | values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", |
| 2566 | \"UDPLite\" or an integer in the range 1-255." |
| 2567 | pattern: ^.* |
| 2568 | x-kubernetes-int-or-string: true |
| 2569 | source: |
| 2570 | description: Source contains the match criteria that apply to |
| 2571 | source entity. |
| 2572 | properties: |
| 2573 | namespaceSelector: |
| 2574 | description: "NamespaceSelector is an optional field that |
| 2575 | contains a selector expression. Only traffic that originates |
| 2576 | from (or terminates at) endpoints within the selected |
| 2577 | namespaces will be matched. When both NamespaceSelector |
| 2578 | and Selector are defined on the same rule, then only workload |
| 2579 | endpoints that are matched by both selectors will be selected |
| 2580 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 2581 | implies that the Selector is limited to selecting only |
| 2582 | workload endpoints in the same namespace as the NetworkPolicy. |
| 2583 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 2584 | that the Selector is limited to selecting only GlobalNetworkSet |
| 2585 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 2586 | NamespaceSelector implies the Selector applies to workload |
| 2587 | endpoints across all namespaces." |
| 2588 | type: string |
| 2589 | nets: |
| 2590 | description: Nets is an optional field that restricts the |
| 2591 | rule to only apply to traffic that originates from (or |
| 2592 | terminates at) IP addresses in any of the given subnets. |
| 2593 | items: |
| 2594 | type: string |
| 2595 | type: array |
| 2596 | notNets: |
| 2597 | description: NotNets is the negated version of the Nets |
| 2598 | field. |
| 2599 | items: |
| 2600 | type: string |
| 2601 | type: array |
| 2602 | notPorts: |
| 2603 | description: NotPorts is the negated version of the Ports |
| 2604 | field. Since only some protocols have ports, if any ports |
| 2605 | are specified it requires the Protocol match in the Rule |
| 2606 | to be set to "TCP" or "UDP". |
| 2607 | items: |
| 2608 | anyOf: |
| 2609 | - type: integer |
| 2610 | - type: string |
| 2611 | pattern: ^.* |
| 2612 | x-kubernetes-int-or-string: true |
| 2613 | type: array |
| 2614 | notSelector: |
| 2615 | description: NotSelector is the negated version of the Selector |
| 2616 | field. See Selector field for subtleties with negated |
| 2617 | selectors. |
| 2618 | type: string |
| 2619 | ports: |
| 2620 | description: "Ports is an optional field that restricts |
| 2621 | the rule to only apply to traffic that has a source (destination) |
| 2622 | port that matches one of these ranges/values. This value |
| 2623 | is a list of integers or strings that represent ranges |
| 2624 | of ports. \n Since only some protocols have ports, if |
| 2625 | any ports are specified it requires the Protocol match |
| 2626 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 2627 | items: |
| 2628 | anyOf: |
| 2629 | - type: integer |
| 2630 | - type: string |
| 2631 | pattern: ^.* |
| 2632 | x-kubernetes-int-or-string: true |
| 2633 | type: array |
| 2634 | selector: |
| 2635 | description: "Selector is an optional field that contains |
| 2636 | a selector expression (see Policy for sample syntax). |
| 2637 | \ Only traffic that originates from (terminates at) endpoints |
| 2638 | matching the selector will be matched. \n Note that: in |
| 2639 | addition to the negated version of the Selector (see NotSelector |
| 2640 | below), the selector expression syntax itself supports |
| 2641 | negation. The two types of negation are subtly different. |
| 2642 | One negates the set of matched endpoints, the other negates |
| 2643 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 2644 | packets that are from other Calico-controlled \tendpoints |
| 2645 | that do not have the label “my_label”. \n \tNotSelector |
| 2646 | = \"has(my_label)\" matches packets that are not from |
| 2647 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 2648 | \n The effect is that the latter will accept packets from |
| 2649 | non-Calico sources whereas the former is limited to packets |
| 2650 | from Calico-controlled endpoints." |
| 2651 | type: string |
| 2652 | serviceAccounts: |
| 2653 | description: ServiceAccounts is an optional field that restricts |
| 2654 | the rule to only apply to traffic that originates from |
| 2655 | (or terminates at) a pod running as a matching service |
| 2656 | account. |
| 2657 | properties: |
| 2658 | names: |
| 2659 | description: Names is an optional field that restricts |
| 2660 | the rule to only apply to traffic that originates |
| 2661 | from (or terminates at) a pod running as a service |
| 2662 | account whose name is in the list. |
| 2663 | items: |
| 2664 | type: string |
| 2665 | type: array |
| 2666 | selector: |
| 2667 | description: Selector is an optional field that restricts |
| 2668 | the rule to only apply to traffic that originates |
| 2669 | from (or terminates at) a pod running as a service |
| 2670 | account that matches the given label selector. If |
| 2671 | both Names and Selector are specified then they are |
| 2672 | AND'ed. |
| 2673 | type: string |
| 2674 | type: object |
| 2675 | type: object |
| 2676 | required: |
| 2677 | - action |
| 2678 | type: object |
| 2679 | type: array |
| 2680 | ingress: |
| 2681 | description: The ordered set of ingress rules. Each rule contains |
| 2682 | a set of packet match criteria and a corresponding action to apply. |
| 2683 | items: |
| 2684 | description: "A Rule encapsulates a set of match criteria and an |
| 2685 | action. Both selector-based security Policy and security Profiles |
| 2686 | reference rules - separated out as a list of rules for both ingress |
| 2687 | and egress packet matching. \n Each positive match criteria has |
| 2688 | a negated version, prefixed with ”Not”. All the match criteria |
| 2689 | within a rule must be satisfied for a packet to match. A single |
| 2690 | rule can contain the positive and negative version of a match |
| 2691 | and both must be satisfied for the rule to match." |
| 2692 | properties: |
| 2693 | action: |
| 2694 | type: string |
| 2695 | destination: |
| 2696 | description: Destination contains the match criteria that apply |
| 2697 | to destination entity. |
| 2698 | properties: |
| 2699 | namespaceSelector: |
| 2700 | description: "NamespaceSelector is an optional field that |
| 2701 | contains a selector expression. Only traffic that originates |
| 2702 | from (or terminates at) endpoints within the selected |
| 2703 | namespaces will be matched. When both NamespaceSelector |
| 2704 | and Selector are defined on the same rule, then only workload |
| 2705 | endpoints that are matched by both selectors will be selected |
| 2706 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 2707 | implies that the Selector is limited to selecting only |
| 2708 | workload endpoints in the same namespace as the NetworkPolicy. |
| 2709 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 2710 | that the Selector is limited to selecting only GlobalNetworkSet |
| 2711 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 2712 | NamespaceSelector implies the Selector applies to workload |
| 2713 | endpoints across all namespaces." |
| 2714 | type: string |
| 2715 | nets: |
| 2716 | description: Nets is an optional field that restricts the |
| 2717 | rule to only apply to traffic that originates from (or |
| 2718 | terminates at) IP addresses in any of the given subnets. |
| 2719 | items: |
| 2720 | type: string |
| 2721 | type: array |
| 2722 | notNets: |
| 2723 | description: NotNets is the negated version of the Nets |
| 2724 | field. |
| 2725 | items: |
| 2726 | type: string |
| 2727 | type: array |
| 2728 | notPorts: |
| 2729 | description: NotPorts is the negated version of the Ports |
| 2730 | field. Since only some protocols have ports, if any ports |
| 2731 | are specified it requires the Protocol match in the Rule |
| 2732 | to be set to "TCP" or "UDP". |
| 2733 | items: |
| 2734 | anyOf: |
| 2735 | - type: integer |
| 2736 | - type: string |
| 2737 | pattern: ^.* |
| 2738 | x-kubernetes-int-or-string: true |
| 2739 | type: array |
| 2740 | notSelector: |
| 2741 | description: NotSelector is the negated version of the Selector |
| 2742 | field. See Selector field for subtleties with negated |
| 2743 | selectors. |
| 2744 | type: string |
| 2745 | ports: |
| 2746 | description: "Ports is an optional field that restricts |
| 2747 | the rule to only apply to traffic that has a source (destination) |
| 2748 | port that matches one of these ranges/values. This value |
| 2749 | is a list of integers or strings that represent ranges |
| 2750 | of ports. \n Since only some protocols have ports, if |
| 2751 | any ports are specified it requires the Protocol match |
| 2752 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 2753 | items: |
| 2754 | anyOf: |
| 2755 | - type: integer |
| 2756 | - type: string |
| 2757 | pattern: ^.* |
| 2758 | x-kubernetes-int-or-string: true |
| 2759 | type: array |
| 2760 | selector: |
| 2761 | description: "Selector is an optional field that contains |
| 2762 | a selector expression (see Policy for sample syntax). |
| 2763 | \ Only traffic that originates from (terminates at) endpoints |
| 2764 | matching the selector will be matched. \n Note that: in |
| 2765 | addition to the negated version of the Selector (see NotSelector |
| 2766 | below), the selector expression syntax itself supports |
| 2767 | negation. The two types of negation are subtly different. |
| 2768 | One negates the set of matched endpoints, the other negates |
| 2769 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 2770 | packets that are from other Calico-controlled \tendpoints |
| 2771 | that do not have the label “my_label”. \n \tNotSelector |
| 2772 | = \"has(my_label)\" matches packets that are not from |
| 2773 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 2774 | \n The effect is that the latter will accept packets from |
| 2775 | non-Calico sources whereas the former is limited to packets |
| 2776 | from Calico-controlled endpoints." |
| 2777 | type: string |
| 2778 | serviceAccounts: |
| 2779 | description: ServiceAccounts is an optional field that restricts |
| 2780 | the rule to only apply to traffic that originates from |
| 2781 | (or terminates at) a pod running as a matching service |
| 2782 | account. |
| 2783 | properties: |
| 2784 | names: |
| 2785 | description: Names is an optional field that restricts |
| 2786 | the rule to only apply to traffic that originates |
| 2787 | from (or terminates at) a pod running as a service |
| 2788 | account whose name is in the list. |
| 2789 | items: |
| 2790 | type: string |
| 2791 | type: array |
| 2792 | selector: |
| 2793 | description: Selector is an optional field that restricts |
| 2794 | the rule to only apply to traffic that originates |
| 2795 | from (or terminates at) a pod running as a service |
| 2796 | account that matches the given label selector. If |
| 2797 | both Names and Selector are specified then they are |
| 2798 | AND'ed. |
| 2799 | type: string |
| 2800 | type: object |
| 2801 | type: object |
| 2802 | http: |
| 2803 | description: HTTP contains match criteria that apply to HTTP |
| 2804 | requests. |
| 2805 | properties: |
| 2806 | methods: |
| 2807 | description: Methods is an optional field that restricts |
| 2808 | the rule to apply only to HTTP requests that use one of |
| 2809 | the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple |
| 2810 | methods are OR'd together. |
| 2811 | items: |
| 2812 | type: string |
| 2813 | type: array |
| 2814 | paths: |
| 2815 | description: 'Paths is an optional field that restricts |
| 2816 | the rule to apply to HTTP requests that use one of the |
| 2817 | listed HTTP Paths. Multiple paths are OR''d together. |
| 2818 | e.g: - exact: /foo - prefix: /bar NOTE: Each entry may |
| 2819 | ONLY specify either a `exact` or a `prefix` match. The |
| 2820 | validator will check for it.' |
| 2821 | items: |
| 2822 | description: 'HTTPPath specifies an HTTP path to match. |
| 2823 | It may be either of the form: exact: <path>: which matches |
| 2824 | the path exactly or prefix: <path-prefix>: which matches |
| 2825 | the path prefix' |
| 2826 | properties: |
| 2827 | exact: |
| 2828 | type: string |
| 2829 | prefix: |
| 2830 | type: string |
| 2831 | type: object |
| 2832 | type: array |
| 2833 | type: object |
| 2834 | icmp: |
| 2835 | description: ICMP is an optional field that restricts the rule |
| 2836 | to apply to a specific type and code of ICMP traffic. This |
| 2837 | should only be specified if the Protocol field is set to "ICMP" |
| 2838 | or "ICMPv6". |
| 2839 | properties: |
| 2840 | code: |
| 2841 | description: Match on a specific ICMP code. If specified, |
| 2842 | the Type value must also be specified. This is a technical |
| 2843 | limitation imposed by the kernel’s iptables firewall, |
| 2844 | which Calico uses to enforce the rule. |
| 2845 | type: integer |
| 2846 | type: |
| 2847 | description: Match on a specific ICMP type. For example |
| 2848 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 2849 | type: integer |
| 2850 | type: object |
| 2851 | ipVersion: |
| 2852 | description: IPVersion is an optional field that restricts the |
| 2853 | rule to only match a specific IP version. |
| 2854 | type: integer |
| 2855 | metadata: |
| 2856 | description: Metadata contains additional information for this |
| 2857 | rule |
| 2858 | properties: |
| 2859 | annotations: |
| 2860 | additionalProperties: |
| 2861 | type: string |
| 2862 | description: Annotations is a set of key value pairs that |
| 2863 | give extra information about the rule |
| 2864 | type: object |
| 2865 | type: object |
| 2866 | notICMP: |
| 2867 | description: NotICMP is the negated version of the ICMP field. |
| 2868 | properties: |
| 2869 | code: |
| 2870 | description: Match on a specific ICMP code. If specified, |
| 2871 | the Type value must also be specified. This is a technical |
| 2872 | limitation imposed by the kernel’s iptables firewall, |
| 2873 | which Calico uses to enforce the rule. |
| 2874 | type: integer |
| 2875 | type: |
| 2876 | description: Match on a specific ICMP type. For example |
| 2877 | a value of 8 refers to ICMP Echo Request (i.e. pings). |
| 2878 | type: integer |
| 2879 | type: object |
| 2880 | notProtocol: |
| 2881 | anyOf: |
| 2882 | - type: integer |
| 2883 | - type: string |
| 2884 | description: NotProtocol is the negated version of the Protocol |
| 2885 | field. |
| 2886 | pattern: ^.* |
| 2887 | x-kubernetes-int-or-string: true |
| 2888 | protocol: |
| 2889 | anyOf: |
| 2890 | - type: integer |
| 2891 | - type: string |
| 2892 | description: "Protocol is an optional field that restricts the |
| 2893 | rule to only apply to traffic of a specific IP protocol. Required |
| 2894 | if any of the EntityRules contain Ports (because ports only |
| 2895 | apply to certain protocols). \n Must be one of these string |
| 2896 | values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", |
| 2897 | \"UDPLite\" or an integer in the range 1-255." |
| 2898 | pattern: ^.* |
| 2899 | x-kubernetes-int-or-string: true |
| 2900 | source: |
| 2901 | description: Source contains the match criteria that apply to |
| 2902 | source entity. |
| 2903 | properties: |
| 2904 | namespaceSelector: |
| 2905 | description: "NamespaceSelector is an optional field that |
| 2906 | contains a selector expression. Only traffic that originates |
| 2907 | from (or terminates at) endpoints within the selected |
| 2908 | namespaces will be matched. When both NamespaceSelector |
| 2909 | and Selector are defined on the same rule, then only workload |
| 2910 | endpoints that are matched by both selectors will be selected |
| 2911 | by the rule. \n For NetworkPolicy, an empty NamespaceSelector |
| 2912 | implies that the Selector is limited to selecting only |
| 2913 | workload endpoints in the same namespace as the NetworkPolicy. |
| 2914 | \n For NetworkPolicy, `global()` NamespaceSelector implies |
| 2915 | that the Selector is limited to selecting only GlobalNetworkSet |
| 2916 | or HostEndpoint. \n For GlobalNetworkPolicy, an empty |
| 2917 | NamespaceSelector implies the Selector applies to workload |
| 2918 | endpoints across all namespaces." |
| 2919 | type: string |
| 2920 | nets: |
| 2921 | description: Nets is an optional field that restricts the |
| 2922 | rule to only apply to traffic that originates from (or |
| 2923 | terminates at) IP addresses in any of the given subnets. |
| 2924 | items: |
| 2925 | type: string |
| 2926 | type: array |
| 2927 | notNets: |
| 2928 | description: NotNets is the negated version of the Nets |
| 2929 | field. |
| 2930 | items: |
| 2931 | type: string |
| 2932 | type: array |
| 2933 | notPorts: |
| 2934 | description: NotPorts is the negated version of the Ports |
| 2935 | field. Since only some protocols have ports, if any ports |
| 2936 | are specified it requires the Protocol match in the Rule |
| 2937 | to be set to "TCP" or "UDP". |
| 2938 | items: |
| 2939 | anyOf: |
| 2940 | - type: integer |
| 2941 | - type: string |
| 2942 | pattern: ^.* |
| 2943 | x-kubernetes-int-or-string: true |
| 2944 | type: array |
| 2945 | notSelector: |
| 2946 | description: NotSelector is the negated version of the Selector |
| 2947 | field. See Selector field for subtleties with negated |
| 2948 | selectors. |
| 2949 | type: string |
| 2950 | ports: |
| 2951 | description: "Ports is an optional field that restricts |
| 2952 | the rule to only apply to traffic that has a source (destination) |
| 2953 | port that matches one of these ranges/values. This value |
| 2954 | is a list of integers or strings that represent ranges |
| 2955 | of ports. \n Since only some protocols have ports, if |
| 2956 | any ports are specified it requires the Protocol match |
| 2957 | in the Rule to be set to \"TCP\" or \"UDP\"." |
| 2958 | items: |
| 2959 | anyOf: |
| 2960 | - type: integer |
| 2961 | - type: string |
| 2962 | pattern: ^.* |
| 2963 | x-kubernetes-int-or-string: true |
| 2964 | type: array |
| 2965 | selector: |
| 2966 | description: "Selector is an optional field that contains |
| 2967 | a selector expression (see Policy for sample syntax). |
| 2968 | \ Only traffic that originates from (terminates at) endpoints |
| 2969 | matching the selector will be matched. \n Note that: in |
| 2970 | addition to the negated version of the Selector (see NotSelector |
| 2971 | below), the selector expression syntax itself supports |
| 2972 | negation. The two types of negation are subtly different. |
| 2973 | One negates the set of matched endpoints, the other negates |
| 2974 | the whole match: \n \tSelector = \"!has(my_label)\" matches |
| 2975 | packets that are from other Calico-controlled \tendpoints |
| 2976 | that do not have the label “my_label”. \n \tNotSelector |
| 2977 | = \"has(my_label)\" matches packets that are not from |
| 2978 | Calico-controlled \tendpoints that do have the label “my_label”. |
| 2979 | \n The effect is that the latter will accept packets from |
| 2980 | non-Calico sources whereas the former is limited to packets |
| 2981 | from Calico-controlled endpoints." |
| 2982 | type: string |
| 2983 | serviceAccounts: |
| 2984 | description: ServiceAccounts is an optional field that restricts |
| 2985 | the rule to only apply to traffic that originates from |
| 2986 | (or terminates at) a pod running as a matching service |
| 2987 | account. |
| 2988 | properties: |
| 2989 | names: |
| 2990 | description: Names is an optional field that restricts |
| 2991 | the rule to only apply to traffic that originates |
| 2992 | from (or terminates at) a pod running as a service |
| 2993 | account whose name is in the list. |
| 2994 | items: |
| 2995 | type: string |
| 2996 | type: array |
| 2997 | selector: |
| 2998 | description: Selector is an optional field that restricts |
| 2999 | the rule to only apply to traffic that originates |
| 3000 | from (or terminates at) a pod running as a service |
| 3001 | account that matches the given label selector. If |
| 3002 | both Names and Selector are specified then they are |
| 3003 | AND'ed. |
| 3004 | type: string |
| 3005 | type: object |
| 3006 | type: object |
| 3007 | required: |
| 3008 | - action |
| 3009 | type: object |
| 3010 | type: array |
| 3011 | order: |
| 3012 | description: Order is an optional field that specifies the order in |
| 3013 | which the policy is applied. Policies with higher "order" are applied |
| 3014 | after those with lower order. If the order is omitted, it may be |
| 3015 | considered to be "infinite" - i.e. the policy will be applied last. Policies |
| 3016 | with identical order will be applied in alphanumerical order based |
| 3017 | on the Policy "Name". |
| 3018 | type: number |
| 3019 | selector: |
| 3020 | description: "The selector is an expression used to pick pick out |
| 3021 | the endpoints that the policy should be applied to. \n Selector |
| 3022 | expressions follow this syntax: \n \tlabel == \"string_literal\" |
| 3023 | \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" |
| 3024 | \ -> not equal; also matches if label is not present \tlabel in |
| 3025 | { \"a\", \"b\", \"c\", ... } -> true if the value of label X is |
| 3026 | one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", |
| 3027 | ... } -> true if the value of label X is not one of \"a\", \"b\", |
| 3028 | \"c\" \thas(label_name) -> True if that label is present \t! expr |
| 3029 | -> negation of expr \texpr && expr -> Short-circuit and \texpr |
| 3030 | || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() |
| 3031 | or the empty selector -> matches all endpoints. \n Label names are |
| 3032 | allowed to contain alphanumerics, -, _ and /. String literals are |
| 3033 | more permissive but they do not support escape characters. \n Examples |
| 3034 | (with made-up labels): \n \ttype == \"webserver\" && deployment |
| 3035 | == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != |
| 3036 | \"dev\" \t! has(label_name)" |
| 3037 | type: string |
| 3038 | serviceAccountSelector: |
| 3039 | description: ServiceAccountSelector is an optional field for an expression |
| 3040 | used to select a pod based on service accounts. |
| 3041 | type: string |
| 3042 | types: |
| 3043 | description: "Types indicates whether this policy applies to ingress, |
| 3044 | or to egress, or to both. When not explicitly specified (and so |
| 3045 | the value on creation is empty or nil), Calico defaults Types according |
| 3046 | to what Ingress and Egress are present in the policy. The default |
| 3047 | is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including |
| 3048 | the case where there are also no Ingress rules) \n - [ PolicyTypeEgress |
| 3049 | ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, |
| 3050 | PolicyTypeEgress ], if there are both Ingress and Egress rules. |
| 3051 | \n When the policy is read back again, Types will always be one |
| 3052 | of these values, never empty or nil." |
| 3053 | items: |
| 3054 | description: PolicyType enumerates the possible values of the PolicySpec |
| 3055 | Types field. |
| 3056 | type: string |
| 3057 | type: array |
| 3058 | type: object |
| 3059 | type: object |
| 3060 | served: true |
| 3061 | storage: true |
| 3062 | status: |
| 3063 | acceptedNames: |
| 3064 | kind: "" |
| 3065 | plural: "" |
| 3066 | conditions: [] |
| 3067 | storedVersions: [] |
| 3068 | |
| 3069 | --- |
| 3070 | |
| 3071 | --- |
| 3072 | apiVersion: apiextensions.k8s.io/v1 |
| 3073 | kind: CustomResourceDefinition |
| 3074 | metadata: |
| 3075 | annotations: |
| 3076 | controller-gen.kubebuilder.io/version: (devel) |
| 3077 | creationTimestamp: null |
| 3078 | name: networksets.crd.projectcalico.org |
| 3079 | spec: |
| 3080 | group: crd.projectcalico.org |
| 3081 | names: |
| 3082 | kind: NetworkSet |
| 3083 | listKind: NetworkSetList |
| 3084 | plural: networksets |
| 3085 | singular: networkset |
| 3086 | scope: Namespaced |
| 3087 | versions: |
| 3088 | - name: v1 |
| 3089 | schema: |
| 3090 | openAPIV3Schema: |
| 3091 | description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. |
| 3092 | properties: |
| 3093 | apiVersion: |
| 3094 | description: 'APIVersion defines the versioned schema of this representation |
| 3095 | of an object. Servers should convert recognized schemas to the latest |
| 3096 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' |
| 3097 | type: string |
| 3098 | kind: |
| 3099 | description: 'Kind is a string value representing the REST resource this |
| 3100 | object represents. Servers may infer this from the endpoint the client |
| 3101 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' |
| 3102 | type: string |
| 3103 | metadata: |
| 3104 | type: object |
| 3105 | spec: |
| 3106 | description: NetworkSetSpec contains the specification for a NetworkSet |
| 3107 | resource. |
| 3108 | properties: |
| 3109 | nets: |
| 3110 | description: The list of IP networks that belong to this set. |
| 3111 | items: |
| 3112 | type: string |
| 3113 | type: array |
| 3114 | type: object |
| 3115 | type: object |
| 3116 | served: true |
| 3117 | storage: true |
| 3118 | status: |
| 3119 | acceptedNames: |
| 3120 | kind: "" |
| 3121 | plural: "" |
| 3122 | conditions: [] |
| 3123 | storedVersions: [] |
| 3124 | |
| 3125 | --- |
| 3126 | |