calico网卡未就绪

    https://blog.csdn.net/u011327801/article/details/100579803
    正常：

    [root@master ~]# kubectl get pod -A
    NAMESPACE NAME READY STATUS RESTARTS AGE
    kube-system calico-kube-controllers-77c4b7448-9nrx2 1/1 Running 0 26m
    kube-system calico-node-mc7s7 1/1 Running 0 26m
    kube-system calico-node-p8rm7 1/1 Running 0 21m
    kube-system calico-node-wwtkl 1/1 Running 0 21m
    kube-system coredns-9d85f5447-ht4c4 1/1 Running 0 35m
    kube-system coredns-9d85f5447-wvjlb 1/1 Running 0 35m
    kube-system etcd-master 1/1 Running 0 35m
    kube-system kube-apiserver-master 1/1 Running 0 35m
    kube-system kube-controller-manager-master 1/1 Running 0 35m
    kube-system kube-proxy-hgmjw 1/1 Running 1 21m
    kube-system kube-proxy-skc2k 1/1 Running 1 35m
    kube-system kube-proxy-zsnxv 1/1 Running 1 21m
    kube-system kube-scheduler-master 1/1 Running 0 35m
    [root@master ~]#
    [root@master ~]# ping 192.168.31.91
    PING 192.168.31.91 (192.168.31.91) 56(84) bytes of data.
    64 bytes from 192.168.31.91: icmp_seq=1 ttl=64 time=0.729 ms
    64 bytes from 192.168.31.91: icmp_seq=2 ttl=64 time=0.859 ms
    ^C
    —- 192.168.31.91 ping statistics —-
    2 packets transmitted, 2 received, 0% packet loss, time 1000ms
    rtt min/avg/max/mdev = 0.729/0.794/0.859/0.065 ms
    [root@master ~]# ping 192.168.31.92
    PING 192.168.31.92 (192.168.31.92) 56(84) bytes of data.
    64 bytes from 192.168.31.92: icmp_seq=1 ttl=64 time=0.389 ms
    64 bytes from 192.168.31.92: icmp_seq=2 ttl=64 time=0.932 ms
    64 bytes from 192.168.31.92: icmp_seq=3 ttl=64 time=2.06 ms
    64 bytes from 192.168.31.92: icmp_seq=4 ttl=64 time=0.768 ms
    ^C
    —- 192.168.31.92 ping statistics —-
    4 packets transmitted, 4 received, 0% packet loss, time 3001ms
    rtt min/avg/max/mdev = 0.389/1.038/2.065/0.625 ms
    [root@master ~]# ipvsadm -L
    IP Virtual Server version 1.2.1 (size=4096)
    Prot LocalAddress:Port Scheduler Flags
    -> RemoteAddress:Port Forward Weight ActiveConn InActConn
    TCP master:https rr
    -> master:sun-sr-https Masq 1 5 0
    TCP master:domain rr
    -> 192.168.219.65:domain Masq 1 0 0
    -> 192.168.219.67:domain Masq 1 0 0
    TCP master:9153 rr
    -> 192.168.219.65:9153 Masq 1 0 0
    -> 192.168.219.67:9153 Masq 1 0 0
    UDP master:domain rr
    -> 192.168.219.65:domain Masq 1 0 0
    -> 192.168.219.67:domain Masq 1 0 0
    [root@master ~]#
    [root@master ~]# ip route show
    default via 192.168.31.1 dev eth0 proto static metric 100
    172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
    192.168.31.0/24 dev eth0 proto kernel scope link src 192.168.31.90 metric 100
    192.168.140.64/26 via 192.168.31.92 dev tunl0 proto bird onlink
    192.168.196.128/26 via 192.168.31.91 dev tunl0 proto bird onlink
    blackhole 192.168.219.64/26 proto bird
    192.168.219.65 dev calia1377bfae06 scope link
    192.168.219.66 dev cali3fffe2ec811 scope link
    192.168.219.67 dev cali57bd4ccf5ee scope link
    [root@master ~]# route -n
    Kernel IP routing table
    Destination Gateway Genmask Flags Metric Ref Use Iface
    0.0.0.0 192.168.31.1 0.0.0.0 UG 100 0 0 eth0
    172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
    192.168.31.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
    192.168.140.64 192.168.31.92 255.255.255.192 UG 0 0 0 tunl0
    192.168.196.128 192.168.31.91 255.255.255.192 UG 0 0 0 tunl0
    192.168.219.64 0.0.0.0 255.255.255.192 U 0 0 0 *
    192.168.219.65 0.0.0.0 255.255.255.255 UH 0 0 0 calia1377bfae06
    192.168.219.66 0.0.0.0 255.255.255.255 UH 0 0 0 cali3fffe2ec811
    192.168.219.67 0.0.0.0 255.255.255.255 UH 0 0 0 cali57bd4ccf5ee
    [root@master ~]#

    异常：

    1. [root@master ~]#  kubectl get po -n kube-system
    2. NAME                                      READY   STATUS    RESTARTS   AGE
    3. calico-kube-controllers-77c4b7448-9nrx2   1/1     Running   14         67d
    4. calico-node-mc7s7                         0/1     Running   15         67d
    5. calico-node-p8rm7                         1/1     Running   9          67d
    6. calico-node-wwtkl                         1/1     Running   9          67d
    7. coredns-66bff467f8-2bsdr                  0/1     Running   0          11m
    8. coredns-66bff467f8-5gsjh                  0/1     Running   0          11m
    9. coredns-9d85f5447-wvjlb                   1/1     Running   14         67d
    10. etcd-master                               1/1     Running   6          12d
    11. kube-apiserver-master                     1/1     Running   0          12m
    12. kube-controller-manager-master            1/1     Running   0          12m
    13. kube-proxy-69xfs                          1/1     Running   0          11m
    14. kube-proxy-fxwgp                          1/1     Running   0          11m
    15. kube-proxy-kgfbx                          1/1     Running   0          11m
    16. kube-scheduler-master                     1/1     Running   0          12m
    1. Events:
    2.   Type     Reason     Age                     From             Message
    3.   ----     ------     ----                    ----             -------
    4.   Warning  Unhealthy  13m (x1279 over 3h51m)  kubelet, master  (combined from similar events): Readiness probe failed: calico/node is not ready: BIRD is not ready: BGP not established with 192.168.31.91,192.168.31.922020-04-12 11:59:28.313 [INFO][42895] health.go 156: Number of node(s) with BGP peering established = 0
    1. /*
    2. 调整calicao 网络插件的网卡发现机制，修改IP_AUTODETECTION_METHOD对应的value值。官方提供的yaml文件中，ip识别策略（IPDETECTMETHOD）没有配置，即默认为first-found，这会导致一个网络异常的ip作为nodeIP被注册，从而影响node-to-node mesh。我们可以修改成can-reach或者interface的策略，尝试连接某一个Ready的node的IP，以此选择出正确的IP。
    3. */
    5. // calico.yaml 文件添加以下二行
    6.             - name: IP_AUTODETECTION_METHOD
    7.               value: "interface=ens.*"  # ens 根据实际网卡开头配置
    9.  // 配置如下             
    10.             - name: CLUSTER_TYPE
    11.               value: "k8s,bgp"
    12.             - name: IP_AUTODETECTION_METHOD
    13.               value: "interface=ens.*"
    14.               #或者 value: "interface=ens160"
    15.             # Auto-detect the BGP IP address.
    16.             - name: IP
    17.               value: "autodetect"
    18.             # Enable IPIP
    19.             - name: CALICO_IPV4POOL_IPIP
    20.               value: "Always"
    1. [root@master ~]# kubectl get pod -A
    2. NAMESPACE     NAME                                      READY   STATUS    RESTARTS   AGE
    3. kube-system   calico-kube-controllers-77c4b7448-9nrx2   1/1     Running   14         67d
    4. kube-system   calico-node-dvmcz                         1/1     Running   0          17s
    5. kube-system   calico-node-w6lfn                         1/1     Running   0          30s
    6. kube-system   calico-node-z5db9                         0/1     Running   0          8s
    7. kube-system   coredns-66bff467f8-2bsdr                  0/1     Running   0          17m
    8. kube-system   coredns-66bff467f8-5gsjh                  0/1     Running   0          17m
    9. kube-system   coredns-9d85f5447-wvjlb                   1/1     Running   14         67d
    10. kube-system   etcd-master                               1/1     Running   6          12d
    11. kube-system   kube-apiserver-master                     1/1     Running   0          17m
    12. kube-system   kube-controller-manager-master            1/1     Running   0          17m
    13. kube-system   kube-proxy-69xfs                          1/1     Running   0          16m
    14. kube-system   kube-proxy-fxwgp                          1/1     Running   0          16m
    15. kube-system   kube-proxy-kgfbx                          1/1     Running   0          16m
    16. kube-system   kube-scheduler-master                     1/1     Running   0          17m
    1. ---
    2. # Source: calico/templates/calico-config.yaml
    3. # This ConfigMap is used to configure a self-hosted Calico installation.
    4. kind: ConfigMap
    5. apiVersion: v1
    6. metadata:
    7.   name: calico-config
    8.   namespace: kube-system
    9. data:
    10.   # Typha is disabled.
    11.   typha_service_name: "none"
    12.   # Configure the backend to use.
    13.   calico_backend: "bird"
    15.   # Configure the MTU to use for workload interfaces and tunnels.
    16.   # By default, MTU is auto-detected, and explicitly setting this field should not be required.
    17.   # You can override auto-detection by providing a non-zero value.
    18.   veth_mtu: "0"
    20.   # The CNI network configuration to install on each node. The special
    21.   # values in this config will be automatically populated.
    22.   cni_network_config: |-
    23.     {
    24.       "name": "k8s-pod-network",
    25.       "cniVersion": "0.3.1",
    26.       "plugins": [
    27.         {
    28.           "type": "calico",
    29.           "log_level": "info",
    30.           "log_file_path": "/var/log/calico/cni/cni.log",
    31.           "datastore_type": "kubernetes",
    32.           "nodename": "__KUBERNETES_NODE_NAME__",
    33.           "mtu": __CNI_MTU__,
    34.           "ipam": {
    35.               "type": "calico-ipam"
    36.           },
    37.           "policy": {
    38.               "type": "k8s"
    39.           },
    40.           "kubernetes": {
    41.               "kubeconfig": "__KUBECONFIG_FILEPATH__"
    42.           }
    43.         },
    44.         {
    45.           "type": "portmap",
    46.           "snat": true,
    47.           "capabilities": {"portMappings": true}
    48.         },
    49.         {
    50.           "type": "bandwidth",
    51.           "capabilities": {"bandwidth": true}
    52.         }
    53.       ]
    54.     }
    56. ---
    57. # Source: calico/templates/kdd-crds.yaml
    59. apiVersion: apiextensions.k8s.io/v1
    60. kind: CustomResourceDefinition
    61. metadata:
    62.   name: bgpconfigurations.crd.projectcalico.org
    63. spec:
    64.   group: crd.projectcalico.org
    65.   names:
    66.     kind: BGPConfiguration
    67.     listKind: BGPConfigurationList
    68.     plural: bgpconfigurations
    69.     singular: bgpconfiguration
    70.   scope: Cluster
    71.   versions:
    72.   - name: v1
    73.     schema:
    74.       openAPIV3Schema:
    75.         description: BGPConfiguration contains the configuration for any BGP routing.
    76.         properties:
    77.           apiVersion:
    78.             description: 'APIVersion defines the versioned schema of this representation
    79.               of an object. Servers should convert recognized schemas to the latest
    80.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    81.             type: string
    82.           kind:
    83.             description: 'Kind is a string value representing the REST resource this
    84.               object represents. Servers may infer this from the endpoint the client
    85.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    86.             type: string
    87.           metadata:
    88.             type: object
    89.           spec:
    90.             description: BGPConfigurationSpec contains the values of the BGP configuration.
    91.             properties:
    92.               asNumber:
    93.                 description: 'ASNumber is the default AS number used by a node. [Default:
    94.                   64512]'
    95.                 format: int32
    96.                 type: integer
    97.               communities:
    98.                 description: Communities is a list of BGP community values and their
    99.                   arbitrary names for tagging routes.
    100.                 items:
    101.                   description: Community contains standard or large community value
    102.                     and its name.
    103.                   properties:
    104.                     name:
    105.                       description: Name given to community value.
    106.                       type: string
    107.                     value:
    108.                       description: Value must be of format `aa:nn` or `aa:nn:mm`.
    109.                         For standard community use `aa:nn` format, where `aa` and
    110.                         `nn` are 16 bit number. For large community use `aa:nn:mm`
    111.                         format, where `aa`, `nn` and `mm` are 32 bit number. Where,
    112.                         `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
    113.                       pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
    114.                       type: string
    115.                   type: object
    116.                 type: array
    117.               listenPort:
    118.                 description: ListenPort is the port where BGP protocol should listen.
    119.                   Defaults to 179
    120.                 maximum: 65535
    121.                 minimum: 1
    122.                 type: integer
    123.               logSeverityScreen:
    124.                 description: 'LogSeverityScreen is the log severity above which logs
    125.                   are sent to the stdout. [Default: INFO]'
    126.                 type: string
    127.               nodeToNodeMeshEnabled:
    128.                 description: 'NodeToNodeMeshEnabled sets whether full node to node
    129.                   BGP mesh is enabled. [Default: true]'
    130.                 type: boolean
    131.               prefixAdvertisements:
    132.                 description: PrefixAdvertisements contains per-prefix advertisement
    133.                   configuration.
    134.                 items:
    135.                   description: PrefixAdvertisement configures advertisement properties
    136.                     for the specified CIDR.
    137.                   properties:
    138.                     cidr:
    139.                       description: CIDR for which properties should be advertised.
    140.                       type: string
    141.                     communities:
    142.                       description: Communities can be list of either community names
    143.                         already defined in `Specs.Communities` or community value
    144.                         of format `aa:nn` or `aa:nn:mm`. For standard community use
    145.                         `aa:nn` format, where `aa` and `nn` are 16 bit number. For
    146.                         large community use `aa:nn:mm` format, where `aa`, `nn` and
    147.                         `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
    148.                         `mm` are per-AS identifier.
    149.                       items:
    150.                         type: string
    151.                       type: array
    152.                   type: object
    153.                 type: array
    154.               serviceClusterIPs:
    155.                 description: ServiceClusterIPs are the CIDR blocks from which service
    156.                   cluster IPs are allocated. If specified, Calico will advertise these
    157.                   blocks, as well as any cluster IPs within them.
    158.                 items:
    159.                   description: ServiceClusterIPBlock represents a single allowed ClusterIP
    160.                     CIDR block.
    161.                   properties:
    162.                     cidr:
    163.                       type: string
    164.                   type: object
    165.                 type: array
    166.               serviceExternalIPs:
    167.                 description: ServiceExternalIPs are the CIDR blocks for Kubernetes
    168.                   Service External IPs. Kubernetes Service ExternalIPs will only be
    169.                   advertised if they are within one of these blocks.
    170.                 items:
    171.                   description: ServiceExternalIPBlock represents a single allowed
    172.                     External IP CIDR block.
    173.                   properties:
    174.                     cidr:
    175.                       type: string
    176.                   type: object
    177.                 type: array
    178.               serviceLoadBalancerIPs:
    179.                 description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
    180.                   Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
    181.                   IPs will only be advertised if they are within one of these blocks.
    182.                 items:
    183.                   description: ServiceLoadBalancerIPBlock represents a single allowed
    184.                     LoadBalancer IP CIDR block.
    185.                   properties:
    186.                     cidr:
    187.                       type: string
    188.                   type: object
    189.                 type: array
    190.             type: object
    191.         type: object
    192.     served: true
    193.     storage: true
    194. status:
    195.   acceptedNames:
    196.     kind: ""
    197.     plural: ""
    198.   conditions: []
    199.   storedVersions: []
    201. ---
    202. apiVersion: apiextensions.k8s.io/v1
    203. kind: CustomResourceDefinition
    204. metadata:
    205.   name: bgppeers.crd.projectcalico.org
    206. spec:
    207.   group: crd.projectcalico.org
    208.   names:
    209.     kind: BGPPeer
    210.     listKind: BGPPeerList
    211.     plural: bgppeers
    212.     singular: bgppeer
    213.   scope: Cluster
    214.   versions:
    215.   - name: v1
    216.     schema:
    217.       openAPIV3Schema:
    218.         properties:
    219.           apiVersion:
    220.             description: 'APIVersion defines the versioned schema of this representation
    221.               of an object. Servers should convert recognized schemas to the latest
    222.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    223.             type: string
    224.           kind:
    225.             description: 'Kind is a string value representing the REST resource this
    226.               object represents. Servers may infer this from the endpoint the client
    227.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    228.             type: string
    229.           metadata:
    230.             type: object
    231.           spec:
    232.             description: BGPPeerSpec contains the specification for a BGPPeer resource.
    233.             properties:
    234.               asNumber:
    235.                 description: The AS Number of the peer.
    236.                 format: int32
    237.                 type: integer
    238.               keepOriginalNextHop:
    239.                 description: Option to keep the original nexthop field when routes
    240.                   are sent to a BGP Peer. Setting "true" configures the selected BGP
    241.                   Peers node to use the "next hop keep;" instead of "next hop self;"(default)
    242.                   in the specific branch of the Node on "bird.cfg".
    243.                 type: boolean
    244.               node:
    245.                 description: The node name identifying the Calico node instance that
    246.                   is targeted by this peer. If this is not set, and no nodeSelector
    247.                   is specified, then this BGP peer selects all nodes in the cluster.
    248.                 type: string
    249.               nodeSelector:
    250.                 description: Selector for the nodes that should have this peering.  When
    251.                   this is set, the Node field must be empty.
    252.                 type: string
    253.               password:
    254.                 description: Optional BGP password for the peerings generated by this
    255.                   BGPPeer resource.
    256.                 properties:
    257.                   secretKeyRef:
    258.                     description: Selects a key of a secret in the node pod's namespace.
    259.                     properties:
    260.                       key:
    261.                         description: The key of the secret to select from.  Must be
    262.                           a valid secret key.
    263.                         type: string
    264.                       name:
    265.                         description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    266.                           TODO: Add other useful fields. apiVersion, kind, uid?'
    267.                         type: string
    268.                       optional:
    269.                         description: Specify whether the Secret or its key must be
    270.                           defined
    271.                         type: boolean
    272.                     required:
    273.                     - key
    274.                     type: object
    275.                 type: object
    276.               peerIP:
    277.                 description: The IP address of the peer followed by an optional port
    278.                   number to peer with. If port number is given, format should be `[<IPv6>]:port`
    279.                   or `<IPv4>:<port>` for IPv4. If optional port number is not set,
    280.                   and this peer IP and ASNumber belongs to a calico/node with ListenPort
    281.                   set in BGPConfiguration, then we use that port to peer.
    282.                 type: string
    283.               peerSelector:
    284.                 description: Selector for the remote nodes to peer with.  When this
    285.                   is set, the PeerIP and ASNumber fields must be empty.  For each
    286.                   peering between the local node and selected remote nodes, we configure
    287.                   an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
    288.                   and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
    289.                   remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
    290.                   or the global default if that is not set.
    291.                 type: string
    292.               sourceAddress:
    293.                 description: Specifies whether and how to configure a source address
    294.                   for the peerings generated by this BGPPeer resource.  Default value
    295.                   "UseNodeIP" means to configure the node IP as the source address.  "None"
    296.                   means not to configure a source address.
    297.                 type: string
    298.             type: object
    299.         type: object
    300.     served: true
    301.     storage: true
    302. status:
    303.   acceptedNames:
    304.     kind: ""
    305.     plural: ""
    306.   conditions: []
    307.   storedVersions: []
    309. ---
    310. apiVersion: apiextensions.k8s.io/v1
    311. kind: CustomResourceDefinition
    312. metadata:
    313.   name: blockaffinities.crd.projectcalico.org
    314. spec:
    315.   group: crd.projectcalico.org
    316.   names:
    317.     kind: BlockAffinity
    318.     listKind: BlockAffinityList
    319.     plural: blockaffinities
    320.     singular: blockaffinity
    321.   scope: Cluster
    322.   versions:
    323.   - name: v1
    324.     schema:
    325.       openAPIV3Schema:
    326.         properties:
    327.           apiVersion:
    328.             description: 'APIVersion defines the versioned schema of this representation
    329.               of an object. Servers should convert recognized schemas to the latest
    330.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    331.             type: string
    332.           kind:
    333.             description: 'Kind is a string value representing the REST resource this
    334.               object represents. Servers may infer this from the endpoint the client
    335.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    336.             type: string
    337.           metadata:
    338.             type: object
    339.           spec:
    340.             description: BlockAffinitySpec contains the specification for a BlockAffinity
    341.               resource.
    342.             properties:
    343.               cidr:
    344.                 type: string
    345.               deleted:
    346.                 description: Deleted indicates that this block affinity is being deleted.
    347.                   This field is a string for compatibility with older releases that
    348.                   mistakenly treat this field as a string.
    349.                 type: string
    350.               node:
    351.                 type: string
    352.               state:
    353.                 type: string
    354.             required:
    355.             - cidr
    356.             - deleted
    357.             - node
    358.             - state
    359.             type: object
    360.         type: object
    361.     served: true
    362.     storage: true
    363. status:
    364.   acceptedNames:
    365.     kind: ""
    366.     plural: ""
    367.   conditions: []
    368.   storedVersions: []
    370. ---
    371. apiVersion: apiextensions.k8s.io/v1
    372. kind: CustomResourceDefinition
    373. metadata:
    374.   name: clusterinformations.crd.projectcalico.org
    375. spec:
    376.   group: crd.projectcalico.org
    377.   names:
    378.     kind: ClusterInformation
    379.     listKind: ClusterInformationList
    380.     plural: clusterinformations
    381.     singular: clusterinformation
    382.   scope: Cluster
    383.   versions:
    384.   - name: v1
    385.     schema:
    386.       openAPIV3Schema:
    387.         description: ClusterInformation contains the cluster specific information.
    388.         properties:
    389.           apiVersion:
    390.             description: 'APIVersion defines the versioned schema of this representation
    391.               of an object. Servers should convert recognized schemas to the latest
    392.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    393.             type: string
    394.           kind:
    395.             description: 'Kind is a string value representing the REST resource this
    396.               object represents. Servers may infer this from the endpoint the client
    397.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    398.             type: string
    399.           metadata:
    400.             type: object
    401.           spec:
    402.             description: ClusterInformationSpec contains the values of describing
    403.               the cluster.
    404.             properties:
    405.               calicoVersion:
    406.                 description: CalicoVersion is the version of Calico that the cluster
    407.                   is running
    408.                 type: string
    409.               clusterGUID:
    410.                 description: ClusterGUID is the GUID of the cluster
    411.                 type: string
    412.               clusterType:
    413.                 description: ClusterType describes the type of the cluster
    414.                 type: string
    415.               datastoreReady:
    416.                 description: DatastoreReady is used during significant datastore migrations
    417.                   to signal to components such as Felix that it should wait before
    418.                   accessing the datastore.
    419.                 type: boolean
    420.               variant:
    421.                 description: Variant declares which variant of Calico should be active.
    422.                 type: string
    423.             type: object
    424.         type: object
    425.     served: true
    426.     storage: true
    427. status:
    428.   acceptedNames:
    429.     kind: ""
    430.     plural: ""
    431.   conditions: []
    432.   storedVersions: []
    434. ---
    435. apiVersion: apiextensions.k8s.io/v1
    436. kind: CustomResourceDefinition
    437. metadata:
    438.   name: felixconfigurations.crd.projectcalico.org
    439. spec:
    440.   group: crd.projectcalico.org
    441.   names:
    442.     kind: FelixConfiguration
    443.     listKind: FelixConfigurationList
    444.     plural: felixconfigurations
    445.     singular: felixconfiguration
    446.   scope: Cluster
    447.   versions:
    448.   - name: v1
    449.     schema:
    450.       openAPIV3Schema:
    451.         description: Felix Configuration contains the configuration for Felix.
    452.         properties:
    453.           apiVersion:
    454.             description: 'APIVersion defines the versioned schema of this representation
    455.               of an object. Servers should convert recognized schemas to the latest
    456.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    457.             type: string
    458.           kind:
    459.             description: 'Kind is a string value representing the REST resource this
    460.               object represents. Servers may infer this from the endpoint the client
    461.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    462.             type: string
    463.           metadata:
    464.             type: object
    465.           spec:
    466.             description: FelixConfigurationSpec contains the values of the Felix configuration.
    467.             properties:
    468.               allowIPIPPacketsFromWorkloads:
    469.                 description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
    470.                   will add a rule to drop IPIP encapsulated traffic from workloads
    471.                   [Default: false]'
    472.                 type: boolean
    473.               allowVXLANPacketsFromWorkloads:
    474.                 description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
    475.                   will add a rule to drop VXLAN encapsulated traffic from workloads
    476.                   [Default: false]'
    477.                 type: boolean
    478.               awsSrcDstCheck:
    479.                 description: 'Set source-destination-check on AWS EC2 instances. Accepted
    480.                   value must be one of "DoNothing", "Enabled" or "Disabled". [Default:
    481.                   DoNothing]'
    482.                 enum:
    483.                 - DoNothing
    484.                 - Enable
    485.                 - Disable
    486.                 type: string
    487.               bpfConnectTimeLoadBalancingEnabled:
    488.                 description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
    489.                   controls whether Felix installs the connection-time load balancer.  The
    490.                   connect-time load balancer is required for the host to be able to
    491.                   reach Kubernetes services and it improves the performance of pod-to-service
    492.                   connections.  The only reason to disable it is for debugging purposes.  [Default:
    493.                   true]'
    494.                 type: boolean
    495.               bpfDataIfacePattern:
    496.                 description: BPFDataIfacePattern is a regular expression that controls
    497.                   which interfaces Felix should attach BPF programs to in order to
    498.                   catch traffic to/from the network.  This needs to match the interfaces
    499.                   that Calico workload traffic flows over as well as any interfaces
    500.                   that handle incoming traffic to nodeports and services from outside
    501.                   the cluster.  It should not match the workload interfaces (usually
    502.                   named cali...).
    503.                 type: string
    504.               bpfDisableUnprivileged:
    505.                 description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
    506.                   sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
    507.                   users cannot access Calico''s BPF maps and cannot insert their own
    508.                   BPF programs to interfere with Calico''s. [Default: true]'
    509.                 type: boolean
    510.               bpfEnabled:
    511.                 description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
    512.                   [Default: false]'
    513.                 type: boolean
    514.               bpfExternalServiceMode:
    515.                 description: 'BPFExternalServiceMode in BPF mode, controls how connections
    516.                   from outside the cluster to services (node ports and cluster IPs)
    517.                   are forwarded to remote workloads.  If set to "Tunnel" then both
    518.                   request and response traffic is tunneled to the remote node.  If
    519.                   set to "DSR", the request traffic is tunneled but the response traffic
    520.                   is sent directly from the remote node.  In "DSR" mode, the remote
    521.                   node appears to use the IP of the ingress node; this requires a
    522.                   permissive L2 network.  [Default: Tunnel]'
    523.                 type: string
    524.               bpfKubeProxyEndpointSlicesEnabled:
    525.                 description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
    526.                   whether Felix's embedded kube-proxy accepts EndpointSlices or not.
    527.                 type: boolean
    528.               bpfKubeProxyIptablesCleanupEnabled:
    529.                 description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
    530.                   mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
    531.                   iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
    532.                   true]'
    533.                 type: boolean
    534.               bpfKubeProxyMinSyncPeriod:
    535.                 description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
    536.                   minimum time between updates to the dataplane for Felix''s embedded
    537.                   kube-proxy.  Lower values give reduced set-up latency.  Higher values
    538.                   reduce Felix CPU usage by batching up more work.  [Default: 1s]'
    539.                 type: string
    540.               bpfLogLevel:
    541.                 description: 'BPFLogLevel controls the log level of the BPF programs
    542.                   when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
    543.                   logs are emitted to the BPF trace pipe, accessible with the command
    544.                   `tc exec bpf debug`. [Default: Off].'
    545.                 type: string
    546.               chainInsertMode:
    547.                 description: 'ChainInsertMode controls whether Felix hooks the kernel''s
    548.                   top-level iptables chains by inserting a rule at the top of the
    549.                   chain or by appending a rule at the bottom. insert is the safe default
    550.                   since it prevents Calico''s rules from being bypassed. If you switch
    551.                   to append mode, be sure that the other rules in the chains signal
    552.                   acceptance by falling through to the Calico rules, otherwise the
    553.                   Calico policy will be bypassed. [Default: insert]'
    554.                 type: string
    555.               dataplaneDriver:
    556.                 type: string
    557.               debugDisableLogDropping:
    558.                 type: boolean
    559.               debugMemoryProfilePath:
    560.                 type: string
    561.               debugSimulateCalcGraphHangAfter:
    562.                 type: string
    563.               debugSimulateDataplaneHangAfter:
    564.                 type: string
    565.               defaultEndpointToHostAction:
    566.                 description: 'DefaultEndpointToHostAction controls what happens to
    567.                   traffic that goes from a workload endpoint to the host itself (after
    568.                   the traffic hits the endpoint egress policy). By default Calico
    569.                   blocks traffic from workload endpoints to the host itself with an
    570.                   iptables "DROP" action. If you want to allow some or all traffic
    571.                   from endpoint to host, set this parameter to RETURN or ACCEPT. Use
    572.                   RETURN if you have your own rules in the iptables "INPUT" chain;
    573.                   Calico will insert its rules at the top of that chain, then "RETURN"
    574.                   packets to the "INPUT" chain once it has completed processing workload
    575.                   endpoint egress policy. Use ACCEPT to unconditionally accept packets
    576.                   from workloads after processing workload endpoint egress policy.
    577.                   [Default: Drop]'
    578.                 type: string
    579.               deviceRouteProtocol:
    580.                 description: This defines the route protocol added to programmed device
    581.                   routes, by default this will be RTPROT_BOOT when left blank.
    582.                 type: integer
    583.               deviceRouteSourceAddress:
    584.                 description: This is the source address to use on programmed device
    585.                   routes. By default the source address is left blank, leaving the
    586.                   kernel to choose the source address used.
    587.                 type: string
    588.               disableConntrackInvalidCheck:
    589.                 type: boolean
    590.               endpointReportingDelay:
    591.                 type: string
    592.               endpointReportingEnabled:
    593.                 type: boolean
    594.               externalNodesList:
    595.                 description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
    596.                   which may source tunnel traffic and have the tunneled traffic be
    597.                   accepted at calico nodes.
    598.                 items:
    599.                   type: string
    600.                 type: array
    601.               failsafeInboundHostPorts:
    602.                 description: 'FailsafeInboundHostPorts is a comma-delimited list of
    603.                   UDP/TCP ports that Felix will allow incoming traffic to host endpoints
    604.                   on irrespective of the security policy. This is useful to avoid
    605.                   accidentally cutting off a host with incorrect configuration. Each
    606.                   port should be specified as tcp:<port-number> or udp:<port-number>.
    607.                   For back-compatibility, if the protocol is not specified, it defaults
    608.                   to "tcp". To disable all inbound host ports, use the value none.
    609.                   The default value allows ssh access and DHCP. [Default: tcp:22,
    610.                   udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
    611.                 items:
    612.                   description: ProtoPort is combination of protocol and port, both
    613.                     must be specified.
    614.                   properties:
    615.                     port:
    616.                       type: integer
    617.                     protocol:
    618.                       type: string
    619.                   required:
    620.                   - port
    621.                   - protocol
    622.                   type: object
    623.                 type: array
    624.               failsafeOutboundHostPorts:
    625.                 description: 'FailsafeOutboundHostPorts is a comma-delimited list
    626.                   of UDP/TCP ports that Felix will allow outgoing traffic from host
    627.                   endpoints to irrespective of the security policy. This is useful
    628.                   to avoid accidentally cutting off a host with incorrect configuration.
    629.                   Each port should be specified as tcp:<port-number> or udp:<port-number>.
    630.                   For back-compatibility, if the protocol is not specified, it defaults
    631.                   to "tcp". To disable all outbound host ports, use the value none.
    632.                   The default value opens etcd''s standard ports to ensure that Felix
    633.                   does not get cut off from etcd as well as allowing DHCP and DNS.
    634.                   [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667,
    635.                   udp:53, udp:67]'
    636.                 items:
    637.                   description: ProtoPort is combination of protocol and port, both
    638.                     must be specified.
    639.                   properties:
    640.                     port:
    641.                       type: integer
    642.                     protocol:
    643.                       type: string
    644.                   required:
    645.                   - port
    646.                   - protocol
    647.                   type: object
    648.                 type: array
    649.               featureDetectOverride:
    650.                 description: FeatureDetectOverride is used to override the feature
    651.                   detection. Values are specified in a comma separated list with no
    652.                   spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
    653.                   "true" or "false" will force the feature, empty or omitted values
    654.                   are auto-detected.
    655.                 type: string
    656.               genericXDPEnabled:
    657.                 description: 'GenericXDPEnabled enables Generic XDP so network cards
    658.                   that don''t support XDP offload or driver modes can use XDP. This
    659.                   is not recommended since it doesn''t provide better performance
    660.                   than iptables. [Default: false]'
    661.                 type: boolean
    662.               healthEnabled:
    663.                 type: boolean
    664.               healthHost:
    665.                 type: string
    666.               healthPort:
    667.                 type: integer
    668.               interfaceExclude:
    669.                 description: 'InterfaceExclude is a comma-separated list of interfaces
    670.                   that Felix should exclude when monitoring for host endpoints. The
    671.                   default value ensures that Felix ignores Kubernetes'' IPVS dummy
    672.                   interface, which is used internally by kube-proxy. If you want to
    673.                   exclude multiple interface names using a single value, the list
    674.                   supports regular expressions. For regular expressions you must wrap
    675.                   the value with ''/''. For example having values ''/^kube/,veth1''
    676.                   will exclude all interfaces that begin with ''kube'' and also the
    677.                   interface ''veth1''. [Default: kube-ipvs0]'
    678.                 type: string
    679.               interfacePrefix:
    680.                 description: 'InterfacePrefix is the interface name prefix that identifies
    681.                   workload endpoints and so distinguishes them from host endpoint
    682.                   interfaces. Note: in environments other than bare metal, the orchestrators
    683.                   configure this appropriately. For example our Kubernetes and Docker
    684.                   integrations set the ''cali'' value, and our OpenStack integration
    685.                   sets the ''tap'' value. [Default: cali]'
    686.                 type: string
    687.               interfaceRefreshInterval:
    688.                 description: InterfaceRefreshInterval is the period at which Felix
    689.                   rescans local interfaces to verify their state. The rescan can be
    690.                   disabled by setting the interval to 0.
    691.                 type: string
    692.               ipipEnabled:
    693.                 type: boolean
    694.               ipipMTU:
    695.                 description: 'IPIPMTU is the MTU to set on the tunnel device. See
    696.                   Configuring MTU [Default: 1440]'
    697.                 type: integer
    698.               ipsetsRefreshInterval:
    699.                 description: 'IpsetsRefreshInterval is the period at which Felix re-checks
    700.                   all iptables state to ensure that no other process has accidentally
    701.                   broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
    702.                   90s]'
    703.                 type: string
    704.               iptablesBackend:
    705.                 description: IptablesBackend specifies which backend of iptables will
    706.                   be used. The default is legacy.
    707.                 type: string
    708.               iptablesFilterAllowAction:
    709.                 type: string
    710.               iptablesLockFilePath:
    711.                 description: 'IptablesLockFilePath is the location of the iptables
    712.                   lock file. You may need to change this if the lock file is not in
    713.                   its standard location (for example if you have mapped it into Felix''s
    714.                   container at a different path). [Default: /run/xtables.lock]'
    715.                 type: string
    716.               iptablesLockProbeInterval:
    717.                 description: 'IptablesLockProbeInterval is the time that Felix will
    718.                   wait between attempts to acquire the iptables lock if it is not
    719.                   available. Lower values make Felix more responsive when the lock
    720.                   is contended, but use more CPU. [Default: 50ms]'
    721.                 type: string
    722.               iptablesLockTimeout:
    723.                 description: 'IptablesLockTimeout is the time that Felix will wait
    724.                   for the iptables lock, or 0, to disable. To use this feature, Felix
    725.                   must share the iptables lock file with all other processes that
    726.                   also take the lock. When running Felix inside a container, this
    727.                   requires the /run directory of the host to be mounted into the calico/node
    728.                   or calico/felix container. [Default: 0s disabled]'
    729.                 type: string
    730.               iptablesMangleAllowAction:
    731.                 type: string
    732.               iptablesMarkMask:
    733.                 description: 'IptablesMarkMask is the mask that Felix selects its
    734.                   IPTables Mark bits from. Should be a 32 bit hexadecimal number with
    735.                   at least 8 bits set, none of which clash with any other mark bits
    736.                   in use on the system. [Default: 0xff000000]'
    737.                 format: int32
    738.                 type: integer
    739.               iptablesNATOutgoingInterfaceFilter:
    740.                 type: string
    741.               iptablesPostWriteCheckInterval:
    742.                 description: 'IptablesPostWriteCheckInterval is the period after Felix
    743.                   has done a write to the dataplane that it schedules an extra read
    744.                   back in order to check the write was not clobbered by another process.
    745.                   This should only occur if another application on the system doesn''t
    746.                   respect the iptables lock. [Default: 1s]'
    747.                 type: string
    748.               iptablesRefreshInterval:
    749.                 description: 'IptablesRefreshInterval is the period at which Felix
    750.                   re-checks the IP sets in the dataplane to ensure that no other process
    751.                   has accidentally broken Calico''s rules. Set to 0 to disable IP
    752.                   sets refresh. Note: the default for this value is lower than the
    753.                   other refresh intervals as a workaround for a Linux kernel bug that
    754.                   was fixed in kernel version 4.11. If you are using v4.11 or greater
    755.                   you may want to set this to, a higher value to reduce Felix CPU
    756.                   usage. [Default: 10s]'
    757.                 type: string
    758.               ipv6Support:
    759.                 type: boolean
    760.               kubeNodePortRanges:
    761.                 description: 'KubeNodePortRanges holds list of port ranges used for
    762.                   service node ports. Only used if felix detects kube-proxy running
    763.                   in ipvs mode. Felix uses these ranges to separate host and workload
    764.                   traffic. [Default: 30000:32767].'
    765.                 items:
    766.                   anyOf:
    767.                   - type: integer
    768.                   - type: string
    769.                   pattern: ^.*
    770.                   x-kubernetes-int-or-string: true
    771.                 type: array
    772.               logFilePath:
    773.                 description: 'LogFilePath is the full path to the Felix log. Set to
    774.                   none to disable file logging. [Default: /var/log/calico/felix.log]'
    775.                 type: string
    776.               logPrefix:
    777.                 description: 'LogPrefix is the log prefix that Felix uses when rendering
    778.                   LOG rules. [Default: calico-packet]'
    779.                 type: string
    780.               logSeverityFile:
    781.                 description: 'LogSeverityFile is the log severity above which logs
    782.                   are sent to the log file. [Default: Info]'
    783.                 type: string
    784.               logSeverityScreen:
    785.                 description: 'LogSeverityScreen is the log severity above which logs
    786.                   are sent to the stdout. [Default: Info]'
    787.                 type: string
    788.               logSeveritySys:
    789.                 description: 'LogSeveritySys is the log severity above which logs
    790.                   are sent to the syslog. Set to None for no logging to syslog. [Default:
    791.                   Info]'
    792.                 type: string
    793.               maxIpsetSize:
    794.                 type: integer
    795.               metadataAddr:
    796.                 description: 'MetadataAddr is the IP address or domain name of the
    797.                   server that can answer VM queries for cloud-init metadata. In OpenStack,
    798.                   this corresponds to the machine running nova-api (or in Ubuntu,
    799.                   nova-api-metadata). A value of none (case insensitive) means that
    800.                   Felix should not set up any NAT rule for the metadata path. [Default:
    801.                   127.0.0.1]'
    802.                 type: string
    803.               metadataPort:
    804.                 description: 'MetadataPort is the port of the metadata server. This,
    805.                   combined with global.MetadataAddr (if not ''None''), is used to
    806.                   set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
    807.                   In most cases this should not need to be changed [Default: 8775].'
    808.                 type: integer
    809.               mtuIfacePattern:
    810.                 description: MTUIfacePattern is a regular expression that controls
    811.                   which interfaces Felix should scan in order to calculate the host's
    812.                   MTU. This should not match workload interfaces (usually named cali...).
    813.                 type: string
    814.               natOutgoingAddress:
    815.                 description: NATOutgoingAddress specifies an address to use when performing
    816.                   source NAT for traffic in a natOutgoing pool that is leaving the
    817.                   network. By default the address used is an address on the interface
    818.                   the traffic is leaving on (ie it uses the iptables MASQUERADE target)
    819.                 type: string
    820.               natPortRange:
    821.                 anyOf:
    822.                 - type: integer
    823.                 - type: string
    824.                 description: NATPortRange specifies the range of ports that is used
    825.                   for port mapping when doing outgoing NAT. When unset the default
    826.                   behavior of the network stack is used.
    827.                 pattern: ^.*
    828.                 x-kubernetes-int-or-string: true
    829.               netlinkTimeout:
    830.                 type: string
    831.               openstackRegion:
    832.                 description: 'OpenstackRegion is the name of the region that a particular
    833.                   Felix belongs to. In a multi-region Calico/OpenStack deployment,
    834.                   this must be configured somehow for each Felix (here in the datamodel,
    835.                   or in felix.cfg or the environment on each compute node), and must
    836.                   match the [calico] openstack_region value configured in neutron.conf
    837.                   on each node. [Default: Empty]'
    838.                 type: string
    839.               policySyncPathPrefix:
    840.                 description: 'PolicySyncPathPrefix is used to by Felix to communicate
    841.                   policy changes to external services, like Application layer policy.
    842.                   [Default: Empty]'
    843.                 type: string
    844.               prometheusGoMetricsEnabled:
    845.                 description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
    846.                   collection, which the Prometheus client does by default, when set
    847.                   to false. This reduces the number of metrics reported, reducing
    848.                   Prometheus load. [Default: true]'
    849.                 type: boolean
    850.               prometheusMetricsEnabled:
    851.                 description: 'PrometheusMetricsEnabled enables the Prometheus metrics
    852.                   server in Felix if set to true. [Default: false]'
    853.                 type: boolean
    854.               prometheusMetricsHost:
    855.                 description: 'PrometheusMetricsHost is the host that the Prometheus
    856.                   metrics server should bind to. [Default: empty]'
    857.                 type: string
    858.               prometheusMetricsPort:
    859.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
    860.                   metrics server should bind to. [Default: 9091]'
    861.                 type: integer
    862.               prometheusProcessMetricsEnabled:
    863.                 description: 'PrometheusProcessMetricsEnabled disables process metrics
    864.                   collection, which the Prometheus client does by default, when set
    865.                   to false. This reduces the number of metrics reported, reducing
    866.                   Prometheus load. [Default: true]'
    867.                 type: boolean
    868.               removeExternalRoutes:
    869.                 description: Whether or not to remove device routes that have not
    870.                   been programmed by Felix. Disabling this will allow external applications
    871.                   to also add device routes. This is enabled by default which means
    872.                   we will remove externally added routes.
    873.                 type: boolean
    874.               reportingInterval:
    875.                 description: 'ReportingInterval is the interval at which Felix reports
    876.                   its status into the datastore or 0 to disable. Must be non-zero
    877.                   in OpenStack deployments. [Default: 30s]'
    878.                 type: string
    879.               reportingTTL:
    880.                 description: 'ReportingTTL is the time-to-live setting for process-wide
    881.                   status reports. [Default: 90s]'
    882.                 type: string
    883.               routeRefreshInterval:
    884.                 description: 'RouteRefreshInterval is the period at which Felix re-checks
    885.                   the routes in the dataplane to ensure that no other process has
    886.                   accidentally broken Calico''s rules. Set to 0 to disable route refresh.
    887.                   [Default: 90s]'
    888.                 type: string
    889.               routeSource:
    890.                 description: 'RouteSource configures where Felix gets its routing
    891.                   information. - WorkloadIPs: use workload endpoints to construct
    892.                   routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
    893.                 type: string
    894.               routeTableRange:
    895.                 description: Calico programs additional Linux route tables for various
    896.                   purposes.  RouteTableRange specifies the indices of the route tables
    897.                   that Calico should use.
    898.                 properties:
    899.                   max:
    900.                     type: integer
    901.                   min:
    902.                     type: integer
    903.                 required:
    904.                 - max
    905.                 - min
    906.                 type: object
    907.               serviceLoopPrevention:
    908.                 description: 'When service IP advertisement is enabled, prevent routing
    909.                   loops to service IPs that are not in use, by dropping or rejecting
    910.                   packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
    911.                   in which case such routing loops continue to be allowed. [Default:
    912.                   Drop]'
    913.                 type: string
    914.               sidecarAccelerationEnabled:
    915.                 description: 'SidecarAccelerationEnabled enables experimental sidecar
    916.                   acceleration [Default: false]'
    917.                 type: boolean
    918.               usageReportingEnabled:
    919.                 description: 'UsageReportingEnabled reports anonymous Calico version
    920.                   number and cluster size to projectcalico.org. Logs warnings returned
    921.                   by the usage server. For example, if a significant security vulnerability
    922.                   has been discovered in the version of Calico being used. [Default:
    923.                   true]'
    924.                 type: boolean
    925.               usageReportingInitialDelay:
    926.                 description: 'UsageReportingInitialDelay controls the minimum delay
    927.                   before Felix makes a report. [Default: 300s]'
    928.                 type: string
    929.               usageReportingInterval:
    930.                 description: 'UsageReportingInterval controls the interval at which
    931.                   Felix makes reports. [Default: 86400s]'
    932.                 type: string
    933.               useInternalDataplaneDriver:
    934.                 type: boolean
    935.               vxlanEnabled:
    936.                 type: boolean
    937.               vxlanMTU:
    938.                 description: 'VXLANMTU is the MTU to set on the tunnel device. See
    939.                   Configuring MTU [Default: 1440]'
    940.                 type: integer
    941.               vxlanPort:
    942.                 type: integer
    943.               vxlanVNI:
    944.                 type: integer
    945.               wireguardEnabled:
    946.                 description: 'WireguardEnabled controls whether Wireguard is enabled.
    947.                   [Default: false]'
    948.                 type: boolean
    949.               wireguardInterfaceName:
    950.                 description: 'WireguardInterfaceName specifies the name to use for
    951.                   the Wireguard interface. [Default: wg.calico]'
    952.                 type: string
    953.               wireguardListeningPort:
    954.                 description: 'WireguardListeningPort controls the listening port used
    955.                   by Wireguard. [Default: 51820]'
    956.                 type: integer
    957.               wireguardMTU:
    958.                 description: 'WireguardMTU controls the MTU on the Wireguard interface.
    959.                   See Configuring MTU [Default: 1420]'
    960.                 type: integer
    961.               wireguardRoutingRulePriority:
    962.                 description: 'WireguardRoutingRulePriority controls the priority value
    963.                   to use for the Wireguard routing rule. [Default: 99]'
    964.                 type: integer
    965.               xdpEnabled:
    966.                 description: 'XDPEnabled enables XDP acceleration for suitable untracked
    967.                   incoming deny rules. [Default: true]'
    968.                 type: boolean
    969.               xdpRefreshInterval:
    970.                 description: 'XDPRefreshInterval is the period at which Felix re-checks
    971.                   all XDP state to ensure that no other process has accidentally broken
    972.                   Calico''s BPF maps or attached programs. Set to 0 to disable XDP
    973.                   refresh. [Default: 90s]'
    974.                 type: string
    975.             type: object
    976.         type: object
    977.     served: true
    978.     storage: true
    979. status:
    980.   acceptedNames:
    981.     kind: ""
    982.     plural: ""
    983.   conditions: []
    984.   storedVersions: []
    986. ---
    987. apiVersion: apiextensions.k8s.io/v1
    988. kind: CustomResourceDefinition
    989. metadata:
    990.   name: globalnetworkpolicies.crd.projectcalico.org
    991. spec:
    992.   group: crd.projectcalico.org
    993.   names:
    994.     kind: GlobalNetworkPolicy
    995.     listKind: GlobalNetworkPolicyList
    996.     plural: globalnetworkpolicies
    997.     singular: globalnetworkpolicy
    998.   scope: Cluster
    999.   versions:
    1000.   - name: v1
    1001.     schema:
    1002.       openAPIV3Schema:
    1003.         properties:
    1004.           apiVersion:
    1005.             description: 'APIVersion defines the versioned schema of this representation
    1006.               of an object. Servers should convert recognized schemas to the latest
    1007.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    1008.             type: string
    1009.           kind:
    1010.             description: 'Kind is a string value representing the REST resource this
    1011.               object represents. Servers may infer this from the endpoint the client
    1012.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    1013.             type: string
    1014.           metadata:
    1015.             type: object
    1016.           spec:
    1017.             properties:
    1018.               applyOnForward:
    1019.                 description: ApplyOnForward indicates to apply the rules in this policy
    1020.                   on forward traffic.
    1021.                 type: boolean
    1022.               doNotTrack:
    1023.                 description: DoNotTrack indicates whether packets matched by the rules
    1024.                   in this policy should go through the data plane's connection tracking,
    1025.                   such as Linux conntrack.  If True, the rules in this policy are
    1026.                   applied before any data plane connection tracking, and packets allowed
    1027.                   by this policy are marked as not to be tracked.
    1028.                 type: boolean
    1029.               egress:
    1030.                 description: The ordered set of egress rules.  Each rule contains
    1031.                   a set of packet match criteria and a corresponding action to apply.
    1032.                 items:
    1033.                   description: "A Rule encapsulates a set of match criteria and an
    1034.                     action.  Both selector-based security Policy and security Profiles
    1035.                     reference rules - separated out as a list of rules for both ingress
    1036.                     and egress packet matching. \n Each positive match criteria has
    1037.                     a negated version, prefixed with \"Not\". All the match criteria
    1038.                     within a rule must be satisfied for a packet to match. A single
    1039.                     rule can contain the positive and negative version of a match
    1040.                     and both must be satisfied for the rule to match."
    1041.                   properties:
    1042.                     action:
    1043.                       type: string
    1044.                     destination:
    1045.                       description: Destination contains the match criteria that apply
    1046.                         to destination entity.
    1047.                       properties:
    1048.                         namespaceSelector:
    1049.                           description: "NamespaceSelector is an optional field that
    1050.                             contains a selector expression. Only traffic that originates
    1051.                             from (or terminates at) endpoints within the selected
    1052.                             namespaces will be matched. When both NamespaceSelector
    1053.                             and Selector are defined on the same rule, then only workload
    1054.                             endpoints that are matched by both selectors will be selected
    1055.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    1056.                             implies that the Selector is limited to selecting only
    1057.                             workload endpoints in the same namespace as the NetworkPolicy.
    1058.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    1059.                             that the Selector is limited to selecting only GlobalNetworkSet
    1060.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    1061.                             NamespaceSelector implies the Selector applies to workload
    1062.                             endpoints across all namespaces."
    1063.                           type: string
    1064.                         nets:
    1065.                           description: Nets is an optional field that restricts the
    1066.                             rule to only apply to traffic that originates from (or
    1067.                             terminates at) IP addresses in any of the given subnets.
    1068.                           items:
    1069.                             type: string
    1070.                           type: array
    1071.                         notNets:
    1072.                           description: NotNets is the negated version of the Nets
    1073.                             field.
    1074.                           items:
    1075.                             type: string
    1076.                           type: array
    1077.                         notPorts:
    1078.                           description: NotPorts is the negated version of the Ports
    1079.                             field. Since only some protocols have ports, if any ports
    1080.                             are specified it requires the Protocol match in the Rule
    1081.                             to be set to "TCP" or "UDP".
    1082.                           items:
    1083.                             anyOf:
    1084.                             - type: integer
    1085.                             - type: string
    1086.                             pattern: ^.*
    1087.                             x-kubernetes-int-or-string: true
    1088.                           type: array
    1089.                         notSelector:
    1090.                           description: NotSelector is the negated version of the Selector
    1091.                             field.  See Selector field for subtleties with negated
    1092.                             selectors.
    1093.                           type: string
    1094.                         ports:
    1095.                           description: "Ports is an optional field that restricts
    1096.                             the rule to only apply to traffic that has a source (destination)
    1097.                             port that matches one of these ranges/values. This value
    1098.                             is a list of integers or strings that represent ranges
    1099.                             of ports. \n Since only some protocols have ports, if
    1100.                             any ports are specified it requires the Protocol match
    1101.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    1102.                           items:
    1103.                             anyOf:
    1104.                             - type: integer
    1105.                             - type: string
    1106.                             pattern: ^.*
    1107.                             x-kubernetes-int-or-string: true
    1108.                           type: array
    1109.                         selector:
    1110.                           description: "Selector is an optional field that contains
    1111.                             a selector expression (see Policy for sample syntax).
    1112.                             \ Only traffic that originates from (terminates at) endpoints
    1113.                             matching the selector will be matched. \n Note that: in
    1114.                             addition to the negated version of the Selector (see NotSelector
    1115.                             below), the selector expression syntax itself supports
    1116.                             negation.  The two types of negation are subtly different.
    1117.                             One negates the set of matched endpoints, the other negates
    1118.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    1119.                             packets that are from other Calico-controlled \tendpoints
    1120.                             that do not have the label \"my_label\". \n \tNotSelector
    1121.                             = \"has(my_label)\" matches packets that are not from
    1122.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    1123.                             \n The effect is that the latter will accept packets from
    1124.                             non-Calico sources whereas the former is limited to packets
    1125.                             from Calico-controlled endpoints."
    1126.                           type: string
    1127.                         serviceAccounts:
    1128.                           description: ServiceAccounts is an optional field that restricts
    1129.                             the rule to only apply to traffic that originates from
    1130.                             (or terminates at) a pod running as a matching service
    1131.                             account.
    1132.                           properties:
    1133.                             names:
    1134.                               description: Names is an optional field that restricts
    1135.                                 the rule to only apply to traffic that originates
    1136.                                 from (or terminates at) a pod running as a service
    1137.                                 account whose name is in the list.
    1138.                               items:
    1139.                                 type: string
    1140.                               type: array
    1141.                             selector:
    1142.                               description: Selector is an optional field that restricts
    1143.                                 the rule to only apply to traffic that originates
    1144.                                 from (or terminates at) a pod running as a service
    1145.                                 account that matches the given label selector. If
    1146.                                 both Names and Selector are specified then they are
    1147.                                 AND'ed.
    1148.                               type: string
    1149.                           type: object
    1150.                       type: object
    1151.                     http:
    1152.                       description: HTTP contains match criteria that apply to HTTP
    1153.                         requests.
    1154.                       properties:
    1155.                         methods:
    1156.                           description: Methods is an optional field that restricts
    1157.                             the rule to apply only to HTTP requests that use one of
    1158.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
    1159.                             methods are OR'd together.
    1160.                           items:
    1161.                             type: string
    1162.                           type: array
    1163.                         paths:
    1164.                           description: 'Paths is an optional field that restricts
    1165.                             the rule to apply to HTTP requests that use one of the
    1166.                             listed HTTP Paths. Multiple paths are OR''d together.
    1167.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
    1168.                             ONLY specify either a `exact` or a `prefix` match. The
    1169.                             validator will check for it.'
    1170.                           items:
    1171.                             description: 'HTTPPath specifies an HTTP path to match.
    1172.                               It may be either of the form: exact: <path>: which matches
    1173.                               the path exactly or prefix: <path-prefix>: which matches
    1174.                               the path prefix'
    1175.                             properties:
    1176.                               exact:
    1177.                                 type: string
    1178.                               prefix:
    1179.                                 type: string
    1180.                             type: object
    1181.                           type: array
    1182.                       type: object
    1183.                     icmp:
    1184.                       description: ICMP is an optional field that restricts the rule
    1185.                         to apply to a specific type and code of ICMP traffic.  This
    1186.                         should only be specified if the Protocol field is set to "ICMP"
    1187.                         or "ICMPv6".
    1188.                       properties:
    1189.                         code:
    1190.                           description: Match on a specific ICMP code.  If specified,
    1191.                             the Type value must also be specified. This is a technical
    1192.                             limitation imposed by the kernel's iptables firewall,
    1193.                             which Calico uses to enforce the rule.
    1194.                           type: integer
    1195.                         type:
    1196.                           description: Match on a specific ICMP type.  For example
    1197.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    1198.                           type: integer
    1199.                       type: object
    1200.                     ipVersion:
    1201.                       description: IPVersion is an optional field that restricts the
    1202.                         rule to only match a specific IP version.
    1203.                       type: integer
    1204.                     metadata:
    1205.                       description: Metadata contains additional information for this
    1206.                         rule
    1207.                       properties:
    1208.                         annotations:
    1209.                           additionalProperties:
    1210.                             type: string
    1211.                           description: Annotations is a set of key value pairs that
    1212.                             give extra information about the rule
    1213.                           type: object
    1214.                       type: object
    1215.                     notICMP:
    1216.                       description: NotICMP is the negated version of the ICMP field.
    1217.                       properties:
    1218.                         code:
    1219.                           description: Match on a specific ICMP code.  If specified,
    1220.                             the Type value must also be specified. This is a technical
    1221.                             limitation imposed by the kernel's iptables firewall,
    1222.                             which Calico uses to enforce the rule.
    1223.                           type: integer
    1224.                         type:
    1225.                           description: Match on a specific ICMP type.  For example
    1226.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    1227.                           type: integer
    1228.                       type: object
    1229.                     notProtocol:
    1230.                       anyOf:
    1231.                       - type: integer
    1232.                       - type: string
    1233.                       description: NotProtocol is the negated version of the Protocol
    1234.                         field.
    1235.                       pattern: ^.*
    1236.                       x-kubernetes-int-or-string: true
    1237.                     protocol:
    1238.                       anyOf:
    1239.                       - type: integer
    1240.                       - type: string
    1241.                       description: "Protocol is an optional field that restricts the
    1242.                         rule to only apply to traffic of a specific IP protocol. Required
    1243.                         if any of the EntityRules contain Ports (because ports only
    1244.                         apply to certain protocols). \n Must be one of these string
    1245.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
    1246.                         \"UDPLite\" or an integer in the range 1-255."
    1247.                       pattern: ^.*
    1248.                       x-kubernetes-int-or-string: true
    1249.                     source:
    1250.                       description: Source contains the match criteria that apply to
    1251.                         source entity.
    1252.                       properties:
    1253.                         namespaceSelector:
    1254.                           description: "NamespaceSelector is an optional field that
    1255.                             contains a selector expression. Only traffic that originates
    1256.                             from (or terminates at) endpoints within the selected
    1257.                             namespaces will be matched. When both NamespaceSelector
    1258.                             and Selector are defined on the same rule, then only workload
    1259.                             endpoints that are matched by both selectors will be selected
    1260.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    1261.                             implies that the Selector is limited to selecting only
    1262.                             workload endpoints in the same namespace as the NetworkPolicy.
    1263.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    1264.                             that the Selector is limited to selecting only GlobalNetworkSet
    1265.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    1266.                             NamespaceSelector implies the Selector applies to workload
    1267.                             endpoints across all namespaces."
    1268.                           type: string
    1269.                         nets:
    1270.                           description: Nets is an optional field that restricts the
    1271.                             rule to only apply to traffic that originates from (or
    1272.                             terminates at) IP addresses in any of the given subnets.
    1273.                           items:
    1274.                             type: string
    1275.                           type: array
    1276.                         notNets:
    1277.                           description: NotNets is the negated version of the Nets
    1278.                             field.
    1279.                           items:
    1280.                             type: string
    1281.                           type: array
    1282.                         notPorts:
    1283.                           description: NotPorts is the negated version of the Ports
    1284.                             field. Since only some protocols have ports, if any ports
    1285.                             are specified it requires the Protocol match in the Rule
    1286.                             to be set to "TCP" or "UDP".
    1287.                           items:
    1288.                             anyOf:
    1289.                             - type: integer
    1290.                             - type: string
    1291.                             pattern: ^.*
    1292.                             x-kubernetes-int-or-string: true
    1293.                           type: array
    1294.                         notSelector:
    1295.                           description: NotSelector is the negated version of the Selector
    1296.                             field.  See Selector field for subtleties with negated
    1297.                             selectors.
    1298.                           type: string
    1299.                         ports:
    1300.                           description: "Ports is an optional field that restricts
    1301.                             the rule to only apply to traffic that has a source (destination)
    1302.                             port that matches one of these ranges/values. This value
    1303.                             is a list of integers or strings that represent ranges
    1304.                             of ports. \n Since only some protocols have ports, if
    1305.                             any ports are specified it requires the Protocol match
    1306.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    1307.                           items:
    1308.                             anyOf:
    1309.                             - type: integer
    1310.                             - type: string
    1311.                             pattern: ^.*
    1312.                             x-kubernetes-int-or-string: true
    1313.                           type: array
    1314.                         selector:
    1315.                           description: "Selector is an optional field that contains
    1316.                             a selector expression (see Policy for sample syntax).
    1317.                             \ Only traffic that originates from (terminates at) endpoints
    1318.                             matching the selector will be matched. \n Note that: in
    1319.                             addition to the negated version of the Selector (see NotSelector
    1320.                             below), the selector expression syntax itself supports
    1321.                             negation.  The two types of negation are subtly different.
    1322.                             One negates the set of matched endpoints, the other negates
    1323.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    1324.                             packets that are from other Calico-controlled \tendpoints
    1325.                             that do not have the label \"my_label\". \n \tNotSelector
    1326.                             = \"has(my_label)\" matches packets that are not from
    1327.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    1328.                             \n The effect is that the latter will accept packets from
    1329.                             non-Calico sources whereas the former is limited to packets
    1330.                             from Calico-controlled endpoints."
    1331.                           type: string
    1332.                         serviceAccounts:
    1333.                           description: ServiceAccounts is an optional field that restricts
    1334.                             the rule to only apply to traffic that originates from
    1335.                             (or terminates at) a pod running as a matching service
    1336.                             account.
    1337.                           properties:
    1338.                             names:
    1339.                               description: Names is an optional field that restricts
    1340.                                 the rule to only apply to traffic that originates
    1341.                                 from (or terminates at) a pod running as a service
    1342.                                 account whose name is in the list.
    1343.                               items:
    1344.                                 type: string
    1345.                               type: array
    1346.                             selector:
    1347.                               description: Selector is an optional field that restricts
    1348.                                 the rule to only apply to traffic that originates
    1349.                                 from (or terminates at) a pod running as a service
    1350.                                 account that matches the given label selector. If
    1351.                                 both Names and Selector are specified then they are
    1352.                                 AND'ed.
    1353.                               type: string
    1354.                           type: object
    1355.                       type: object
    1356.                   required:
    1357.                   - action
    1358.                   type: object
    1359.                 type: array
    1360.               ingress:
    1361.                 description: The ordered set of ingress rules.  Each rule contains
    1362.                   a set of packet match criteria and a corresponding action to apply.
    1363.                 items:
    1364.                   description: "A Rule encapsulates a set of match criteria and an
    1365.                     action.  Both selector-based security Policy and security Profiles
    1366.                     reference rules - separated out as a list of rules for both ingress
    1367.                     and egress packet matching. \n Each positive match criteria has
    1368.                     a negated version, prefixed with \"Not\". All the match criteria
    1369.                     within a rule must be satisfied for a packet to match. A single
    1370.                     rule can contain the positive and negative version of a match
    1371.                     and both must be satisfied for the rule to match."
    1372.                   properties:
    1373.                     action:
    1374.                       type: string
    1375.                     destination:
    1376.                       description: Destination contains the match criteria that apply
    1377.                         to destination entity.
    1378.                       properties:
    1379.                         namespaceSelector:
    1380.                           description: "NamespaceSelector is an optional field that
    1381.                             contains a selector expression. Only traffic that originates
    1382.                             from (or terminates at) endpoints within the selected
    1383.                             namespaces will be matched. When both NamespaceSelector
    1384.                             and Selector are defined on the same rule, then only workload
    1385.                             endpoints that are matched by both selectors will be selected
    1386.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    1387.                             implies that the Selector is limited to selecting only
    1388.                             workload endpoints in the same namespace as the NetworkPolicy.
    1389.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    1390.                             that the Selector is limited to selecting only GlobalNetworkSet
    1391.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    1392.                             NamespaceSelector implies the Selector applies to workload
    1393.                             endpoints across all namespaces."
    1394.                           type: string
    1395.                         nets:
    1396.                           description: Nets is an optional field that restricts the
    1397.                             rule to only apply to traffic that originates from (or
    1398.                             terminates at) IP addresses in any of the given subnets.
    1399.                           items:
    1400.                             type: string
    1401.                           type: array
    1402.                         notNets:
    1403.                           description: NotNets is the negated version of the Nets
    1404.                             field.
    1405.                           items:
    1406.                             type: string
    1407.                           type: array
    1408.                         notPorts:
    1409.                           description: NotPorts is the negated version of the Ports
    1410.                             field. Since only some protocols have ports, if any ports
    1411.                             are specified it requires the Protocol match in the Rule
    1412.                             to be set to "TCP" or "UDP".
    1413.                           items:
    1414.                             anyOf:
    1415.                             - type: integer
    1416.                             - type: string
    1417.                             pattern: ^.*
    1418.                             x-kubernetes-int-or-string: true
    1419.                           type: array
    1420.                         notSelector:
    1421.                           description: NotSelector is the negated version of the Selector
    1422.                             field.  See Selector field for subtleties with negated
    1423.                             selectors.
    1424.                           type: string
    1425.                         ports:
    1426.                           description: "Ports is an optional field that restricts
    1427.                             the rule to only apply to traffic that has a source (destination)
    1428.                             port that matches one of these ranges/values. This value
    1429.                             is a list of integers or strings that represent ranges
    1430.                             of ports. \n Since only some protocols have ports, if
    1431.                             any ports are specified it requires the Protocol match
    1432.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    1433.                           items:
    1434.                             anyOf:
    1435.                             - type: integer
    1436.                             - type: string
    1437.                             pattern: ^.*
    1438.                             x-kubernetes-int-or-string: true
    1439.                           type: array
    1440.                         selector:
    1441.                           description: "Selector is an optional field that contains
    1442.                             a selector expression (see Policy for sample syntax).
    1443.                             \ Only traffic that originates from (terminates at) endpoints
    1444.                             matching the selector will be matched. \n Note that: in
    1445.                             addition to the negated version of the Selector (see NotSelector
    1446.                             below), the selector expression syntax itself supports
    1447.                             negation.  The two types of negation are subtly different.
    1448.                             One negates the set of matched endpoints, the other negates
    1449.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    1450.                             packets that are from other Calico-controlled \tendpoints
    1451.                             that do not have the label \"my_label\". \n \tNotSelector
    1452.                             = \"has(my_label)\" matches packets that are not from
    1453.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    1454.                             \n The effect is that the latter will accept packets from
    1455.                             non-Calico sources whereas the former is limited to packets
    1456.                             from Calico-controlled endpoints."
    1457.                           type: string
    1458.                         serviceAccounts:
    1459.                           description: ServiceAccounts is an optional field that restricts
    1460.                             the rule to only apply to traffic that originates from
    1461.                             (or terminates at) a pod running as a matching service
    1462.                             account.
    1463.                           properties:
    1464.                             names:
    1465.                               description: Names is an optional field that restricts
    1466.                                 the rule to only apply to traffic that originates
    1467.                                 from (or terminates at) a pod running as a service
    1468.                                 account whose name is in the list.
    1469.                               items:
    1470.                                 type: string
    1471.                               type: array
    1472.                             selector:
    1473.                               description: Selector is an optional field that restricts
    1474.                                 the rule to only apply to traffic that originates
    1475.                                 from (or terminates at) a pod running as a service
    1476.                                 account that matches the given label selector. If
    1477.                                 both Names and Selector are specified then they are
    1478.                                 AND'ed.
    1479.                               type: string
    1480.                           type: object
    1481.                       type: object
    1482.                     http:
    1483.                       description: HTTP contains match criteria that apply to HTTP
    1484.                         requests.
    1485.                       properties:
    1486.                         methods:
    1487.                           description: Methods is an optional field that restricts
    1488.                             the rule to apply only to HTTP requests that use one of
    1489.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
    1490.                             methods are OR'd together.
    1491.                           items:
    1492.                             type: string
    1493.                           type: array
    1494.                         paths:
    1495.                           description: 'Paths is an optional field that restricts
    1496.                             the rule to apply to HTTP requests that use one of the
    1497.                             listed HTTP Paths. Multiple paths are OR''d together.
    1498.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
    1499.                             ONLY specify either a `exact` or a `prefix` match. The
    1500.                             validator will check for it.'
    1501.                           items:
    1502.                             description: 'HTTPPath specifies an HTTP path to match.
    1503.                               It may be either of the form: exact: <path>: which matches
    1504.                               the path exactly or prefix: <path-prefix>: which matches
    1505.                               the path prefix'
    1506.                             properties:
    1507.                               exact:
    1508.                                 type: string
    1509.                               prefix:
    1510.                                 type: string
    1511.                             type: object
    1512.                           type: array
    1513.                       type: object
    1514.                     icmp:
    1515.                       description: ICMP is an optional field that restricts the rule
    1516.                         to apply to a specific type and code of ICMP traffic.  This
    1517.                         should only be specified if the Protocol field is set to "ICMP"
    1518.                         or "ICMPv6".
    1519.                       properties:
    1520.                         code:
    1521.                           description: Match on a specific ICMP code.  If specified,
    1522.                             the Type value must also be specified. This is a technical
    1523.                             limitation imposed by the kernel's iptables firewall,
    1524.                             which Calico uses to enforce the rule.
    1525.                           type: integer
    1526.                         type:
    1527.                           description: Match on a specific ICMP type.  For example
    1528.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    1529.                           type: integer
    1530.                       type: object
    1531.                     ipVersion:
    1532.                       description: IPVersion is an optional field that restricts the
    1533.                         rule to only match a specific IP version.
    1534.                       type: integer
    1535.                     metadata:
    1536.                       description: Metadata contains additional information for this
    1537.                         rule
    1538.                       properties:
    1539.                         annotations:
    1540.                           additionalProperties:
    1541.                             type: string
    1542.                           description: Annotations is a set of key value pairs that
    1543.                             give extra information about the rule
    1544.                           type: object
    1545.                       type: object
    1546.                     notICMP:
    1547.                       description: NotICMP is the negated version of the ICMP field.
    1548.                       properties:
    1549.                         code:
    1550.                           description: Match on a specific ICMP code.  If specified,
    1551.                             the Type value must also be specified. This is a technical
    1552.                             limitation imposed by the kernel's iptables firewall,
    1553.                             which Calico uses to enforce the rule.
    1554.                           type: integer
    1555.                         type:
    1556.                           description: Match on a specific ICMP type.  For example
    1557.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    1558.                           type: integer
    1559.                       type: object
    1560.                     notProtocol:
    1561.                       anyOf:
    1562.                       - type: integer
    1563.                       - type: string
    1564.                       description: NotProtocol is the negated version of the Protocol
    1565.                         field.
    1566.                       pattern: ^.*
    1567.                       x-kubernetes-int-or-string: true
    1568.                     protocol:
    1569.                       anyOf:
    1570.                       - type: integer
    1571.                       - type: string
    1572.                       description: "Protocol is an optional field that restricts the
    1573.                         rule to only apply to traffic of a specific IP protocol. Required
    1574.                         if any of the EntityRules contain Ports (because ports only
    1575.                         apply to certain protocols). \n Must be one of these string
    1576.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
    1577.                         \"UDPLite\" or an integer in the range 1-255."
    1578.                       pattern: ^.*
    1579.                       x-kubernetes-int-or-string: true
    1580.                     source:
    1581.                       description: Source contains the match criteria that apply to
    1582.                         source entity.
    1583.                       properties:
    1584.                         namespaceSelector:
    1585.                           description: "NamespaceSelector is an optional field that
    1586.                             contains a selector expression. Only traffic that originates
    1587.                             from (or terminates at) endpoints within the selected
    1588.                             namespaces will be matched. When both NamespaceSelector
    1589.                             and Selector are defined on the same rule, then only workload
    1590.                             endpoints that are matched by both selectors will be selected
    1591.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    1592.                             implies that the Selector is limited to selecting only
    1593.                             workload endpoints in the same namespace as the NetworkPolicy.
    1594.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    1595.                             that the Selector is limited to selecting only GlobalNetworkSet
    1596.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    1597.                             NamespaceSelector implies the Selector applies to workload
    1598.                             endpoints across all namespaces."
    1599.                           type: string
    1600.                         nets:
    1601.                           description: Nets is an optional field that restricts the
    1602.                             rule to only apply to traffic that originates from (or
    1603.                             terminates at) IP addresses in any of the given subnets.
    1604.                           items:
    1605.                             type: string
    1606.                           type: array
    1607.                         notNets:
    1608.                           description: NotNets is the negated version of the Nets
    1609.                             field.
    1610.                           items:
    1611.                             type: string
    1612.                           type: array
    1613.                         notPorts:
    1614.                           description: NotPorts is the negated version of the Ports
    1615.                             field. Since only some protocols have ports, if any ports
    1616.                             are specified it requires the Protocol match in the Rule
    1617.                             to be set to "TCP" or "UDP".
    1618.                           items:
    1619.                             anyOf:
    1620.                             - type: integer
    1621.                             - type: string
    1622.                             pattern: ^.*
    1623.                             x-kubernetes-int-or-string: true
    1624.                           type: array
    1625.                         notSelector:
    1626.                           description: NotSelector is the negated version of the Selector
    1627.                             field.  See Selector field for subtleties with negated
    1628.                             selectors.
    1629.                           type: string
    1630.                         ports:
    1631.                           description: "Ports is an optional field that restricts
    1632.                             the rule to only apply to traffic that has a source (destination)
    1633.                             port that matches one of these ranges/values. This value
    1634.                             is a list of integers or strings that represent ranges
    1635.                             of ports. \n Since only some protocols have ports, if
    1636.                             any ports are specified it requires the Protocol match
    1637.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    1638.                           items:
    1639.                             anyOf:
    1640.                             - type: integer
    1641.                             - type: string
    1642.                             pattern: ^.*
    1643.                             x-kubernetes-int-or-string: true
    1644.                           type: array
    1645.                         selector:
    1646.                           description: "Selector is an optional field that contains
    1647.                             a selector expression (see Policy for sample syntax).
    1648.                             \ Only traffic that originates from (terminates at) endpoints
    1649.                             matching the selector will be matched. \n Note that: in
    1650.                             addition to the negated version of the Selector (see NotSelector
    1651.                             below), the selector expression syntax itself supports
    1652.                             negation.  The two types of negation are subtly different.
    1653.                             One negates the set of matched endpoints, the other negates
    1654.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    1655.                             packets that are from other Calico-controlled \tendpoints
    1656.                             that do not have the label \"my_label\". \n \tNotSelector
    1657.                             = \"has(my_label)\" matches packets that are not from
    1658.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    1659.                             \n The effect is that the latter will accept packets from
    1660.                             non-Calico sources whereas the former is limited to packets
    1661.                             from Calico-controlled endpoints."
    1662.                           type: string
    1663.                         serviceAccounts:
    1664.                           description: ServiceAccounts is an optional field that restricts
    1665.                             the rule to only apply to traffic that originates from
    1666.                             (or terminates at) a pod running as a matching service
    1667.                             account.
    1668.                           properties:
    1669.                             names:
    1670.                               description: Names is an optional field that restricts
    1671.                                 the rule to only apply to traffic that originates
    1672.                                 from (or terminates at) a pod running as a service
    1673.                                 account whose name is in the list.
    1674.                               items:
    1675.                                 type: string
    1676.                               type: array
    1677.                             selector:
    1678.                               description: Selector is an optional field that restricts
    1679.                                 the rule to only apply to traffic that originates
    1680.                                 from (or terminates at) a pod running as a service
    1681.                                 account that matches the given label selector. If
    1682.                                 both Names and Selector are specified then they are
    1683.                                 AND'ed.
    1684.                               type: string
    1685.                           type: object
    1686.                       type: object
    1687.                   required:
    1688.                   - action
    1689.                   type: object
    1690.                 type: array
    1691.               namespaceSelector:
    1692.                 description: NamespaceSelector is an optional field for an expression
    1693.                   used to select a pod based on namespaces.
    1694.                 type: string
    1695.               order:
    1696.                 description: Order is an optional field that specifies the order in
    1697.                   which the policy is applied. Policies with higher "order" are applied
    1698.                   after those with lower order.  If the order is omitted, it may be
    1699.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
    1700.                   with identical order will be applied in alphanumerical order based
    1701.                   on the Policy "Name".
    1702.                 type: number
    1703.               preDNAT:
    1704.                 description: PreDNAT indicates to apply the rules in this policy before
    1705.                   any DNAT.
    1706.                 type: boolean
    1707.               selector:
    1708.                 description: "The selector is an expression used to pick pick out
    1709.                   the endpoints that the policy should be applied to. \n Selector
    1710.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
    1711.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
    1712.                   \  ->  not equal; also matches if label is not present \tlabel in
    1713.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
    1714.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
    1715.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
    1716.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
    1717.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
    1718.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
    1719.                   or the empty selector -> matches all endpoints. \n Label names are
    1720.                   allowed to contain alphanumerics, -, _ and /. String literals are
    1721.                   more permissive but they do not support escape characters. \n Examples
    1722.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
    1723.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
    1724.                   \"dev\" \t! has(label_name)"
    1725.                 type: string
    1726.               serviceAccountSelector:
    1727.                 description: ServiceAccountSelector is an optional field for an expression
    1728.                   used to select a pod based on service accounts.
    1729.                 type: string
    1730.               types:
    1731.                 description: "Types indicates whether this policy applies to ingress,
    1732.                   or to egress, or to both.  When not explicitly specified (and so
    1733.                   the value on creation is empty or nil), Calico defaults Types according
    1734.                   to what Ingress and Egress rules are present in the policy.  The
    1735.                   default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
    1736.                   (including the case where there are   also no Ingress rules) \n
    1737.                   - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
    1738.                   rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
    1739.                   both Ingress and Egress rules. \n When the policy is read back again,
    1740.                   Types will always be one of these values, never empty or nil."
    1741.                 items:
    1742.                   description: PolicyType enumerates the possible values of the PolicySpec
    1743.                     Types field.
    1744.                   type: string
    1745.                 type: array
    1746.             type: object
    1747.         type: object
    1748.     served: true
    1749.     storage: true
    1750. status:
    1751.   acceptedNames:
    1752.     kind: ""
    1753.     plural: ""
    1754.   conditions: []
    1755.   storedVersions: []
    1757. ---
    1758. apiVersion: apiextensions.k8s.io/v1
    1759. kind: CustomResourceDefinition
    1760. metadata:
    1761.   name: globalnetworksets.crd.projectcalico.org
    1762. spec:
    1763.   group: crd.projectcalico.org
    1764.   names:
    1765.     kind: GlobalNetworkSet
    1766.     listKind: GlobalNetworkSetList
    1767.     plural: globalnetworksets
    1768.     singular: globalnetworkset
    1769.   scope: Cluster
    1770.   versions:
    1771.   - name: v1
    1772.     schema:
    1773.       openAPIV3Schema:
    1774.         description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
    1775.           that share labels to allow rules to refer to them via selectors.  The labels
    1776.           of GlobalNetworkSet are not namespaced.
    1777.         properties:
    1778.           apiVersion:
    1779.             description: 'APIVersion defines the versioned schema of this representation
    1780.               of an object. Servers should convert recognized schemas to the latest
    1781.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    1782.             type: string
    1783.           kind:
    1784.             description: 'Kind is a string value representing the REST resource this
    1785.               object represents. Servers may infer this from the endpoint the client
    1786.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    1787.             type: string
    1788.           metadata:
    1789.             type: object
    1790.           spec:
    1791.             description: GlobalNetworkSetSpec contains the specification for a NetworkSet
    1792.               resource.
    1793.             properties:
    1794.               nets:
    1795.                 description: The list of IP networks that belong to this set.
    1796.                 items:
    1797.                   type: string
    1798.                 type: array
    1799.             type: object
    1800.         type: object
    1801.     served: true
    1802.     storage: true
    1803. status:
    1804.   acceptedNames:
    1805.     kind: ""
    1806.     plural: ""
    1807.   conditions: []
    1808.   storedVersions: []
    1810. ---
    1811. apiVersion: apiextensions.k8s.io/v1
    1812. kind: CustomResourceDefinition
    1813. metadata:
    1814.   name: hostendpoints.crd.projectcalico.org
    1815. spec:
    1816.   group: crd.projectcalico.org
    1817.   names:
    1818.     kind: HostEndpoint
    1819.     listKind: HostEndpointList
    1820.     plural: hostendpoints
    1821.     singular: hostendpoint
    1822.   scope: Cluster
    1823.   versions:
    1824.   - name: v1
    1825.     schema:
    1826.       openAPIV3Schema:
    1827.         properties:
    1828.           apiVersion:
    1829.             description: 'APIVersion defines the versioned schema of this representation
    1830.               of an object. Servers should convert recognized schemas to the latest
    1831.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    1832.             type: string
    1833.           kind:
    1834.             description: 'Kind is a string value representing the REST resource this
    1835.               object represents. Servers may infer this from the endpoint the client
    1836.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    1837.             type: string
    1838.           metadata:
    1839.             type: object
    1840.           spec:
    1841.             description: HostEndpointSpec contains the specification for a HostEndpoint
    1842.               resource.
    1843.             properties:
    1844.               expectedIPs:
    1845.                 description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
    1846.                   If \"InterfaceName\" is not present, Calico will look for an interface
    1847.                   matching any of the IPs in the list and apply policy to that. Note:
    1848.                   \tWhen using the selector match criteria in an ingress or egress
    1849.                   security Policy \tor Profile, Calico converts the selector into
    1850.                   a set of IP addresses. For host \tendpoints, the ExpectedIPs field
    1851.                   is used for that purpose. (If only the interface \tname is specified,
    1852.                   Calico does not learn the IPs of the interface for use in match
    1853.                   \tcriteria.)"
    1854.                 items:
    1855.                   type: string
    1856.                 type: array
    1857.               interfaceName:
    1858.                 description: "Either \"*\", or the name of a specific Linux interface
    1859.                   to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
    1860.                   governs all traffic to, from or through the default network namespace
    1861.                   of the host named by the \"Node\" field; entering and leaving that
    1862.                   namespace via any interface, including those from/to non-host-networked
    1863.                   local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
    1864.                   only governs traffic that enters or leaves the host through the
    1865.                   specific interface named by InterfaceName, or - when InterfaceName
    1866.                   is empty - through the specific interface that has one of the IPs
    1867.                   in ExpectedIPs. Therefore, when InterfaceName is empty, at least
    1868.                   one expected IP must be specified.  Only external interfaces (such
    1869.                   as \"eth0\") are supported here; it isn't possible for a HostEndpoint
    1870.                   to protect traffic through a specific local workload interface.
    1871.                   \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
    1872.                   initially just pre-DNAT policy.  Please check Calico documentation
    1873.                   for the latest position."
    1874.                 type: string
    1875.               node:
    1876.                 description: The node name identifying the Calico node instance.
    1877.                 type: string
    1878.               ports:
    1879.                 description: Ports contains the endpoint's named ports, which may
    1880.                   be referenced in security policy rules.
    1881.                 items:
    1882.                   properties:
    1883.                     name:
    1884.                       type: string
    1885.                     port:
    1886.                       type: integer
    1887.                     protocol:
    1888.                       anyOf:
    1889.                       - type: integer
    1890.                       - type: string
    1891.                       pattern: ^.*
    1892.                       x-kubernetes-int-or-string: true
    1893.                   required:
    1894.                   - name
    1895.                   - port
    1896.                   - protocol
    1897.                   type: object
    1898.                 type: array
    1899.               profiles:
    1900.                 description: A list of identifiers of security Profile objects that
    1901.                   apply to this endpoint. Each profile is applied in the order that
    1902.                   they appear in this list.  Profile rules are applied after the selector-based
    1903.                   security policy.
    1904.                 items:
    1905.                   type: string
    1906.                 type: array
    1907.             type: object
    1908.         type: object
    1909.     served: true
    1910.     storage: true
    1911. status:
    1912.   acceptedNames:
    1913.     kind: ""
    1914.     plural: ""
    1915.   conditions: []
    1916.   storedVersions: []
    1918. ---
    1919. apiVersion: apiextensions.k8s.io/v1
    1920. kind: CustomResourceDefinition
    1921. metadata:
    1922.   name: ipamblocks.crd.projectcalico.org
    1923. spec:
    1924.   group: crd.projectcalico.org
    1925.   names:
    1926.     kind: IPAMBlock
    1927.     listKind: IPAMBlockList
    1928.     plural: ipamblocks
    1929.     singular: ipamblock
    1930.   scope: Cluster
    1931.   versions:
    1932.   - name: v1
    1933.     schema:
    1934.       openAPIV3Schema:
    1935.         properties:
    1936.           apiVersion:
    1937.             description: 'APIVersion defines the versioned schema of this representation
    1938.               of an object. Servers should convert recognized schemas to the latest
    1939.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    1940.             type: string
    1941.           kind:
    1942.             description: 'Kind is a string value representing the REST resource this
    1943.               object represents. Servers may infer this from the endpoint the client
    1944.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    1945.             type: string
    1946.           metadata:
    1947.             type: object
    1948.           spec:
    1949.             description: IPAMBlockSpec contains the specification for an IPAMBlock
    1950.               resource.
    1951.             properties:
    1952.               affinity:
    1953.                 type: string
    1954.               allocations:
    1955.                 items:
    1956.                   type: integer
    1957.                   # TODO: This nullable is manually added in. We should update controller-gen
    1958.                   # to handle []*int properly itself.
    1959.                   nullable: true
    1960.                 type: array
    1961.               attributes:
    1962.                 items:
    1963.                   properties:
    1964.                     handle_id:
    1965.                       type: string
    1966.                     secondary:
    1967.                       additionalProperties:
    1968.                         type: string
    1969.                       type: object
    1970.                   type: object
    1971.                 type: array
    1972.               cidr:
    1973.                 type: string
    1974.               deleted:
    1975.                 type: boolean
    1976.               strictAffinity:
    1977.                 type: boolean
    1978.               unallocated:
    1979.                 items:
    1980.                   type: integer
    1981.                 type: array
    1982.             required:
    1983.             - allocations
    1984.             - attributes
    1985.             - cidr
    1986.             - strictAffinity
    1987.             - unallocated
    1988.             type: object
    1989.         type: object
    1990.     served: true
    1991.     storage: true
    1992. status:
    1993.   acceptedNames:
    1994.     kind: ""
    1995.     plural: ""
    1996.   conditions: []
    1997.   storedVersions: []
    1999. ---
    2000. apiVersion: apiextensions.k8s.io/v1
    2001. kind: CustomResourceDefinition
    2002. metadata:
    2003.   name: ipamconfigs.crd.projectcalico.org
    2004. spec:
    2005.   group: crd.projectcalico.org
    2006.   names:
    2007.     kind: IPAMConfig
    2008.     listKind: IPAMConfigList
    2009.     plural: ipamconfigs
    2010.     singular: ipamconfig
    2011.   scope: Cluster
    2012.   versions:
    2013.   - name: v1
    2014.     schema:
    2015.       openAPIV3Schema:
    2016.         properties:
    2017.           apiVersion:
    2018.             description: 'APIVersion defines the versioned schema of this representation
    2019.               of an object. Servers should convert recognized schemas to the latest
    2020.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    2021.             type: string
    2022.           kind:
    2023.             description: 'Kind is a string value representing the REST resource this
    2024.               object represents. Servers may infer this from the endpoint the client
    2025.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    2026.             type: string
    2027.           metadata:
    2028.             type: object
    2029.           spec:
    2030.             description: IPAMConfigSpec contains the specification for an IPAMConfig
    2031.               resource.
    2032.             properties:
    2033.               autoAllocateBlocks:
    2034.                 type: boolean
    2035.               maxBlocksPerHost:
    2036.                 description: MaxBlocksPerHost, if non-zero, is the max number of blocks
    2037.                   that can be affine to each host.
    2038.                 type: integer
    2039.               strictAffinity:
    2040.                 type: boolean
    2041.             required:
    2042.             - autoAllocateBlocks
    2043.             - strictAffinity
    2044.             type: object
    2045.         type: object
    2046.     served: true
    2047.     storage: true
    2048. status:
    2049.   acceptedNames:
    2050.     kind: ""
    2051.     plural: ""
    2052.   conditions: []
    2053.   storedVersions: []
    2055. ---
    2056. apiVersion: apiextensions.k8s.io/v1
    2057. kind: CustomResourceDefinition
    2058. metadata:
    2059.   name: ipamhandles.crd.projectcalico.org
    2060. spec:
    2061.   group: crd.projectcalico.org
    2062.   names:
    2063.     kind: IPAMHandle
    2064.     listKind: IPAMHandleList
    2065.     plural: ipamhandles
    2066.     singular: ipamhandle
    2067.   scope: Cluster
    2068.   versions:
    2069.   - name: v1
    2070.     schema:
    2071.       openAPIV3Schema:
    2072.         properties:
    2073.           apiVersion:
    2074.             description: 'APIVersion defines the versioned schema of this representation
    2075.               of an object. Servers should convert recognized schemas to the latest
    2076.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    2077.             type: string
    2078.           kind:
    2079.             description: 'Kind is a string value representing the REST resource this
    2080.               object represents. Servers may infer this from the endpoint the client
    2081.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    2082.             type: string
    2083.           metadata:
    2084.             type: object
    2085.           spec:
    2086.             description: IPAMHandleSpec contains the specification for an IPAMHandle
    2087.               resource.
    2088.             properties:
    2089.               block:
    2090.                 additionalProperties:
    2091.                   type: integer
    2092.                 type: object
    2093.               deleted:
    2094.                 type: boolean
    2095.               handleID:
    2096.                 type: string
    2097.             required:
    2098.             - block
    2099.             - handleID
    2100.             type: object
    2101.         type: object
    2102.     served: true
    2103.     storage: true
    2104. status:
    2105.   acceptedNames:
    2106.     kind: ""
    2107.     plural: ""
    2108.   conditions: []
    2109.   storedVersions: []
    2111. ---
    2112. apiVersion: apiextensions.k8s.io/v1
    2113. kind: CustomResourceDefinition
    2114. metadata:
    2115.   name: ippools.crd.projectcalico.org
    2116. spec:
    2117.   group: crd.projectcalico.org
    2118.   names:
    2119.     kind: IPPool
    2120.     listKind: IPPoolList
    2121.     plural: ippools
    2122.     singular: ippool
    2123.   scope: Cluster
    2124.   versions:
    2125.   - name: v1
    2126.     schema:
    2127.       openAPIV3Schema:
    2128.         properties:
    2129.           apiVersion:
    2130.             description: 'APIVersion defines the versioned schema of this representation
    2131.               of an object. Servers should convert recognized schemas to the latest
    2132.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    2133.             type: string
    2134.           kind:
    2135.             description: 'Kind is a string value representing the REST resource this
    2136.               object represents. Servers may infer this from the endpoint the client
    2137.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    2138.             type: string
    2139.           metadata:
    2140.             type: object
    2141.           spec:
    2142.             description: IPPoolSpec contains the specification for an IPPool resource.
    2143.             properties:
    2144.               blockSize:
    2145.                 description: The block size to use for IP address assignments from
    2146.                   this pool. Defaults to 26 for IPv4 and 112 for IPv6.
    2147.                 type: integer
    2148.               cidr:
    2149.                 description: The pool CIDR.
    2150.                 type: string
    2151.               disabled:
    2152.                 description: When disabled is true, Calico IPAM will not assign addresses
    2153.                   from this pool.
    2154.                 type: boolean
    2155.               ipip:
    2156.                 description: 'Deprecated: this field is only used for APIv1 backwards
    2157.                   compatibility. Setting this field is not allowed, this field is
    2158.                   for internal use only.'
    2159.                 properties:
    2160.                   enabled:
    2161.                     description: When enabled is true, ipip tunneling will be used
    2162.                       to deliver packets to destinations within this pool.
    2163.                     type: boolean
    2164.                   mode:
    2165.                     description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
    2166.                       mode of "always" will also use IPIP tunneling for routing to
    2167.                       destination IP addresses within this pool.  A mode of "cross-subnet"
    2168.                       will only use IPIP tunneling when the destination node is on
    2169.                       a different subnet to the originating node.  The default value
    2170.                       (if not specified) is "always".
    2171.                     type: string
    2172.                 type: object
    2173.               ipipMode:
    2174.                 description: Contains configuration for IPIP tunneling for this pool.
    2175.                   If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
    2176.                   is disabled).
    2177.                 type: string
    2178.               nat-outgoing:
    2179.                 description: 'Deprecated: this field is only used for APIv1 backwards
    2180.                   compatibility. Setting this field is not allowed, this field is
    2181.                   for internal use only.'
    2182.                 type: boolean
    2183.               natOutgoing:
    2184.                 description: When nat-outgoing is true, packets sent from Calico networked
    2185.                   containers in this pool to destinations outside of this pool will
    2186.                   be masqueraded.
    2187.                 type: boolean
    2188.               nodeSelector:
    2189.                 description: Allows IPPool to allocate for a specific node by label
    2190.                   selector.
    2191.                 type: string
    2192.               vxlanMode:
    2193.                 description: Contains configuration for VXLAN tunneling for this pool.
    2194.                   If not specified, then this is defaulted to "Never" (i.e. VXLAN
    2195.                   tunneling is disabled).
    2196.                 type: string
    2197.             required:
    2198.             - cidr
    2199.             type: object
    2200.         type: object
    2201.     served: true
    2202.     storage: true
    2203. status:
    2204.   acceptedNames:
    2205.     kind: ""
    2206.     plural: ""
    2207.   conditions: []
    2208.   storedVersions: []
    2210. ---
    2211. apiVersion: apiextensions.k8s.io/v1
    2212. kind: CustomResourceDefinition
    2213. metadata:
    2214.   name: kubecontrollersconfigurations.crd.projectcalico.org
    2215. spec:
    2216.   group: crd.projectcalico.org
    2217.   names:
    2218.     kind: KubeControllersConfiguration
    2219.     listKind: KubeControllersConfigurationList
    2220.     plural: kubecontrollersconfigurations
    2221.     singular: kubecontrollersconfiguration
    2222.   scope: Cluster
    2223.   versions:
    2224.   - name: v1
    2225.     schema:
    2226.       openAPIV3Schema:
    2227.         properties:
    2228.           apiVersion:
    2229.             description: 'APIVersion defines the versioned schema of this representation
    2230.               of an object. Servers should convert recognized schemas to the latest
    2231.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    2232.             type: string
    2233.           kind:
    2234.             description: 'Kind is a string value representing the REST resource this
    2235.               object represents. Servers may infer this from the endpoint the client
    2236.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    2237.             type: string
    2238.           metadata:
    2239.             type: object
    2240.           spec:
    2241.             description: KubeControllersConfigurationSpec contains the values of the
    2242.               Kubernetes controllers configuration.
    2243.             properties:
    2244.               controllers:
    2245.                 description: Controllers enables and configures individual Kubernetes
    2246.                   controllers
    2247.                 properties:
    2248.                   namespace:
    2249.                     description: Namespace enables and configures the namespace controller.
    2250.                       Enabled by default, set to nil to disable.
    2251.                     properties:
    2252.                       reconcilerPeriod:
    2253.                         description: 'ReconcilerPeriod is the period to perform reconciliation
    2254.                           with the Calico datastore. [Default: 5m]'
    2255.                         type: string
    2256.                     type: object
    2257.                   node:
    2258.                     description: Node enables and configures the node controller.
    2259.                       Enabled by default, set to nil to disable.
    2260.                     properties:
    2261.                       hostEndpoint:
    2262.                         description: HostEndpoint controls syncing nodes to host endpoints.
    2263.                           Disabled by default, set to nil to disable.
    2264.                         properties:
    2265.                           autoCreate:
    2266.                             description: 'AutoCreate enables automatic creation of
    2267.                               host endpoints for every node. [Default: Disabled]'
    2268.                             type: string
    2269.                         type: object
    2270.                       reconcilerPeriod:
    2271.                         description: 'ReconcilerPeriod is the period to perform reconciliation
    2272.                           with the Calico datastore. [Default: 5m]'
    2273.                         type: string
    2274.                       syncLabels:
    2275.                         description: 'SyncLabels controls whether to copy Kubernetes
    2276.                           node labels to Calico nodes. [Default: Enabled]'
    2277.                         type: string
    2278.                     type: object
    2279.                   policy:
    2280.                     description: Policy enables and configures the policy controller.
    2281.                       Enabled by default, set to nil to disable.
    2282.                     properties:
    2283.                       reconcilerPeriod:
    2284.                         description: 'ReconcilerPeriod is the period to perform reconciliation
    2285.                           with the Calico datastore. [Default: 5m]'
    2286.                         type: string
    2287.                     type: object
    2288.                   serviceAccount:
    2289.                     description: ServiceAccount enables and configures the service
    2290.                       account controller. Enabled by default, set to nil to disable.
    2291.                     properties:
    2292.                       reconcilerPeriod:
    2293.                         description: 'ReconcilerPeriod is the period to perform reconciliation
    2294.                           with the Calico datastore. [Default: 5m]'
    2295.                         type: string
    2296.                     type: object
    2297.                   workloadEndpoint:
    2298.                     description: WorkloadEndpoint enables and configures the workload
    2299.                       endpoint controller. Enabled by default, set to nil to disable.
    2300.                     properties:
    2301.                       reconcilerPeriod:
    2302.                         description: 'ReconcilerPeriod is the period to perform reconciliation
    2303.                           with the Calico datastore. [Default: 5m]'
    2304.                         type: string
    2305.                     type: object
    2306.                 type: object
    2307.               etcdV3CompactionPeriod:
    2308.                 description: 'EtcdV3CompactionPeriod is the period between etcdv3
    2309.                   compaction requests. Set to 0 to disable. [Default: 10m]'
    2310.                 type: string
    2311.               healthChecks:
    2312.                 description: 'HealthChecks enables or disables support for health
    2313.                   checks [Default: Enabled]'
    2314.                 type: string
    2315.               logSeverityScreen:
    2316.                 description: 'LogSeverityScreen is the log severity above which logs
    2317.                   are sent to the stdout. [Default: Info]'
    2318.                 type: string
    2319.               prometheusMetricsPort:
    2320.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
    2321.                   metrics server should bind to. Set to 0 to disable. [Default: 9094]'
    2322.                 type: integer
    2323.             required:
    2324.             - controllers
    2325.             type: object
    2326.           status:
    2327.             description: KubeControllersConfigurationStatus represents the status
    2328.               of the configuration. It's useful for admins to be able to see the actual
    2329.               config that was applied, which can be modified by environment variables
    2330.               on the kube-controllers process.
    2331.             properties:
    2332.               environmentVars:
    2333.                 additionalProperties:
    2334.                   type: string
    2335.                 description: EnvironmentVars contains the environment variables on
    2336.                   the kube-controllers that influenced the RunningConfig.
    2337.                 type: object
    2338.               runningConfig:
    2339.                 description: RunningConfig contains the effective config that is running
    2340.                   in the kube-controllers pod, after merging the API resource with
    2341.                   any environment variables.
    2342.                 properties:
    2343.                   controllers:
    2344.                     description: Controllers enables and configures individual Kubernetes
    2345.                       controllers
    2346.                     properties:
    2347.                       namespace:
    2348.                         description: Namespace enables and configures the namespace
    2349.                           controller. Enabled by default, set to nil to disable.
    2350.                         properties:
    2351.                           reconcilerPeriod:
    2352.                             description: 'ReconcilerPeriod is the period to perform
    2353.                               reconciliation with the Calico datastore. [Default:
    2354.                               5m]'
    2355.                             type: string
    2356.                         type: object
    2357.                       node:
    2358.                         description: Node enables and configures the node controller.
    2359.                           Enabled by default, set to nil to disable.
    2360.                         properties:
    2361.                           hostEndpoint:
    2362.                             description: HostEndpoint controls syncing nodes to host
    2363.                               endpoints. Disabled by default, set to nil to disable.
    2364.                             properties:
    2365.                               autoCreate:
    2366.                                 description: 'AutoCreate enables automatic creation
    2367.                                   of host endpoints for every node. [Default: Disabled]'
    2368.                                 type: string
    2369.                             type: object
    2370.                           reconcilerPeriod:
    2371.                             description: 'ReconcilerPeriod is the period to perform
    2372.                               reconciliation with the Calico datastore. [Default:
    2373.                               5m]'
    2374.                             type: string
    2375.                           syncLabels:
    2376.                             description: 'SyncLabels controls whether to copy Kubernetes
    2377.                               node labels to Calico nodes. [Default: Enabled]'
    2378.                             type: string
    2379.                         type: object
    2380.                       policy:
    2381.                         description: Policy enables and configures the policy controller.
    2382.                           Enabled by default, set to nil to disable.
    2383.                         properties:
    2384.                           reconcilerPeriod:
    2385.                             description: 'ReconcilerPeriod is the period to perform
    2386.                               reconciliation with the Calico datastore. [Default:
    2387.                               5m]'
    2388.                             type: string
    2389.                         type: object
    2390.                       serviceAccount:
    2391.                         description: ServiceAccount enables and configures the service
    2392.                           account controller. Enabled by default, set to nil to disable.
    2393.                         properties:
    2394.                           reconcilerPeriod:
    2395.                             description: 'ReconcilerPeriod is the period to perform
    2396.                               reconciliation with the Calico datastore. [Default:
    2397.                               5m]'
    2398.                             type: string
    2399.                         type: object
    2400.                       workloadEndpoint:
    2401.                         description: WorkloadEndpoint enables and configures the workload
    2402.                           endpoint controller. Enabled by default, set to nil to disable.
    2403.                         properties:
    2404.                           reconcilerPeriod:
    2405.                             description: 'ReconcilerPeriod is the period to perform
    2406.                               reconciliation with the Calico datastore. [Default:
    2407.                               5m]'
    2408.                             type: string
    2409.                         type: object
    2410.                     type: object
    2411.                   etcdV3CompactionPeriod:
    2412.                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
    2413.                       compaction requests. Set to 0 to disable. [Default: 10m]'
    2414.                     type: string
    2415.                   healthChecks:
    2416.                     description: 'HealthChecks enables or disables support for health
    2417.                       checks [Default: Enabled]'
    2418.                     type: string
    2419.                   logSeverityScreen:
    2420.                     description: 'LogSeverityScreen is the log severity above which
    2421.                       logs are sent to the stdout. [Default: Info]'
    2422.                     type: string
    2423.                   prometheusMetricsPort:
    2424.                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
    2425.                       metrics server should bind to. Set to 0 to disable. [Default:
    2426.                       9094]'
    2427.                     type: integer
    2428.                 required:
    2429.                 - controllers
    2430.                 type: object
    2431.             type: object
    2432.         type: object
    2433.     served: true
    2434.     storage: true
    2435. status:
    2436.   acceptedNames:
    2437.     kind: ""
    2438.     plural: ""
    2439.   conditions: []
    2440.   storedVersions: []
    2442. ---
    2443. apiVersion: apiextensions.k8s.io/v1
    2444. kind: CustomResourceDefinition
    2445. metadata:
    2446.   name: networkpolicies.crd.projectcalico.org
    2447. spec:
    2448.   group: crd.projectcalico.org
    2449.   names:
    2450.     kind: NetworkPolicy
    2451.     listKind: NetworkPolicyList
    2452.     plural: networkpolicies
    2453.     singular: networkpolicy
    2454.   scope: Namespaced
    2455.   versions:
    2456.   - name: v1
    2457.     schema:
    2458.       openAPIV3Schema:
    2459.         properties:
    2460.           apiVersion:
    2461.             description: 'APIVersion defines the versioned schema of this representation
    2462.               of an object. Servers should convert recognized schemas to the latest
    2463.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    2464.             type: string
    2465.           kind:
    2466.             description: 'Kind is a string value representing the REST resource this
    2467.               object represents. Servers may infer this from the endpoint the client
    2468.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    2469.             type: string
    2470.           metadata:
    2471.             type: object
    2472.           spec:
    2473.             properties:
    2474.               egress:
    2475.                 description: The ordered set of egress rules.  Each rule contains
    2476.                   a set of packet match criteria and a corresponding action to apply.
    2477.                 items:
    2478.                   description: "A Rule encapsulates a set of match criteria and an
    2479.                     action.  Both selector-based security Policy and security Profiles
    2480.                     reference rules - separated out as a list of rules for both ingress
    2481.                     and egress packet matching. \n Each positive match criteria has
    2482.                     a negated version, prefixed with \"Not\". All the match criteria
    2483.                     within a rule must be satisfied for a packet to match. A single
    2484.                     rule can contain the positive and negative version of a match
    2485.                     and both must be satisfied for the rule to match."
    2486.                   properties:
    2487.                     action:
    2488.                       type: string
    2489.                     destination:
    2490.                       description: Destination contains the match criteria that apply
    2491.                         to destination entity.
    2492.                       properties:
    2493.                         namespaceSelector:
    2494.                           description: "NamespaceSelector is an optional field that
    2495.                             contains a selector expression. Only traffic that originates
    2496.                             from (or terminates at) endpoints within the selected
    2497.                             namespaces will be matched. When both NamespaceSelector
    2498.                             and Selector are defined on the same rule, then only workload
    2499.                             endpoints that are matched by both selectors will be selected
    2500.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    2501.                             implies that the Selector is limited to selecting only
    2502.                             workload endpoints in the same namespace as the NetworkPolicy.
    2503.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    2504.                             that the Selector is limited to selecting only GlobalNetworkSet
    2505.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    2506.                             NamespaceSelector implies the Selector applies to workload
    2507.                             endpoints across all namespaces."
    2508.                           type: string
    2509.                         nets:
    2510.                           description: Nets is an optional field that restricts the
    2511.                             rule to only apply to traffic that originates from (or
    2512.                             terminates at) IP addresses in any of the given subnets.
    2513.                           items:
    2514.                             type: string
    2515.                           type: array
    2516.                         notNets:
    2517.                           description: NotNets is the negated version of the Nets
    2518.                             field.
    2519.                           items:
    2520.                             type: string
    2521.                           type: array
    2522.                         notPorts:
    2523.                           description: NotPorts is the negated version of the Ports
    2524.                             field. Since only some protocols have ports, if any ports
    2525.                             are specified it requires the Protocol match in the Rule
    2526.                             to be set to "TCP" or "UDP".
    2527.                           items:
    2528.                             anyOf:
    2529.                             - type: integer
    2530.                             - type: string
    2531.                             pattern: ^.*
    2532.                             x-kubernetes-int-or-string: true
    2533.                           type: array
    2534.                         notSelector:
    2535.                           description: NotSelector is the negated version of the Selector
    2536.                             field.  See Selector field for subtleties with negated
    2537.                             selectors.
    2538.                           type: string
    2539.                         ports:
    2540.                           description: "Ports is an optional field that restricts
    2541.                             the rule to only apply to traffic that has a source (destination)
    2542.                             port that matches one of these ranges/values. This value
    2543.                             is a list of integers or strings that represent ranges
    2544.                             of ports. \n Since only some protocols have ports, if
    2545.                             any ports are specified it requires the Protocol match
    2546.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    2547.                           items:
    2548.                             anyOf:
    2549.                             - type: integer
    2550.                             - type: string
    2551.                             pattern: ^.*
    2552.                             x-kubernetes-int-or-string: true
    2553.                           type: array
    2554.                         selector:
    2555.                           description: "Selector is an optional field that contains
    2556.                             a selector expression (see Policy for sample syntax).
    2557.                             \ Only traffic that originates from (terminates at) endpoints
    2558.                             matching the selector will be matched. \n Note that: in
    2559.                             addition to the negated version of the Selector (see NotSelector
    2560.                             below), the selector expression syntax itself supports
    2561.                             negation.  The two types of negation are subtly different.
    2562.                             One negates the set of matched endpoints, the other negates
    2563.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    2564.                             packets that are from other Calico-controlled \tendpoints
    2565.                             that do not have the label \"my_label\". \n \tNotSelector
    2566.                             = \"has(my_label)\" matches packets that are not from
    2567.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    2568.                             \n The effect is that the latter will accept packets from
    2569.                             non-Calico sources whereas the former is limited to packets
    2570.                             from Calico-controlled endpoints."
    2571.                           type: string
    2572.                         serviceAccounts:
    2573.                           description: ServiceAccounts is an optional field that restricts
    2574.                             the rule to only apply to traffic that originates from
    2575.                             (or terminates at) a pod running as a matching service
    2576.                             account.
    2577.                           properties:
    2578.                             names:
    2579.                               description: Names is an optional field that restricts
    2580.                                 the rule to only apply to traffic that originates
    2581.                                 from (or terminates at) a pod running as a service
    2582.                                 account whose name is in the list.
    2583.                               items:
    2584.                                 type: string
    2585.                               type: array
    2586.                             selector:
    2587.                               description: Selector is an optional field that restricts
    2588.                                 the rule to only apply to traffic that originates
    2589.                                 from (or terminates at) a pod running as a service
    2590.                                 account that matches the given label selector. If
    2591.                                 both Names and Selector are specified then they are
    2592.                                 AND'ed.
    2593.                               type: string
    2594.                           type: object
    2595.                       type: object
    2596.                     http:
    2597.                       description: HTTP contains match criteria that apply to HTTP
    2598.                         requests.
    2599.                       properties:
    2600.                         methods:
    2601.                           description: Methods is an optional field that restricts
    2602.                             the rule to apply only to HTTP requests that use one of
    2603.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
    2604.                             methods are OR'd together.
    2605.                           items:
    2606.                             type: string
    2607.                           type: array
    2608.                         paths:
    2609.                           description: 'Paths is an optional field that restricts
    2610.                             the rule to apply to HTTP requests that use one of the
    2611.                             listed HTTP Paths. Multiple paths are OR''d together.
    2612.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
    2613.                             ONLY specify either a `exact` or a `prefix` match. The
    2614.                             validator will check for it.'
    2615.                           items:
    2616.                             description: 'HTTPPath specifies an HTTP path to match.
    2617.                               It may be either of the form: exact: <path>: which matches
    2618.                               the path exactly or prefix: <path-prefix>: which matches
    2619.                               the path prefix'
    2620.                             properties:
    2621.                               exact:
    2622.                                 type: string
    2623.                               prefix:
    2624.                                 type: string
    2625.                             type: object
    2626.                           type: array
    2627.                       type: object
    2628.                     icmp:
    2629.                       description: ICMP is an optional field that restricts the rule
    2630.                         to apply to a specific type and code of ICMP traffic.  This
    2631.                         should only be specified if the Protocol field is set to "ICMP"
    2632.                         or "ICMPv6".
    2633.                       properties:
    2634.                         code:
    2635.                           description: Match on a specific ICMP code.  If specified,
    2636.                             the Type value must also be specified. This is a technical
    2637.                             limitation imposed by the kernel's iptables firewall,
    2638.                             which Calico uses to enforce the rule.
    2639.                           type: integer
    2640.                         type:
    2641.                           description: Match on a specific ICMP type.  For example
    2642.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    2643.                           type: integer
    2644.                       type: object
    2645.                     ipVersion:
    2646.                       description: IPVersion is an optional field that restricts the
    2647.                         rule to only match a specific IP version.
    2648.                       type: integer
    2649.                     metadata:
    2650.                       description: Metadata contains additional information for this
    2651.                         rule
    2652.                       properties:
    2653.                         annotations:
    2654.                           additionalProperties:
    2655.                             type: string
    2656.                           description: Annotations is a set of key value pairs that
    2657.                             give extra information about the rule
    2658.                           type: object
    2659.                       type: object
    2660.                     notICMP:
    2661.                       description: NotICMP is the negated version of the ICMP field.
    2662.                       properties:
    2663.                         code:
    2664.                           description: Match on a specific ICMP code.  If specified,
    2665.                             the Type value must also be specified. This is a technical
    2666.                             limitation imposed by the kernel's iptables firewall,
    2667.                             which Calico uses to enforce the rule.
    2668.                           type: integer
    2669.                         type:
    2670.                           description: Match on a specific ICMP type.  For example
    2671.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    2672.                           type: integer
    2673.                       type: object
    2674.                     notProtocol:
    2675.                       anyOf:
    2676.                       - type: integer
    2677.                       - type: string
    2678.                       description: NotProtocol is the negated version of the Protocol
    2679.                         field.
    2680.                       pattern: ^.*
    2681.                       x-kubernetes-int-or-string: true
    2682.                     protocol:
    2683.                       anyOf:
    2684.                       - type: integer
    2685.                       - type: string
    2686.                       description: "Protocol is an optional field that restricts the
    2687.                         rule to only apply to traffic of a specific IP protocol. Required
    2688.                         if any of the EntityRules contain Ports (because ports only
    2689.                         apply to certain protocols). \n Must be one of these string
    2690.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
    2691.                         \"UDPLite\" or an integer in the range 1-255."
    2692.                       pattern: ^.*
    2693.                       x-kubernetes-int-or-string: true
    2694.                     source:
    2695.                       description: Source contains the match criteria that apply to
    2696.                         source entity.
    2697.                       properties:
    2698.                         namespaceSelector:
    2699.                           description: "NamespaceSelector is an optional field that
    2700.                             contains a selector expression. Only traffic that originates
    2701.                             from (or terminates at) endpoints within the selected
    2702.                             namespaces will be matched. When both NamespaceSelector
    2703.                             and Selector are defined on the same rule, then only workload
    2704.                             endpoints that are matched by both selectors will be selected
    2705.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    2706.                             implies that the Selector is limited to selecting only
    2707.                             workload endpoints in the same namespace as the NetworkPolicy.
    2708.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    2709.                             that the Selector is limited to selecting only GlobalNetworkSet
    2710.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    2711.                             NamespaceSelector implies the Selector applies to workload
    2712.                             endpoints across all namespaces."
    2713.                           type: string
    2714.                         nets:
    2715.                           description: Nets is an optional field that restricts the
    2716.                             rule to only apply to traffic that originates from (or
    2717.                             terminates at) IP addresses in any of the given subnets.
    2718.                           items:
    2719.                             type: string
    2720.                           type: array
    2721.                         notNets:
    2722.                           description: NotNets is the negated version of the Nets
    2723.                             field.
    2724.                           items:
    2725.                             type: string
    2726.                           type: array
    2727.                         notPorts:
    2728.                           description: NotPorts is the negated version of the Ports
    2729.                             field. Since only some protocols have ports, if any ports
    2730.                             are specified it requires the Protocol match in the Rule
    2731.                             to be set to "TCP" or "UDP".
    2732.                           items:
    2733.                             anyOf:
    2734.                             - type: integer
    2735.                             - type: string
    2736.                             pattern: ^.*
    2737.                             x-kubernetes-int-or-string: true
    2738.                           type: array
    2739.                         notSelector:
    2740.                           description: NotSelector is the negated version of the Selector
    2741.                             field.  See Selector field for subtleties with negated
    2742.                             selectors.
    2743.                           type: string
    2744.                         ports:
    2745.                           description: "Ports is an optional field that restricts
    2746.                             the rule to only apply to traffic that has a source (destination)
    2747.                             port that matches one of these ranges/values. This value
    2748.                             is a list of integers or strings that represent ranges
    2749.                             of ports. \n Since only some protocols have ports, if
    2750.                             any ports are specified it requires the Protocol match
    2751.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    2752.                           items:
    2753.                             anyOf:
    2754.                             - type: integer
    2755.                             - type: string
    2756.                             pattern: ^.*
    2757.                             x-kubernetes-int-or-string: true
    2758.                           type: array
    2759.                         selector:
    2760.                           description: "Selector is an optional field that contains
    2761.                             a selector expression (see Policy for sample syntax).
    2762.                             \ Only traffic that originates from (terminates at) endpoints
    2763.                             matching the selector will be matched. \n Note that: in
    2764.                             addition to the negated version of the Selector (see NotSelector
    2765.                             below), the selector expression syntax itself supports
    2766.                             negation.  The two types of negation are subtly different.
    2767.                             One negates the set of matched endpoints, the other negates
    2768.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    2769.                             packets that are from other Calico-controlled \tendpoints
    2770.                             that do not have the label \"my_label\". \n \tNotSelector
    2771.                             = \"has(my_label)\" matches packets that are not from
    2772.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    2773.                             \n The effect is that the latter will accept packets from
    2774.                             non-Calico sources whereas the former is limited to packets
    2775.                             from Calico-controlled endpoints."
    2776.                           type: string
    2777.                         serviceAccounts:
    2778.                           description: ServiceAccounts is an optional field that restricts
    2779.                             the rule to only apply to traffic that originates from
    2780.                             (or terminates at) a pod running as a matching service
    2781.                             account.
    2782.                           properties:
    2783.                             names:
    2784.                               description: Names is an optional field that restricts
    2785.                                 the rule to only apply to traffic that originates
    2786.                                 from (or terminates at) a pod running as a service
    2787.                                 account whose name is in the list.
    2788.                               items:
    2789.                                 type: string
    2790.                               type: array
    2791.                             selector:
    2792.                               description: Selector is an optional field that restricts
    2793.                                 the rule to only apply to traffic that originates
    2794.                                 from (or terminates at) a pod running as a service
    2795.                                 account that matches the given label selector. If
    2796.                                 both Names and Selector are specified then they are
    2797.                                 AND'ed.
    2798.                               type: string
    2799.                           type: object
    2800.                       type: object
    2801.                   required:
    2802.                   - action
    2803.                   type: object
    2804.                 type: array
    2805.               ingress:
    2806.                 description: The ordered set of ingress rules.  Each rule contains
    2807.                   a set of packet match criteria and a corresponding action to apply.
    2808.                 items:
    2809.                   description: "A Rule encapsulates a set of match criteria and an
    2810.                     action.  Both selector-based security Policy and security Profiles
    2811.                     reference rules - separated out as a list of rules for both ingress
    2812.                     and egress packet matching. \n Each positive match criteria has
    2813.                     a negated version, prefixed with \"Not\". All the match criteria
    2814.                     within a rule must be satisfied for a packet to match. A single
    2815.                     rule can contain the positive and negative version of a match
    2816.                     and both must be satisfied for the rule to match."
    2817.                   properties:
    2818.                     action:
    2819.                       type: string
    2820.                     destination:
    2821.                       description: Destination contains the match criteria that apply
    2822.                         to destination entity.
    2823.                       properties:
    2824.                         namespaceSelector:
    2825.                           description: "NamespaceSelector is an optional field that
    2826.                             contains a selector expression. Only traffic that originates
    2827.                             from (or terminates at) endpoints within the selected
    2828.                             namespaces will be matched. When both NamespaceSelector
    2829.                             and Selector are defined on the same rule, then only workload
    2830.                             endpoints that are matched by both selectors will be selected
    2831.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    2832.                             implies that the Selector is limited to selecting only
    2833.                             workload endpoints in the same namespace as the NetworkPolicy.
    2834.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    2835.                             that the Selector is limited to selecting only GlobalNetworkSet
    2836.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    2837.                             NamespaceSelector implies the Selector applies to workload
    2838.                             endpoints across all namespaces."
    2839.                           type: string
    2840.                         nets:
    2841.                           description: Nets is an optional field that restricts the
    2842.                             rule to only apply to traffic that originates from (or
    2843.                             terminates at) IP addresses in any of the given subnets.
    2844.                           items:
    2845.                             type: string
    2846.                           type: array
    2847.                         notNets:
    2848.                           description: NotNets is the negated version of the Nets
    2849.                             field.
    2850.                           items:
    2851.                             type: string
    2852.                           type: array
    2853.                         notPorts:
    2854.                           description: NotPorts is the negated version of the Ports
    2855.                             field. Since only some protocols have ports, if any ports
    2856.                             are specified it requires the Protocol match in the Rule
    2857.                             to be set to "TCP" or "UDP".
    2858.                           items:
    2859.                             anyOf:
    2860.                             - type: integer
    2861.                             - type: string
    2862.                             pattern: ^.*
    2863.                             x-kubernetes-int-or-string: true
    2864.                           type: array
    2865.                         notSelector:
    2866.                           description: NotSelector is the negated version of the Selector
    2867.                             field.  See Selector field for subtleties with negated
    2868.                             selectors.
    2869.                           type: string
    2870.                         ports:
    2871.                           description: "Ports is an optional field that restricts
    2872.                             the rule to only apply to traffic that has a source (destination)
    2873.                             port that matches one of these ranges/values. This value
    2874.                             is a list of integers or strings that represent ranges
    2875.                             of ports. \n Since only some protocols have ports, if
    2876.                             any ports are specified it requires the Protocol match
    2877.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    2878.                           items:
    2879.                             anyOf:
    2880.                             - type: integer
    2881.                             - type: string
    2882.                             pattern: ^.*
    2883.                             x-kubernetes-int-or-string: true
    2884.                           type: array
    2885.                         selector:
    2886.                           description: "Selector is an optional field that contains
    2887.                             a selector expression (see Policy for sample syntax).
    2888.                             \ Only traffic that originates from (terminates at) endpoints
    2889.                             matching the selector will be matched. \n Note that: in
    2890.                             addition to the negated version of the Selector (see NotSelector
    2891.                             below), the selector expression syntax itself supports
    2892.                             negation.  The two types of negation are subtly different.
    2893.                             One negates the set of matched endpoints, the other negates
    2894.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    2895.                             packets that are from other Calico-controlled \tendpoints
    2896.                             that do not have the label \"my_label\". \n \tNotSelector
    2897.                             = \"has(my_label)\" matches packets that are not from
    2898.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    2899.                             \n The effect is that the latter will accept packets from
    2900.                             non-Calico sources whereas the former is limited to packets
    2901.                             from Calico-controlled endpoints."
    2902.                           type: string
    2903.                         serviceAccounts:
    2904.                           description: ServiceAccounts is an optional field that restricts
    2905.                             the rule to only apply to traffic that originates from
    2906.                             (or terminates at) a pod running as a matching service
    2907.                             account.
    2908.                           properties:
    2909.                             names:
    2910.                               description: Names is an optional field that restricts
    2911.                                 the rule to only apply to traffic that originates
    2912.                                 from (or terminates at) a pod running as a service
    2913.                                 account whose name is in the list.
    2914.                               items:
    2915.                                 type: string
    2916.                               type: array
    2917.                             selector:
    2918.                               description: Selector is an optional field that restricts
    2919.                                 the rule to only apply to traffic that originates
    2920.                                 from (or terminates at) a pod running as a service
    2921.                                 account that matches the given label selector. If
    2922.                                 both Names and Selector are specified then they are
    2923.                                 AND'ed.
    2924.                               type: string
    2925.                           type: object
    2926.                       type: object
    2927.                     http:
    2928.                       description: HTTP contains match criteria that apply to HTTP
    2929.                         requests.
    2930.                       properties:
    2931.                         methods:
    2932.                           description: Methods is an optional field that restricts
    2933.                             the rule to apply only to HTTP requests that use one of
    2934.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
    2935.                             methods are OR'd together.
    2936.                           items:
    2937.                             type: string
    2938.                           type: array
    2939.                         paths:
    2940.                           description: 'Paths is an optional field that restricts
    2941.                             the rule to apply to HTTP requests that use one of the
    2942.                             listed HTTP Paths. Multiple paths are OR''d together.
    2943.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
    2944.                             ONLY specify either a `exact` or a `prefix` match. The
    2945.                             validator will check for it.'
    2946.                           items:
    2947.                             description: 'HTTPPath specifies an HTTP path to match.
    2948.                               It may be either of the form: exact: <path>: which matches
    2949.                               the path exactly or prefix: <path-prefix>: which matches
    2950.                               the path prefix'
    2951.                             properties:
    2952.                               exact:
    2953.                                 type: string
    2954.                               prefix:
    2955.                                 type: string
    2956.                             type: object
    2957.                           type: array
    2958.                       type: object
    2959.                     icmp:
    2960.                       description: ICMP is an optional field that restricts the rule
    2961.                         to apply to a specific type and code of ICMP traffic.  This
    2962.                         should only be specified if the Protocol field is set to "ICMP"
    2963.                         or "ICMPv6".
    2964.                       properties:
    2965.                         code:
    2966.                           description: Match on a specific ICMP code.  If specified,
    2967.                             the Type value must also be specified. This is a technical
    2968.                             limitation imposed by the kernel's iptables firewall,
    2969.                             which Calico uses to enforce the rule.
    2970.                           type: integer
    2971.                         type:
    2972.                           description: Match on a specific ICMP type.  For example
    2973.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    2974.                           type: integer
    2975.                       type: object
    2976.                     ipVersion:
    2977.                       description: IPVersion is an optional field that restricts the
    2978.                         rule to only match a specific IP version.
    2979.                       type: integer
    2980.                     metadata:
    2981.                       description: Metadata contains additional information for this
    2982.                         rule
    2983.                       properties:
    2984.                         annotations:
    2985.                           additionalProperties:
    2986.                             type: string
    2987.                           description: Annotations is a set of key value pairs that
    2988.                             give extra information about the rule
    2989.                           type: object
    2990.                       type: object
    2991.                     notICMP:
    2992.                       description: NotICMP is the negated version of the ICMP field.
    2993.                       properties:
    2994.                         code:
    2995.                           description: Match on a specific ICMP code.  If specified,
    2996.                             the Type value must also be specified. This is a technical
    2997.                             limitation imposed by the kernel's iptables firewall,
    2998.                             which Calico uses to enforce the rule.
    2999.                           type: integer
    3000.                         type:
    3001.                           description: Match on a specific ICMP type.  For example
    3002.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
    3003.                           type: integer
    3004.                       type: object
    3005.                     notProtocol:
    3006.                       anyOf:
    3007.                       - type: integer
    3008.                       - type: string
    3009.                       description: NotProtocol is the negated version of the Protocol
    3010.                         field.
    3011.                       pattern: ^.*
    3012.                       x-kubernetes-int-or-string: true
    3013.                     protocol:
    3014.                       anyOf:
    3015.                       - type: integer
    3016.                       - type: string
    3017.                       description: "Protocol is an optional field that restricts the
    3018.                         rule to only apply to traffic of a specific IP protocol. Required
    3019.                         if any of the EntityRules contain Ports (because ports only
    3020.                         apply to certain protocols). \n Must be one of these string
    3021.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
    3022.                         \"UDPLite\" or an integer in the range 1-255."
    3023.                       pattern: ^.*
    3024.                       x-kubernetes-int-or-string: true
    3025.                     source:
    3026.                       description: Source contains the match criteria that apply to
    3027.                         source entity.
    3028.                       properties:
    3029.                         namespaceSelector:
    3030.                           description: "NamespaceSelector is an optional field that
    3031.                             contains a selector expression. Only traffic that originates
    3032.                             from (or terminates at) endpoints within the selected
    3033.                             namespaces will be matched. When both NamespaceSelector
    3034.                             and Selector are defined on the same rule, then only workload
    3035.                             endpoints that are matched by both selectors will be selected
    3036.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
    3037.                             implies that the Selector is limited to selecting only
    3038.                             workload endpoints in the same namespace as the NetworkPolicy.
    3039.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
    3040.                             that the Selector is limited to selecting only GlobalNetworkSet
    3041.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
    3042.                             NamespaceSelector implies the Selector applies to workload
    3043.                             endpoints across all namespaces."
    3044.                           type: string
    3045.                         nets:
    3046.                           description: Nets is an optional field that restricts the
    3047.                             rule to only apply to traffic that originates from (or
    3048.                             terminates at) IP addresses in any of the given subnets.
    3049.                           items:
    3050.                             type: string
    3051.                           type: array
    3052.                         notNets:
    3053.                           description: NotNets is the negated version of the Nets
    3054.                             field.
    3055.                           items:
    3056.                             type: string
    3057.                           type: array
    3058.                         notPorts:
    3059.                           description: NotPorts is the negated version of the Ports
    3060.                             field. Since only some protocols have ports, if any ports
    3061.                             are specified it requires the Protocol match in the Rule
    3062.                             to be set to "TCP" or "UDP".
    3063.                           items:
    3064.                             anyOf:
    3065.                             - type: integer
    3066.                             - type: string
    3067.                             pattern: ^.*
    3068.                             x-kubernetes-int-or-string: true
    3069.                           type: array
    3070.                         notSelector:
    3071.                           description: NotSelector is the negated version of the Selector
    3072.                             field.  See Selector field for subtleties with negated
    3073.                             selectors.
    3074.                           type: string
    3075.                         ports:
    3076.                           description: "Ports is an optional field that restricts
    3077.                             the rule to only apply to traffic that has a source (destination)
    3078.                             port that matches one of these ranges/values. This value
    3079.                             is a list of integers or strings that represent ranges
    3080.                             of ports. \n Since only some protocols have ports, if
    3081.                             any ports are specified it requires the Protocol match
    3082.                             in the Rule to be set to \"TCP\" or \"UDP\"."
    3083.                           items:
    3084.                             anyOf:
    3085.                             - type: integer
    3086.                             - type: string
    3087.                             pattern: ^.*
    3088.                             x-kubernetes-int-or-string: true
    3089.                           type: array
    3090.                         selector:
    3091.                           description: "Selector is an optional field that contains
    3092.                             a selector expression (see Policy for sample syntax).
    3093.                             \ Only traffic that originates from (terminates at) endpoints
    3094.                             matching the selector will be matched. \n Note that: in
    3095.                             addition to the negated version of the Selector (see NotSelector
    3096.                             below), the selector expression syntax itself supports
    3097.                             negation.  The two types of negation are subtly different.
    3098.                             One negates the set of matched endpoints, the other negates
    3099.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
    3100.                             packets that are from other Calico-controlled \tendpoints
    3101.                             that do not have the label \"my_label\". \n \tNotSelector
    3102.                             = \"has(my_label)\" matches packets that are not from
    3103.                             Calico-controlled \tendpoints that do have the label \"my_label\".
    3104.                             \n The effect is that the latter will accept packets from
    3105.                             non-Calico sources whereas the former is limited to packets
    3106.                             from Calico-controlled endpoints."
    3107.                           type: string
    3108.                         serviceAccounts:
    3109.                           description: ServiceAccounts is an optional field that restricts
    3110.                             the rule to only apply to traffic that originates from
    3111.                             (or terminates at) a pod running as a matching service
    3112.                             account.
    3113.                           properties:
    3114.                             names:
    3115.                               description: Names is an optional field that restricts
    3116.                                 the rule to only apply to traffic that originates
    3117.                                 from (or terminates at) a pod running as a service
    3118.                                 account whose name is in the list.
    3119.                               items:
    3120.                                 type: string
    3121.                               type: array
    3122.                             selector:
    3123.                               description: Selector is an optional field that restricts
    3124.                                 the rule to only apply to traffic that originates
    3125.                                 from (or terminates at) a pod running as a service
    3126.                                 account that matches the given label selector. If
    3127.                                 both Names and Selector are specified then they are
    3128.                                 AND'ed.
    3129.                               type: string
    3130.                           type: object
    3131.                       type: object
    3132.                   required:
    3133.                   - action
    3134.                   type: object
    3135.                 type: array
    3136.               order:
    3137.                 description: Order is an optional field that specifies the order in
    3138.                   which the policy is applied. Policies with higher "order" are applied
    3139.                   after those with lower order.  If the order is omitted, it may be
    3140.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
    3141.                   with identical order will be applied in alphanumerical order based
    3142.                   on the Policy "Name".
    3143.                 type: number
    3144.               selector:
    3145.                 description: "The selector is an expression used to pick pick out
    3146.                   the endpoints that the policy should be applied to. \n Selector
    3147.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
    3148.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
    3149.                   \  ->  not equal; also matches if label is not present \tlabel in
    3150.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
    3151.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
    3152.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
    3153.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
    3154.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
    3155.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
    3156.                   or the empty selector -> matches all endpoints. \n Label names are
    3157.                   allowed to contain alphanumerics, -, _ and /. String literals are
    3158.                   more permissive but they do not support escape characters. \n Examples
    3159.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
    3160.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
    3161.                   \"dev\" \t! has(label_name)"
    3162.                 type: string
    3163.               serviceAccountSelector:
    3164.                 description: ServiceAccountSelector is an optional field for an expression
    3165.                   used to select a pod based on service accounts.
    3166.                 type: string
    3167.               types:
    3168.                 description: "Types indicates whether this policy applies to ingress,
    3169.                   or to egress, or to both.  When not explicitly specified (and so
    3170.                   the value on creation is empty or nil), Calico defaults Types according
    3171.                   to what Ingress and Egress are present in the policy.  The default
    3172.                   is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
    3173.                   the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
    3174.                   ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
    3175.                   PolicyTypeEgress ], if there are both Ingress and Egress rules.
    3176.                   \n When the policy is read back again, Types will always be one
    3177.                   of these values, never empty or nil."
    3178.                 items:
    3179.                   description: PolicyType enumerates the possible values of the PolicySpec
    3180.                     Types field.
    3181.                   type: string
    3182.                 type: array
    3183.             type: object
    3184.         type: object
    3185.     served: true
    3186.     storage: true
    3187. status:
    3188.   acceptedNames:
    3189.     kind: ""
    3190.     plural: ""
    3191.   conditions: []
    3192.   storedVersions: []
    3194. ---
    3195. apiVersion: apiextensions.k8s.io/v1
    3196. kind: CustomResourceDefinition
    3197. metadata:
    3198.   name: networksets.crd.projectcalico.org
    3199. spec:
    3200.   group: crd.projectcalico.org
    3201.   names:
    3202.     kind: NetworkSet
    3203.     listKind: NetworkSetList
    3204.     plural: networksets
    3205.     singular: networkset
    3206.   scope: Namespaced
    3207.   versions:
    3208.   - name: v1
    3209.     schema:
    3210.       openAPIV3Schema:
    3211.         description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
    3212.         properties:
    3213.           apiVersion:
    3214.             description: 'APIVersion defines the versioned schema of this representation
    3215.               of an object. Servers should convert recognized schemas to the latest
    3216.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    3217.             type: string
    3218.           kind:
    3219.             description: 'Kind is a string value representing the REST resource this
    3220.               object represents. Servers may infer this from the endpoint the client
    3221.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    3222.             type: string
    3223.           metadata:
    3224.             type: object
    3225.           spec:
    3226.             description: NetworkSetSpec contains the specification for a NetworkSet
    3227.               resource.
    3228.             properties:
    3229.               nets:
    3230.                 description: The list of IP networks that belong to this set.
    3231.                 items:
    3232.                   type: string
    3233.                 type: array
    3234.             type: object
    3235.         type: object
    3236.     served: true
    3237.     storage: true
    3238. status:
    3239.   acceptedNames:
    3240.     kind: ""
    3241.     plural: ""
    3242.   conditions: []
    3243.   storedVersions: []
    3245. ---
    3246. ---
    3247. # Source: calico/templates/calico-kube-controllers-rbac.yaml
    3249. # Include a clusterrole for the kube-controllers component,
    3250. # and bind it to the calico-kube-controllers serviceaccount.
    3251. kind: ClusterRole
    3252. apiVersion: rbac.authorization.k8s.io/v1
    3253. metadata:
    3254.   name: calico-kube-controllers
    3255. rules:
    3256.   # Nodes are watched to monitor for deletions.
    3257.   - apiGroups: [""]
    3258.     resources:
    3259.       - nodes
    3260.     verbs:
    3261.       - watch
    3262.       - list
    3263.       - get
    3264.   # Pods are queried to check for existence.
    3265.   - apiGroups: [""]
    3266.     resources:
    3267.       - pods
    3268.     verbs:
    3269.       - get
    3270.   # IPAM resources are manipulated when nodes are deleted.
    3271.   - apiGroups: ["crd.projectcalico.org"]
    3272.     resources:
    3273.       - ippools
    3274.     verbs:
    3275.       - list
    3276.   - apiGroups: ["crd.projectcalico.org"]
    3277.     resources:
    3278.       - blockaffinities
    3279.       - ipamblocks
    3280.       - ipamhandles
    3281.     verbs:
    3282.       - get
    3283.       - list
    3284.       - create
    3285.       - update
    3286.       - delete
    3287.       - watch
    3288.   # kube-controllers manages hostendpoints.
    3289.   - apiGroups: ["crd.projectcalico.org"]
    3290.     resources:
    3291.       - hostendpoints
    3292.     verbs:
    3293.       - get
    3294.       - list
    3295.       - create
    3296.       - update
    3297.       - delete
    3298.   # Needs access to update clusterinformations.
    3299.   - apiGroups: ["crd.projectcalico.org"]
    3300.     resources:
    3301.       - clusterinformations
    3302.     verbs:
    3303.       - get
    3304.       - create
    3305.       - update
    3306.   # KubeControllersConfiguration is where it gets its config
    3307.   - apiGroups: ["crd.projectcalico.org"]
    3308.     resources:
    3309.       - kubecontrollersconfigurations
    3310.     verbs:
    3311.       # read its own config
    3312.       - get
    3313.       # create a default if none exists
    3314.       - create
    3315.       # update status
    3316.       - update
    3317.       # watch for changes
    3318.       - watch
    3319. ---
    3320. kind: ClusterRoleBinding
    3321. apiVersion: rbac.authorization.k8s.io/v1
    3322. metadata:
    3323.   name: calico-kube-controllers
    3324. roleRef:
    3325.   apiGroup: rbac.authorization.k8s.io
    3326.   kind: ClusterRole
    3327.   name: calico-kube-controllers
    3328. subjects:
    3329. - kind: ServiceAccount
    3330.   name: calico-kube-controllers
    3331.   namespace: kube-system
    3332. ---
    3334. ---
    3335. # Source: calico/templates/calico-node-rbac.yaml
    3336. # Include a clusterrole for the calico-node DaemonSet,
    3337. # and bind it to the calico-node serviceaccount.
    3338. kind: ClusterRole
    3339. apiVersion: rbac.authorization.k8s.io/v1
    3340. metadata:
    3341.   name: calico-node
    3342. rules:
    3343.   # The CNI plugin needs to get pods, nodes, and namespaces.
    3344.   - apiGroups: [""]
    3345.     resources:
    3346.       - pods
    3347.       - nodes
    3348.       - namespaces
    3349.     verbs:
    3350.       - get
    3351.   - apiGroups: [""]
    3352.     resources:
    3353.       - endpoints
    3354.       - services
    3355.     verbs:
    3356.       # Used to discover service IPs for advertisement.
    3357.       - watch
    3358.       - list
    3359.       # Used to discover Typhas.
    3360.       - get
    3361.   # Pod CIDR auto-detection on kubeadm needs access to config maps.
    3362.   - apiGroups: [""]
    3363.     resources:
    3364.       - configmaps
    3365.     verbs:
    3366.       - get
    3367.   - apiGroups: [""]
    3368.     resources:
    3369.       - nodes/status
    3370.     verbs:
    3371.       # Needed for clearing NodeNetworkUnavailable flag.
    3372.       - patch
    3373.       # Calico stores some configuration information in node annotations.
    3374.       - update
    3375.   # Watch for changes to Kubernetes NetworkPolicies.
    3376.   - apiGroups: ["networking.k8s.io"]
    3377.     resources:
    3378.       - networkpolicies
    3379.     verbs:
    3380.       - watch
    3381.       - list
    3382.   # Used by Calico for policy information.
    3383.   - apiGroups: [""]
    3384.     resources:
    3385.       - pods
    3386.       - namespaces
    3387.       - serviceaccounts
    3388.     verbs:
    3389.       - list
    3390.       - watch
    3391.   # The CNI plugin patches pods/status.
    3392.   - apiGroups: [""]
    3393.     resources:
    3394.       - pods/status
    3395.     verbs:
    3396.       - patch
    3397.   # Calico monitors various CRDs for config.
    3398.   - apiGroups: ["crd.projectcalico.org"]
    3399.     resources:
    3400.       - globalfelixconfigs
    3401.       - felixconfigurations
    3402.       - bgppeers
    3403.       - globalbgpconfigs
    3404.       - bgpconfigurations
    3405.       - ippools
    3406.       - ipamblocks
    3407.       - globalnetworkpolicies
    3408.       - globalnetworksets
    3409.       - networkpolicies
    3410.       - networksets
    3411.       - clusterinformations
    3412.       - hostendpoints
    3413.       - blockaffinities
    3414.     verbs:
    3415.       - get
    3416.       - list
    3417.       - watch
    3418.   # Calico must create and update some CRDs on startup.
    3419.   - apiGroups: ["crd.projectcalico.org"]
    3420.     resources:
    3421.       - ippools
    3422.       - felixconfigurations
    3423.       - clusterinformations
    3424.     verbs:
    3425.       - create
    3426.       - update
    3427.   # Calico stores some configuration information on the node.
    3428.   - apiGroups: [""]
    3429.     resources:
    3430.       - nodes
    3431.     verbs:
    3432.       - get
    3433.       - list
    3434.       - watch
    3435.   # These permissions are only required for upgrade from v2.6, and can
    3436.   # be removed after upgrade or on fresh installations.
    3437.   - apiGroups: ["crd.projectcalico.org"]
    3438.     resources:
    3439.       - bgpconfigurations
    3440.       - bgppeers
    3441.     verbs:
    3442.       - create
    3443.       - update
    3444.   # These permissions are required for Calico CNI to perform IPAM allocations.
    3445.   - apiGroups: ["crd.projectcalico.org"]
    3446.     resources:
    3447.       - blockaffinities
    3448.       - ipamblocks
    3449.       - ipamhandles
    3450.     verbs:
    3451.       - get
    3452.       - list
    3453.       - create
    3454.       - update
    3455.       - delete
    3456.   - apiGroups: ["crd.projectcalico.org"]
    3457.     resources:
    3458.       - ipamconfigs
    3459.     verbs:
    3460.       - get
    3461.   # Block affinities must also be watchable by confd for route aggregation.
    3462.   - apiGroups: ["crd.projectcalico.org"]
    3463.     resources:
    3464.       - blockaffinities
    3465.     verbs:
    3466.       - watch
    3467.   # The Calico IPAM migration needs to get daemonsets. These permissions can be
    3468.   # removed if not upgrading from an installation using host-local IPAM.
    3469.   - apiGroups: ["apps"]
    3470.     resources:
    3471.       - daemonsets
    3472.     verbs:
    3473.       - get
    3475. ---
    3476. apiVersion: rbac.authorization.k8s.io/v1
    3477. kind: ClusterRoleBinding
    3478. metadata:
    3479.   name: calico-node
    3480. roleRef:
    3481.   apiGroup: rbac.authorization.k8s.io
    3482.   kind: ClusterRole
    3483.   name: calico-node
    3484. subjects:
    3485. - kind: ServiceAccount
    3486.   name: calico-node
    3487.   namespace: kube-system
    3489. ---
    3490. # Source: calico/templates/calico-node.yaml
    3491. # This manifest installs the calico-node container, as well
    3492. # as the CNI plugins and network config on
    3493. # each master and worker node in a Kubernetes cluster.
    3494. kind: DaemonSet
    3495. apiVersion: apps/v1
    3496. metadata:
    3497.   name: calico-node
    3498.   namespace: kube-system
    3499.   labels:
    3500.     k8s-app: calico-node
    3501. spec:
    3502.   selector:
    3503.     matchLabels:
    3504.       k8s-app: calico-node
    3505.   updateStrategy:
    3506.     type: RollingUpdate
    3507.     rollingUpdate:
    3508.       maxUnavailable: 1
    3509.   template:
    3510.     metadata:
    3511.       labels:
    3512.         k8s-app: calico-node
    3513.     spec:
    3514.       nodeSelector:
    3515.         kubernetes.io/os: linux
    3516.       hostNetwork: true
    3517.       tolerations:
    3518.         # Make sure calico-node gets scheduled on all nodes.
    3519.         - effect: NoSchedule
    3520.           operator: Exists
    3521.         # Mark the pod as a critical add-on for rescheduling.
    3522.         - key: CriticalAddonsOnly
    3523.           operator: Exists
    3524.         - effect: NoExecute
    3525.           operator: Exists
    3526.       serviceAccountName: calico-node
    3527.       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
    3528.       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
    3529.       terminationGracePeriodSeconds: 0
    3530.       priorityClassName: system-node-critical
    3531.       initContainers:
    3532.         # This container performs upgrade from host-local IPAM to calico-ipam.
    3533.         # It can be deleted if this is a fresh installation, or if you have already
    3534.         # upgraded to use calico-ipam.
    3535.         - name: upgrade-ipam
    3536.           image: docker.io/calico/cni:v3.18.0
    3537.           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
    3538.           envFrom:
    3539.           - configMapRef:
    3540.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
    3541.               name: kubernetes-services-endpoint
    3542.               optional: true
    3543.           env:
    3544.             - name: KUBERNETES_NODE_NAME
    3545.               valueFrom:
    3546.                 fieldRef:
    3547.                   fieldPath: spec.nodeName
    3548.             - name: CALICO_NETWORKING_BACKEND
    3549.               valueFrom:
    3550.                 configMapKeyRef:
    3551.                   name: calico-config
    3552.                   key: calico_backend
    3553.           volumeMounts:
    3554.             - mountPath: /var/lib/cni/networks
    3555.               name: host-local-net-dir
    3556.             - mountPath: /host/opt/cni/bin
    3557.               name: cni-bin-dir
    3558.           securityContext:
    3559.             privileged: true
    3560.         # This container installs the CNI binaries
    3561.         # and CNI network config file on each node.
    3562.         - name: install-cni
    3563.           image: docker.io/calico/cni:v3.18.0
    3564.           command: ["/opt/cni/bin/install"]
    3565.           envFrom:
    3566.           - configMapRef:
    3567.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
    3568.               name: kubernetes-services-endpoint
    3569.               optional: true
    3570.           env:
    3571.             # Name of the CNI config file to create.
    3572.             - name: CNI_CONF_NAME
    3573.               value: "10-calico.conflist"
    3574.             # The CNI network config to install on each node.
    3575.             - name: CNI_NETWORK_CONFIG
    3576.               valueFrom:
    3577.                 configMapKeyRef:
    3578.                   name: calico-config
    3579.                   key: cni_network_config
    3580.             # Set the hostname based on the k8s node name.
    3581.             - name: KUBERNETES_NODE_NAME
    3582.               valueFrom:
    3583.                 fieldRef:
    3584.                   fieldPath: spec.nodeName
    3585.             # CNI MTU Config variable
    3586.             - name: CNI_MTU
    3587.               valueFrom:
    3588.                 configMapKeyRef:
    3589.                   name: calico-config
    3590.                   key: veth_mtu
    3591.             # Prevents the container from sleeping forever.
    3592.             - name: SLEEP
    3593.               value: "false"
    3594.           volumeMounts:
    3595.             - mountPath: /host/opt/cni/bin
    3596.               name: cni-bin-dir
    3597.             - mountPath: /host/etc/cni/net.d
    3598.               name: cni-net-dir
    3599.           securityContext:
    3600.             privileged: true
    3601.         # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
    3602.         # to communicate with Felix over the Policy Sync API.
    3603.         - name: flexvol-driver
    3604.           image: docker.io/calico/pod2daemon-flexvol:v3.18.0
    3605.           volumeMounts:
    3606.           - name: flexvol-driver-host
    3607.             mountPath: /host/driver
    3608.           securityContext:
    3609.             privileged: true
    3610.       containers:
    3611.         # Runs calico-node container on each Kubernetes node. This
    3612.         # container programs network policy and routes on each
    3613.         # host.
    3614.         - name: calico-node
    3615.           image: docker.io/calico/node:v3.18.0
    3616.           envFrom:
    3617.           - configMapRef:
    3618.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
    3619.               name: kubernetes-services-endpoint
    3620.               optional: true
    3621.           env:
    3622.             # Use Kubernetes API as the backing datastore.
    3623.             - name: DATASTORE_TYPE
    3624.               value: "kubernetes"
    3625.             # Wait for the datastore.
    3626.             - name: WAIT_FOR_DATASTORE
    3627.               value: "true"
    3628.             # Set based on the k8s node name.
    3629.             - name: NODENAME
    3630.               valueFrom:
    3631.                 fieldRef:
    3632.                   fieldPath: spec.nodeName
    3633.             # Choose the backend to use.
    3634.             - name: CALICO_NETWORKING_BACKEND
    3635.               valueFrom:
    3636.                 configMapKeyRef:
    3637.                   name: calico-config
    3638.                   key: calico_backend
    3639.             # Cluster type to identify the deployment type
    3640.             - name: CLUSTER_TYPE
    3641.               value: "k8s,bgp"
    3642.             # Auto-detect the BGP IP address.
    3643.             - name: IP
    3644.               value: "autodetect"
    3645.             # Enable IPIP
    3646.             - name: CALICO_IPV4POOL_IPIP
    3647.               value: "Always"
    3648.             # Enable or Disable VXLAN on the default IP pool.
    3649.             - name: CALICO_IPV4POOL_VXLAN
    3650.               value: "Never"
    3651.             # Set MTU for tunnel device used if ipip is enabled
    3652.             - name: FELIX_IPINIPMTU
    3653.               valueFrom:
    3654.                 configMapKeyRef:
    3655.                   name: calico-config
    3656.                   key: veth_mtu
    3657.             # Set MTU for the VXLAN tunnel device.
    3658.             - name: FELIX_VXLANMTU
    3659.               valueFrom:
    3660.                 configMapKeyRef:
    3661.                   name: calico-config
    3662.                   key: veth_mtu
    3663.             # Set MTU for the Wireguard tunnel device.
    3664.             - name: FELIX_WIREGUARDMTU
    3665.               valueFrom:
    3666.                 configMapKeyRef:
    3667.                   name: calico-config
    3668.                   key: veth_mtu
    3669.             # The default IPv4 pool to create on startup if none exists. Pod IPs will be
    3670.             # chosen from this range. Changing this value after installation will have
    3671.             # no effect. This should fall within `--cluster-cidr`.
    3672.             # - name: CALICO_IPV4POOL_CIDR
    3673.             #   value: "192.168.0.0/16"
    3674.             # Disable file logging so `kubectl logs` works.
    3675.             - name: CALICO_DISABLE_FILE_LOGGING
    3676.               value: "true"
    3677.             # Set Felix endpoint to host default action to ACCEPT.
    3678.             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
    3679.               value: "ACCEPT"
    3680.             # Disable IPv6 on Kubernetes.
    3681.             - name: FELIX_IPV6SUPPORT
    3682.               value: "false"
    3683.             # Set Felix logging to "info"
    3684.             - name: FELIX_LOGSEVERITYSCREEN
    3685.               value: "info"
    3686.             - name: FELIX_HEALTHENABLED
    3687.               value: "true"
    3688.           securityContext:
    3689.             privileged: true
    3690.           resources:
    3691.             requests:
    3692.               cpu: 250m
    3693.           livenessProbe:
    3694.             exec:
    3695.               command:
    3696.               - /bin/calico-node
    3697.               - -felix-live
    3698.               - -bird-live
    3699.             periodSeconds: 10
    3700.             initialDelaySeconds: 10
    3701.             failureThreshold: 6
    3702.           readinessProbe:
    3703.             exec:
    3704.               command:
    3705.               - /bin/calico-node
    3706.               - -felix-ready
    3707.               - -bird-ready
    3708.             periodSeconds: 10
    3709.           volumeMounts:
    3710.             - mountPath: /lib/modules
    3711.               name: lib-modules
    3712.               readOnly: true
    3713.             - mountPath: /run/xtables.lock
    3714.               name: xtables-lock
    3715.               readOnly: false
    3716.             - mountPath: /var/run/calico
    3717.               name: var-run-calico
    3718.               readOnly: false
    3719.             - mountPath: /var/lib/calico
    3720.               name: var-lib-calico
    3721.               readOnly: false
    3722.             - name: policysync
    3723.               mountPath: /var/run/nodeagent
    3724.             # For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
    3725.             # parent directory.
    3726.             - name: sysfs
    3727.               mountPath: /sys/fs/
    3728.               # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
    3729.               # If the host is known to mount that filesystem already then Bidirectional can be omitted.
    3730.               mountPropagation: Bidirectional
    3731.             - name: cni-log-dir
    3732.               mountPath: /var/log/calico/cni
    3733.               readOnly: true
    3734.       volumes:
    3735.         # Used by calico-node.
    3736.         - name: lib-modules
    3737.           hostPath:
    3738.             path: /lib/modules
    3739.         - name: var-run-calico
    3740.           hostPath:
    3741.             path: /var/run/calico
    3742.         - name: var-lib-calico
    3743.           hostPath:
    3744.             path: /var/lib/calico
    3745.         - name: xtables-lock
    3746.           hostPath:
    3747.             path: /run/xtables.lock
    3748.             type: FileOrCreate
    3749.         - name: sysfs
    3750.           hostPath:
    3751.             path: /sys/fs/
    3752.             type: DirectoryOrCreate
    3753.         # Used to install CNI.
    3754.         - name: cni-bin-dir
    3755.           hostPath:
    3756.             path: /opt/cni/bin
    3757.         - name: cni-net-dir
    3758.           hostPath:
    3759.             path: /etc/cni/net.d
    3760.         # Used to access CNI logs.
    3761.         - name: cni-log-dir
    3762.           hostPath:
    3763.             path: /var/log/calico/cni
    3764.         # Mount in the directory for host-local IPAM allocations. This is
    3765.         # used when upgrading from host-local to calico-ipam, and can be removed
    3766.         # if not using the upgrade-ipam init container.
    3767.         - name: host-local-net-dir
    3768.           hostPath:
    3769.             path: /var/lib/cni/networks
    3770.         # Used to create per-pod Unix Domain Sockets
    3771.         - name: policysync
    3772.           hostPath:
    3773.             type: DirectoryOrCreate
    3774.             path: /var/run/nodeagent
    3775.         # Used to install Flex Volume Driver
    3776.         - name: flexvol-driver-host
    3777.           hostPath:
    3778.             type: DirectoryOrCreate
    3779.             path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
    3780. ---
    3782. apiVersion: v1
    3783. kind: ServiceAccount
    3784. metadata:
    3785.   name: calico-node
    3786.   namespace: kube-system
    3788. ---
    3789. # Source: calico/templates/calico-kube-controllers.yaml
    3790. # See https://github.com/projectcalico/kube-controllers
    3791. apiVersion: apps/v1
    3792. kind: Deployment
    3793. metadata:
    3794.   name: calico-kube-controllers
    3795.   namespace: kube-system
    3796.   labels:
    3797.     k8s-app: calico-kube-controllers
    3798. spec:
    3799.   # The controllers can only have a single active instance.
    3800.   replicas: 1
    3801.   selector:
    3802.     matchLabels:
    3803.       k8s-app: calico-kube-controllers
    3804.   strategy:
    3805.     type: Recreate
    3806.   template:
    3807.     metadata:
    3808.       name: calico-kube-controllers
    3809.       namespace: kube-system
    3810.       labels:
    3811.         k8s-app: calico-kube-controllers
    3812.     spec:
    3813.       nodeSelector:
    3814.         kubernetes.io/os: linux
    3815.       tolerations:
    3816.         # Mark the pod as a critical add-on for rescheduling.
    3817.         - key: CriticalAddonsOnly
    3818.           operator: Exists
    3819.         - key: node-role.kubernetes.io/master
    3820.           effect: NoSchedule
    3821.       serviceAccountName: calico-kube-controllers
    3822.       priorityClassName: system-cluster-critical
    3823.       containers:
    3824.         - name: calico-kube-controllers
    3825.           image: docker.io/calico/kube-controllers:v3.18.0
    3826.           env:
    3827.             # Choose which controllers to run.
    3828.             - name: ENABLED_CONTROLLERS
    3829.               value: node
    3830.             - name: DATASTORE_TYPE
    3831.               value: kubernetes
    3832.           readinessProbe:
    3833.             exec:
    3834.               command:
    3835.               - /usr/bin/check-status
    3836.               - -r
    3838. ---
    3840. apiVersion: v1
    3841. kind: ServiceAccount
    3842. metadata:
    3843.   name: calico-kube-controllers
    3844.   namespace: kube-system
    3846. ---
    3848. # This manifest creates a Pod Disruption Budget for Controller to allow K8s Cluster Autoscaler to evict
    3850. apiVersion: policy/v1beta1
    3851. kind: PodDisruptionBudget
    3852. metadata:
    3853.   name: calico-kube-controllers
    3854.   namespace: kube-system
    3855.   labels:
    3856.     k8s-app: calico-kube-controllers
    3857. spec:
    3858.   maxUnavailable: 1
    3859.   selector:
    3860.     matchLabels:
    3861.       k8s-app: calico-kube-controllers
    3863. ---
    3864. # Source: calico/templates/calico-etcd-secrets.yaml
    3866. ---
    3867. # Source: calico/templates/calico-typha.yaml
    3869. ---
    3870. # Source: calico/templates/configure-canal.yaml

    image.png

    [root@master ~]# kubectl -n kube-system edit daemonsets.apps calico-node

    Warning FailedScheduling default-scheduler 0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn’t tolerate.

    去掉master节点上的污点

    kubectl taint nodes --all node-role.kubernetes.io/master-

    Warning  FailedScheduling  <unknown>  default-scheduler  0/1 nodes are available: 1 node(s) didn't match node selector