Compare text

Find the difference between two text files

Real-time diff

Unified diff

Collapse lines

Highlight change

Syntax highlighting

Tools

Comparing sensitive data, confidential files or internal emails?

Most legal and privacy policies prohibit uploading sensitive data online. Diffchecker Desktop ensures your confidential information never leaves your computer. Work offline and compare documents securely.

Download Diffchecker Desktop Learn more

HCloud Cilium Config Diff

Created 4 years agoDiff never expires

553 removals

680 lines

363 additions

690 lines

---

# Source: cilium/charts/agent/templates/serviceaccount.yaml

# Source: cilium/templates/cilium-agent-serviceaccount.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: kube-system

---

# Source: cilium/charts/operator/templates/serviceaccount.yaml

# Source: cilium/templates/cilium-operator-serviceaccount.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: kube-system

---

# Source: cilium/charts/config/templates/configmap.yaml

# Source: cilium/templates/cilium-configmap.yaml

apiVersion: v1

kind: ConfigMap

metadata:

namespace: kube-system

data:

# Identity allocation mode selects how identities are shared between cilium

# nodes by setting how they are stored. The options are "crd" or "kvstore".

# - "crd" stores identities in kubernetes as CRDs (custom resource definition).

# These can be queried with:

# kubectl get ciliumid

# - "kvstore" stores identities in a kvstore, etcd or consul, that is

# configured below. Cilium versions before 1.6 supported only the kvstore

# backend. Upgrades from these older cilium versions should continue using

# the kvstore by commenting out the identity-allocation-mode below, or

# setting it to "kvstore".

identity-allocation-mode: crd

cilium-endpoint-gc-interval: "5m0s"

# If you want to run cilium in debug mode change this value to true

debug: "false"

# If you want metrics enabled in all of your Cilium agents, set the port for

# which the Cilium agents will have their metrics exposed.

# This option deprecates the "prometheus-serve-addr" in the

# "cilium-metrics-config" ConfigMap

# NOTE that this will open the port on ALL nodes where Cilium pods are

# scheduled.

prometheus-serve-addr: ":9100"

# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4

# address.

enable-ipv4: "true"

# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6

# address.

enable-ipv6: "false"

# Users who wish to specify their own custom CNI configuration file must set

# custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.

custom-cni-conf: "false"

enable-bpf-clock-probe: "true"

# If you want cilium monitor to aggregate tracing for packets, set this level

# to "low", "medium", or "maximum". The higher the level, the less packets

# that will be seen in monitor output.

monitor-aggregation: medium

# The monitor aggregation interval governs the typical time between monitor

# notification events for each allowed connection.

# Only effective when monitor aggregation is set to "medium" or higher.

monitor-aggregation-interval: 5s

# The monitor aggregation flags determine which TCP flags which, upon the

# first observation, cause monitor notifications to be generated.

# Only effective when monitor aggregation is set to "medium" or higher.

monitor-aggregation-flags: all

# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic

# ct-global-max-entries-* specifies the maximum number of connections

# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.

# supported across all endpoints, split by protocol: tcp or other. One pair

bpf-map-dynamic-size-ratio: "0.0025"

# of maps uses these values for IPv4 connections, and another pair of maps

# bpf-policy-map-max specifies the maximum number of entries in endpoint

# use these values for IPv6 connections.

# policy map (per endpoint)

bpf-policy-map-max: "16384"

# If these values are modified, then during the next Cilium startup the

# bpf-lb-map-max specifies the maximum number of entries in bpf lb service,

# tracking of ongoing connections may be disrupted. This may lead to brief

# backend and affinity maps.

# policy drops or a change in loadbalancing decisions for a connection.

bpf-lb-map-max: "65536"

# For users upgrading from Cilium 1.2 or earlier, to minimize disruption

# during the upgrade process, comment out these options.

bpf-ct-global-tcp-max: "524288"

bpf-ct-global-any-max: "262144"

# Pre-allocation of map entries allows per-packet latency to be reduced, at

# the expense of up-front memory allocation for the entries in the maps. The

# default value below will minimize memory usage in the default installation;

# users who are sensitive to latency may consider setting this to "true".

# This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore

# this option and behave as though it is set to "true".

# If this value is modified, then during the next Cilium startup the restore

# of existing endpoints and tracking of ongoing connections may be disrupted.

# This may lead to policy drops or a change in loadbalancing decisions for a

# As a result, reply packets may be dropped and the load-balancing decisions

# connection for some time. Endpoints may need to be recreated to restore

# for established connections may change.

# connectivity.

# If this option is set to "false" during an upgrade from 1.3 or earlier to

# 1.4 or later, then it may cause one-time disruptions during the upgrade.

preallocate-bpf-maps: "false"

# Regular expression matching compatible Istio sidecar istio-proxy

# container image names

sidecar-istio-proxy-image: "cilium/istio_proxy"

# Encapsulation mode for communication between nodes

# Possible values:

# - disabled

# - vxlan (default)

# - geneve

tunnel: disabled

# Name of the cluster. Only relevant when building a mesh of clusters.

cluster-name: default

# Enables L7 proxy for L7 policy enforcement and visibility

# DNS Polling periodically issues a DNS lookup for each `matchName` from

enable-l7-proxy: "true"

# cilium-agent. The result is used to regenerate endpoint policy.

# DNS lookups are repeated with an interval of 5 seconds, and are made for

# A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP

# data is used instead. An IP change will trigger a regeneration of the Cilium

# policy for each endpoint and increment the per cilium-agent policy

# repository revision.

# This option is disabled by default starting from version 1.4.x in favor

# of a more powerful DNS proxy-based implementation, see [0] for details.

# Enable this option if you want to use FQDN policies but do not want to use

# the DNS proxy.

# To ease upgrade, users may opt to set this option to "true".

# Otherwise please refer to the Upgrade Guide [1] which explains how to

# prepare policy rules for upgrade.

# [0] http://docs.cilium.io/en/stable/policy/language/#dns-based

# [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action

tofqdns-enable-poller: "false"

# wait-bpf-mount makes init container wait until bpf filesystem is mounted

wait-bpf-mount: "false"

masquerade: "true"

enable-ipsec: "false"

enable-bpf-masquerade: "true"

ipsec-key-file: /etc/ipsec/keys

encrypt-interface: ens10

encrypt-node: "false"

enable-xt-socket-fallback: "true"

install-iptables-rules: "true"

auto-direct-node-routes: "false"

enable-bandwidth-manager: "false"

enable-local-redirect-policy: "false"

kube-proxy-replacement: "probe"

enable-host-reachable-services: "false"

kube-proxy-replacement-healthz-bind-address: ""

enable-external-ips: "false"

enable-health-check-nodeport: "true"

enable-node-port: "false"

node-port-bind-protection: "true"

enable-auto-protect-node-port-range: "true"

enable-session-affinity: "true"

enable-endpoint-health-checking: "true"

enable-health-checking: "true"

enable-well-known-identities: "false"

enable-remote-node-identity: "true"

operator-api-serve-addr: "127.0.0.1:9234"

# Enable Hubble gRPC service.

enable-hubble: "true"

# UNIX domain socket for Hubble server to listen to.

hubble-socket-path: "/var/run/cilium/hubble.sock"

ipam: "cluster-pool"

cluster-pool-ipv4-cidr: 10.224.0.0/16

cluster-pool-ipv4-mask-size: "24"

disable-cnp-status-updates: "true"

blacklist-conflicting-routes: "false"

#Inserted Configuration

native-routing-cidr: 10.0.0.0/8

enable-endpoint-routes: "true"

---

# Source: cilium/charts/agent/templates/clusterrole.yaml

# Source: cilium/templates/cilium-agent-clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

rules:

- apiGroups:

- networking.k8s.io

resources:

- networkpolicies

verbs:

- get

- list

- watch

- apiGroups:

- discovery.k8s.io

resources:

- endpointslices

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

- namespaces

- services

- nodes

- endpoints

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

- pods

- nodes

- pods/finalizers

verbs:

- get

- list

- watch

- update

- apiGroups:

- delete

- ""

- apiGroups:

resources:

- ""

- nodes

resources:

- nodes/status

- nodes

verbs:

- patch

- get

- apiGroups:

- list

- apiextensions.k8s.io

- watch

resources:

- update

- customresourcedefinitions

- apiGroups:

verbs:

- ""

- create

resources:

- get

- nodes

- list

- nodes/status

- watch

verbs:

- update

- patch

- apiGroups:

- cilium.io

- apiextensions.k8s.io

resources:

- ciliumnetworkpolicies

- customresourcedefinitions

- ciliumnetworkpolicies/status

verbs:

- ciliumclusterwidenetworkpolicies

# Deprecated for removal in v1.10

- ciliumclusterwidenetworkpolicies/status

- create

- ciliumendpoints

- list

- ciliumendpoints/status

- watch

- ciliumnodes

- update

- ciliumnodes/status

- ciliumidentities

# This is used when validating policies in preflight. This will need to stay

- ciliumidentities/status

# until we figure out how to avoid "get" inside the preflight, and then

verbs:

# should be removed ideally.

- "*"

- get

- apiGroups:

- cilium.io

resources:

- ciliumnetworkpolicies

- ciliumnetworkpolicies/status

- ciliumnetworkpolicies/finalizers

- ciliumclusterwidenetworkpolicies

- ciliumclusterwidenetworkpolicies/status

- ciliumclusterwidenetworkpolicies/finalizers

- ciliumendpoints

- ciliumendpoints/status

- ciliumendpoints/finalizers

- ciliumnodes

- ciliumnodes/status

- ciliumnodes/finalizers

- ciliumidentities

- ciliumidentities/finalizers

- ciliumlocalredirectpolicies

- ciliumlocalredirectpolicies/status

- ciliumlocalredirectpolicies/finalizers

verbs:

- '*'

---

# Source: cilium/charts/operator/templates/clusterrole.yaml

# Source: cilium/templates/cilium-operator-clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

rules:

- apiGroups:

- ""

resources:

# to automatically delete [core|kube]dns pods so that are starting to being

# managed by Cilium

- pods

verbs:

- get

- list

- watch

- delete

- apiGroups:

- discovery.k8s.io

resources:

- endpointslices

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

# to automatically read from k8s and import the node"s pod CIDR to cilium"s

# to perform the translation of a CNP that contains `ToGroup` to its endpoints

# etcd so all nodes know how to reach another pod running in in a different

- services

# node.

- endpoints

- nodes

# to check apiserver connectivity

# to perform the translation of a CNP that contains `ToGroup` to its endpoints

- namespaces

- services

verbs:

- endpoints

- get

# to check apiserver connectivity

- list

- namespaces

- watch

verbs:

- apiGroups:

- get

- cilium.io

- list

resources:

- watch

- ciliumnetworkpolicies

- apiGroups:

- ciliumnetworkpolicies/status

- cilium.io

- ciliumnetworkpolicies/finalizers

resources:

- ciliumclusterwidenetworkpolicies

- ciliumnetworkpolicies

- ciliumclusterwidenetworkpolicies/status

- ciliumnetworkpolicies/status

- ciliumclusterwidenetworkpolicies/finalizers

- ciliumclusterwidenetworkpolicies

- ciliumendpoints

- ciliumclusterwidenetworkpolicies/status

- ciliumendpoints/status

- ciliumendpoints

- ciliumendpoints/finalizers

- ciliumendpoints/status

- ciliumnodes

- ciliumnodes/status

- ciliumnodes/finalizers

- ciliumidentities

- ciliumidentities/status

verbs:

- ciliumidentities/finalizers

- "*"

- ciliumlocalredirectpolicies

- ciliumlocalredirectpolicies/status

- ciliumlocalredirectpolicies/finalizers

verbs:

- '*'

- apiGroups:

- apiextensions.k8s.io

resources:

- customresourcedefinitions

verbs:

- create

- get

- list

- update

- watch

# For cilium-operator running in HA mode.

# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election

# between mulitple running instances.

# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less

# common and fewer objects in the cluster watch "all Leases".

# The support for leases was introduced in coordination.k8s.io/v1 during Kubernetes 1.14 release.

# In Cilium we currently don't support HA mode for K8s version < 1.14. This condition make sure

# that we only authorize access to leases resources in supported K8s versions.

- apiGroups:

- coordination.k8s.io

resources:

- leases

verbs:

- create

- get

- update

---

# Source: cilium/charts/agent/templates/clusterrolebinding.yaml

# Source: cilium/templates/cilium-agent-clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

subjects:

- kind: ServiceAccount

namespace: kube-system

---

# Source: cilium/charts/operator/templates/clusterrolebinding.yaml

# Source: cilium/templates/cilium-operator-clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

subjects:

- kind: ServiceAccount

namespace: kube-system

---

# Source: cilium/charts/agent/templates/daemonset.yaml

# Source: cilium/templates/cilium-agent-daemonset.yaml

apiVersion: apps/v1

kind: DaemonSet

metadata:

labels:

k8s-app: cilium

namespace: kube-system

spec:

selector:

matchLabels:

k8s-app: cilium

Text moved from lines 540-543

updateStrategy:

rollingUpdate:

maxUnavailable: 2

type: RollingUpdate

template:

metadata:

annotations:

prometheus.io/port: "9100"

prometheus.io/scrape: "true"

# This annotation plus the CriticalAddonsOnly toleration makes

# cilium to be a critical pod in the cluster, which ensures cilium

# gets priority scheduling.

# https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/

scheduler.alpha.kubernetes.io/critical-pod: ""

labels:

k8s-app: cilium

spec:

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchExpressions:

- key: k8s-app

operator: In

values:

- cilium

topologyKey: kubernetes.io/hostname

containers:

- args:

- --config-dir=/tmp/cilium/config-map

command:

- cilium-agent

livenessProbe:

httpGet:

host: '127.0.0.1'

path: /healthz

port: 9876

scheme: HTTP

httpHeaders:

- name: "brief"

value: "true"

failureThreshold: 10

# The initial delay for the liveness probe is intentionally large to

# avoid an endless kill & restart cycle if in the event that the initial

# bootstrapping takes longer than expected.

initialDelaySeconds: 120

periodSeconds: 30

successThreshold: 1

timeoutSeconds: 5

readinessProbe:

httpGet:

host: '127.0.0.1'

path: /healthz

port: 9876

scheme: HTTP

httpHeaders:

- name: "brief"

value: "true"

failureThreshold: 3

initialDelaySeconds: 5

periodSeconds: 30

successThreshold: 1

timeoutSeconds: 5

env:

- name: K8S_NODE_NAME

valueFrom:

fieldRef:

apiVersion: v1

fieldPath: spec.nodeName

- name: CILIUM_K8S_NAMESPACE

valueFrom:

fieldRef:

apiVersion: v1

fieldPath: metadata.namespace

- name: CILIUM_FLANNEL_MASTER_DEVICE

valueFrom:

configMapKeyRef:

key: flannel-master-device

optional: true

- name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT

valueFrom:

configMapKeyRef:

key: flannel-uninstall-on-exit

optional: true

- name: CILIUM_CLUSTERMESH_CONFIG

value: /var/lib/cilium/clustermesh/

- name: CILIUM_CNI_CHAINING_MODE

valueFrom:

configMapKeyRef:

key: cni-chaining-mode

optional: true

- name: CILIUM_CUSTOM_CNI_CONF

valueFrom:

configMapKeyRef:

key: custom-cni-conf

optional: true

image: quay.io/cilium/cilium:v1.9.0

imagePullPolicy: IfNotPresent

lifecycle:

postStart:

exec:

command:

- cilium

- "/cni-install.sh"

- status

- "--enable-debug=false"

- --brief

preStop:

failureThreshold: 10

# The initial delay for the liveness probe is intentionally large to

# avoid an endless kill & restart cycle if in the event that the initial

# bootstrapping takes longer than expected.

initialDelaySeconds: 120

periodSeconds: 30

successThreshold: 1

timeoutSeconds: 5

readinessProbe:

exec:

command:

- cilium

- /cni-uninstall.sh

- status

- --brief

securityContext:

failureThreshold: 3

capabilities:

initialDelaySeconds: 5

add:

periodSeconds: 30

- NET_ADMIN

successThreshold: 1

- SYS_MODULE

timeoutSeconds: 5

privileged: true

env:

volumeMounts:

- name: K8S_NODE_NAME

- mountPath: /sys/fs/bpf

valueFrom:

fieldRef:

- mountPath: /var/run/cilium

apiVersion: v1

fieldPath: spec.nodeName

- mountPath: /host/opt/cni/bin

- name: CILIUM_K8S_NAMESPACE

valueFrom:

- mountPath: /host/etc/cni/net.d

fieldRef:

apiVersion: v1

- mountPath: /var/lib/cilium/clustermesh

fieldPath: metadata.namespace

- name: CILIUM_FLANNEL_MASTER_DEVICE

readOnly: true

valueFrom:

- mountPath: /tmp/cilium/config-map

configMapKeyRef:

key: flannel-master-device

readOnly: true

# Needed to be able to load kernel modules

optional: true

- mountPath: /lib/modules

- name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT

valueFrom:

readOnly: true

configMapKeyRef:

- mountPath: /run/xtables.lock

key: flannel-uninstall-on-exit

optional: true

- name: CILIUM_CLUSTERMESH_CONFIG

value: /var/lib/cilium/clustermesh/

- name: CILIUM_CNI_CHAINING_MODE

valueFrom:

configMapKeyRef:

key: cni-chaining-mode

optional: true

- name: CILIUM_CUSTOM_CNI_CONF

valueFrom:

configMapKeyRef:

key: custom-cni-conf

optional: true

image: "docker.io/cilium/cilium:v1.7.1"

imagePullPolicy: IfNotPresent

lifecycle:

postStart:

exec:

command:

- "/cni-install.sh"

- "--enable-debug=false"

preStop:

exec:

command:

- /cni-uninstall.sh

ports:

- containerPort: 9100

hostPort: 9100

protocol: TCP

securityContext:

capabilities:

add:

- NET_ADMIN

- SYS_MODULE

privileged: true

volumeMounts:

- mountPath: /sys/fs/bpf

- mountPath: /var/run/cilium

- mountPath: /host/opt/cni/bin

- mountPath: /host/etc/cni/net.d

- mountPath: /var/lib/cilium/clustermesh

readOnly: true

- mountPath: /tmp/cilium/config-map

readOnly: true

# Needed to be able to load kernel modules

- mountPath: /lib/modules

readOnly: true

- mountPath: /run/xtables.lock

hostNetwork: true

initContainers:

- command:

- /init-container.sh

env:

- name: CILIUM_ALL_STATE

valueFrom:

configMapKeyRef:

key: clean-cilium-state

optional: true

- name: CILIUM_BPF_STATE

valueFrom:

configMapKeyRef:

key: clean-cilium-bpf-state

optional: true

- name: CILIUM_WAIT_BPF_MOUNT

valueFrom:

configMapKeyRef:

key: wait-bpf-mount

optional: true

image: "docker.io/cilium/cilium:v1.7.1"

image: quay.io/cilium/cilium:v1.9.0

imagePullPolicy: IfNotPresent

securityContext:

capabilities:

add:

- NET_ADMIN

privileged: true

volumeMounts:

- mountPath: /sys/fs/bpf

mountPropagation: HostToContainer

- mountPath: /var/run/cilium

resources:

requests:

cpu: 100m

memory: 100Mi

restartPolicy: Always

priorityClassName: system-node-critical

serviceAccount: cilium

serviceAccountName: cilium

terminationGracePeriodSeconds: 1

tolerations:

- operator: Exists

volumes:

# To keep state between restarts / upgrades

- hostPath:

path: /var/run/cilium

type: DirectoryOrCreate

# To keep state between restarts / upgrades for bpf maps

- hostPath:

path: /sys/fs/bpf

type: DirectoryOrCreate

# To install cilium cni plugin in the host

- hostPath:

path: /opt/cni/bin

type: DirectoryOrCreate

# To install cilium cni configuration in the host

- hostPath:

path: /etc/cni/net.d

type: DirectoryOrCreate

# To be able to load kernel modules

- hostPath:

path: /lib/modules

# To access iptables concurrently with other processes (e.g. kube-proxy)

- hostPath:

path: /run/xtables.lock

type: FileOrCreate

# To read the clustermesh configuration

- name: clustermesh-secrets

secret:

defaultMode: 420

optional: true

secretName: cilium-clustermesh

# To read the configuration from the config map

- configMap:

Text moved to lines 371-374

updateStrategy:

rollingUpdate:

maxUnavailable: 2

type: RollingUpdate

---

# Source: cilium/charts/operator/templates/deployment.yaml

# Source: cilium/templates/cilium-operator-deployment.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

labels:

io.cilium/app: operator

namespace: kube-system

spec:

replicas: 1

# We support HA mode only for Kubernetes version > 1.14

# See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go

# for more details.

replicas: 2

selector:

matchLabels:

io.cilium/app: operator

strategy:

rollingUpdate:

maxSurge: 1

maxUnavailable: 1

type: RollingUpdate

template:

metadata:

annotations:

prometheus.io/port: "6942"

prometheus.io/scrape: "true"

labels:

io.cilium/app: operator

spec:

# In HA mode, cilium-operator pods must not be scheduled on the same

# node as they will clash with each other.

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchExpressions:

- key: io.cilium/app

operator: In

values:

- operator

topologyKey: kubernetes.io/hostname

containers:

- args:

- --debug=$(CILIUM_DEBUG)

- --config-dir=/tmp/cilium/config-map

- --identity-allocation-mode=$(CILIUM_IDENTITY_ALLOCATION_MODE)

- --debug=$(CILIUM_DEBUG)

- --enable-metrics

command:

- --synchronize-k8s-nodes=true

- cilium-operator-generic

command:

env:

- cilium-operator

- name: K8S_NODE_NAME

env:

valueFrom:

- name: CILIUM_K8S_NAMESPACE

fieldRef:

valueFrom:

apiVersion: v1

fieldRef:

fieldPath: spec.nodeName

apiVersion: v1

- name: CILIUM_K8S_NAMESPACE

fieldPath: metadata.namespace

valueFrom:

- name: K8S_NODE_NAME

fieldRef:

valueFrom:

apiVersion: v1

fieldRef:

fieldPath: metadata.namespace

apiVersion: v1

- name: CILIUM_DEBUG

fieldPath: spec.nodeName

valueFrom:

- name: CILIUM_DEBUG

configMapKeyRef:

valueFrom:

key: debug

configMapKeyRef:

key: debug

optional: true

image: quay.io/cilium/operator-generic:v1.9.0

optional: true

imagePullPolicy: IfNotPresent

- name: CILIUM_CLUSTER_NAME

valueFrom:

livenessProbe:

configMapKeyRef:

httpGet:

key: cluster-name

host: '127.0.0.1'

path: /healthz

optional: true

port: 9234

- name: CILIUM_CLUSTER_ID

scheme: HTTP

valueFrom:

initialDelaySeconds: 60

configMapKeyRef:

periodSeconds: 10

key: cluster-id

timeoutSeconds: 3

volumeMounts:

optional: true

- mountPath: /tmp/cilium/config-map

- name: CILIUM_IPAM

valueFrom:

readOnly: true

configMapKeyRef:

key: ipam

optional: true

- name: CILIUM_DISABLE_ENDPOINT_CRD

valueFrom:

configMapKeyRef:

key: disable-endpoint-crd

optional: true

- name: CILIUM_KVSTORE

valueFrom:

configMapKeyRef:

key: kvstore

optional: true

- name: CILIUM_KVSTORE_OPT

valueFrom:

configMapKeyRef:

key: kvstore-opt

optional: true

- name: AWS_ACCESS_KEY_ID

valueFrom:

secretKeyRef:

key: AWS_ACCESS_KEY_ID

optional: true

- name: AWS_SECRET_ACCESS_KEY

valueFrom:

secretKeyRef:

key: AWS_SECRET_ACCESS_KEY

optional: true

- name: AWS_DEFAULT_REGION

valueFrom:

secretKeyRef:

key: AWS_DEFAULT_REGION

optional: true

- name: CILIUM_IDENTITY_ALLOCATION_MODE

valueFrom:

configMapKeyRef:

key: identity-allocation-mode

optional: true

image: "docker.io/cilium/operator:v1.7.1"

imagePullPolicy: IfNotPresent

ports:

- containerPort: 6942

hostPort: 6942

protocol: TCP

livenessProbe:

httpGet:

host: "127.0.0.1"

path: /healthz

port: 9234

scheme: HTTP

initialDelaySeconds: 60

periodSeconds: 10

timeoutSeconds: 3

hostNetwork: true

restartPolicy: Always

priorityClassName: system-cluster-critical

serviceAccount: cilium-operator

serviceAccountName: cilium-operator

tolerations:

- operator: Exists

volumes:

# To read the configuration from the config map

- configMap:

Saved diffs

Original text

Open file

---
# Source: cilium/charts/agent/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium
  namespace: kube-system
---
# Source: cilium/charts/operator/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-operator
  namespace: kube-system
---
# Source: cilium/charts/config/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:

# Identity allocation mode selects how identities are shared between cilium
  # nodes by setting how they are stored. The options are "crd" or "kvstore".
  # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
  #   These can be queried with:
  #     kubectl get ciliumid
  # - "kvstore" stores identities in a kvstore, etcd or consul, that is
  #   configured below. Cilium versions before 1.6 supported only the kvstore
  #   backend. Upgrades from these older cilium versions should continue using
  #   the kvstore by commenting out the identity-allocation-mode below, or
  #   setting it to "kvstore".
  identity-allocation-mode: crd

# If you want to run cilium in debug mode change this value to true
  debug: "false"
  # If you want metrics enabled in all of your Cilium agents, set the port for
  # which the Cilium agents will have their metrics exposed.
  # This option deprecates the "prometheus-serve-addr" in the
  # "cilium-metrics-config" ConfigMap
  # NOTE that this will open the port on ALL nodes where Cilium pods are
  # scheduled.
  prometheus-serve-addr: ":9100"

# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  # address.
  enable-ipv4: "true"

# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  # address.
  enable-ipv6: "false"

# If you want cilium monitor to aggregate tracing for packets, set this level
  # to "low", "medium", or "maximum". The higher the level, the less packets
  # that will be seen in monitor output.
  monitor-aggregation: medium

# The monitor aggregation interval governs the typical time between monitor
  # notification events for each allowed connection.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-interval: 5s

# ct-global-max-entries-* specifies the maximum number of connections
  # supported across all endpoints, split by protocol: tcp or other. One pair
  # of maps uses these values for IPv4 connections, and another pair of maps
  # use these values for IPv6 connections.
  #
  # If these values are modified, then during the next Cilium startup the
  # tracking of ongoing connections may be disrupted. This may lead to brief
  # policy drops or a change in loadbalancing decisions for a connection.
  #
  # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
  # during the upgrade process, comment out these options.
  bpf-ct-global-tcp-max: "524288"
  bpf-ct-global-any-max: "262144"

# Pre-allocation of map entries allows per-packet latency to be reduced, at
  # the expense of up-front memory allocation for the entries in the maps. The
  # default value below will minimize memory usage in the default installation;
  # users who are sensitive to latency may consider setting this to "true".
  #
  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  # this option and behave as though it is set to "true".
  #
  # If this value is modified, then during the next Cilium startup the restore
  # of existing endpoints and tracking of ongoing connections may be disrupted.
  # This may lead to policy drops or a change in loadbalancing decisions for a
  # connection for some time. Endpoints may need to be recreated to restore
  # connectivity.
  #
  # If this option is set to "false" during an upgrade from 1.3 or earlier to
  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  preallocate-bpf-maps: "false"

# Regular expression matching compatible Istio sidecar istio-proxy
  # container image names
  sidecar-istio-proxy-image: "cilium/istio_proxy"

# Encapsulation mode for communication between nodes
  # Possible values:
  #   - disabled
  #   - vxlan (default)
  #   - geneve
  tunnel: disabled

# Name of the cluster. Only relevant when building a mesh of clusters.
  cluster-name: default

# DNS Polling periodically issues a DNS lookup for each `matchName` from
  # cilium-agent. The result is used to regenerate endpoint policy.
  # DNS lookups are repeated with an interval of 5 seconds, and are made for
  # A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP
  # data is used instead. An IP change will trigger a regeneration of the Cilium
  # policy for each endpoint and increment the per cilium-agent policy
  # repository revision.
  #
  # This option is disabled by default starting from version 1.4.x in favor
  # of a more powerful DNS proxy-based implementation, see [0] for details.
  # Enable this option if you want to use FQDN policies but do not want to use
  # the DNS proxy.
  #
  # To ease upgrade, users may opt to set this option to "true".
  # Otherwise please refer to the Upgrade Guide [1] which explains how to
  # prepare policy rules for upgrade.
  #
  # [0] http://docs.cilium.io/en/stable/policy/language/#dns-based
  # [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
  tofqdns-enable-poller: "false"

# wait-bpf-mount makes init container wait until bpf filesystem is mounted
  wait-bpf-mount: "false"

masquerade: "true"
  enable-ipsec: "false"
  ipsec-key-file: /etc/ipsec/keys
  encrypt-interface: ens10
  encrypt-node: "false"
  enable-xt-socket-fallback: "true"
  install-iptables-rules: "true"
  auto-direct-node-routes: "false"
  kube-proxy-replacement:  "probe"
  enable-host-reachable-services: "false"
  enable-external-ips: "false"
  enable-node-port: "false"
  enable-well-known-identities: "false"
  enable-remote-node-identity: "true"

blacklist-conflicting-routes: "false"
---
# Source: cilium/charts/agent/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - services
      - nodes
      - endpoints
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - ""
    resources:
      - nodes
      - nodes/status
    verbs:
      - patch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - create
      - get
      - list
      - watch
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumnetworkpolicies/status
      - ciliumclusterwidenetworkpolicies
      - ciliumclusterwidenetworkpolicies/status
      - ciliumendpoints
      - ciliumendpoints/status
      - ciliumnodes
      - ciliumnodes/status
      - ciliumidentities
      - ciliumidentities/status
    verbs:
      - "*"
---
# Source: cilium/charts/operator/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
  - apiGroups:
      - ""
    resources:
      # to automatically delete [core|kube]dns pods so that are starting to being
      # managed by Cilium
      - pods
    verbs:
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      # to automatically read from k8s and import the node"s pod CIDR to cilium"s
      # etcd so all nodes know how to reach another pod running in in a different
      # node.
      - nodes
      # to perform the translation of a CNP that contains `ToGroup` to its endpoints
      - services
      - endpoints
      # to check apiserver connectivity
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumnetworkpolicies/status
      - ciliumclusterwidenetworkpolicies
      - ciliumclusterwidenetworkpolicies/status
      - ciliumendpoints
      - ciliumendpoints/status
      - ciliumnodes
      - ciliumnodes/status
      - ciliumidentities
      - ciliumidentities/status
    verbs:
      - "*"
---
# Source: cilium/charts/agent/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
  - kind: ServiceAccount
    name: cilium
    namespace: kube-system
---
# Source: cilium/charts/operator/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
  - kind: ServiceAccount
    name: cilium-operator
    namespace: kube-system
---
# Source: cilium/charts/agent/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: cilium
  name: cilium
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  template:
    metadata:
      annotations:
        prometheus.io/port: "9100"
        prometheus.io/scrape: "true"
        # This annotation plus the CriticalAddonsOnly toleration makes
        # cilium to be a critical pod in the cluster, which ensures cilium
        # gets priority scheduling.
        # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        k8s-app: cilium
    spec:
      containers:
        - args:
            - --config-dir=/tmp/cilium/config-map
          command:
            - cilium-agent
          livenessProbe:
            exec:
              command:
                - cilium
                - status
                - --brief
            failureThreshold: 10
            # The initial delay for the liveness probe is intentionally large to
            # avoid an endless kill & restart cycle if in the event that the initial
            # bootstrapping takes longer than expected.
            initialDelaySeconds: 120
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            exec:
              command:
                - cilium
                - status
                - --brief
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: CILIUM_FLANNEL_MASTER_DEVICE
              valueFrom:
                configMapKeyRef:
                  key: flannel-master-device
                  name: cilium-config
                  optional: true
            - name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT
              valueFrom:
                configMapKeyRef:
                  key: flannel-uninstall-on-exit
                  name: cilium-config
                  optional: true
            - name: CILIUM_CLUSTERMESH_CONFIG
              value: /var/lib/cilium/clustermesh/
            - name: CILIUM_CNI_CHAINING_MODE
              valueFrom:
                configMapKeyRef:
                  key: cni-chaining-mode
                  name: cilium-config
                  optional: true
            - name: CILIUM_CUSTOM_CNI_CONF
              valueFrom:
                configMapKeyRef:
                  key: custom-cni-conf
                  name: cilium-config
                  optional: true
          image: "docker.io/cilium/cilium:v1.7.1"
          imagePullPolicy: IfNotPresent
          lifecycle:
            postStart:
              exec:
                command:
                  - "/cni-install.sh"
                  - "--enable-debug=false"
            preStop:
              exec:
                command:
                  - /cni-uninstall.sh
          name: cilium-agent
          ports:
            - containerPort: 9100
              hostPort: 9100
              name: prometheus
              protocol: TCP
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
                - SYS_MODULE
            privileged: true
          volumeMounts:
            - mountPath: /sys/fs/bpf
              name: bpf-maps
            - mountPath: /var/run/cilium
              name: cilium-run
            - mountPath: /host/opt/cni/bin
              name: cni-path
            - mountPath: /host/etc/cni/net.d
              name: etc-cni-netd
            - mountPath: /var/lib/cilium/clustermesh
              name: clustermesh-secrets
              readOnly: true
            - mountPath: /tmp/cilium/config-map
              name: cilium-config-path
              readOnly: true
              # Needed to be able to load kernel modules
            - mountPath: /lib/modules
              name: lib-modules
              readOnly: true
            - mountPath: /run/xtables.lock
              name: xtables-lock
      hostNetwork: true
      initContainers:
        - command:
            - /init-container.sh
          env:
            - name: CILIUM_ALL_STATE
              valueFrom:
                configMapKeyRef:
                  key: clean-cilium-state
                  name: cilium-config
                  optional: true
            - name: CILIUM_BPF_STATE
              valueFrom:
                configMapKeyRef:
                  key: clean-cilium-bpf-state
                  name: cilium-config
                  optional: true
            - name: CILIUM_WAIT_BPF_MOUNT
              valueFrom:
                configMapKeyRef:
                  key: wait-bpf-mount
                  name: cilium-config
                  optional: true
          image: "docker.io/cilium/cilium:v1.7.1"
          imagePullPolicy: IfNotPresent
          name: clean-cilium-state
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
            privileged: true
          volumeMounts:
            - mountPath: /sys/fs/bpf
              name: bpf-maps
              mountPropagation: HostToContainer
            - mountPath: /var/run/cilium
              name: cilium-run
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccount: cilium
      serviceAccountName: cilium
      terminationGracePeriodSeconds: 1
      tolerations:
        - operator: Exists
      volumes:
        # To keep state between restarts / upgrades
        - hostPath:
            path: /var/run/cilium
            type: DirectoryOrCreate
          name: cilium-run
          # To keep state between restarts / upgrades for bpf maps
        - hostPath:
            path: /sys/fs/bpf
            type: DirectoryOrCreate
          name: bpf-maps
        # To install cilium cni plugin in the host
        - hostPath:
            path:  /opt/cni/bin
            type: DirectoryOrCreate
          name: cni-path
          # To install cilium cni configuration in the host
        - hostPath:
            path: /etc/cni/net.d
            type: DirectoryOrCreate
          name: etc-cni-netd
          # To be able to load kernel modules
        - hostPath:
            path: /lib/modules
          name: lib-modules
          # To access iptables concurrently with other processes (e.g. kube-proxy)
        - hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
          name: xtables-lock
          # To read the clustermesh configuration
        - name: clustermesh-secrets
          secret:
            defaultMode: 420
            optional: true
            secretName: cilium-clustermesh
          # To read the configuration from the config map
        - configMap:
            name: cilium-config
          name: cilium-config-path
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
---
# Source: cilium/charts/operator/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    io.cilium/app: operator
    name: cilium-operator
  name: cilium-operator
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        prometheus.io/port: "6942"
        prometheus.io/scrape: "true"
      labels:
        io.cilium/app: operator
        name: cilium-operator
    spec:
      containers:
        - args:
            - --debug=$(CILIUM_DEBUG)
            - --identity-allocation-mode=$(CILIUM_IDENTITY_ALLOCATION_MODE)
            - --enable-metrics
            - --synchronize-k8s-nodes=true
          command:
            - cilium-operator
          env:
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_DEBUG
              valueFrom:
                configMapKeyRef:
                  key: debug
                  name: cilium-config
                  optional: true
            - name: CILIUM_CLUSTER_NAME
              valueFrom:
                configMapKeyRef:
                  key: cluster-name
                  name: cilium-config
                  optional: true
            - name: CILIUM_CLUSTER_ID
              valueFrom:
                configMapKeyRef:
                  key: cluster-id
                  name: cilium-config
                  optional: true
            - name: CILIUM_IPAM
              valueFrom:
                configMapKeyRef:
                  key: ipam
                  name: cilium-config
                  optional: true
            - name: CILIUM_DISABLE_ENDPOINT_CRD
              valueFrom:
                configMapKeyRef:
                  key: disable-endpoint-crd
                  name: cilium-config
                  optional: true
            - name: CILIUM_KVSTORE
              valueFrom:
                configMapKeyRef:
                  key: kvstore
                  name: cilium-config
                  optional: true
            - name: CILIUM_KVSTORE_OPT
              valueFrom:
                configMapKeyRef:
                  key: kvstore-opt
                  name: cilium-config
                  optional: true
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  key: AWS_ACCESS_KEY_ID
                  name: cilium-aws
                  optional: true
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  key: AWS_SECRET_ACCESS_KEY
                  name: cilium-aws
                  optional: true
            - name: AWS_DEFAULT_REGION
              valueFrom:
                secretKeyRef:
                  key: AWS_DEFAULT_REGION
                  name: cilium-aws
                  optional: true
            - name: CILIUM_IDENTITY_ALLOCATION_MODE
              valueFrom:
                configMapKeyRef:
                  key: identity-allocation-mode
                  name: cilium-config
                  optional: true
          image: "docker.io/cilium/operator:v1.7.1"
          imagePullPolicy: IfNotPresent
          name: cilium-operator
          ports:
            - containerPort: 6942
              hostPort: 6942
              name: prometheus
              protocol: TCP
          livenessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9234
              scheme: HTTP
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 3
      hostNetwork: true
      restartPolicy: Always
      serviceAccount: cilium-operator
      serviceAccountName: cilium-operator

Changed text

Open file

---
# Source: cilium/templates/cilium-agent-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-operator
  namespace: kube-system
---
# Source: cilium/templates/cilium-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:

# If you want to run cilium in debug mode change this value to true
  debug: "false"

# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  # address.
  enable-ipv4: "true"

# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  # address.
  enable-ipv6: "false"
  # Users who wish to specify their own custom CNI configuration file must set
  # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
  custom-cni-conf: "false"
  enable-bpf-clock-probe: "true"
  # If you want cilium monitor to aggregate tracing for packets, set this level
  # to "low", "medium", or "maximum". The higher the level, the less packets
  # that will be seen in monitor output.
  monitor-aggregation: medium

# The monitor aggregation flags determine which TCP flags which, upon the
  # first observation, cause monitor notifications to be generated.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-flags: all
  # Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
  bpf-map-dynamic-size-ratio: "0.0025"
  # bpf-policy-map-max specifies the maximum number of entries in endpoint
  # policy map (per endpoint)
  bpf-policy-map-max: "16384"
  # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
  # backend and affinity maps.
  bpf-lb-map-max: "65536"
  # Pre-allocation of map entries allows per-packet latency to be reduced, at
  # the expense of up-front memory allocation for the entries in the maps. The
  # default value below will minimize memory usage in the default installation;
  # users who are sensitive to latency may consider setting this to "true".
  #
  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  # this option and behave as though it is set to "true".
  #
  # If this value is modified, then during the next Cilium startup the restore
  # of existing endpoints and tracking of ongoing connections may be disrupted.
  # As a result, reply packets may be dropped and the load-balancing decisions
  # for established connections may change.
  #
  # If this option is set to "false" during an upgrade from 1.3 or earlier to
  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  preallocate-bpf-maps: "false"

# Regular expression matching compatible Istio sidecar istio-proxy
  # container image names
  sidecar-istio-proxy-image: "cilium/istio_proxy"

# Encapsulation mode for communication between nodes
  # Possible values:
  #   - disabled
  #   - vxlan (default)
  #   - geneve
  tunnel: disabled

# Name of the cluster. Only relevant when building a mesh of clusters.
  cluster-name: default
  # Enables L7 proxy for L7 policy enforcement and visibility
  enable-l7-proxy: "true"

# wait-bpf-mount makes init container wait until bpf filesystem is mounted
  wait-bpf-mount: "false"

masquerade: "true"
  enable-bpf-masquerade: "true"

enable-xt-socket-fallback: "true"
  install-iptables-rules: "true"

auto-direct-node-routes: "false"
  enable-bandwidth-manager: "false"
  enable-local-redirect-policy: "false"
  kube-proxy-replacement:  "probe"
  kube-proxy-replacement-healthz-bind-address: ""
  enable-health-check-nodeport: "true"
  node-port-bind-protection: "true"
  enable-auto-protect-node-port-range: "true"
  enable-session-affinity: "true"
  enable-endpoint-health-checking: "true"
  enable-health-checking: "true"
  enable-well-known-identities: "false"
  enable-remote-node-identity: "true"
  operator-api-serve-addr: "127.0.0.1:9234"
  # Enable Hubble gRPC service.
  enable-hubble: "true"
  # UNIX domain socket for Hubble server to listen to.
  hubble-socket-path:  "/var/run/cilium/hubble.sock"
  ipam: "cluster-pool"
  cluster-pool-ipv4-cidr: 10.224.0.0/16
  cluster-pool-ipv4-mask-size: "24"
  disable-cnp-status-updates: "true"

#Inserted Configuration
  native-routing-cidr: 10.0.0.0/8
  enable-endpoint-routes: "true"
---
# Source: cilium/templates/cilium-agent-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  - nodes
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  - pods/finalizers
  verbs:
  - get
  - list
  - watch
  - update
  - delete
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - ""
  resources:
  - nodes
  - nodes/status
  verbs:
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  # Deprecated for removal in v1.10
  - create
  - list
  - watch
  - update

# This is used when validating policies in preflight. This will need to stay
  # until we figure out how to avoid "get" inside the preflight, and then
  # should be removed ideally.
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumnetworkpolicies/finalizers
  - ciliumclusterwidenetworkpolicies
  - ciliumclusterwidenetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/finalizers
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumendpoints/finalizers
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  - ciliumidentities
  - ciliumidentities/finalizers
  - ciliumlocalredirectpolicies
  - ciliumlocalredirectpolicies/status
  - ciliumlocalredirectpolicies/finalizers
  verbs:
  - '*'
---
# Source: cilium/templates/cilium-operator-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
- apiGroups:
  - ""
  resources:
  # to automatically delete [core|kube]dns pods so that are starting to being
  # managed by Cilium
  - pods
  verbs:
  - get
  - list
  - watch
  - delete
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  # to perform the translation of a CNP that contains `ToGroup` to its endpoints
  - services
  - endpoints
  # to check apiserver connectivity
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumnetworkpolicies/finalizers
  - ciliumclusterwidenetworkpolicies
  - ciliumclusterwidenetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/finalizers
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumendpoints/finalizers
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  - ciliumidentities
  - ciliumidentities/status
  - ciliumidentities/finalizers
  - ciliumlocalredirectpolicies
  - ciliumlocalredirectpolicies/status
  - ciliumlocalredirectpolicies/finalizers
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - create
  - get
  - list
  - update
  - watch
# For cilium-operator running in HA mode.
#
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
# between mulitple running instances.
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
# common and fewer objects in the cluster watch "all Leases".
# The support for leases was introduced in coordination.k8s.io/v1 during Kubernetes 1.14 release.
# In Cilium we currently don't support HA mode for K8s version < 1.14. This condition make sure
# that we only authorize access to leases resources in supported K8s versions.
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - update
---
# Source: cilium/templates/cilium-agent-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
- kind: ServiceAccount
  name: cilium-operator
  namespace: kube-system
---
# Source: cilium/templates/cilium-agent-daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: cilium
  name: cilium
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
  template:
    metadata:
      annotations:
        # This annotation plus the CriticalAddonsOnly toleration makes
        # cilium to be a critical pod in the cluster, which ensures cilium
        # gets priority scheduling.
        # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        k8s-app: cilium
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: k8s-app
                operator: In
                values:
                - cilium
            topologyKey: kubernetes.io/hostname
      containers:
      - args:
        - --config-dir=/tmp/cilium/config-map
        command:
        - cilium-agent
        livenessProbe:
          httpGet:
            host: '127.0.0.1'
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          failureThreshold: 10
          # The initial delay for the liveness probe is intentionally large to
          # avoid an endless kill & restart cycle if in the event that the initial
          # bootstrapping takes longer than expected.
          initialDelaySeconds: 120
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            host: '127.0.0.1'
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          failureThreshold: 3
          initialDelaySeconds: 5
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_FLANNEL_MASTER_DEVICE
          valueFrom:
            configMapKeyRef:
              key: flannel-master-device
              name: cilium-config
              optional: true
        - name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT
          valueFrom:
            configMapKeyRef:
              key: flannel-uninstall-on-exit
              name: cilium-config
              optional: true
        - name: CILIUM_CLUSTERMESH_CONFIG
          value: /var/lib/cilium/clustermesh/
        - name: CILIUM_CNI_CHAINING_MODE
          valueFrom:
            configMapKeyRef:
              key: cni-chaining-mode
              name: cilium-config
              optional: true
        - name: CILIUM_CUSTOM_CNI_CONF
          valueFrom:
            configMapKeyRef:
              key: custom-cni-conf
              name: cilium-config
              optional: true
        image: quay.io/cilium/cilium:v1.9.0
        imagePullPolicy: IfNotPresent
        lifecycle:
          postStart:
            exec:
              command:
              - "/cni-install.sh"
              - "--enable-debug=false"
          preStop:
            exec:
              command:
              - /cni-uninstall.sh
        name: cilium-agent
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - SYS_MODULE
          privileged: true
        volumeMounts:
        - mountPath: /sys/fs/bpf
          name: bpf-maps
        - mountPath: /var/run/cilium
          name: cilium-run
        - mountPath: /host/opt/cni/bin
          name: cni-path
        - mountPath: /host/etc/cni/net.d
          name: etc-cni-netd
        - mountPath: /var/lib/cilium/clustermesh
          name: clustermesh-secrets
          readOnly: true
        - mountPath: /tmp/cilium/config-map
          name: cilium-config-path
          readOnly: true
          # Needed to be able to load kernel modules
        - mountPath: /lib/modules
          name: lib-modules
          readOnly: true
        - mountPath: /run/xtables.lock
          name: xtables-lock
      hostNetwork: true
      initContainers:
      - command:
        - /init-container.sh
        env:
        - name: CILIUM_ALL_STATE
          valueFrom:
            configMapKeyRef:
              key: clean-cilium-state
              name: cilium-config
              optional: true
        - name: CILIUM_BPF_STATE
          valueFrom:
            configMapKeyRef:
              key: clean-cilium-bpf-state
              name: cilium-config
              optional: true
        - name: CILIUM_WAIT_BPF_MOUNT
          valueFrom:
            configMapKeyRef:
              key: wait-bpf-mount
              name: cilium-config
              optional: true
        image: quay.io/cilium/cilium:v1.9.0
        imagePullPolicy: IfNotPresent
        name: clean-cilium-state
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: true
        volumeMounts:
        - mountPath: /sys/fs/bpf
          name: bpf-maps
          mountPropagation: HostToContainer
        - mountPath: /var/run/cilium
          name: cilium-run
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccount: cilium
      serviceAccountName: cilium
      terminationGracePeriodSeconds: 1
      tolerations:
      - operator: Exists
      volumes:
        # To keep state between restarts / upgrades
      - hostPath:
          path: /var/run/cilium
          type: DirectoryOrCreate
        name: cilium-run
        # To keep state between restarts / upgrades for bpf maps
      - hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
        name: bpf-maps
      # To install cilium cni plugin in the host
      - hostPath:
          path:  /opt/cni/bin
          type: DirectoryOrCreate
        name: cni-path
        # To install cilium cni configuration in the host
      - hostPath:
          path: /etc/cni/net.d
          type: DirectoryOrCreate
        name: etc-cni-netd
        # To be able to load kernel modules
      - hostPath:
          path: /lib/modules
        name: lib-modules
        # To access iptables concurrently with other processes (e.g. kube-proxy)
      - hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
        name: xtables-lock
        # To read the clustermesh configuration
      - name: clustermesh-secrets
        secret:
          defaultMode: 420
          optional: true
          secretName: cilium-clustermesh
        # To read the configuration from the config map
      - configMap:
          name: cilium-config
        name: cilium-config-path
---
# Source: cilium/templates/cilium-operator-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    io.cilium/app: operator
    name: cilium-operator
  name: cilium-operator
  namespace: kube-system
spec:
  # We support HA mode only for Kubernetes version > 1.14
  # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go
  # for more details.
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        io.cilium/app: operator
        name: cilium-operator
    spec:
      # In HA mode, cilium-operator pods must not be scheduled on the same
      # node as they will clash with each other.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: io.cilium/app
                operator: In
                values:
                - operator
            topologyKey: kubernetes.io/hostname
      containers:
      - args:
        - --config-dir=/tmp/cilium/config-map
        - --debug=$(CILIUM_DEBUG)
        command:
        - cilium-operator-generic
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_DEBUG
          valueFrom:
            configMapKeyRef:
              key: debug
              name: cilium-config
              optional: true
        image: quay.io/cilium/operator-generic:v1.9.0
        imagePullPolicy: IfNotPresent
        name: cilium-operator
        livenessProbe:
          httpGet:
            host: '127.0.0.1'
            path: /healthz
            port: 9234
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 3
        volumeMounts:
        - mountPath: /tmp/cilium/config-map
          name: cilium-config-path
          readOnly: true
      hostNetwork: true
      restartPolicy: Always
      priorityClassName: system-cluster-critical
      serviceAccount: cilium-operator
      serviceAccountName: cilium-operator
      tolerations:
      - operator: Exists
      volumes:
        # To read the configuration from the config map
      - configMap:
          name: cilium-config
        name: cilium-config-path