Skip to content

Commit 1d5b281

Browse files
author
Kubernetes Submit Queue
authoredOct 17, 2017
Merge pull request #3623 from KashifSaadat/canal-v2.5
Automatic merge from submit-queue. Add Calico v2.5 support for Kubernetes v1.8+ Added support for Canal (Calico) v2.5.1, which is required to work with Kubernetes v1.8.0+. Older versions of Calico relied on ThirdPartyResources API to store it's config data, however this is now fully deprecated in Kubernetes v1.8 and has moved over to CustomResourceDefinitions (CRD). Calico v2.5+ has been updated to use CRD, however there is a manual upgrade process involved to migrate the configuration data across: https://github.com/projectcalico/calico/blob/master/upgrade/v2.5/README.md
·
v1.32.0-beta.11.8.0-beta.1
2 parents f63a8aa + 6d624c7 commit 1d5b281

File tree

2 files changed

+464
-7
lines changed

2 files changed

+464
-7
lines changed
 

‎upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.8.yaml.template

+439
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,439 @@
1+
# This ConfigMap can be used to configure a self-hosted Canal installation.
2+
kind: ConfigMap
3+
apiVersion: v1
4+
metadata:
5+
name: canal-config
6+
namespace: kube-system
7+
data:
8+
# The interface used by canal for host <-> host communication.
9+
# If left blank, then the interface is chosen using the node's
10+
# default route.
11+
canal_iface: ""
12+
13+
# Whether or not to masquerade traffic to destinations not within
14+
# the pod network.
15+
masquerade: "true"
16+
17+
# The CNI network configuration to install on each node.
18+
cni_network_config: |-
19+
{
20+
"name": "k8s-pod-network",
21+
"cniVersion": "0.1.0",
22+
"type": "calico",
23+
"log_level": "info",
24+
"datastore_type": "kubernetes",
25+
"nodename": "__KUBERNETES_NODE_NAME__",
26+
"ipam": {
27+
"type": "host-local",
28+
"subnet": "usePodCidr"
29+
},
30+
"policy": {
31+
"type": "k8s",
32+
"k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
33+
},
34+
"kubernetes": {
35+
"k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
36+
"kubeconfig": "__KUBECONFIG_FILEPATH__"
37+
}
38+
}
39+
40+
# Flannel network configuration. Mounted into the flannel container.
41+
net-conf.json: |
42+
{
43+
"Network": "{{ .NonMasqueradeCIDR }}",
44+
"Backend": {
45+
"Type": "vxlan"
46+
}
47+
}
48+
49+
---
50+
51+
# This manifest installs the calico/node container, as well
52+
# as the Calico CNI plugins and network config on
53+
# each master and worker node in a Kubernetes cluster.
54+
kind: DaemonSet
55+
apiVersion: extensions/v1beta1
56+
metadata:
57+
name: canal
58+
namespace: kube-system
59+
labels:
60+
k8s-app: canal
61+
spec:
62+
selector:
63+
matchLabels:
64+
k8s-app: canal
65+
template:
66+
metadata:
67+
labels:
68+
k8s-app: canal
69+
annotations:
70+
scheduler.alpha.kubernetes.io/critical-pod: ''
71+
spec:
72+
hostNetwork: true
73+
serviceAccountName: canal
74+
tolerations:
75+
# Allow the pod to run on the master. This is required for
76+
# the master to communicate with pods.
77+
- key: node-role.kubernetes.io/master
78+
effect: NoSchedule
79+
# Mark the pod as a critical add-on for rescheduling.
80+
- key: "CriticalAddonsOnly"
81+
operator: "Exists"
82+
containers:
83+
# Runs calico/node container on each Kubernetes node. This
84+
# container programs network policy and routes on each
85+
# host.
86+
- name: calico-node
87+
image: quay.io/calico/node:v2.5.1
88+
env:
89+
# Use Kubernetes API as the backing datastore.
90+
- name: DATASTORE_TYPE
91+
value: "kubernetes"
92+
# Enable felix logging.
93+
- name: FELIX_LOGSEVERITYSYS
94+
value: "info"
95+
# Don't enable BGP.
96+
- name: CALICO_NETWORKING_BACKEND
97+
value: "none"
98+
# Cluster type to identify the deployment type
99+
- name: CLUSTER_TYPE
100+
value: "kops,canal"
101+
# Disable file logging so `kubectl logs` works.
102+
- name: CALICO_DISABLE_FILE_LOGGING
103+
value: "true"
104+
# Period, in seconds, at which felix re-applies all iptables state
105+
- name: FELIX_IPTABLESREFRESHINTERVAL
106+
value: "60"
107+
# Disable IPV6 support in Felix.
108+
- name: FELIX_IPV6SUPPORT
109+
value: "false"
110+
# Wait for the datastore.
111+
- name: WAIT_FOR_DATASTORE
112+
value: "true"
113+
# No IP address needed.
114+
- name: IP
115+
value: ""
116+
- name: NODENAME
117+
valueFrom:
118+
fieldRef:
119+
fieldPath: spec.nodeName
120+
# Set Felix endpoint to host default action to ACCEPT.
121+
- name: FELIX_DEFAULTENDPOINTTOHOSTACTION
122+
value: "{{- or .Networking.Canal.DefaultEndpointToHostAction "ACCEPT" }}"
123+
# Controls whether Felix inserts rules to the top of iptables chains, or appends to the bottom
124+
- name: FELIX_CHAININSERTMODE
125+
value: "{{- or .Networking.Canal.ChainInsertMode "insert" }}"
126+
# Set to enable the experimental Prometheus metrics server
127+
- name: FELIX_PROMETHEUSMETRICSENABLED
128+
value: "{{- or .Networking.Canal.PrometheusMetricsEnabled "false" }}"
129+
# TCP port that the Prometheus metrics server should bind to
130+
- name: FELIX_PROMETHEUSMETRICSPORT
131+
value: "{{- or .Networking.Canal.PrometheusMetricsPort "9091" }}"
132+
# Enable Prometheus Go runtime metrics collection
133+
- name: FELIX_PROMETHEUSGOMETRICSENABLED
134+
value: "{{- or .Networking.Canal.PrometheusGoMetricsEnabled "true" }}"
135+
# Enable Prometheus process metrics collection
136+
- name: FELIX_PROMETHEUSPROCESSMETRICSENABLED
137+
value: "{{- or .Networking.Canal.PrometheusProcessMetricsEnabled "true" }}"
138+
- name: FELIX_HEALTHENABLED
139+
value: "true"
140+
securityContext:
141+
privileged: true
142+
resources:
143+
limits:
144+
cpu: 250m
145+
requests:
146+
cpu: 250m
147+
livenessProbe:
148+
httpGet:
149+
path: /liveness
150+
port: 9099
151+
periodSeconds: 10
152+
initialDelaySeconds: 10
153+
failureThreshold: 6
154+
readinessProbe:
155+
httpGet:
156+
path: /readiness
157+
port: 9099
158+
periodSeconds: 10
159+
volumeMounts:
160+
- mountPath: /lib/modules
161+
name: lib-modules
162+
readOnly: true
163+
- mountPath: /var/run/calico
164+
name: var-run-calico
165+
readOnly: false
166+
# This container installs the Calico CNI binaries
167+
# and CNI network config file on each node.
168+
- name: install-cni
169+
image: quay.io/calico/cni:v1.10.0
170+
command: ["/install-cni.sh"]
171+
env:
172+
# The CNI network config to install on each node.
173+
- name: CNI_NETWORK_CONFIG
174+
valueFrom:
175+
configMapKeyRef:
176+
name: canal-config
177+
key: cni_network_config
178+
- name: KUBERNETES_NODE_NAME
179+
valueFrom:
180+
fieldRef:
181+
fieldPath: spec.nodeName
182+
volumeMounts:
183+
- mountPath: /host/opt/cni/bin
184+
name: cni-bin-dir
185+
- mountPath: /host/etc/cni/net.d
186+
name: cni-net-dir
187+
# This container runs flannel using the kube-subnet-mgr backend
188+
# for allocating subnets.
189+
- name: kube-flannel
190+
image: quay.io/coreos/flannel:v0.8.0
191+
command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ]
192+
securityContext:
193+
privileged: true
194+
env:
195+
- name: POD_NAME
196+
valueFrom:
197+
fieldRef:
198+
fieldPath: metadata.name
199+
- name: POD_NAMESPACE
200+
valueFrom:
201+
fieldRef:
202+
fieldPath: metadata.namespace
203+
- name: FLANNELD_IFACE
204+
valueFrom:
205+
configMapKeyRef:
206+
name: canal-config
207+
key: canal_iface
208+
- name: FLANNELD_IP_MASQ
209+
valueFrom:
210+
configMapKeyRef:
211+
name: canal-config
212+
key: masquerade
213+
resources:
214+
limits:
215+
cpu: 100m
216+
memory: 100Mi
217+
requests:
218+
cpu: 100m
219+
memory: 100Mi
220+
volumeMounts:
221+
- name: run
222+
mountPath: /run
223+
- name: flannel-cfg
224+
mountPath: /etc/kube-flannel/
225+
volumes:
226+
# Used by calico/node.
227+
- name: lib-modules
228+
hostPath:
229+
path: /lib/modules
230+
- name: var-run-calico
231+
hostPath:
232+
path: /var/run/calico
233+
# Used to install CNI.
234+
- name: cni-bin-dir
235+
hostPath:
236+
path: /opt/cni/bin
237+
- name: cni-net-dir
238+
hostPath:
239+
path: /etc/cni/net.d
240+
# Used by flannel.
241+
- name: run
242+
hostPath:
243+
path: /run
244+
- name: flannel-cfg
245+
configMap:
246+
name: canal-config
247+
248+
249+
# Create all the CustomResourceDefinitions needed for
250+
# Calico policy-only mode.
251+
---
252+
253+
apiVersion: apiextensions.k8s.io/v1beta1
254+
description: Calico Global Felix Configuration
255+
kind: CustomResourceDefinition
256+
metadata:
257+
name: globalfelixconfigs.crd.projectcalico.org
258+
spec:
259+
scope: Cluster
260+
group: crd.projectcalico.org
261+
version: v1
262+
names:
263+
kind: GlobalFelixConfig
264+
plural: globalfelixconfigs
265+
singular: globalfelixconfig
266+
267+
---
268+
269+
apiVersion: apiextensions.k8s.io/v1beta1
270+
description: Calico Global BGP Configuration
271+
kind: CustomResourceDefinition
272+
metadata:
273+
name: globalbgpconfigs.crd.projectcalico.org
274+
spec:
275+
scope: Cluster
276+
group: crd.projectcalico.org
277+
version: v1
278+
names:
279+
kind: GlobalBGPConfig
280+
plural: globalbgpconfigs
281+
singular: globalbgpconfig
282+
283+
---
284+
285+
apiVersion: apiextensions.k8s.io/v1beta1
286+
description: Calico IP Pools
287+
kind: CustomResourceDefinition
288+
metadata:
289+
name: ippools.crd.projectcalico.org
290+
spec:
291+
scope: Cluster
292+
group: crd.projectcalico.org
293+
version: v1
294+
names:
295+
kind: IPPool
296+
plural: ippools
297+
singular: ippool
298+
299+
---
300+
301+
apiVersion: apiextensions.k8s.io/v1beta1
302+
description: Calico Global Network Policies
303+
kind: CustomResourceDefinition
304+
metadata:
305+
name: globalnetworkpolicies.crd.projectcalico.org
306+
spec:
307+
scope: Cluster
308+
group: crd.projectcalico.org
309+
version: v1
310+
names:
311+
kind: GlobalNetworkPolicy
312+
plural: globalnetworkpolicies
313+
singular: globalnetworkpolicy
314+
315+
---
316+
317+
apiVersion: v1
318+
kind: ServiceAccount
319+
metadata:
320+
name: canal
321+
namespace: kube-system
322+
323+
---
324+
325+
# Calico Roles
326+
# Pulled from https://docs.projectcalico.org/v2.5/getting-started/kubernetes/installation/hosted/rbac-kdd.yaml
327+
kind: ClusterRole
328+
apiVersion: rbac.authorization.k8s.io/v1beta1
329+
metadata:
330+
name: calico
331+
namespace: kube-system
332+
rules:
333+
- apiGroups: [""]
334+
resources:
335+
- namespaces
336+
verbs:
337+
- get
338+
- list
339+
- watch
340+
- apiGroups: [""]
341+
resources:
342+
- pods/status
343+
verbs:
344+
- update
345+
- apiGroups: [""]
346+
resources:
347+
- pods
348+
verbs:
349+
- get
350+
- list
351+
- watch
352+
- apiGroups: [""]
353+
resources:
354+
- nodes
355+
verbs:
356+
- get
357+
- list
358+
- update
359+
- watch
360+
- apiGroups: ["extensions"]
361+
resources:
362+
- networkpolicies
363+
verbs:
364+
- get
365+
- list
366+
- watch
367+
- apiGroups: ["crd.projectcalico.org"]
368+
resources:
369+
- globalfelixconfigs
370+
- bgppeers
371+
- globalbgpconfigs
372+
- ippools
373+
- globalnetworkpolicies
374+
verbs:
375+
- create
376+
- get
377+
- list
378+
- update
379+
- watch
380+
381+
---
382+
383+
# Flannel roles
384+
# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml
385+
kind: ClusterRole
386+
apiVersion: rbac.authorization.k8s.io/v1beta1
387+
metadata:
388+
name: flannel
389+
rules:
390+
- apiGroups:
391+
- ""
392+
resources:
393+
- pods
394+
verbs:
395+
- get
396+
- apiGroups:
397+
- ""
398+
resources:
399+
- nodes
400+
verbs:
401+
- list
402+
- watch
403+
- apiGroups:
404+
- ""
405+
resources:
406+
- nodes/status
407+
verbs:
408+
- patch
409+
---
410+
411+
# Bind the flannel ClusterRole to the canal ServiceAccount.
412+
kind: ClusterRoleBinding
413+
apiVersion: rbac.authorization.k8s.io/v1beta1
414+
metadata:
415+
name: canal-flannel
416+
roleRef:
417+
apiGroup: rbac.authorization.k8s.io
418+
kind: ClusterRole
419+
name: flannel
420+
subjects:
421+
- kind: ServiceAccount
422+
name: canal
423+
namespace: kube-system
424+
425+
---
426+
427+
# Bind the calico ClusterRole to the canal ServiceAccount.
428+
apiVersion: rbac.authorization.k8s.io/v1beta1
429+
kind: ClusterRoleBinding
430+
metadata:
431+
name: canal-calico
432+
roleRef:
433+
apiGroup: rbac.authorization.k8s.io
434+
kind: ClusterRole
435+
name: calico
436+
subjects:
437+
- kind: ServiceAccount
438+
name: canal
439+
namespace: kube-system

‎upup/pkg/fi/cloudup/bootstrapchannelbuilder.go

+25-7
Original file line numberDiff line numberDiff line change
@@ -443,16 +443,19 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri
443443

444444
if b.cluster.Spec.Networking.Canal != nil {
445445
key := "networking.projectcalico.org.canal"
446-
// Locking canal addon version to 2.4.1 (same as Calico node). Best to maintain lockstep for sanity
447-
version := "2.4.1"
446+
versions := map[string]string{
447+
"pre-k8s-1.6": "2.4.1",
448+
"k8s-1.6": "2.4.1",
449+
"k8s-1.8": "2.5.1",
450+
}
448451

449452
{
450-
location := key + "/pre-k8s-1.6.yaml"
451453
id := "pre-k8s-1.6"
454+
location := key + "/" + id + ".yaml"
452455

453456
addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{
454457
Name: fi.String(key),
455-
Version: fi.String(version),
458+
Version: fi.String(versions[id]),
456459
Selector: networkingSelector,
457460
Manifest: fi.String(location),
458461
KubernetesVersion: "<1.6.0",
@@ -462,15 +465,30 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri
462465
}
463466

464467
{
465-
location := key + "/k8s-1.6.yaml"
466468
id := "k8s-1.6"
469+
location := key + "/" + id + ".yaml"
467470

468471
addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{
469472
Name: fi.String(key),
470-
Version: fi.String(version),
473+
Version: fi.String(versions[id]),
471474
Selector: networkingSelector,
472475
Manifest: fi.String(location),
473-
KubernetesVersion: ">=1.6.0",
476+
KubernetesVersion: ">=1.6.0 <1.8.0",
477+
Id: id,
478+
})
479+
manifests[key+"-"+id] = "addons/" + location
480+
}
481+
482+
{
483+
id := "k8s-1.8"
484+
location := key + "/" + id + ".yaml"
485+
486+
addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{
487+
Name: fi.String(key),
488+
Version: fi.String(versions[id]),
489+
Selector: networkingSelector,
490+
Manifest: fi.String(location),
491+
KubernetesVersion: ">=1.8.0",
474492
Id: id,
475493
})
476494
manifests[key+"-"+id] = "addons/" + location

0 commit comments

Comments
 (0)
Please sign in to comment.