diff --git a/clusters/cl01tl/manifests/cilium/ClusterRole-cilium-operator.yaml b/clusters/cl01tl/manifests/cilium/ClusterRole-cilium-operator.yaml index f7e07eb33..59686cae3 100644 --- a/clusters/cl01tl/manifests/cilium/ClusterRole-cilium-operator.yaml +++ b/clusters/cl01tl/manifests/cilium/ClusterRole-cilium-operator.yaml @@ -73,6 +73,18 @@ rules: - update - delete - patch + - apiGroups: + - "discovery.k8s.io" + resources: + - endpointslices + verbs: + - get + - list + - watch + - create + - update + - delete + - patch - apiGroups: - cilium.io resources: @@ -166,7 +178,6 @@ rules: - update resourceNames: - ciliumloadbalancerippools.cilium.io - - ciliumbgppeeringpolicies.cilium.io - ciliumbgpclusterconfigs.cilium.io - ciliumbgppeerconfigs.cilium.io - ciliumbgpadvertisements.cilium.io @@ -192,7 +203,6 @@ rules: resources: - ciliumloadbalancerippools - ciliumpodippools - - ciliumbgppeeringpolicies - ciliumbgpclusterconfigs - ciliumbgpnodeconfigoverrides - ciliumbgppeerconfigs @@ -274,3 +284,9 @@ rules: - get - list - watch + - apiGroups: + - cilium.io + resources: + - ciliumendpointslices + verbs: + - deletecollection diff --git a/clusters/cl01tl/manifests/cilium/ClusterRole-cilium.yaml b/clusters/cl01tl/manifests/cilium/ClusterRole-cilium.yaml index 92b76c741..b57ca9706 100644 --- a/clusters/cl01tl/manifests/cilium/ClusterRole-cilium.yaml +++ b/clusters/cl01tl/manifests/cilium/ClusterRole-cilium.yaml @@ -45,7 +45,6 @@ rules: - cilium.io resources: - ciliumloadbalancerippools - - ciliumbgppeeringpolicies - ciliumbgpnodeconfigs - ciliumbgpadvertisements - ciliumbgppeerconfigs diff --git a/clusters/cl01tl/manifests/cilium/ClusterRole-hubble-ui.yaml b/clusters/cl01tl/manifests/cilium/ClusterRole-hubble-ui.yaml index 8d8d0f775..722067efd 100644 --- a/clusters/cl01tl/manifests/cilium/ClusterRole-hubble-ui.yaml +++ b/clusters/cl01tl/manifests/cilium/ClusterRole-hubble-ui.yaml @@ -5,14 +5,6 @@ metadata: labels: app.kubernetes.io/part-of: cilium rules: - - apiGroups: - - networking.k8s.io - resources: - - networkpolicies - verbs: - - get - - list - - watch - apiGroups: - "" resources: @@ -34,11 +26,3 @@ rules: - get - list - watch - - apiGroups: - - cilium.io - resources: - - "*" - verbs: - - get - - list - - watch diff --git a/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yaml b/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yaml index d68d9f3b9..d166498f8 100644 --- a/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yaml +++ b/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yaml @@ -25,7 +25,7 @@ data: enable-gateway-api-alpn: "true" gateway-api-xff-num-trusted-hops: "0" gateway-api-service-externaltrafficpolicy: "Cluster" - gateway-api-secrets-namespace: "kube-system" + gateway-api-secrets-namespace: "cilium-secrets" gateway-api-hostnetwork-enabled: "false" gateway-api-hostnetwork-nodelabelselector: "" enable-policy-secrets-sync: "true" @@ -58,6 +58,7 @@ data: tunnel-protocol: "vxlan" tunnel-source-port-range: "0-0" service-no-backend-response: "reject" + policy-deny-response: "none" enable-l7-proxy: "true" enable-ipv4-masquerade: "true" enable-ipv4-big-tcp: "false" @@ -74,6 +75,7 @@ data: devices: "end0 enp6s0" kube-proxy-replacement: "true" kube-proxy-replacement-healthz-bind-address: "" + enable-no-service-endpoints-routable: "true" bpf-lb-sock: "true" bpf-lb-sock-hostns-only: "true" enable-health-check-nodeport: "true" @@ -81,7 +83,7 @@ data: node-port-bind-protection: "true" enable-auto-protect-node-port-range: "true" bpf-lb-acceleration: "disabled" - enable-svc-source-range-check: "true" + enable-service-topology: "false" enable-l2-neigh-discovery: "false" k8s-require-ipv4-pod-cidr: "false" k8s-require-ipv6-pod-cidr: "false" @@ -114,6 +116,7 @@ data: vtep-cidr: "" vtep-mask: "" vtep-mac: "" + packetization-layer-pmtud-mode: "blackhole" procfs: "/host/proc" bpf-root: "/sys/fs/bpf" cgroup-root: "/sys/fs/cgroup" @@ -126,7 +129,7 @@ data: remove-cilium-node-taints: "true" set-cilium-node-taints: "true" set-cilium-is-up-condition: "true" - unmanaged-pod-watcher-interval: "15" + unmanaged-pod-watcher-interval: "15s" dnsproxy-enable-transparent-mode: "true" dnsproxy-socket-linger-timeout: "10" tofqdns-dns-reject-response-code: "refused" @@ -137,7 +140,7 @@ data: tofqdns-proxy-response-max-delay: "100ms" tofqdns-preallocate-identities: "true" agent-not-ready-taint-key: "node.cilium.io/agent-not-ready" - mesh-auth-enabled: "true" + mesh-auth-enabled: "false" mesh-auth-queue-size: "1024" mesh-auth-rotated-identities-queue-size: "1024" mesh-auth-gc-interval: "5m0s" @@ -145,10 +148,14 @@ data: proxy-xff-num-trusted-hops-egress: "0" proxy-connect-timeout: "2" proxy-initial-fetch-timeout: "30" + proxy-max-active-downstream-connections: "50000" proxy-max-requests-per-connection: "0" proxy-max-connection-duration-seconds: "0" proxy-idle-timeout-seconds: "60" proxy-max-concurrent-retries: "128" + proxy-use-original-source-address: "true" + proxy-cluster-max-connections: "1024" + proxy-cluster-max-requests: "1024" http-retry-count: "3" http-stream-idle-timeout: "300" external-envoy-proxy: "true" @@ -156,12 +163,15 @@ data: envoy-access-log-buffer-size: "4096" envoy-keep-cap-netbindservice: "true" max-connected-clusters: "255" + clustermesh-cache-ttl: "0s" clustermesh-enable-endpoint-sync: "false" clustermesh-enable-mcs-api: "false" - policy-default-local-cluster: "false" + clustermesh-mcs-api-install-crds: "true" + policy-default-local-cluster: "true" nat-map-stats-entries: "32" nat-map-stats-interval: "30s" - enable-internal-traffic-policy: "true" enable-lb-ipam: "true" enable-non-default-deny-policies: "true" enable-source-ip-verification: "true" + enable-dynamic-config: "true" + enable-drift-checker: "true" diff --git a/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-envoy-config.yaml b/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-envoy-config.yaml index b351546ab..c40c79c25 100644 --- a/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-envoy-config.yaml +++ b/clusters/cl01tl/manifests/cilium/ConfigMap-cilium-envoy-config.yaml @@ -5,4 +5,4 @@ metadata: namespace: kube-system data: bootstrap-config.json: | - {"admin":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} + {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} diff --git a/clusters/cl01tl/manifests/cilium/CronJob-hubble-generate-certs.yaml b/clusters/cl01tl/manifests/cilium/CronJob-hubble-generate-certs.yaml index 02432a5d9..ced0b7a5e 100644 --- a/clusters/cl01tl/manifests/cilium/CronJob-hubble-generate-certs.yaml +++ b/clusters/cl01tl/manifests/cilium/CronJob-hubble-generate-certs.yaml @@ -9,6 +9,8 @@ metadata: app.kubernetes.io/part-of: cilium spec: schedule: "0 0 1 */4 *" + successfulJobsHistoryLimit: 3 + failedJobsHistoryLimit: 1 concurrencyPolicy: Forbid jobTemplate: spec: @@ -22,7 +24,7 @@ spec: type: RuntimeDefault containers: - name: certgen - image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9" + image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697" imagePullPolicy: IfNotPresent securityContext: capabilities: @@ -63,9 +65,6 @@ spec: - client auth validity: 8760h hostNetwork: false - serviceAccount: "hubble-generate-certs" serviceAccountName: "hubble-generate-certs" automountServiceAccountToken: true restartPolicy: OnFailure - affinity: - ttlSecondsAfterFinished: 1800 diff --git a/clusters/cl01tl/manifests/cilium/DaemonSet-cilium-envoy.yaml b/clusters/cl01tl/manifests/cilium/DaemonSet-cilium-envoy.yaml index 5e7fc72c8..2b3a562ea 100644 --- a/clusters/cl01tl/manifests/cilium/DaemonSet-cilium-envoy.yaml +++ b/clusters/cl01tl/manifests/cilium/DaemonSet-cilium-envoy.yaml @@ -30,7 +30,7 @@ spec: type: Unconfined containers: - name: cilium-envoy - image: "quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86" + image: "quay.io/cilium/cilium-envoy:v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa@sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d" imagePullPolicy: IfNotPresent command: - /usr/bin/cilium-envoy-starter diff --git a/clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yaml b/clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yaml index 57d3cc278..4afa00d9a 100644 --- a/clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yaml +++ b/clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yaml @@ -18,7 +18,7 @@ spec: template: metadata: annotations: - cilium.io/cilium-configmap-checksum: "6c5e6123b63f6fc449922e9eb9bd248afa8fd228d8083cc40c920fff386079bb" + cilium.io/cilium-configmap-checksum: "501f8d2dbdd40925853054c7e3add60e203bb04219e79fec25ccf1a4cbc0e5d5" kubectl.kubernetes.io/default-container: cilium-agent labels: k8s-app: cilium @@ -32,7 +32,7 @@ spec: type: Unconfined containers: - name: cilium-agent - image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" + image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10" imagePullPolicy: IfNotPresent command: - cilium-agent @@ -42,7 +42,7 @@ spec: httpGet: host: "127.0.0.1" path: /healthz - port: 9879 + port: health scheme: HTTP httpHeaders: - name: "brief" @@ -55,7 +55,7 @@ spec: httpGet: host: "127.0.0.1" path: /healthz - port: 9879 + port: health scheme: HTTP httpHeaders: - name: "brief" @@ -70,7 +70,7 @@ spec: httpGet: host: "127.0.0.1" path: /healthz - port: 9879 + port: health scheme: HTTP httpHeaders: - name: "brief" @@ -136,6 +136,10 @@ spec: command: - /cni-uninstall.sh ports: + - name: health + containerPort: 9879 + hostPort: 9879 + protocol: TCP - name: peer-service containerPort: 4244 hostPort: 4244 @@ -155,14 +159,14 @@ spec: - NET_ADMIN - NET_RAW - IPC_LOCK + - SYS_MODULE - SYS_ADMIN - SYS_RESOURCE - DAC_OVERRIDE - FOWNER - SETGID - SETUID - - PERFMON - - BPF + - SYSLOG drop: - ALL terminationMessagePolicy: FallbackToLogsOnError @@ -201,7 +205,7 @@ spec: mountPath: /tmp initContainers: - name: config - image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" + image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10" imagePullPolicy: IfNotPresent command: - cilium-dbg @@ -225,14 +229,20 @@ spec: - name: tmp mountPath: /tmp terminationMessagePolicy: FallbackToLogsOnError + securityContext: + capabilities: + add: + - NET_ADMIN + drop: + - ALL - name: apply-sysctl-overwrites - image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" + image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10" imagePullPolicy: IfNotPresent env: - name: BIN_PATH value: /opt/cni/bin command: - - sh + - bash - -ec - | cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix; @@ -256,7 +266,7 @@ spec: drop: - ALL - name: mount-bpf-fs - image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" + image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10" imagePullPolicy: IfNotPresent args: - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf' @@ -272,7 +282,7 @@ spec: mountPath: /sys/fs/bpf mountPropagation: Bidirectional - name: clean-cilium-state - image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" + image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10" imagePullPolicy: IfNotPresent command: - /init-container.sh @@ -307,6 +317,7 @@ spec: capabilities: add: - NET_ADMIN + - SYS_MODULE - SYS_ADMIN - SYS_RESOURCE drop: @@ -320,11 +331,14 @@ spec: - name: cilium-run mountPath: /var/run/cilium - name: install-cni-binaries - image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" + image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10" imagePullPolicy: IfNotPresent command: - "/install-plugin.sh" resources: + limits: + cpu: 1 + memory: 1Gi requests: cpu: 100m memory: 10Mi diff --git a/clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yaml b/clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yaml index d8d9b9b0a..16335c827 100644 --- a/clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yaml +++ b/clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yaml @@ -22,7 +22,7 @@ spec: template: metadata: annotations: - cilium.io/cilium-configmap-checksum: "6c5e6123b63f6fc449922e9eb9bd248afa8fd228d8083cc40c920fff386079bb" + cilium.io/cilium-configmap-checksum: "501f8d2dbdd40925853054c7e3add60e203bb04219e79fec25ccf1a4cbc0e5d5" labels: io.cilium/app: operator name: cilium-operator @@ -34,7 +34,7 @@ spec: type: RuntimeDefault containers: - name: cilium-operator - image: "quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af" + image: "quay.io/cilium/operator-generic:v1.19.3@sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd" imagePullPolicy: IfNotPresent command: - cilium-operator-generic @@ -63,6 +63,9 @@ spec: - name: KUBERNETES_SERVICE_PORT value: "7445" ports: + - name: health + containerPort: 9234 + hostPort: 9234 - name: prometheus containerPort: 9963 hostPort: 9963 @@ -71,7 +74,7 @@ spec: httpGet: host: "127.0.0.1" path: /healthz - port: 9234 + port: health scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 @@ -80,7 +83,7 @@ spec: httpGet: host: "127.0.0.1" path: /healthz - port: 9234 + port: health scheme: HTTP initialDelaySeconds: 0 periodSeconds: 5 diff --git a/clusters/cl01tl/manifests/cilium/Deployment-hubble-relay.yaml b/clusters/cl01tl/manifests/cilium/Deployment-hubble-relay.yaml index 98982dc55..770871429 100644 --- a/clusters/cl01tl/manifests/cilium/Deployment-hubble-relay.yaml +++ b/clusters/cl01tl/manifests/cilium/Deployment-hubble-relay.yaml @@ -40,7 +40,7 @@ spec: runAsUser: 65532 seccompProfile: type: RuntimeDefault - image: "quay.io/cilium/hubble-relay:v1.18.6@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e" + image: "quay.io/cilium/hubble-relay:v1.19.3@sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b" imagePullPolicy: IfNotPresent command: - hubble-relay diff --git a/clusters/cl01tl/manifests/cilium/Deployment-hubble-ui.yaml b/clusters/cl01tl/manifests/cilium/Deployment-hubble-ui.yaml index 462ab14ad..30534a15f 100644 --- a/clusters/cl01tl/manifests/cilium/Deployment-hubble-ui.yaml +++ b/clusters/cl01tl/manifests/cilium/Deployment-hubble-ui.yaml @@ -41,11 +41,11 @@ spec: livenessProbe: httpGet: path: /healthz - port: 8081 + port: http readinessProbe: httpGet: path: / - port: 8081 + port: http volumeMounts: - name: hubble-ui-nginx-conf mountPath: /etc/nginx/conf.d/default.conf @@ -77,5 +77,5 @@ spec: defaultMode: 420 name: hubble-ui-nginx name: hubble-ui-nginx-conf - - emptyDir: {} - name: tmp-dir + - name: tmp-dir + emptyDir: {} diff --git a/clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs.yaml b/clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs-b36ef54b9b.yaml similarity index 86% rename from clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs.yaml rename to clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs-b36ef54b9b.yaml index f86c46f73..131721271 100644 --- a/clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs.yaml +++ b/clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs-b36ef54b9b.yaml @@ -1,14 +1,12 @@ apiVersion: batch/v1 kind: Job metadata: - name: hubble-generate-certs + name: hubble-generate-certs-b36ef54b9b namespace: kube-system labels: k8s-app: hubble-generate-certs app.kubernetes.io/name: hubble-generate-certs app.kubernetes.io/part-of: cilium - annotations: - "helm.sh/hook": post-install,post-upgrade spec: template: metadata: @@ -20,7 +18,7 @@ spec: type: RuntimeDefault containers: - name: certgen - image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9" + image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697" imagePullPolicy: IfNotPresent securityContext: capabilities: @@ -61,9 +59,6 @@ spec: - client auth validity: 8760h hostNetwork: false - serviceAccount: "hubble-generate-certs" serviceAccountName: "hubble-generate-certs" automountServiceAccountToken: true restartPolicy: OnFailure - affinity: - ttlSecondsAfterFinished: 1800 diff --git a/clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yaml b/clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yaml index 596a326d0..5ba0f73b9 100644 --- a/clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yaml +++ b/clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: cilium-gateway-secrets - namespace: "kube-system" + namespace: "cilium-secrets" labels: app.kubernetes.io/part-of: cilium rules: diff --git a/clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yaml b/clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yaml index cc6e7ac3c..7649b8aa0 100644 --- a/clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yaml +++ b/clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: cilium-operator-gateway-secrets - namespace: "kube-system" + namespace: "cilium-secrets" labels: app.kubernetes.io/part-of: cilium rules: diff --git a/clusters/cl01tl/manifests/cilium/Role-cilium-operator-ztunnel.yaml b/clusters/cl01tl/manifests/cilium/Role-cilium-operator-ztunnel.yaml new file mode 100644 index 000000000..043bbdec2 --- /dev/null +++ b/clusters/cl01tl/manifests/cilium/Role-cilium-operator-ztunnel.yaml @@ -0,0 +1,18 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-operator-ztunnel + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +rules: + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - create + - delete + - get + - list + - watch diff --git a/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yaml b/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yaml index a784d4c34..a386746d1 100644 --- a/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yaml +++ b/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: cilium-gateway-secrets - namespace: "kube-system" + namespace: "cilium-secrets" labels: app.kubernetes.io/part-of: cilium roleRef: diff --git a/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yaml b/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yaml index 868c39853..35c2b1607 100644 --- a/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yaml +++ b/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: cilium-operator-gateway-secrets - namespace: "kube-system" + namespace: "cilium-secrets" labels: app.kubernetes.io/part-of: cilium roleRef: diff --git a/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-ztunnel.yaml b/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-ztunnel.yaml new file mode 100644 index 000000000..0911f31b6 --- /dev/null +++ b/clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-ztunnel.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-operator-ztunnel + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-operator-ztunnel +subjects: + - kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system diff --git a/clusters/cl01tl/manifests/cilium/Service-cilium-envoy.yaml b/clusters/cl01tl/manifests/cilium/Service-cilium-envoy.yaml index 8b56e9ecd..5113391a4 100644 --- a/clusters/cl01tl/manifests/cilium/Service-cilium-envoy.yaml +++ b/clusters/cl01tl/manifests/cilium/Service-cilium-envoy.yaml @@ -17,4 +17,4 @@ spec: - name: envoy-metrics port: 9964 protocol: TCP - targetPort: envoy-metrics + targetPort: 9964