Automated Manifest Update (#2342)
This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow. Reviewed-on: #2342 Co-authored-by: gitea-bot <gitea-bot@alexlebens.net> Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>
This commit was merged in pull request #2342.
This commit is contained in:
@@ -1,51 +1,20 @@
|
||||
---
|
||||
# Source: cilium/charts/cilium/templates/cilium-configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: cilium-config
|
||||
namespace: kube-system
|
||||
data:
|
||||
# Identity allocation mode selects how identities are shared between cilium
|
||||
# nodes by setting how they are stored. The options are "crd", "kvstore" or
|
||||
# "doublewrite-readkvstore" / "doublewrite-readcrd".
|
||||
# - "crd" stores identities in kubernetes as CRDs (custom resource definition).
|
||||
# These can be queried with:
|
||||
# kubectl get ciliumid
|
||||
# - "kvstore" stores identities in an etcd kvstore, that is
|
||||
# configured below. Cilium versions before 1.6 supported only the kvstore
|
||||
# backend. Upgrades from these older cilium versions should continue using
|
||||
# the kvstore by commenting out the identity-allocation-mode below, or
|
||||
# setting it to "kvstore".
|
||||
# - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful
|
||||
# for seamless migrations from the kvstore mode to the crd mode. Consult the
|
||||
# documentation for more information on how to perform the migration.
|
||||
identity-allocation-mode: crd
|
||||
identity-heartbeat-timeout: "30m0s"
|
||||
identity-gc-interval: "15m0s"
|
||||
cilium-endpoint-gc-interval: "5m0s"
|
||||
nodes-gc-interval: "5m0s"
|
||||
# If you want to run cilium in debug mode change this value to true
|
||||
debug: "false"
|
||||
metrics-sampling-interval: "5m"
|
||||
# The agent can be put into the following three policy enforcement modes
|
||||
# default, always and never.
|
||||
# https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes
|
||||
enable-policy: "default"
|
||||
# If you want metrics enabled in all of your Cilium agents, set the port for
|
||||
# which the Cilium agents will have their metrics exposed.
|
||||
# This option deprecates the "prometheus-serve-addr" in the
|
||||
# "cilium-metrics-config" ConfigMap
|
||||
# NOTE that this will open the port on ALL nodes where Cilium pods are
|
||||
# scheduled.
|
||||
prometheus-serve-addr: ":9962"
|
||||
# A space-separated list of controller groups for which to enable metrics.
|
||||
# The special values of "all" and "none" are supported.
|
||||
controller-group-metrics: write-cni-file sync-host-ips sync-lb-maps-with-k8s-services
|
||||
# If you want metrics enabled in cilium-operator, set the port for
|
||||
# which the Cilium Operator will have their metrics exposed.
|
||||
# NOTE that this will open the port on the nodes where Cilium operator pod
|
||||
# is scheduled.
|
||||
operator-prometheus-serve-addr: ":9963"
|
||||
enable-metrics: "true"
|
||||
enable-envoy-config: "true"
|
||||
@@ -63,41 +32,16 @@ data:
|
||||
enable-policy-secrets-sync: "true"
|
||||
policy-secrets-only-from-secrets-namespace: "true"
|
||||
policy-secrets-namespace: "cilium-secrets"
|
||||
# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
|
||||
# address.
|
||||
enable-ipv4: "true"
|
||||
# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
|
||||
# address.
|
||||
enable-ipv6: "false"
|
||||
# Users who wish to specify their own custom CNI configuration file must set
|
||||
# custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
|
||||
custom-cni-conf: "false"
|
||||
enable-bpf-clock-probe: "false"
|
||||
# If you want cilium monitor to aggregate tracing for packets, set this level
|
||||
# to "low", "medium", or "maximum". The higher the level, the less packets
|
||||
# that will be seen in monitor output.
|
||||
monitor-aggregation: medium
|
||||
# The monitor aggregation interval governs the typical time between monitor
|
||||
# notification events for each allowed connection.
|
||||
#
|
||||
# Only effective when monitor aggregation is set to "medium" or higher.
|
||||
monitor-aggregation-interval: "5s"
|
||||
# The monitor aggregation flags determine which TCP flags which, upon the
|
||||
# first observation, cause monitor notifications to be generated.
|
||||
#
|
||||
# Only effective when monitor aggregation is set to "medium" or higher.
|
||||
monitor-aggregation-flags: all
|
||||
# Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
|
||||
# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
|
||||
bpf-map-dynamic-size-ratio: "0.0025"
|
||||
# bpf-policy-map-max specifies the maximum number of entries in endpoint
|
||||
# policy map (per endpoint)
|
||||
bpf-policy-map-max: "16384"
|
||||
# bpf-policy-stats-map-max specifies the maximum number of entries in global
|
||||
# policy stats map
|
||||
bpf-policy-stats-map-max: "65536"
|
||||
# bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
|
||||
# backend and affinity maps.
|
||||
bpf-lb-map-max: "65536"
|
||||
bpf-lb-external-clusterip: "false"
|
||||
bpf-lb-source-range-all-types: "false"
|
||||
@@ -107,37 +51,13 @@ data:
|
||||
bpf-events-drop-enabled: "true"
|
||||
bpf-events-policy-verdict-enabled: "true"
|
||||
bpf-events-trace-enabled: "true"
|
||||
# Pre-allocation of map entries allows per-packet latency to be reduced, at
|
||||
# the expense of up-front memory allocation for the entries in the maps. The
|
||||
# default value below will minimize memory usage in the default installation;
|
||||
# users who are sensitive to latency may consider setting this to "true".
|
||||
#
|
||||
# This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
|
||||
# this option and behave as though it is set to "true".
|
||||
#
|
||||
# If this value is modified, then during the next Cilium startup the restore
|
||||
# of existing endpoints and tracking of ongoing connections may be disrupted.
|
||||
# As a result, reply packets may be dropped and the load-balancing decisions
|
||||
# for established connections may change.
|
||||
#
|
||||
# If this option is set to "false" during an upgrade from 1.3 or earlier to
|
||||
# 1.4 or later, then it may cause one-time disruptions during the upgrade.
|
||||
preallocate-bpf-maps: "false"
|
||||
# Name of the cluster. Only relevant when building a mesh of clusters.
|
||||
cluster-name: "default"
|
||||
# Unique ID of the cluster. Must be unique across all conneted clusters and
|
||||
# in the range of 1 and 255. Only relevant when building a mesh of clusters.
|
||||
cluster-id: "0"
|
||||
# Encapsulation mode for communication between nodes
|
||||
# Possible values:
|
||||
# - disabled
|
||||
# - vxlan (default)
|
||||
# - geneve
|
||||
routing-mode: "tunnel"
|
||||
tunnel-protocol: "vxlan"
|
||||
tunnel-source-port-range: "0-0"
|
||||
service-no-backend-response: "reject"
|
||||
# Enables L7 proxy for L7 policy enforcement and visibility
|
||||
enable-l7-proxy: "true"
|
||||
enable-ipv4-masquerade: "true"
|
||||
enable-ipv4-big-tcp: "false"
|
||||
@@ -151,8 +71,6 @@ data:
|
||||
iptables-random-fully: "false"
|
||||
auto-direct-node-routes: "false"
|
||||
direct-routing-skip-unreachable: "false"
|
||||
# List of devices used to attach bpf_host.o (implements BPF NodePort,
|
||||
# host-firewall and BPF masquerading)
|
||||
devices: "end0 enp6s0"
|
||||
kube-proxy-replacement: "true"
|
||||
kube-proxy-replacement-healthz-bind-address: ""
|
||||
@@ -169,7 +87,6 @@ data:
|
||||
k8s-require-ipv6-pod-cidr: "false"
|
||||
enable-k8s-networkpolicy: "true"
|
||||
enable-endpoint-lockdown-on-policy-overflow: "false"
|
||||
# Tell the agent to generate and write a CNI configuration file
|
||||
write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
|
||||
cni-exclusive: "true"
|
||||
cni-log-file: "/var/run/cilium/cilium-cni.log"
|
||||
@@ -181,10 +98,8 @@ data:
|
||||
synchronize-k8s-nodes: "true"
|
||||
operator-api-serve-addr: "127.0.0.1:9234"
|
||||
enable-hubble: "true"
|
||||
# UNIX domain socket for Hubble server to listen to.
|
||||
hubble-socket-path: "/var/run/cilium/hubble.sock"
|
||||
hubble-network-policy-correlation-enabled: "true"
|
||||
# An additional address for Hubble server to listen to (e.g. ":4244").
|
||||
hubble-listen-address: ":4244"
|
||||
hubble-disable-tls: "false"
|
||||
hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
|
||||
@@ -213,7 +128,6 @@ data:
|
||||
set-cilium-node-taints: "true"
|
||||
set-cilium-is-up-condition: "true"
|
||||
unmanaged-pod-watcher-interval: "15"
|
||||
# default DNS proxy to transparent mode in non-chaining modes
|
||||
dnsproxy-enable-transparent-mode: "true"
|
||||
dnsproxy-socket-linger-timeout: "10"
|
||||
tofqdns-dns-reject-response-code: "refused"
|
||||
@@ -252,5 +166,3 @@ data:
|
||||
enable-lb-ipam: "true"
|
||||
enable-non-default-deny-policies: "true"
|
||||
enable-source-ip-verification: "true"
|
||||
# Extra config allows adding arbitrary properties to the cilium config.
|
||||
# By putting it at the end of the ConfigMap, it's also possible to override existing properties.
|
||||
|
||||
Reference in New Issue
Block a user