169 lines
5.9 KiB
YAML
169 lines
5.9 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cilium-config
|
|
namespace: kube-system
|
|
data:
|
|
identity-allocation-mode: crd
|
|
identity-heartbeat-timeout: "30m0s"
|
|
identity-gc-interval: "15m0s"
|
|
cilium-endpoint-gc-interval: "5m0s"
|
|
nodes-gc-interval: "5m0s"
|
|
debug: "false"
|
|
metrics-sampling-interval: "5m"
|
|
enable-policy: "default"
|
|
prometheus-serve-addr: ":9962"
|
|
controller-group-metrics: write-cni-file sync-host-ips sync-lb-maps-with-k8s-services
|
|
operator-prometheus-serve-addr: ":9963"
|
|
enable-metrics: "true"
|
|
enable-envoy-config: "true"
|
|
envoy-config-retry-interval: "15s"
|
|
enable-gateway-api: "true"
|
|
enable-gateway-api-secrets-sync: "true"
|
|
enable-gateway-api-proxy-protocol: "false"
|
|
enable-gateway-api-app-protocol: "true"
|
|
enable-gateway-api-alpn: "true"
|
|
gateway-api-xff-num-trusted-hops: "0"
|
|
gateway-api-service-externaltrafficpolicy: "Cluster"
|
|
gateway-api-secrets-namespace: "cilium-secrets"
|
|
gateway-api-hostnetwork-enabled: "false"
|
|
gateway-api-hostnetwork-nodelabelselector: ""
|
|
enable-policy-secrets-sync: "true"
|
|
policy-secrets-only-from-secrets-namespace: "true"
|
|
policy-secrets-namespace: "cilium-secrets"
|
|
enable-ipv4: "true"
|
|
enable-ipv6: "false"
|
|
custom-cni-conf: "false"
|
|
enable-bpf-clock-probe: "false"
|
|
monitor-aggregation: medium
|
|
monitor-aggregation-interval: "5s"
|
|
monitor-aggregation-flags: all
|
|
bpf-map-dynamic-size-ratio: "0.0025"
|
|
bpf-policy-map-max: "16384"
|
|
bpf-policy-stats-map-max: "65536"
|
|
bpf-lb-map-max: "65536"
|
|
bpf-lb-external-clusterip: "false"
|
|
bpf-lb-source-range-all-types: "false"
|
|
bpf-lb-algorithm-annotation: "false"
|
|
bpf-lb-mode-annotation: "false"
|
|
bpf-distributed-lru: "false"
|
|
bpf-events-drop-enabled: "true"
|
|
bpf-events-policy-verdict-enabled: "true"
|
|
bpf-events-trace-enabled: "true"
|
|
preallocate-bpf-maps: "false"
|
|
cluster-name: "default"
|
|
cluster-id: "0"
|
|
routing-mode: "tunnel"
|
|
tunnel-protocol: "vxlan"
|
|
tunnel-source-port-range: "0-0"
|
|
service-no-backend-response: "reject"
|
|
enable-l7-proxy: "true"
|
|
enable-ipv4-masquerade: "true"
|
|
enable-ipv4-big-tcp: "false"
|
|
enable-ipv6-big-tcp: "false"
|
|
enable-ipv6-masquerade: "true"
|
|
enable-tcx: "true"
|
|
datapath-mode: "veth"
|
|
enable-masquerade-to-route-source: "false"
|
|
enable-xt-socket-fallback: "true"
|
|
install-no-conntrack-iptables-rules: "false"
|
|
iptables-random-fully: "false"
|
|
auto-direct-node-routes: "false"
|
|
direct-routing-skip-unreachable: "false"
|
|
devices: "end0 enp6s0"
|
|
kube-proxy-replacement: "true"
|
|
kube-proxy-replacement-healthz-bind-address: ""
|
|
bpf-lb-sock: "true"
|
|
bpf-lb-sock-hostns-only: "true"
|
|
enable-health-check-nodeport: "true"
|
|
enable-health-check-loadbalancer-ip: "false"
|
|
node-port-bind-protection: "true"
|
|
enable-auto-protect-node-port-range: "true"
|
|
bpf-lb-acceleration: "disabled"
|
|
enable-svc-source-range-check: "true"
|
|
enable-l2-neigh-discovery: "false"
|
|
k8s-require-ipv4-pod-cidr: "false"
|
|
k8s-require-ipv6-pod-cidr: "false"
|
|
enable-k8s-networkpolicy: "true"
|
|
enable-endpoint-lockdown-on-policy-overflow: "false"
|
|
write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
|
|
cni-exclusive: "true"
|
|
cni-log-file: "/var/run/cilium/cilium-cni.log"
|
|
enable-endpoint-health-checking: "true"
|
|
enable-health-checking: "true"
|
|
health-check-icmp-failure-threshold: "3"
|
|
enable-well-known-identities: "false"
|
|
enable-node-selector-labels: "false"
|
|
synchronize-k8s-nodes: "true"
|
|
operator-api-serve-addr: "127.0.0.1:9234"
|
|
enable-hubble: "true"
|
|
hubble-socket-path: "/var/run/cilium/hubble.sock"
|
|
hubble-network-policy-correlation-enabled: "true"
|
|
hubble-listen-address: ":4244"
|
|
hubble-disable-tls: "false"
|
|
hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
|
|
hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
|
|
hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
|
|
ipam: "kubernetes"
|
|
ipam-cilium-node-update-rate: "15s"
|
|
default-lb-service-ipam: "lbipam"
|
|
egress-gateway-reconciliation-trigger-interval: "1s"
|
|
enable-vtep: "false"
|
|
vtep-endpoint: ""
|
|
vtep-cidr: ""
|
|
vtep-mask: ""
|
|
vtep-mac: ""
|
|
enable-k8s-endpoint-slice: "true"
|
|
procfs: "/host/proc"
|
|
bpf-root: "/sys/fs/bpf"
|
|
cgroup-root: "/sys/fs/cgroup"
|
|
enable-cilium-endpoint-slice: "true"
|
|
ces-rate-limits: "[{\"burst\":20,\"limit\":10,\"nodes\":0},{\"burst\":100,\"limit\":50,\"nodes\":100}]"
|
|
identity-management-mode: "agent"
|
|
enable-sctp: "false"
|
|
k8s-client-qps: "50"
|
|
k8s-client-burst: "100"
|
|
remove-cilium-node-taints: "true"
|
|
set-cilium-node-taints: "true"
|
|
set-cilium-is-up-condition: "true"
|
|
unmanaged-pod-watcher-interval: "15"
|
|
dnsproxy-enable-transparent-mode: "true"
|
|
dnsproxy-socket-linger-timeout: "10"
|
|
tofqdns-dns-reject-response-code: "refused"
|
|
tofqdns-enable-dns-compression: "true"
|
|
tofqdns-endpoint-max-ip-per-hostname: "1000"
|
|
tofqdns-idle-connection-grace-period: "0s"
|
|
tofqdns-max-deferred-connection-deletes: "10000"
|
|
tofqdns-proxy-response-max-delay: "100ms"
|
|
tofqdns-preallocate-identities: "true"
|
|
agent-not-ready-taint-key: "node.cilium.io/agent-not-ready"
|
|
mesh-auth-enabled: "true"
|
|
mesh-auth-queue-size: "1024"
|
|
mesh-auth-rotated-identities-queue-size: "1024"
|
|
mesh-auth-gc-interval: "5m0s"
|
|
proxy-xff-num-trusted-hops-ingress: "0"
|
|
proxy-xff-num-trusted-hops-egress: "0"
|
|
proxy-connect-timeout: "2"
|
|
proxy-initial-fetch-timeout: "30"
|
|
proxy-max-requests-per-connection: "0"
|
|
proxy-max-connection-duration-seconds: "0"
|
|
proxy-idle-timeout-seconds: "60"
|
|
proxy-max-concurrent-retries: "128"
|
|
http-retry-count: "3"
|
|
http-stream-idle-timeout: "300"
|
|
external-envoy-proxy: "true"
|
|
envoy-base-id: "0"
|
|
envoy-access-log-buffer-size: "4096"
|
|
envoy-keep-cap-netbindservice: "true"
|
|
max-connected-clusters: "255"
|
|
clustermesh-enable-endpoint-sync: "false"
|
|
clustermesh-enable-mcs-api: "false"
|
|
policy-default-local-cluster: "false"
|
|
nat-map-stats-entries: "32"
|
|
nat-map-stats-interval: "30s"
|
|
enable-internal-traffic-policy: "true"
|
|
enable-lb-ipam: "true"
|
|
enable-non-default-deny-policies: "true"
|
|
enable-source-ip-verification: "true"
|