dipup 사용 차트를 카탈로그에 동기화 (7개 갱신 + 5개 신규)
dipup 이 go:embed 로 직접 보관·관리하던 Helm 차트를 카탈로그로 옮기는 첫 단계다.
두 저장소가 각자 CVE/SBOM 파이프라인을 운영하는 이중화를 해소하려면, 먼저 카탈로그가
dipup 과 같은 차트·같은 이미지를 보게 만들어야 한다.
배경: CVE 파이프라인 구성 이전에 두 곳에서 같은 차트를 유지하기 어려워 dipup 이 별도로
차트를 관리해 왔고, 그 결과 버전이 갈라졌다. 겹치는 10개 중 버전까지 일치하는 것은
postgresql-ha·dnsup 2개뿐이었다.
## 버전 갱신 (7개) — 신규 버전 디렉토리 추가, 구버전은 보존
| 차트 | 기존 | 신규 | appVersion |
|---|---|---|---|
| apisix | 2.14.0 | 2.16.0 | 3.16.0 → 3.17.0 |
| argo-cd | 7.7.0 | 7.8.11 | v2.13.0 → v2.14.5 |
| cert-manager | v1.16.1 | v1.21.0 | 동일 |
| gitea | 12.4.0 | 12.6.0 | 1.24.6 → 1.26.1 |
| harbor | 1.16.2 | 1.19.1 | 2.12.2 → 2.15.1 |
| kyverno | 3.4.1 | 3.8.2 | v1.14.1 → v1.18.2 |
| rancher | 2.10.1 | 2.14.3 | v2.10.1 → v2.14.3 |
차트 본문은 dipup 이 임베딩한 .tgz 를 그대로 전개했다(네트워크 pull 이 아니라 dipup 이
실제 배포하는 바이트와 동일함을 보장하기 위함). BUILD-README/CUSTOM-README/custom-values
3개 파일은 구버전에서 승계했다.
## 신규 추가 (5개)
infisical-standalone 1.9.0, longhorn 109.3.1+up1.11.2, longhorn-crd 109.3.1+up1.11.2,
metallb 0.16.1, secrets-operator v0.10.33.
longhorn/longhorn-crd 는 업스트림이 아니라 Rancher 패키징 차트(109.x 라인, Rancher 2.14
계열과 짝)다. BUILD-README 의 `helm repo add` 라인은 chart_version_detector 가 파싱하는
계약이라 실제 업스트림 repo 를 검증해 기재했고, 감지기로 현재/최신 버전이 정상 조회되는
것을 확인했다.
## custom-values — 버전과 결합된 이미지 핀 정리
카탈로그 스캐너가 dipup 의 effective image 를 보게 하려면 이미지 핀이 맞아야 한다.
- **kyverno: 승계본이 3.8.2 에서 깨져 재작성.** 3.4.1 은 정리 훅이
`registry: ~ / repository: bitnami/kubectl` 이라 bitnamilegacy 오버라이드가 맞았지만,
3.8.2 는 `registry: ghcr.io / repository: kyverno/readiness-checker` 로 바뀌었다.
그대로 옮기면 ghcr.io/bitnamilegacy/kubectl 이라는 없는 좌표가 된다. 해당 오버라이드를
제거하고, 3.8.2 에서 삭제된 policyReportsCleanup 키도 함께 뺐다. 남는 조치는 tag 고정뿐
(기본 tag 가 비어 latest 로 떨어짐 → v1.18.2 로 고정).
- apisix: 3.16.0-keycloak-authz → 3.17.0-keycloak-authz (차트 appVersion 과 함께 이동)
- gitea: image.tag 1.26.4 핀 추가 — 차트 기본 1.26.1 대비 CRITICAL 2→0, HIGH 44→12
- infisical: image.tag v0.162.7 핀 — 기본 v0.158.x 는 stale Debian base 로 OS 기인 CVE
다수(fixable CRITICAL 53→5, HIGH 491→55). redis/postgresql 은 bitnamilegacy 좌표로.
- longhorn: 실측 기반 리소스 튜닝(manager request, guaranteedInstanceManagerCPU,
systemManagedCSIComponentsResourceLimits). replica 수처럼 노드 수에 의존하는 값은
넣지 않았다 — 소비 측에서 주입한다.
## 검증
12개 차트 전부 `helm template --kube-version 1.34.1` 렌더 성공. 렌더 결과 이미지가
dipup 배포 이미지와 일치함을 확인(paasup/apisix:3.17.0-keycloak-authz,
gitea:1.26.4-rootless, readiness-checker:v1.18.2, infisical:v0.162.7).
## 범위에서 뺀 것
- **keycloak**: 카탈로그는 codecentric(app 17.0.1-legacy), dipup 은 bitnami(app 26.2.4)로
계보가 다르다. 이슈 #1(bitnami 대체 방안 검토)의 결론이 나온 뒤 처리한다.
- **rancher-monitoring(-crd)**: 14c05f1 에서 불필요 판단으로 제거된 차트이고
victoria-metrics 스택으로 대체 예정이라 추가하지 않는다.
- **dip-api/dip-console**: 자체 개발 차트로 각 앱 저장소가 출처다. 대조 결과 앱 저장소와
dipup 사본이 일치해 카탈로그가 개입할 이유가 없다.
- **postgresql-ha/dnsup**: 이미 버전이 일치해 작업 대상이 아니었다.
## 후속 과제
dnsup 은 카탈로그·dipup 사본(1.0.1)이 원본(dip-console-api helm/dnsup 1.0.0)보다 앞서
있다. 1.0.1 에만 있는 service.LoadBalancerIP·service.annotations 지원을 원본으로 백포트한
뒤, 카탈로그에서 dnsup 을 제거하는 것이 자체 개발 차트 출처 원칙에 맞다.
This commit is contained in:
wbsong111
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: crds
|
||||
repository: ""
|
||||
version: 0.0.25
|
||||
digest: sha256:fadaadfc20fb2ce98510dd77b848ebd867a5d2e95a253120fedd5af31e766dd8
|
||||
generated: "2026-05-07T19:06:46.617697725+02:00"
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v2
|
||||
appVersion: v0.0.25
|
||||
dependencies:
|
||||
- condition: crds.enabled
|
||||
name: crds
|
||||
repository: ""
|
||||
version: 0.0.25
|
||||
description: A cloud native wrapper of FRR
|
||||
home: https://metallb.universe.tf
|
||||
icon: https://metallb.universe.tf/images/logo/metallb-white.png
|
||||
kubeVersion: '>= 1.19.0-0'
|
||||
name: frr-k8s
|
||||
sources:
|
||||
- https://github.com/metallb/frr-k8s
|
||||
type: application
|
||||
version: 0.0.25
|
||||
@@ -0,0 +1,98 @@
|
||||
# frr-k8s
|
||||
|
||||
  
|
||||
|
||||
A cloud native wrapper of FRR
|
||||
|
||||
**Homepage:** <https://metallb.universe.tf>
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/metallb/frr-k8s>
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>= 1.19.0-0`
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| | crds | 0.0.25 |
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| crds.enabled | bool | `true` | Enable installation of CRDs. |
|
||||
| crds.validationFailurePolicy | string | `"Fail"` | Validation failure policy for CRDs. Can be Fail or Ignore. |
|
||||
| frrk8s.affinity | object | `{}` | Affinity for pod assignment. |
|
||||
| frrk8s.alwaysBlock | string | `""` | A comma separated list of cidrs to always block for incoming routes. |
|
||||
| frrk8s.bgpDebounceTimeout | integer | `nil` | BGP debounce timeout for FRR configuration reloads, in milliseconds. Default (when unset) is 3000 ms.This feature is experimental |
|
||||
| frrk8s.disableCertRotation | bool | `false` | Specifies whether the cert rotator works as part of the webhook. |
|
||||
| frrk8s.frr.acceptIncomingBGPConnections | bool | `false` | Allow FRR to accept incoming BGP connections. |
|
||||
| frrk8s.frr.image.pullPolicy | string | `nil` | The FRR image pull policy. |
|
||||
| frrk8s.frr.image.repository | string | `"quay.io/frrouting/frr"` | The FRR image repository. |
|
||||
| frrk8s.frr.image.tag | string | `"10.4.3"` | The FRR image tag. |
|
||||
| frrk8s.frr.metricsBindAddress | string | `"127.0.0.1"` | Bind address for FRR metrics. |
|
||||
| frrk8s.frr.metricsPort | int | `7573` | Port for FRR metrics. |
|
||||
| frrk8s.frr.resources | object | `{}` | Resource limits and requests for the FRR container. |
|
||||
| frrk8s.frr.secureMetricsPort | int | `9141` | Secure metrics port for FRR. |
|
||||
| frrk8s.frrMetrics.resources | object | `{}` | Resource limits and requests for the FRR metrics container. |
|
||||
| frrk8s.frrStatus.pollInterval | string | `"2m"` | Polling interval for FRR status updates. |
|
||||
| frrk8s.frrStatus.resources | object | `{}` | Resource limits and requests for the FRR status container. |
|
||||
| frrk8s.image.pullPolicy | string | `nil` | The frr-k8s image pull policy. |
|
||||
| frrk8s.image.repository | string | `"quay.io/metallb/frr-k8s"` | The frr-k8s image repository. |
|
||||
| frrk8s.image.tag | string | `nil` | The frr-k8s image tag. If not set, defaults to the chart appVersion. |
|
||||
| frrk8s.labels | object | `{"app":"frr-k8s"}` | Additional labels to add to the pod. |
|
||||
| frrk8s.livenessProbe.enabled | bool | `true` | Enable liveness probe. |
|
||||
| frrk8s.livenessProbe.failureThreshold | int | `3` | Number of failures before the probe is considered failed. |
|
||||
| frrk8s.livenessProbe.initialDelaySeconds | int | `10` | Number of seconds after the container has started before liveness probes are initiated. |
|
||||
| frrk8s.livenessProbe.periodSeconds | int | `10` | How often (in seconds) to perform the probe. |
|
||||
| frrk8s.livenessProbe.successThreshold | int | `1` | Minimum consecutive successes for the probe to be considered successful. |
|
||||
| frrk8s.livenessProbe.timeoutSeconds | int | `1` | Number of seconds after which the probe times out. |
|
||||
| frrk8s.logLevel | string | `"info"` | Controller log level that is passed as a CLI flag. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` |
|
||||
| frrk8s.nodeSelector | object | `{}` | Node selector for pod assignment. |
|
||||
| frrk8s.podAnnotations | object | `{}` | Additional annotations to add to the pod. |
|
||||
| frrk8s.priorityClassName | string | `""` | Priority class name for the pod. |
|
||||
| frrk8s.readinessProbe.enabled | bool | `true` | Enable readiness probe. |
|
||||
| frrk8s.readinessProbe.failureThreshold | int | `3` | Number of failures before the probe is considered failed. |
|
||||
| frrk8s.readinessProbe.initialDelaySeconds | int | `10` | Number of seconds after the container has started before readiness probes are initiated. |
|
||||
| frrk8s.readinessProbe.periodSeconds | int | `10` | How often (in seconds) to perform the probe. |
|
||||
| frrk8s.readinessProbe.successThreshold | int | `1` | Minimum consecutive successes for the probe to be considered successful. |
|
||||
| frrk8s.readinessProbe.timeoutSeconds | int | `1` | Number of seconds after which the probe times out. |
|
||||
| frrk8s.reloader.resources | object | `{}` | Resource limits and requests for the reloader container. |
|
||||
| frrk8s.resources | object | `{}` | Resource limits and requests for the frr-k8s controller container. |
|
||||
| frrk8s.restartOnRotatorSecretRefresh | bool | `false` | Specifies whether the pod restarts when the rotator refreshes the cert secret. Useful for webhook stability during redeployments. |
|
||||
| frrk8s.runtimeClassName | string | `""` | Runtime class name for the pod. |
|
||||
| frrk8s.serviceAccount.annotations | object | `{}` | Additional annotations to add to the ServiceAccount. |
|
||||
| frrk8s.serviceAccount.create | bool | `true` | Specifies whether a ServiceAccount should be created. |
|
||||
| frrk8s.serviceAccount.name | string | `""` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template. |
|
||||
| frrk8s.startupProbe.enabled | bool | `true` | Enable startup probe. |
|
||||
| frrk8s.startupProbe.failureThreshold | int | `30` | Number of failures before the probe is considered failed. |
|
||||
| frrk8s.startupProbe.periodSeconds | int | `5` | How often (in seconds) to perform the probe. |
|
||||
| frrk8s.tolerateMaster | bool | `true` | Tolerate master nodes for pod scheduling. |
|
||||
| frrk8s.tolerations | list | `[]` | Tolerations for pod assignment. |
|
||||
| frrk8s.updateStrategy.type | string | `"RollingUpdate"` | Specify the FRR-K8s daemonset update strategy. |
|
||||
| frrk8s.webhookPort | int | `19443` | Port for the webhook server. |
|
||||
| fullnameOverride | string | `""` | String to override the default fully qualified app name. |
|
||||
| nameOverride | string | `""` | String to override the default chart name. |
|
||||
| prometheus.namespace | string | `""` | The namespace where Prometheus is deployed. Required when ".Values.prometheus.rbacPrometheus == true" and "prometheus.serviceMonitor.enabled=true". |
|
||||
| prometheus.rbacPrometheus | bool | `false` | Give Prometheus permission to scrape metallb's namespace. |
|
||||
| prometheus.scrapeAnnotations | bool | `false` | Add Prometheus metric auto-collection annotations to pods. |
|
||||
| prometheus.secureMetricsPort | int | `9140` | Port frr-k8s will listen on for secure metrics. |
|
||||
| prometheus.serviceAccount | string | `""` | The service account used by Prometheus. Required when ".Values.prometheus.rbacPrometheus == true" and "prometheus.serviceMonitor.enabled=true" |
|
||||
| prometheus.serviceMonitor.additionalLabels | object | `{}` | Additional labels to add to the ServiceMonitor. |
|
||||
| prometheus.serviceMonitor.annotations | object | `{}` | Optional additional annotations for the controller serviceMonitor. |
|
||||
| prometheus.serviceMonitor.enabled | bool | `false` | Enable support for Prometheus Operator. |
|
||||
| prometheus.serviceMonitor.interval | string | `nil` | Scrape interval. If not set, the Prometheus default scrape interval is used. |
|
||||
| prometheus.serviceMonitor.jobLabel | string | `"app.kubernetes.io/name"` | Job label for scrape target. |
|
||||
| prometheus.serviceMonitor.metricRelabelings | list | `[]` | Metric relabel configs to apply to samples before ingestion. |
|
||||
| prometheus.serviceMonitor.relabelings | list | `[]` | Relabel configs to apply to samples before ingestion. |
|
||||
| prometheus.serviceMonitor.tlsConfig.insecureSkipVerify | bool | `true` | Disables SSL certificate verification |
|
||||
| rbac.create | bool | `true` | Specifies whether to install and use RBAC rules. |
|
||||
| tls.cipherSuites | string | `""` | Comma-separated list of TLS cipher suites. If empty, uses Go defaults. Only applies to TLS 1.2. |
|
||||
| tls.curvePreferences | string | `""` | Comma-separated list of numeric CurveID values (e.g. 29,4588). See https://pkg.go.dev/crypto/tls#CurveID. If empty, uses Go defaults. |
|
||||
| tls.metricsTLSSecret | string | `""` | The name of the secret to be mounted in the pods to provide TLS certificates for metrics endpoints. If not present, a self-signed certificate is auto-generated. |
|
||||
| tls.minVersion | string | `""` | Minimum TLS version (VersionTLS12 or VersionTLS13). Defaults to VersionTLS13. |
|
||||
|
||||
----------------------------------------------
|
||||
Autogenerated from chart metadata using [helm-docs v1.10.0](https://github.com/norwoodj/helm-docs/releases/v1.10.0)
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: v2
|
||||
appVersion: v0.0.25
|
||||
description: FRR K8s CRDs
|
||||
home: https://metallb.universe.tf
|
||||
icon: https://metallb.universe.tf/images/logo/metallb-white.png
|
||||
name: crds
|
||||
sources:
|
||||
- https://github.com/metallb/frr-k8s
|
||||
type: application
|
||||
version: 0.0.25
|
||||
@@ -0,0 +1,14 @@
|
||||
# crds
|
||||
|
||||
  
|
||||
|
||||
FRR-K8s CRDs
|
||||
|
||||
**Homepage:** <https://metallb.universe.tf>
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/metallb/frr-k8s>
|
||||
|
||||
----------------------------------------------
|
||||
Autogenerated from chart metadata using [helm-docs v1.10.0](https://github.com/norwoodj/helm-docs/releases/v1.10.0)
|
||||
+77
@@ -0,0 +1,77 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.3
|
||||
name: bgpsessionstates.frrk8s.metallb.io
|
||||
spec:
|
||||
group: frrk8s.metallb.io
|
||||
names:
|
||||
kind: BGPSessionState
|
||||
listKind: BGPSessionStateList
|
||||
plural: bgpsessionstates
|
||||
singular: bgpsessionstate
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.node
|
||||
name: Node
|
||||
type: string
|
||||
- jsonPath: .status.peer
|
||||
name: Peer
|
||||
type: string
|
||||
- jsonPath: .status.vrf
|
||||
name: VRF
|
||||
type: string
|
||||
- jsonPath: .status.bgpStatus
|
||||
name: BGP
|
||||
type: string
|
||||
- jsonPath: .status.bfdStatus
|
||||
name: BFD
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: BGPSessionState exposes the status of a BGP Session from the
|
||||
FRR instance running on the node.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: BGPSessionStateSpec defines the desired state of BGPSessionState.
|
||||
type: object
|
||||
status:
|
||||
description: BGPSessionStateStatus defines the observed state of BGPSessionState.
|
||||
properties:
|
||||
bfdStatus:
|
||||
type: string
|
||||
bgpStatus:
|
||||
type: string
|
||||
node:
|
||||
type: string
|
||||
peer:
|
||||
type: string
|
||||
vrf:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+501
@@ -0,0 +1,501 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.3
|
||||
name: frrconfigurations.frrk8s.metallb.io
|
||||
spec:
|
||||
group: frrk8s.metallb.io
|
||||
names:
|
||||
kind: FRRConfiguration
|
||||
listKind: FRRConfigurationList
|
||||
plural: frrconfigurations
|
||||
singular: frrconfiguration
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: FRRConfiguration is a piece of FRR configuration.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: FRRConfigurationSpec defines the desired state of FRRConfiguration.
|
||||
properties:
|
||||
bgp:
|
||||
description: BGP is the configuration related to the BGP protocol.
|
||||
properties:
|
||||
bfdProfiles:
|
||||
description: BFDProfiles is the list of bfd profiles to be used
|
||||
when configuring the neighbors.
|
||||
items:
|
||||
description: |-
|
||||
BFDProfile is the configuration related to the BFD protocol associated
|
||||
to a BGP session.
|
||||
properties:
|
||||
detectMultiplier:
|
||||
description: |-
|
||||
Configures the detection multiplier to determine
|
||||
packet loss. The remote transmission interval will be multiplied
|
||||
by this value to determine the connection loss detection timer.
|
||||
format: int32
|
||||
maximum: 255
|
||||
minimum: 2
|
||||
type: integer
|
||||
echoInterval:
|
||||
description: |-
|
||||
Configures the minimal echo receive transmission
|
||||
interval that this system is capable of handling in milliseconds.
|
||||
Defaults to 50ms
|
||||
format: int32
|
||||
maximum: 60000
|
||||
minimum: 10
|
||||
type: integer
|
||||
echoMode:
|
||||
description: |-
|
||||
Enables or disables the echo transmission mode.
|
||||
This mode is disabled by default, and not supported on multi
|
||||
hops setups.
|
||||
type: boolean
|
||||
minimumTtl:
|
||||
description: |-
|
||||
For multi hop sessions only: configure the minimum
|
||||
expected TTL for an incoming BFD control packet.
|
||||
format: int32
|
||||
maximum: 254
|
||||
minimum: 1
|
||||
type: integer
|
||||
name:
|
||||
description: |-
|
||||
The name of the BFD Profile to be referenced in other parts
|
||||
of the configuration.
|
||||
type: string
|
||||
passiveMode:
|
||||
description: |-
|
||||
Mark session as passive: a passive session will not
|
||||
attempt to start the connection and will wait for control packets
|
||||
from peer before it begins replying.
|
||||
type: boolean
|
||||
receiveInterval:
|
||||
description: |-
|
||||
The minimum interval that this system is capable of
|
||||
receiving control packets in milliseconds.
|
||||
Defaults to 300ms.
|
||||
format: int32
|
||||
maximum: 60000
|
||||
minimum: 10
|
||||
type: integer
|
||||
transmitInterval:
|
||||
description: |-
|
||||
The minimum transmission interval (less jitter)
|
||||
that this system wants to use to send BFD control packets in
|
||||
milliseconds. Defaults to 300ms
|
||||
format: int32
|
||||
maximum: 60000
|
||||
minimum: 10
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
routers:
|
||||
description: Routers is the list of routers we want FRR to configure
|
||||
(one per VRF).
|
||||
items:
|
||||
description: Router represent a neighbor router we want FRR
|
||||
to connect to.
|
||||
properties:
|
||||
asn:
|
||||
description: ASN is the AS number to use for the local end
|
||||
of the session.
|
||||
format: int64
|
||||
maximum: 4294967295
|
||||
minimum: 0
|
||||
type: integer
|
||||
id:
|
||||
description: ID is the BGP router ID
|
||||
type: string
|
||||
imports:
|
||||
description: Imports is the list of imported VRFs we want
|
||||
for this router / vrf.
|
||||
items:
|
||||
description: Import represents the possible imported VRFs
|
||||
to a given router.
|
||||
properties:
|
||||
vrf:
|
||||
description: Vrf is the vrf we want to import from
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
neighbors:
|
||||
description: Neighbors is the list of neighbors we want
|
||||
to establish BGP sessions with.
|
||||
items:
|
||||
description: Neighbor represents a BGP Neighbor we want
|
||||
FRR to connect to.
|
||||
properties:
|
||||
address:
|
||||
description: Address is the IP address to establish
|
||||
the session with.
|
||||
type: string
|
||||
asn:
|
||||
description: |-
|
||||
ASN is the AS number to use for the local end of the session.
|
||||
ASN and DynamicASN are mutually exclusive and one of them must be specified.
|
||||
format: int64
|
||||
maximum: 4294967295
|
||||
minimum: 0
|
||||
type: integer
|
||||
bfdProfile:
|
||||
description: |-
|
||||
BFDProfile is the name of the BFD Profile to be used for the BFD session associated
|
||||
to the BGP session. If not set, the BFD session won't be set up.
|
||||
type: string
|
||||
connectTime:
|
||||
description: Requested BGP connect time, controls
|
||||
how long BGP waits between connection attempts to
|
||||
a neighbor.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: connect time should be between 1 seconds
|
||||
to 65535
|
||||
rule: duration(self).getSeconds() >= 1 && duration(self).getSeconds()
|
||||
<= 65535
|
||||
- message: connect time should contain a whole number
|
||||
of seconds
|
||||
rule: duration(self).getMilliseconds() % 1000 ==
|
||||
0
|
||||
disableMP:
|
||||
default: false
|
||||
description: |-
|
||||
DisableMP is no longer used and has no effect.
|
||||
Use DualStackAddressFamily instead to enable the neighbor for both IPv4 and IPv6 address families.
|
||||
|
||||
Deprecated: This field is ignored. Use DualStackAddressFamily instead.
|
||||
type: boolean
|
||||
dualStackAddressFamily:
|
||||
default: false
|
||||
description: |-
|
||||
To set if we want to enable the neighbor not only for the ipfamily related to its session,
|
||||
but also the other one. This allows to advertise/receive IPv4 prefixes over IPv6 sessions and vice versa.
|
||||
type: boolean
|
||||
dynamicASN:
|
||||
description: |-
|
||||
DynamicASN detects the AS number to use for the local end of the session
|
||||
without explicitly setting it via the ASN field. Limited to:
|
||||
internal - if the neighbor's ASN is different than the router's the connection is denied.
|
||||
external - if the neighbor's ASN is the same as the router's the connection is denied.
|
||||
ASN and DynamicASN are mutually exclusive and one of them must be specified.
|
||||
enum:
|
||||
- internal
|
||||
- external
|
||||
type: string
|
||||
ebgpMultiHop:
|
||||
description: EBGPMultiHop indicates if the BGPPeer
|
||||
is multi-hops away.
|
||||
type: boolean
|
||||
enableGracefulRestart:
|
||||
description: |-
|
||||
EnableGracefulRestart allows BGP peer to continue to forward data packets along
|
||||
known routes while the routing protocol information is being restored. If
|
||||
the session is already established, the configuration will have effect
|
||||
after reconnecting to the peer
|
||||
type: boolean
|
||||
holdTime:
|
||||
description: |-
|
||||
HoldTime is the requested BGP hold time, per RFC4271.
|
||||
Defaults to 180s.
|
||||
type: string
|
||||
interface:
|
||||
description: |-
|
||||
Interface is the node interface over which the unnumbered BGP peering will
|
||||
be established. No API validation takes place as that string value
|
||||
represents an interface name on the host and if user provides an invalid
|
||||
value, only the actual BGP session will not be established.
|
||||
Address and Interface are mutually exclusive and one of them must be specified.
|
||||
Note: when enabling unnumbered, the neighbor will be enabled for both
|
||||
IPv4 and IPv6 address families.
|
||||
type: string
|
||||
keepaliveTime:
|
||||
description: |-
|
||||
KeepaliveTime is the requested BGP keepalive time, per RFC4271.
|
||||
Defaults to 60s.
|
||||
type: string
|
||||
localASN:
|
||||
description: |-
|
||||
LocalASN allows advertising a different AS number to the peer using BGP's
|
||||
local-as feature. When set, FRR will advertise this ASN to the peer
|
||||
via "neighbor <peer> local-as <ASN> no-prepend replace-as", overriding
|
||||
the router-level ASN for this specific session.
|
||||
Note: this field is only applicable to eBGP sessions (where the peer ASN differs
|
||||
from the router ASN). Setting it on an iBGP session is rejected.
|
||||
format: int64
|
||||
maximum: 4294967295
|
||||
minimum: 1
|
||||
type: integer
|
||||
password:
|
||||
description: |-
|
||||
Password to be used for establishing the BGP session.
|
||||
Password and PasswordSecret are mutually exclusive.
|
||||
type: string
|
||||
passwordSecret:
|
||||
description: |-
|
||||
PasswordSecret is name of the authentication secret for the neighbor.
|
||||
the secret must be of type "kubernetes.io/basic-auth", and created in the
|
||||
same namespace as the frr-k8s daemon. The password is stored in the
|
||||
secret as the key "password".
|
||||
Password and PasswordSecret are mutually exclusive.
|
||||
properties:
|
||||
name:
|
||||
description: name is unique within a namespace
|
||||
to reference a secret resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace defines the space within
|
||||
which the secret name must be unique.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
port:
|
||||
description: |-
|
||||
Port is the port to dial when establishing the session.
|
||||
Defaults to 179.
|
||||
maximum: 16384
|
||||
minimum: 0
|
||||
type: integer
|
||||
sourceaddress:
|
||||
description: |-
|
||||
SourceAddress is the IPv4 or IPv6 source address to use for the BGP
|
||||
session to this neighbour, may be specified as either an IP address
|
||||
directly or as an interface name
|
||||
type: string
|
||||
toAdvertise:
|
||||
description: |-
|
||||
ToAdvertise represents the list of prefixes to advertise to the given neighbor
|
||||
and the associated properties.
|
||||
properties:
|
||||
allowed:
|
||||
description: |-
|
||||
Allowed is is the list of prefixes allowed to be propagated to
|
||||
this neighbor. They must match the prefixes defined in the router.
|
||||
properties:
|
||||
mode:
|
||||
default: filtered
|
||||
description: |-
|
||||
Mode is the mode to use when handling the prefixes.
|
||||
When set to "filtered", only the prefixes in the given list will be allowed.
|
||||
When set to "all", all the prefixes configured on the router will be allowed.
|
||||
enum:
|
||||
- all
|
||||
- filtered
|
||||
type: string
|
||||
prefixes:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
withCommunity:
|
||||
description: |-
|
||||
PrefixesWithCommunity is a list of prefixes that are associated to a
|
||||
bgp community when being advertised. The prefixes associated to a given local pref
|
||||
must be in the prefixes allowed to be advertised.
|
||||
items:
|
||||
description: CommunityPrefixes is a list of
|
||||
prefixes associated to a community.
|
||||
properties:
|
||||
community:
|
||||
description: Community is the community
|
||||
associated to the prefixes.
|
||||
type: string
|
||||
prefixes:
|
||||
description: Prefixes is the list of prefixes
|
||||
associated to the community.
|
||||
format: cidr
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
withLocalPref:
|
||||
description: |-
|
||||
PrefixesWithLocalPref is a list of prefixes that are associated to a local
|
||||
preference when being advertised. The prefixes associated to a given local pref
|
||||
must be in the prefixes allowed to be advertised.
|
||||
items:
|
||||
description: LocalPrefPrefixes is a list of
|
||||
prefixes associated to a local preference.
|
||||
properties:
|
||||
localPref:
|
||||
description: LocalPref is the local preference
|
||||
associated to the prefixes.
|
||||
format: int32
|
||||
type: integer
|
||||
prefixes:
|
||||
description: Prefixes is the list of prefixes
|
||||
associated to the local preference.
|
||||
format: cidr
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
toReceive:
|
||||
description: ToReceive represents the list of prefixes
|
||||
to receive from the given neighbor.
|
||||
properties:
|
||||
allowed:
|
||||
description: |-
|
||||
Allowed is the list of prefixes allowed to be received from
|
||||
this neighbor.
|
||||
properties:
|
||||
mode:
|
||||
default: filtered
|
||||
description: |-
|
||||
Mode is the mode to use when handling the prefixes.
|
||||
When set to "filtered", only the prefixes in the given list will be allowed.
|
||||
When set to "all", all the prefixes configured on the router will be allowed.
|
||||
enum:
|
||||
- all
|
||||
- filtered
|
||||
type: string
|
||||
prefixes:
|
||||
items:
|
||||
description: PrefixSelector is a filter
|
||||
of prefixes to receive.
|
||||
properties:
|
||||
ge:
|
||||
description: |-
|
||||
The prefix length modifier. This selector accepts any matching prefix with length
|
||||
greater or equal the given value.
|
||||
format: int32
|
||||
maximum: 128
|
||||
minimum: 1
|
||||
type: integer
|
||||
le:
|
||||
description: |-
|
||||
The prefix length modifier. This selector accepts any matching prefix with length
|
||||
less or equal the given value.
|
||||
format: int32
|
||||
maximum: 128
|
||||
minimum: 1
|
||||
type: integer
|
||||
prefix:
|
||||
format: cidr
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
prefixes:
|
||||
description: Prefixes is the list of prefixes we want to
|
||||
advertise from this router instance.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
vrf:
|
||||
description: VRF is the host vrf used to establish sessions
|
||||
from this router.
|
||||
type: string
|
||||
required:
|
||||
- asn
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
nodeSelector:
|
||||
description: |-
|
||||
NodeSelector limits the nodes that will attempt to apply this config.
|
||||
When specified, the configuration will be considered only on nodes
|
||||
whose labels match the specified selectors.
|
||||
When it is not specified all nodes will attempt to apply this config.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
raw:
|
||||
description: |-
|
||||
Raw is a snippet of raw frr configuration that gets appended to the
|
||||
one rendered translating the type safe API.
|
||||
properties:
|
||||
priority:
|
||||
description: |-
|
||||
Priority is the order with this configuration is appended to the
|
||||
bottom of the rendered configuration. A higher value means the
|
||||
raw config is appended later in the configuration file.
|
||||
type: integer
|
||||
rawConfig:
|
||||
description: |-
|
||||
Config is a raw FRR configuration to be appended to the configuration
|
||||
rendered via the k8s api.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: FRRConfigurationStatus defines the observed state of FRRConfiguration.
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+65
@@ -0,0 +1,65 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.3
|
||||
name: frrk8sconfigurations.frrk8s.metallb.io
|
||||
spec:
|
||||
group: frrk8s.metallb.io
|
||||
names:
|
||||
kind: FRRK8sConfiguration
|
||||
listKind: FRRK8sConfigurationList
|
||||
plural: frrk8sconfigurations
|
||||
singular: frrk8sconfiguration
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
FRRK8sConfiguration holds the FRR Operator configuration with global
|
||||
settings for the K8s and FRR.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: FRRK8sConfigurationSpec defines the desired state of FRRK8sConfiguration.
|
||||
properties:
|
||||
logLevel:
|
||||
description: |-
|
||||
LogLevel sets the logging verbosity for the FRR-K8s components at runtime.
|
||||
When configured, this value overrides the defaults established by the --log-level CLI flag.
|
||||
Valid values are: all, debug, info, warn, error, none.
|
||||
enum:
|
||||
- all
|
||||
- debug
|
||||
- info
|
||||
- warn
|
||||
- error
|
||||
- none
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: FRRK8sConfigurationStatus defines the observed state of FRRK8sConfiguration.
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+65
@@ -0,0 +1,65 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.3
|
||||
name: frrnodestates.frrk8s.metallb.io
|
||||
spec:
|
||||
group: frrk8s.metallb.io
|
||||
names:
|
||||
kind: FRRNodeState
|
||||
listKind: FRRNodeStateList
|
||||
plural: frrnodestates
|
||||
singular: frrnodestate
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: FRRNodeState exposes the status of the FRR instance running on
|
||||
each node.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: FRRNodeStateSpec defines the desired state of FRRNodeState.
|
||||
type: object
|
||||
status:
|
||||
description: FRRNodeStateStatus defines the observed state of FRRNodeState.
|
||||
properties:
|
||||
lastConversionResult:
|
||||
description: LastConversionResult is the status of the last translation
|
||||
between the `FRRConfiguration`s resources and FRR's configuration,
|
||||
contains "success" or an error.
|
||||
type: string
|
||||
lastReloadResult:
|
||||
description: LastReloadResult represents the status of the last configuration
|
||||
update operation by FRR, contains "success" or an error.
|
||||
type: string
|
||||
runningConfig:
|
||||
description: RunningConfig represents the current FRR running config,
|
||||
which is the configuration the FRR instance is currently running
|
||||
with.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,4 @@
|
||||
FRR-k8s is now running in the cluster.
|
||||
|
||||
Now you can configure it via its CRs. Please refer to the frr-k8s official docs
|
||||
on how to use the CRs.
|
||||
@@ -0,0 +1,63 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "frrk8s.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "frrk8s.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "frrk8s.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "frrk8s.labels" -}}
|
||||
helm.sh/chart: {{ include "frrk8s.chart" . }}
|
||||
{{ include "frrk8s.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "frrk8s.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "frrk8s.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the frrk8s service account to use
|
||||
*/}}
|
||||
{{- define "frrk8s.serviceAccountName" -}}
|
||||
{{- if .Values.frrk8s.serviceAccount.create }}
|
||||
{{- default (printf "%s-controller" (include "frrk8s.fullname" .)) .Values.frrk8s.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.frrk8s.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,462 @@
|
||||
# FRR expects to have these files owned by frr:frr on startup.
|
||||
# Having them in a ConfigMap allows us to modify behaviors: for example enabling more daemons on startup.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "frrk8s.fullname" . }}-frr-startup
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "frrk8s.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: frr-k8s
|
||||
data:
|
||||
daemons: |
|
||||
# This file tells the frr package which daemons to start.
|
||||
#
|
||||
# Sample configurations for these daemons can be found in
|
||||
# /usr/share/doc/frr/examples/.
|
||||
#
|
||||
# ATTENTION:
|
||||
#
|
||||
# When activating a daemon for the first time, a config file, even if it is
|
||||
# empty, has to be present *and* be owned by the user and group "frr", else
|
||||
# the daemon will not be started by /etc/init.d/frr. The permissions should
|
||||
# be u=rw,g=r,o=.
|
||||
# When using "vtysh" such a config file is also needed. It should be owned by
|
||||
# group "frrvty" and set to ug=rw,o= though. Check /etc/pam.d/frr, too.
|
||||
#
|
||||
# The watchfrr and zebra daemons are always started.
|
||||
#
|
||||
bgpd=yes
|
||||
ospfd=no
|
||||
ospf6d=no
|
||||
ripd=no
|
||||
ripngd=no
|
||||
isisd=no
|
||||
pimd=no
|
||||
ldpd=no
|
||||
nhrpd=no
|
||||
eigrpd=no
|
||||
babeld=no
|
||||
sharpd=no
|
||||
pbrd=no
|
||||
bfdd=yes
|
||||
fabricd=no
|
||||
vrrpd=no
|
||||
|
||||
#
|
||||
# If this option is set the /etc/init.d/frr script automatically loads
|
||||
# the config via "vtysh -b" when the servers are started.
|
||||
# Check /etc/pam.d/frr if you intend to use "vtysh"!
|
||||
#
|
||||
vtysh_enable=yes
|
||||
zebra_options=" -A 127.0.0.1 -K 120 -s 90000000 --limit-fds 100000"
|
||||
bgpd_options=" -A 127.0.0.1 {{ if not .Values.frrk8s.frr.acceptIncomingBGPConnections }} -p 0 {{- end }} --limit-fds 100000"
|
||||
ospfd_options=" -A 127.0.0.1"
|
||||
ospf6d_options=" -A ::1"
|
||||
ripd_options=" -A 127.0.0.1"
|
||||
ripngd_options=" -A ::1"
|
||||
isisd_options=" -A 127.0.0.1"
|
||||
pimd_options=" -A 127.0.0.1"
|
||||
ldpd_options=" -A 127.0.0.1"
|
||||
nhrpd_options=" -A 127.0.0.1"
|
||||
eigrpd_options=" -A 127.0.0.1"
|
||||
babeld_options=" -A 127.0.0.1"
|
||||
sharpd_options=" -A 127.0.0.1"
|
||||
pbrd_options=" -A 127.0.0.1"
|
||||
staticd_options="-A 127.0.0.1 --limit-fds 100000"
|
||||
bfdd_options=" -A 127.0.0.1 --limit-fds 100000"
|
||||
fabricd_options="-A 127.0.0.1"
|
||||
vrrpd_options=" -A 127.0.0.1"
|
||||
|
||||
# configuration profile
|
||||
#
|
||||
#frr_profile="traditional"
|
||||
#frr_profile="datacenter"
|
||||
|
||||
#
|
||||
# This is the maximum number of FD's that will be available.
|
||||
# Upon startup this is read by the control files and ulimit
|
||||
# is called. Uncomment and use a reasonable value for your
|
||||
# setup if you are expecting a large number of peers in
|
||||
# say BGP.
|
||||
#MAX_FDS=1024
|
||||
|
||||
# The list of daemons to watch is automatically generated by the init script.
|
||||
#watchfrr_options=""
|
||||
|
||||
# for debugging purposes, you can specify a "wrap" command to start instead
|
||||
# of starting the daemon directly, e.g. to use valgrind on ospfd:
|
||||
# ospfd_wrap="/usr/bin/valgrind"
|
||||
# or you can use "all_wrap" for all daemons, e.g. to use perf record:
|
||||
# all_wrap="/usr/bin/perf record --call-graph -"
|
||||
# the normal daemon command is added to this at the end.
|
||||
vtysh.conf: |+
|
||||
service integrated-vtysh-config
|
||||
frr.conf: |+
|
||||
! This file gets overriden the first time the speaker renders a config.
|
||||
! So anything configured here is only temporary.
|
||||
frr version 8.0
|
||||
frr defaults traditional
|
||||
hostname Router
|
||||
line vty
|
||||
log stdout informational
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ template "frrk8s.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "frrk8s.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: frr-k8s
|
||||
{{- range $key, $value := .Values.frrk8s.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.frrk8s.updateStrategy }}
|
||||
updateStrategy: {{- toYaml .Values.frrk8s.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "frrk8s.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: frr-k8s
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "frrk8s.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: frr-k8s
|
||||
{{- range $key, $value := .Values.frrk8s.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.frrk8s.runtimeClassName }}
|
||||
runtimeClassName: {{ .Values.frrk8s.runtimeClassName }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "frrk8s.serviceAccountName" . }}
|
||||
terminationGracePeriodSeconds: 0
|
||||
hostNetwork: true
|
||||
volumes:
|
||||
- name: frr-sockets
|
||||
emptyDir: {}
|
||||
- name: frr-startup
|
||||
configMap:
|
||||
name: {{ template "frrk8s.fullname" . }}-frr-startup
|
||||
- name: frr-conf
|
||||
emptyDir: {}
|
||||
- name: reloader
|
||||
emptyDir: {}
|
||||
- name: metrics
|
||||
emptyDir: {}
|
||||
- name: frr-status
|
||||
emptyDir: {}
|
||||
- name: frr-lib
|
||||
emptyDir: {}
|
||||
- name: frr-tmp
|
||||
emptyDir: {}
|
||||
{{- if .Values.tls.metricsTLSSecret }}
|
||||
- name: metrics-certs
|
||||
secret:
|
||||
secretName: {{ .Values.tls.metricsTLSSecret }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
# Copies the initial config files with the right permissions to the shared volume.
|
||||
- name: cp-frr-files
|
||||
image: {{ .Values.frrk8s.frr.image.repository }}:{{ .Values.frrk8s.frr.image.tag | default .Chart.AppVersion }}
|
||||
securityContext:
|
||||
runAsUser: 100
|
||||
runAsGroup: 101
|
||||
command: ["/bin/sh", "-c", "cp -rLf /tmp/frr/* /etc/frr/"]
|
||||
volumeMounts:
|
||||
- name: frr-startup
|
||||
mountPath: /tmp/frr
|
||||
- name: frr-conf
|
||||
mountPath: /etc/frr
|
||||
# Copies the reloader to the shared volume between the speaker and reloader.
|
||||
- name: cp-reloader
|
||||
image: {{ .Values.frrk8s.image.repository }}:{{ .Values.frrk8s.image.tag | default .Chart.AppVersion }}
|
||||
command: ["/bin/sh", "-c", "cp -f /frr-reloader.sh /etc/frr_reloader/"]
|
||||
volumeMounts:
|
||||
- name: reloader
|
||||
mountPath: /etc/frr_reloader
|
||||
# Copies the metrics exporter
|
||||
- name: cp-metrics
|
||||
image: {{ .Values.frrk8s.image.repository }}:{{ .Values.frrk8s.image.tag | default .Chart.AppVersion }}
|
||||
command: ["/bin/sh", "-c", "cp -f /frr-metrics /etc/frr_metrics/"]
|
||||
volumeMounts:
|
||||
- name: metrics
|
||||
mountPath: /etc/frr_metrics
|
||||
- name: cp-frr-status
|
||||
image: {{ .Values.frrk8s.image.repository }}:{{ .Values.frrk8s.image.tag | default .Chart.AppVersion }}
|
||||
command: ["/bin/sh", "-c", "cp -f /frr-status /etc/frr_status/"]
|
||||
volumeMounts:
|
||||
- name: frr-status
|
||||
mountPath: /etc/frr_status
|
||||
shareProcessNamespace: true
|
||||
containers:
|
||||
- name: controller
|
||||
image: {{ .Values.frrk8s.image.repository }}:{{ .Values.frrk8s.image.tag | default .Chart.AppVersion }}
|
||||
{{- if .Values.frrk8s.image.pullPolicy }}
|
||||
imagePullPolicy: {{ .Values.frrk8s.image.pullPolicy }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /frr-k8s
|
||||
args:
|
||||
- "--node-name=$(NODE_NAME)"
|
||||
- "--namespace=$(NAMESPACE)"
|
||||
- "--metrics-bind-address=0.0.0.0:{{ .Values.prometheus.secureMetricsPort }}"
|
||||
{{- with .Values.frrk8s.logLevel }}
|
||||
- --log-level={{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.alwaysBlock }}
|
||||
- --always-block={{ .Values.frrk8s.alwaysBlock }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.bgpDebounceTimeout }}
|
||||
- --bgp-debounce-timeout={{ .Values.frrk8s.bgpDebounceTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.cipherSuites }}
|
||||
- --tls-cipher-suites={{ .Values.tls.cipherSuites }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.curvePreferences }}
|
||||
- --tls-curve-preferences={{ .Values.tls.curvePreferences }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.minVersion }}
|
||||
- --tls-min-version={{ .Values.tls.minVersion }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.metricsTLSSecret }}
|
||||
- --metrics-cert-dir=/etc/metrics
|
||||
{{- end }}
|
||||
env:
|
||||
- name: FRR_CONFIG_FILE
|
||||
value: /etc/frr_reloader/frr.conf
|
||||
- name: FRR_RELOADER_PID_FILE
|
||||
value: /etc/frr_reloader/reloader.pid
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
ports:
|
||||
- containerPort: {{ .Values.prometheus.secureMetricsPort }}
|
||||
name: metricshttps
|
||||
{{- if .Values.frrk8s.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 7572
|
||||
host: 127.0.0.1
|
||||
initialDelaySeconds: {{ .Values.frrk8s.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.frrk8s.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.frrk8s.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.frrk8s.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.frrk8s.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 7572
|
||||
host: 127.0.0.1
|
||||
initialDelaySeconds: {{ .Values.frrk8s.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.frrk8s.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.frrk8s.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.frrk8s.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.frrk8s.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_RAW
|
||||
volumeMounts:
|
||||
- name: reloader
|
||||
mountPath: /etc/frr_reloader
|
||||
{{- if .Values.tls.metricsTLSSecret }}
|
||||
- name: metrics-certs
|
||||
mountPath: /etc/metrics
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: frr
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
- SYS_ADMIN
|
||||
- NET_BIND_SERVICE
|
||||
image: {{ .Values.frrk8s.frr.image.repository }}:{{ .Values.frrk8s.frr.image.tag | default .Chart.AppVersion }}
|
||||
{{- if .Values.frrk8s.frr.image.pullPolicy }}
|
||||
imagePullPolicy: {{ .Values.frrk8s.frr.image.pullPolicy }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: TINI_SUBREAPER
|
||||
value: "true"
|
||||
volumeMounts:
|
||||
- name: frr-sockets
|
||||
mountPath: /var/run/frr
|
||||
- name: frr-conf
|
||||
mountPath: /etc/frr
|
||||
- name: frr-lib
|
||||
mountPath: /var/lib/frr
|
||||
- name: frr-tmp
|
||||
mountPath: /var/tmp/frr
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- /sbin/tini -- /usr/lib/frr/docker-start
|
||||
{{- with .Values.frrk8s.frr.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: {{ .Values.frrk8s.frr.secureMetricsPort }}
|
||||
scheme: HTTPS
|
||||
periodSeconds: {{ .Values.frrk8s.livenessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.frrk8s.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: {{ .Values.frrk8s.frr.secureMetricsPort }}
|
||||
scheme: HTTPS
|
||||
failureThreshold: {{ .Values.frrk8s.startupProbe.failureThreshold }}
|
||||
periodSeconds: {{ .Values.frrk8s.startupProbe.periodSeconds }}
|
||||
{{- end }}
|
||||
- name: reloader
|
||||
image: {{ .Values.frrk8s.frr.image.repository }}:{{ .Values.frrk8s.frr.image.tag | default .Chart.AppVersion }}
|
||||
{{- if .Values.frrk8s.frr.image.pullPolicy }}
|
||||
imagePullPolicy: {{ .Values.frrk8s.frr.image.pullPolicy }}
|
||||
{{- end }}
|
||||
command: ["/etc/frr_reloader/frr-reloader.sh"]
|
||||
volumeMounts:
|
||||
- name: frr-sockets
|
||||
mountPath: /var/run/frr
|
||||
- name: frr-conf
|
||||
mountPath: /etc/frr
|
||||
- name: reloader
|
||||
mountPath: /etc/frr_reloader
|
||||
{{- with .Values.frrk8s.reloader.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: frr-metrics
|
||||
image: {{ .Values.frrk8s.frr.image.repository }}:{{ .Values.frrk8s.frr.image.tag | default .Chart.AppVersion }}
|
||||
command: ["/etc/frr_metrics/frr-metrics"]
|
||||
args:
|
||||
- --metrics-port={{ .Values.frrk8s.frr.secureMetricsPort }}
|
||||
- --metrics-bind-address=0.0.0.0
|
||||
{{- if .Values.tls.metricsTLSSecret }}
|
||||
- --tls-cert-file=/etc/metrics/tls.crt
|
||||
- --tls-private-key-file=/etc/metrics/tls.key
|
||||
{{- end }}
|
||||
{{- if .Values.tls.cipherSuites }}
|
||||
- --tls-cipher-suites={{ .Values.tls.cipherSuites }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.curvePreferences }}
|
||||
- --tls-curve-preferences={{ .Values.tls.curvePreferences }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.minVersion }}
|
||||
- --tls-min-version={{ .Values.tls.minVersion }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.frrk8s.frr.secureMetricsPort }}
|
||||
name: frrmetricshttps
|
||||
volumeMounts:
|
||||
- name: frr-sockets
|
||||
mountPath: /var/run/frr
|
||||
- name: frr-conf
|
||||
mountPath: /etc/frr
|
||||
- name: metrics
|
||||
mountPath: /etc/frr_metrics
|
||||
{{- if .Values.tls.metricsTLSSecret }}
|
||||
- name: metrics-certs
|
||||
mountPath: /etc/metrics
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.frrMetrics.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: frr-status
|
||||
args:
|
||||
- --node-name=$(NODE_NAME)
|
||||
- --namespace=$(NAMESPACE)
|
||||
- --pod-name=$(POD_NAME)
|
||||
{{- with .Values.frrk8s.logLevel }}
|
||||
- --log-level={{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.frrStatus.pollInterval }}
|
||||
- --poll-interval={{ .Values.frrk8s.frrStatus.pollInterval }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /etc/frr_status/frr-status
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
image: {{ .Values.frrk8s.frr.image.repository }}:{{ .Values.frrk8s.frr.image.tag | default .Chart.AppVersion }}
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/frr
|
||||
name: frr-sockets
|
||||
- mountPath: /etc/frr
|
||||
name: frr-conf
|
||||
- mountPath: /etc/frr_status
|
||||
name: frr-status
|
||||
{{- with .Values.frrk8s.frrStatus.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
nodeSelector:
|
||||
"kubernetes.io/os": linux
|
||||
{{- with .Values.frrk8s.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.frrk8s.tolerateMaster .Values.frrk8s.tolerations }}
|
||||
tolerations:
|
||||
{{- if .Values.frrk8s.tolerateMaster }}
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
effect: NoSchedule
|
||||
operator: Exists
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.tolerations }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,113 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "frrk8s.fullname" . }}-controller
|
||||
labels: {{- include "frrk8s.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["frrk8sconfigurations"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["frrconfigurations"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["frrnodestates"]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["frrnodestates/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["bgpsessionstates"]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["bgpsessionstates/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resourceNames: ["frr-k8s-validating-webhook-configuration"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "frrk8s.fullname" . }}-controller
|
||||
labels: {{- include "frrk8s.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "frrk8s.fullname" . }}-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "frrk8s.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "frrk8s.fullname" . }}-controller
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "frrk8s.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get","list","watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "frrk8s.fullname" . }}-controller
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "frrk8s.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "frrk8s.fullname" . }}-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "frrk8s.serviceAccountName" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "frrk8s.fullname" . }}-nodestate-cleaner
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "frrk8s.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["frrk8s.metallb.io"]
|
||||
resources: ["frrnodestates"]
|
||||
verbs: ["get", "list", "watch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "frrk8s.fullname" . }}-nodestate-cleaner
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "frrk8s.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "frrk8s.fullname" . }}-nodestate-cleaner
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "frrk8s.serviceAccountName" . }}
|
||||
{{ end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.frrk8s.serviceAccount.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "frrk8s.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "frrk8s.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: controller
|
||||
{{- with .Values.frrk8s.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,128 @@
|
||||
{{- if .Values.prometheus.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "frrk8s.fullname" . }}-frr-k8s-monitor
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "frrk8s.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: frr-k8s
|
||||
{{- if .Values.prometheus.serviceMonitor.additionalLabels }}
|
||||
{{ toYaml .Values.prometheus.serviceMonitor.additionalLabels | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.serviceMonitor.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.prometheus.serviceMonitor.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
- port: "metricshttps"
|
||||
honorLabels: true
|
||||
{{- if .Values.prometheus.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml .Values.prometheus.serviceMonitor.metricRelabelings | nindent 8 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.prometheus.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml .Values.prometheus.serviceMonitor.relabelings | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.serviceMonitor.interval }}
|
||||
interval: {{ .Values.prometheus.serviceMonitor.interval }}
|
||||
{{- end -}}
|
||||
{{ if .Values.prometheus.secureMetricsPort }}
|
||||
bearerTokenFile: "/var/run/secrets/kubernetes.io/serviceaccount/token"
|
||||
scheme: "https"
|
||||
{{- if .Values.prometheus.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{ toYaml .Values.prometheus.serviceMonitor.tlsConfig | indent 8 }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
{{ if .Values.frrk8s.frr.secureMetricsPort }}
|
||||
- port: "frrmetricshttps"
|
||||
honorLabels: true
|
||||
{{- if .Values.prometheus.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml .Values.prometheus.serviceMonitor.metricRelabelings | nindent 8 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.prometheus.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml .Values.prometheus.serviceMonitor.relabelings | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.serviceMonitor.interval }}
|
||||
interval: {{ .Values.prometheus.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
bearerTokenFile: "/var/run/secrets/kubernetes.io/serviceaccount/token"
|
||||
scheme: "https"
|
||||
{{- if .Values.prometheus.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{ toYaml .Values.prometheus.serviceMonitor.tlsConfig | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
jobLabel: {{ .Values.prometheus.serviceMonitor.jobLabel | quote }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
name: {{ template "frrk8s.fullname" . }}-frr-k8s-monitor-service
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
{{- if .Values.prometheus.serviceMonitor.annotations }}
|
||||
{{ toYaml .Values.prometheus.serviceMonitor.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
name: {{ template "frrk8s.fullname" . }}-frr-k8s-monitor-service
|
||||
name: {{ template "frrk8s.fullname" . }}-frr-k8s-monitor-service
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "frrk8s.selectorLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: frr-k8s
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: "metricshttps"
|
||||
port: {{ .Values.prometheus.secureMetricsPort }}
|
||||
targetPort: {{ .Values.prometheus.secureMetricsPort }}
|
||||
- name: frrmetricshttps
|
||||
port: {{ .Values.frrk8s.frr.secureMetricsPort }}
|
||||
targetPort: {{ .Values.frrk8s.frr.secureMetricsPort }}
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
{{- if .Values.prometheus.rbacPrometheus }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "frrk8s.fullname" . }}-prometheus
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "frrk8s.fullname" . }}-prometheus
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "frrk8s.fullname" . }}-prometheus
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ required ".Values.prometheus.serviceAccount must be defined when .Values.prometheus.serviceMonitor.enabled == true" .Values.prometheus.serviceAccount }}
|
||||
namespace: {{ required ".Values.prometheus.namespace must be defined when .Values.prometheus.serviceMonitor.enabled == true" .Values.prometheus.namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,129 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "frrk8s.fullname" . }}-statuscleaner
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "frrk8s.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: statuscleaner
|
||||
{{- range $key, $value := .Values.frrk8s.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: statuscleaner
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: frr-k8s-statuscleaner
|
||||
labels:
|
||||
app.kubernetes.io/component: statuscleaner
|
||||
spec:
|
||||
{{- if .Values.frrk8s.runtimeClassName }}
|
||||
runtimeClassName: {{ .Values.frrk8s.runtimeClassName }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- command:
|
||||
- /statuscleaner
|
||||
args:
|
||||
- --webhook-port={{ .Values.frrk8s.webhookPort }}
|
||||
{{- with .Values.frrk8s.logLevel }}
|
||||
- --log-level={{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.disableCertRotation }}
|
||||
- "--disable-cert-rotation=true"
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.restartOnRotatorSecretRefresh }}
|
||||
- "--restart-on-rotator-secret-refresh=true"
|
||||
{{- end }}
|
||||
- "--namespace=$(NAMESPACE)"
|
||||
{{- if .Values.tls.cipherSuites }}
|
||||
- --tls-cipher-suites={{ .Values.tls.cipherSuites }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.curvePreferences }}
|
||||
- --tls-curve-preferences={{ .Values.tls.curvePreferences }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.minVersion }}
|
||||
- --tls-min-version={{ .Values.tls.minVersion }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: {{ .Values.frrk8s.image.repository }}:{{ .Values.frrk8s.image.tag | default .Chart.AppVersion }}
|
||||
{{- if .Values.frrk8s.image.pullPolicy }}
|
||||
imagePullPolicy: {{ .Values.frrk8s.image.pullPolicy }}
|
||||
{{- end }}
|
||||
name: frr-k8s-statuscleaner
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
ports:
|
||||
- containerPort: {{ .Values.frrk8s.webhookPort }}
|
||||
name: webhook
|
||||
{{- if .Values.frrk8s.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: webhook
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: {{ .Values.frrk8s.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.frrk8s.livenessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.frrk8s.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.frrk8s.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: webhook
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: {{ .Values.frrk8s.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.frrk8s.readinessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.frrk8s.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: cert
|
||||
mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
readOnly: true
|
||||
{{- with .Values.frrk8s.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.frrk8s.tolerateMaster .Values.frrk8s.tolerations }}
|
||||
tolerations:
|
||||
{{- if .Values.frrk8s.tolerateMaster }}
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
effect: NoSchedule
|
||||
operator: Exists
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.tolerations }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.frrk8s.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: frr-k8s-webhook-server-cert
|
||||
serviceAccountName: {{ template "frrk8s.serviceAccountName" . }}
|
||||
terminationGracePeriodSeconds: 10
|
||||
hostNetwork: true
|
||||
@@ -0,0 +1,43 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: frr-k8s-webhook-server-cert
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: frr-k8s-webhook-service
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: statuscleaner
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: frr-k8s-validating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: frr-k8s-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-frrk8s-metallb-io-v1beta1-frrconfiguration
|
||||
failurePolicy: {{ .Values.crds.validationFailurePolicy }}
|
||||
name: frrconfigurationsvalidationwebhook.metallb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- frrk8s.metallb.io
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- frrconfigurations
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,394 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft-07/schema#",
|
||||
"title": "Values",
|
||||
"type": "object",
|
||||
"definitions": {
|
||||
"prometheusAlert": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"enabled"
|
||||
]
|
||||
},
|
||||
"probe": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"failureThreshold": {
|
||||
"type": "integer"
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"successThreshold": {
|
||||
"type": "integer"
|
||||
},
|
||||
"timeoutSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"failureThreshold",
|
||||
"initialDelaySeconds",
|
||||
"periodSeconds",
|
||||
"successThreshold",
|
||||
"timeoutSeconds"
|
||||
]
|
||||
},
|
||||
"component": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"logLevel": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"all",
|
||||
"debug",
|
||||
"info",
|
||||
"warn",
|
||||
"error",
|
||||
"none"
|
||||
]
|
||||
},
|
||||
"image": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pullPolicy": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "null"
|
||||
},
|
||||
{
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"Always",
|
||||
"IfNotPresent",
|
||||
"Never"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceAccount": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"annotations": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"resources": {
|
||||
"type": "object"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"type": "object"
|
||||
},
|
||||
"tolerations": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"priorityClassName": {
|
||||
"type": "string"
|
||||
},
|
||||
"runtimeClassName": {
|
||||
"type": "string"
|
||||
},
|
||||
"affinity": {
|
||||
"type": "object"
|
||||
},
|
||||
"podAnnotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"$ref": "#/definitions/probe"
|
||||
},
|
||||
"readinessProbe": {
|
||||
"$ref": "#/definitions/probe"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image",
|
||||
"serviceAccount"
|
||||
]
|
||||
}
|
||||
},
|
||||
"properties": {
|
||||
"imagePullSecrets": {
|
||||
"description": "Secrets used for pulling images",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"nameOverride": {
|
||||
"description": "Override chart name",
|
||||
"type": "string"
|
||||
},
|
||||
"fullNameOverride": {
|
||||
"description": "Override fully qualified app name",
|
||||
"type": "string"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS configuration for all components",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cipherSuites": {
|
||||
"description": "Comma-separated list of TLS cipher suites",
|
||||
"type": "string"
|
||||
},
|
||||
"curvePreferences": {
|
||||
"description": "Comma-separated list of numeric CurveID values",
|
||||
"type": "string"
|
||||
},
|
||||
"minVersion": {
|
||||
"description": "Minimum TLS version (VersionTLS12 or VersionTLS13)",
|
||||
"type": "string"
|
||||
},
|
||||
"metricsTLSSecret": {
|
||||
"description": "Secret name for metrics TLS certificates. If empty, self-signed certs are auto-generated.",
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"rbac": {
|
||||
"description": "RBAC configuration",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"create": {
|
||||
"description": "Enable RBAC",
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"prometheus": {
|
||||
"description": "Prometheus monitoring config",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"scrapeAnnotations": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"secureMetricsPort": {
|
||||
"type": "integer"
|
||||
},
|
||||
"rbacPrometheus": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"type": "string"
|
||||
},
|
||||
"serviceMonitor": {
|
||||
"description": "Prometheus Operator ServiceMonitors",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"jobLabel": {
|
||||
"type": "string"
|
||||
},
|
||||
"interval": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"metricRelabelings": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"relabelings": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"frrk8s": {
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/component"
|
||||
},
|
||||
{
|
||||
"description": "FRR-K8s controller",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"tolerateMaster": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"updateStrategy": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
]
|
||||
},
|
||||
"runtimeClassName": {
|
||||
"type": "string"
|
||||
},
|
||||
"secretName": {
|
||||
"type": "string"
|
||||
},
|
||||
"frr": {
|
||||
"description": "The FRR properties in the controller",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"image": {
|
||||
"$ref": "#/definitions/component/properties/image"
|
||||
},
|
||||
"metricsPort": {
|
||||
"type": "integer"
|
||||
},
|
||||
"secureMetricsPort": {
|
||||
"type": "integer"
|
||||
},
|
||||
"resources:": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"enabled"
|
||||
]
|
||||
},
|
||||
"command": {
|
||||
"type": "string"
|
||||
},
|
||||
"reloader": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"resources": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"frrMetrics": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"resources": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"tolerateMaster"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"crds": {
|
||||
"description": "CRD configuration",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"description": "Enable CRDs",
|
||||
"type": "boolean"
|
||||
},
|
||||
"validationFailurePolicy": {
|
||||
"description": "Failure policy to use with validating webhooks",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"Ignore",
|
||||
"Fail"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"frrk8s": {
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/component"
|
||||
},
|
||||
{
|
||||
"description": "FRRk8s Controller",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"strategy": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
]
|
||||
},
|
||||
"command": {
|
||||
"type": "string"
|
||||
},
|
||||
"webhookMode": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"frrk8s"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,215 @@
|
||||
# Default values for frr-k8s.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
# -- String to override the default chart name.
|
||||
nameOverride: ""
|
||||
# -- String to override the default fully qualified app name.
|
||||
fullnameOverride: ""
|
||||
|
||||
tls:
|
||||
# -- Comma-separated list of TLS cipher suites. If empty, uses Go defaults. Only applies to TLS 1.2.
|
||||
cipherSuites: ""
|
||||
# -- Comma-separated list of numeric CurveID values (e.g. 29,4588). See https://pkg.go.dev/crypto/tls#CurveID. If empty, uses Go defaults.
|
||||
curvePreferences: ""
|
||||
# -- Minimum TLS version (VersionTLS12 or VersionTLS13). Defaults to VersionTLS13.
|
||||
minVersion: ""
|
||||
# -- The name of the secret to be mounted in the pods to provide TLS certificates for metrics endpoints. If not present, a self-signed certificate is auto-generated.
|
||||
metricsTLSSecret: ""
|
||||
|
||||
rbac:
|
||||
# -- Specifies whether to install and use RBAC rules.
|
||||
create: true
|
||||
|
||||
prometheus:
|
||||
# scrape annotations specifies whether to add Prometheus metric
|
||||
# auto-collection annotations to pods. See
|
||||
# https://github.com/prometheus/prometheus/blob/release-2.1/documentation/examples/prometheus-kubernetes.yml
|
||||
# for a corresponding Prometheus configuration. Alternatively, you
|
||||
# may want to use the Prometheus Operator
|
||||
# (https://github.com/coreos/prometheus-operator) for more powerful
|
||||
# monitoring configuration. If you use the Prometheus operator, this
|
||||
# can be left at false.
|
||||
# -- Add Prometheus metric auto-collection annotations to pods.
|
||||
scrapeAnnotations: false
|
||||
|
||||
# -- Port frr-k8s will listen on for secure metrics.
|
||||
secureMetricsPort: 9140
|
||||
|
||||
# -- Give Prometheus permission to scrape metallb's namespace.
|
||||
rbacPrometheus: false
|
||||
|
||||
# -- The service account used by Prometheus. Required when ".Values.prometheus.rbacPrometheus == true" and "prometheus.serviceMonitor.enabled=true"
|
||||
serviceAccount: ""
|
||||
|
||||
# -- The namespace where Prometheus is deployed. Required when ".Values.prometheus.rbacPrometheus == true" and "prometheus.serviceMonitor.enabled=true".
|
||||
namespace: ""
|
||||
|
||||
# Prometheus Operator ServiceMonitors.
|
||||
serviceMonitor:
|
||||
# -- Enable support for Prometheus Operator.
|
||||
enabled: false
|
||||
|
||||
# -- Additional labels to add to the ServiceMonitor.
|
||||
additionalLabels: {}
|
||||
# -- Optional additional annotations for the controller serviceMonitor.
|
||||
annotations: {}
|
||||
## Optional TLS configuration for the controller serviceMonitor, in case secure metrics are enabled.
|
||||
tlsConfig:
|
||||
# -- Disables SSL certificate verification
|
||||
insecureSkipVerify: true
|
||||
|
||||
# -- Job label for scrape target.
|
||||
jobLabel: "app.kubernetes.io/name"
|
||||
|
||||
# -- Scrape interval. If not set, the Prometheus default scrape interval is used.
|
||||
interval:
|
||||
|
||||
# -- Metric relabel configs to apply to samples before ingestion.
|
||||
metricRelabelings: []
|
||||
# - action: keep
|
||||
# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'
|
||||
# sourceLabels: [__name__]
|
||||
|
||||
# -- Relabel configs to apply to samples before ingestion.
|
||||
relabelings: []
|
||||
# - sourceLabels: [__meta_kubernetes_pod_node_name]
|
||||
# separator: ;
|
||||
# regex: ^(.*)$
|
||||
# target_label: nodename
|
||||
# replacement: $1
|
||||
# action: replace
|
||||
|
||||
# controller contains configuration specific to the FRRK8s controller
|
||||
# daemonset.
|
||||
frrk8s:
|
||||
# -- Controller log level that is passed as a CLI flag. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none`
|
||||
logLevel: info
|
||||
# -- Tolerate master nodes for pod scheduling.
|
||||
tolerateMaster: true
|
||||
image:
|
||||
# -- The frr-k8s image repository.
|
||||
repository: quay.io/metallb/frr-k8s
|
||||
# -- The frr-k8s image tag. If not set, defaults to the chart appVersion.
|
||||
tag:
|
||||
# -- The frr-k8s image pull policy.
|
||||
pullPolicy:
|
||||
## @param controller.updateStrategy.type FRR-K8s controller daemonset strategy type
|
||||
## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
|
||||
##
|
||||
updateStrategy:
|
||||
## StrategyType
|
||||
## Can be set to RollingUpdate or OnDelete
|
||||
# -- Specify the FRR-K8s daemonset update strategy.
|
||||
type: RollingUpdate
|
||||
serviceAccount:
|
||||
# -- Specifies whether a ServiceAccount should be created.
|
||||
create: true
|
||||
# -- The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template.
|
||||
name: ""
|
||||
# -- Additional annotations to add to the ServiceAccount.
|
||||
annotations: {}
|
||||
## Defines a secret name for the controller to generate a memberlist encryption secret
|
||||
## By default secretName: {{ "metallb.fullname" }}-memberlist
|
||||
##
|
||||
# secretName:
|
||||
# -- Resource limits and requests for the frr-k8s controller container.
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 100Mi
|
||||
# -- Node selector for pod assignment.
|
||||
nodeSelector: {}
|
||||
# -- Tolerations for pod assignment.
|
||||
tolerations: []
|
||||
# -- Priority class name for the pod.
|
||||
priorityClassName: ""
|
||||
# -- Affinity for pod assignment.
|
||||
affinity: {}
|
||||
## Selects which runtime class will be used by the pod.
|
||||
# -- Runtime class name for the pod.
|
||||
runtimeClassName: ""
|
||||
# -- Additional annotations to add to the pod.
|
||||
podAnnotations: {}
|
||||
# -- Additional labels to add to the pod.
|
||||
labels:
|
||||
app: frr-k8s
|
||||
# -- Port for the webhook server.
|
||||
webhookPort: 19443
|
||||
livenessProbe:
|
||||
# -- Enable liveness probe.
|
||||
enabled: true
|
||||
# -- Number of failures before the probe is considered failed.
|
||||
failureThreshold: 3
|
||||
# -- Number of seconds after the container has started before liveness probes are initiated.
|
||||
initialDelaySeconds: 10
|
||||
# -- How often (in seconds) to perform the probe.
|
||||
periodSeconds: 10
|
||||
# -- Minimum consecutive successes for the probe to be considered successful.
|
||||
successThreshold: 1
|
||||
# -- Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
# -- Enable readiness probe.
|
||||
enabled: true
|
||||
# -- Number of failures before the probe is considered failed.
|
||||
failureThreshold: 3
|
||||
# -- Number of seconds after the container has started before readiness probes are initiated.
|
||||
initialDelaySeconds: 10
|
||||
# -- How often (in seconds) to perform the probe.
|
||||
periodSeconds: 10
|
||||
# -- Minimum consecutive successes for the probe to be considered successful.
|
||||
successThreshold: 1
|
||||
# -- Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 1
|
||||
startupProbe:
|
||||
# -- Enable startup probe.
|
||||
enabled: true
|
||||
# -- Number of failures before the probe is considered failed.
|
||||
failureThreshold: 30
|
||||
# -- How often (in seconds) to perform the probe.
|
||||
periodSeconds: 5
|
||||
# -- A comma separated list of cidrs to always block for incoming routes.
|
||||
alwaysBlock: ""
|
||||
# -- (integer) BGP debounce timeout for FRR configuration reloads, in milliseconds. Default (when unset) is 3000 ms.This feature is experimental
|
||||
bgpDebounceTimeout: null
|
||||
# -- Specifies whether the cert rotator works as part of the webhook.
|
||||
disableCertRotation: false
|
||||
## Note: Enabling this proved useful for the webhook's stability when it is redeployed multiple times in succession.
|
||||
# -- Specifies whether the pod restarts when the rotator refreshes the cert secret. Useful for webhook stability during redeployments.
|
||||
restartOnRotatorSecretRefresh: false
|
||||
# frr contains configuration specific to the FRR container,
|
||||
frr:
|
||||
image:
|
||||
# -- The FRR image repository.
|
||||
repository: quay.io/frrouting/frr
|
||||
# -- The FRR image tag.
|
||||
tag: 10.4.3
|
||||
# -- The FRR image pull policy.
|
||||
pullPolicy:
|
||||
# -- Bind address for FRR metrics.
|
||||
metricsBindAddress: 127.0.0.1
|
||||
# -- Port for FRR metrics.
|
||||
metricsPort: 7573
|
||||
# -- Resource limits and requests for the FRR container.
|
||||
resources: {}
|
||||
# -- Secure metrics port for FRR.
|
||||
secureMetricsPort: 9141
|
||||
# -- Allow FRR to accept incoming BGP connections.
|
||||
acceptIncomingBGPConnections: false
|
||||
reloader:
|
||||
# -- Resource limits and requests for the reloader container.
|
||||
resources: {}
|
||||
frrMetrics:
|
||||
# -- Resource limits and requests for the FRR metrics container.
|
||||
resources: {}
|
||||
frrStatus:
|
||||
# -- Polling interval for FRR status updates.
|
||||
pollInterval: "2m"
|
||||
# -- Resource limits and requests for the FRR status container.
|
||||
resources: {}
|
||||
crds:
|
||||
# -- Enable installation of CRDs.
|
||||
enabled: true
|
||||
# -- Validation failure policy for CRDs. Can be Fail or Ignore.
|
||||
validationFailurePolicy: Fail
|
||||
Reference in New Issue
Block a user