# Canal Version v3.1.7

# https://docs.projectcalico.org/v3.1/releases#v3.1.7

# This manifest includes the following component versions:

#   calico/node:v3.1.7

#   calico/cni:v3.1.7

#   coreos/flannel:v0.9.1

# This ConfigMap can be used to configure a self-hosted Canal installation.

kind: ConfigMap

apiVersion: v1

metadata:

  name: canal-config

  namespace: kube-system

data:

  # The interface used by canal for host <-> host communication.

  # If left blank, then the interface is chosen using the node's

  # default route.

  canal_iface: ""

  # Whether or not to masquerade traffic to destinations not within

  # the pod network.

  masquerade: "true"

  # The CNI network configuration to install on each node.

  cni_network_config: |-

    {

      "name": "k8s-pod-network",

      "cniVersion": "0.3.0",

      "plugins": [

        {

          "type": "calico",

          "log_level": "info",

          "datastore_type": "kubernetes",

          "nodename": "__KUBERNETES_NODE_NAME__",

          "ipam": {

            "type": "host-local",

            "subnet": "usePodCidr"

          },

          "policy": {

            "type": "k8s"

          },

          "kubernetes": {

            "kubeconfig": "__KUBECONFIG_FILEPATH__"

          }

        },

        {

          "type": "portmap",

          "snat": true,

          "capabilities": {"portMappings": true}

        }

      ]

    }

  # Flannel network configuration. Mounted into the flannel container.

  net-conf.json: |

    {

      "Network": "10.244.0.0/16",

      "Backend": {

        "Type": "vxlan"

      }

    }

---

# This manifest installs the calico/node container, as well

# as the Calico CNI plugins and network config on

# each master and worker node in a Kubernetes cluster.

kind: DaemonSet

apiVersion: apps/v1

metadata:

  name: canal

  namespace: kube-system

  labels:

    k8s-app: canal

spec:

  selector:

    matchLabels:

      k8s-app: canal

  updateStrategy:

    type: RollingUpdate

    rollingUpdate:

      maxUnavailable: 1

  template:

    metadata:

      labels:

        k8s-app: canal

      annotations:

        scheduler.alpha.kubernetes.io/critical-pod: ''

    spec:

      hostNetwork: true

      serviceAccountName: canal

      tolerations:

        # Tolerate this effect so the pods will be schedulable at all times

        - effect: NoSchedule

          operator: Exists

        # Mark the pod as a critical add-on for rescheduling.

        - key: CriticalAddonsOnly

          operator: Exists

        - effect: NoExecute

          operator: Exists

      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force

      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.

      terminationGracePeriodSeconds: 0

      containers:

        # Runs calico/node container on each Kubernetes node.  This

        # container programs network policy and routes on each

        # host.

        - name: calico-node

          image: quay.io/calico/node:v3.1.7

          env:

            # Use Kubernetes API as the backing datastore.

            - name: DATASTORE_TYPE

              value: "kubernetes"

            # Enable felix logging.

            - name: FELIX_LOGSEVERITYSCREEN

              value: "info"

            # Don't enable BGP.

            - name: CALICO_NETWORKING_BACKEND

              value: "none"

            # Cluster type to identify the deployment type

            - name: CLUSTER_TYPE

              value: "k8s,canal"

            # Disable file logging so `kubectl logs` works.

            - name: CALICO_DISABLE_FILE_LOGGING

              value: "true"

            # Period, in seconds, at which felix re-applies all iptables state

            - name: FELIX_IPTABLESREFRESHINTERVAL

              value: "60"

            # Disable IPV6 support in Felix.

            - name: FELIX_IPV6SUPPORT

              value: "false"

            # Wait for the datastore.

            - name: WAIT_FOR_DATASTORE

              value: "true"

            # No IP address needed.

            - name: IP

              value: ""

            - name: NODENAME

              valueFrom:

                fieldRef:

                  fieldPath: spec.nodeName

            # Set Felix endpoint to host default action to ACCEPT.

            - name: FELIX_DEFAULTENDPOINTTOHOSTACTION

              value: "ACCEPT"

            - name: FELIX_HEALTHENABLED

              value: "true"

          securityContext:

            privileged: true

          resources:

            requests:

              cpu: 250m

          livenessProbe:

            httpGet:

              path: /liveness

              port: 9099

            periodSeconds: 10

            initialDelaySeconds: 10

            failureThreshold: 6

          readinessProbe:

            httpGet:

              path: /readiness

              port: 9099

            periodSeconds: 10

          volumeMounts:

            - mountPath: /lib/modules

              name: lib-modules

              readOnly: true

            - mountPath: /var/run/calico

              name: var-run-calico

              readOnly: false

            - mountPath: /var/lib/calico

              name: var-lib-calico

              readOnly: false

        # This container installs the Calico CNI binaries

        # and CNI network config file on each node.

        - name: install-cni

          image: quay.io/calico/cni:v3.1.7

          command: ["/install-cni.sh"]

          env:

            - name: CNI_CONF_NAME

              value: "10-calico.conflist"

            # The CNI network config to install on each node.

            - name: CNI_NETWORK_CONFIG

              valueFrom:

                configMapKeyRef:

                  name: canal-config

                  key: cni_network_config

            - name: KUBERNETES_NODE_NAME

              valueFrom:

                fieldRef:

                  fieldPath: spec.nodeName

          volumeMounts:

            - mountPath: /host/opt/cni/bin

              name: cni-bin-dir

            - mountPath: /host/etc/cni/net.d

              name: cni-net-dir

        # This container runs flannel using the kube-subnet-mgr backend

        # for allocating subnets.

        - name: kube-flannel

          image: quay.io/coreos/flannel:v0.9.1

          command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ]

          securityContext:

            privileged: true

          env:

            - name: POD_NAME

              valueFrom:

                fieldRef:

                  fieldPath: metadata.name

            - name: POD_NAMESPACE

              valueFrom:

                fieldRef:

                  fieldPath: metadata.namespace

            - name: FLANNELD_IFACE

              valueFrom:

                configMapKeyRef:

                  name: canal-config

                  key: canal_iface

            - name: FLANNELD_IP_MASQ

              valueFrom:

                configMapKeyRef:

                  name: canal-config

                  key: masquerade

          volumeMounts:

          - name: run

            mountPath: /run

          - name: flannel-cfg

            mountPath: /etc/kube-flannel/

      volumes:

        # Used by calico/node.

        - name: lib-modules

          hostPath:

            path: /lib/modules

        - name: var-run-calico

          hostPath:

            path: /var/run/calico

        - name: var-lib-calico

          hostPath:

            path: /var/lib/calico

        # Used to install CNI.

        - name: cni-bin-dir

          hostPath:

            path: /opt/cni/bin

        - name: cni-net-dir

          hostPath:

            path: /etc/cni/net.d

        # Used by flannel.

        - name: run

          hostPath:

            path: /run

        - name: flannel-cfg

          configMap:

            name: canal-config

# Create all the CustomResourceDefinitions needed for

# Calico policy-only mode.

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

   name: felixconfigurations.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: FelixConfiguration

    plural: felixconfigurations

    singular: felixconfiguration

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: bgpconfigurations.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: BGPConfiguration

    plural: bgpconfigurations

    singular: bgpconfiguration

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: ippools.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: IPPool

    plural: ippools

    singular: ippool

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: clusterinformations.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: ClusterInformation

    plural: clusterinformations

    singular: clusterinformation

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: globalnetworkpolicies.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: GlobalNetworkPolicy

    plural: globalnetworkpolicies

    singular: globalnetworkpolicy

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: networkpolicies.crd.projectcalico.org

spec:

  scope: Namespaced

  group: crd.projectcalico.org

  version: v1

  names:

    kind: NetworkPolicy

    plural: networkpolicies

    singular: networkpolicy

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: globalnetworksets.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: GlobalNetworkSet

    plural: globalnetworksets

    singular: globalnetworkset

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

  name: hostendpoints.crd.projectcalico.org

spec:

  scope: Cluster

  group: crd.projectcalico.org

  version: v1

  names:

    kind: HostEndpoint

    plural: hostendpoints

    singular: hostendpoint

---

apiVersion: v1

kind: ServiceAccount

metadata:

  name: canal

  namespace: kube-system