Documentation ¶
Index ¶
Constants ¶
View Source
const ( // EndpointGCIntervalDefault is the default time for the CEP GC EndpointGCIntervalDefault = 5 * time.Minute // PrometheusServeAddr is the default server address for operator metrics PrometheusServeAddr = ":9963" // CESMaxCEPsInCESDefault is the maximum number of cilium endpoints allowed in a CES CESMaxCEPsInCESDefault = 100 // CESSlicingModeDefault is default method for grouping CEP in a CES. CESSlicingModeDefault = "cesSliceModeIdentity" // CNPStatusCleanupQPSDefault is the default rate for the CNP NodeStatus updates GC. CNPStatusCleanupQPSDefault = 10 // CNPStatusCleanupBurstDefault is the default maximum burst for the CNP NodeStatus updates GC. CNPStatusCleanupBurstDefault = 20 )
View Source
const ( // BGPAnnounceLBIP announces service IPs of type LoadBalancer via BGP beta (deprecated) BGPAnnounceLBIP = "bgp-announce-lb-ip" // BGPConfigPath is the file path to the BGP configuration. It is // compatible with MetalLB's configuration. BGPConfigPath = "bgp-config-path" // SkipCRDCreation specifies whether the CustomResourceDefinition will be // disabled for the operator SkipCRDCreation = "skip-crd-creation" // CNPNodeStatusGCInterval is the GC interval for nodes which have been // removed from the cluster in CiliumNetworkPolicy and // CiliumClusterwideNetworkPolicy Status. CNPNodeStatusGCInterval = "cnp-node-status-gc-interval" // CNPStatusUpdateInterval is the interval between status updates // being sent to the K8s apiserver for a given CNP. CNPStatusUpdateInterval = "cnp-status-update-interval" // SkipCNPStatusStartupClean specifies if the cleanup of all the CNP // NodeStatus updates at startup must be skipped. SkipCNPStatusStartupClean = "skip-cnp-status-startup-clean" // CNPStatusCleanupQPS is the rate at which the cleanup operation of the status // nodes updates in CNPs is carried out. It is expressed as queries per second, // and for each query a single CNP status update will be deleted. CNPStatusCleanupQPS = "cnp-status-cleanup-qps" // CNPStatusCleanupBurst is the maximum burst of queries allowed for the cleanup // operation of the status nodes updates in CNPs. CNPStatusCleanupBurst = "cnp-status-cleanup-burst" // EnableMetrics enables prometheus metrics. EnableMetrics = "enable-metrics" // EndpointGCInterval is the interval between attempts of the CEP GC // controller. // Note that only one node per cluster should run this, and most iterations // will simply return. EndpointGCInterval = "cilium-endpoint-gc-interval" // IdentityGCInterval is the interval in which allocator identities are // attempted to be expired from the kvstore IdentityGCInterval = "identity-gc-interval" // IdentityGCRateInterval is the interval used for rate limiting the GC of // identities. IdentityGCRateInterval = "identity-gc-rate-interval" // IdentityGCRateLimit is the maximum identities used for rate limiting the // GC of identities. IdentityGCRateLimit = "identity-gc-rate-limit" // IdentityHeartbeatTimeout is the timeout used to GC identities from k8s IdentityHeartbeatTimeout = "identity-heartbeat-timeout" // NodesGCInterval is the duration for which the cilium nodes are GC. NodesGCInterval = "nodes-gc-interval" // OperatorAPIServeAddr IP:Port on which to serve api requests in // operator (pass ":Port" to bind on all interfaces, "" is off) OperatorAPIServeAddr = "operator-api-serve-addr" // OperatorPrometheusServeAddr IP:Port on which to serve prometheus // metrics (pass ":Port" to bind on all interfaces, "" is off). OperatorPrometheusServeAddr = "operator-prometheus-serve-addr" // PProf enabled pprof debugging endpoint PProf = "operator-pprof" // PProfAddress is the port that the pprof listens on PProfAddress = "operator-pprof-address" // PProfPort is the port that the pprof listens on PProfPort = "operator-pprof-port" // SyncK8sServices synchronizes k8s services into the kvstore SyncK8sServices = "synchronize-k8s-services" // SyncK8sNodes synchronizes k8s nodes into the kvstore SyncK8sNodes = "synchronize-k8s-nodes" // UnmanagedPodWatcherInterval is the interval to check for unmanaged kube-dns pods (0 to disable) UnmanagedPodWatcherInterval = "unmanaged-pod-watcher-interval" // IPAMAPIBurst is the burst value allowed when accessing external IPAM APIs IPAMAPIBurst = "limit-ipam-api-burst" // IPAMAPIQPSLimit is the queries per second limit when accessing external IPAM APIs IPAMAPIQPSLimit = "limit-ipam-api-qps" // IPAMSubnetsIDs are optional subnets IDs used to filter subnets and interfaces listing IPAMSubnetsIDs = "subnet-ids-filter" // IPAMSubnetsTags are optional tags used to filter subnets, and interfaces within those subnets IPAMSubnetsTags = "subnet-tags-filter" // IPAMInstanceTagFilter are optional tags used to filter instances for ENI discovery ; only used with AWS IPAM mode for now IPAMInstanceTags = "instance-tags-filter" // ClusterPoolIPv4CIDR is the cluster's IPv4 CIDR to allocate // individual PodCIDR ranges from when using the ClusterPool ipam mode. ClusterPoolIPv4CIDR = "cluster-pool-ipv4-cidr" // ClusterPoolIPv6CIDR is the cluster's IPv6 CIDR to allocate // individual PodCIDR ranges from when using the ClusterPool ipam mode. ClusterPoolIPv6CIDR = "cluster-pool-ipv6-cidr" // NodeCIDRMaskSizeIPv4 is the IPv4 podCIDR mask size that will be used // per node. NodeCIDRMaskSizeIPv4 = "cluster-pool-ipv4-mask-size" // NodeCIDRMaskSizeIPv6 is the IPv6 podCIDR mask size that will be used // per node. NodeCIDRMaskSizeIPv6 = "cluster-pool-ipv6-mask-size" // AWSInstanceLimitMapping allows overwirting AWS instance limits defined in // pkg/aws/eni/limits.go // e.g. {"a1.medium": "2,4,4", "a2.custom2": "4,5,6"} AWSInstanceLimitMapping = "aws-instance-limit-mapping" // AWSReleaseExcessIPs allows releasing excess free IP addresses from ENI. // Enabling this option reduces waste of IP addresses but may increase // the number of API calls to AWS EC2 service. AWSReleaseExcessIPs = "aws-release-excess-ips" // ExcessIPReleaseDelay controls how long operator would wait before an IP previously marked as excess is released. // Defaults to 180 secs ExcessIPReleaseDelay = "excess-ip-release-delay" // AWSEnablePrefixDelegation allows operator to allocate prefixes to ENIs on nitro instances instead of individual // IP addresses. Allows for increased pod density on nodes. AWSEnablePrefixDelegation = "aws-enable-prefix-delegation" // ENITags are the tags that will be added to every ENI created by the // AWS ENI IPAM. ENITags = "eni-tags" // ENIGarbageCollectionTags is a tag that will be added to every ENI // created by the AWS ENI IPAM. // Any stale and unattached ENIs with this tag will be garbage // collected by the operator. ENIGarbageCollectionTags = "eni-gc-tags" // ENIGarbageCollectionInterval defines the interval of ENI GC ENIGarbageCollectionInterval = "eni-gc-interval" // ParallelAllocWorkers specifies the number of parallel workers to be used for IPAM allocation ParallelAllocWorkers = "parallel-alloc-workers" // UpdateEC2AdapterLimitViaAPI configures the operator to use the EC2 // API to fill out the instancetype to adapter limit mapping. UpdateEC2AdapterLimitViaAPI = "update-ec2-adapter-limit-via-api" // EC2APIEndpoint is the custom API endpoint to use for the EC2 AWS service, // e.g. "ec2-fips.us-west-1.amazonaws.com" to use a FIPS endpoint in the us-west-1 region. EC2APIEndpoint = "ec2-api-endpoint" // AWSUsePrimaryAddress specifies whether an interface's primary address should be available for allocations on // node AWSUsePrimaryAddress = "aws-use-primary-address" // AzureSubscriptionID is the subscription ID to use when accessing the Azure API AzureSubscriptionID = "azure-subscription-id" // AzureResourceGroup is the resource group of the nodes used for the cluster AzureResourceGroup = "azure-resource-group" // AzureUserAssignedIdentityID is the id of the user assigned identity used // for retrieving Azure API credentials AzureUserAssignedIdentityID = "azure-user-assigned-identity-id" // AzureUsePrimaryAddress specifies whether we should use or ignore the interface's // primary IPConfiguration AzureUsePrimaryAddress = "azure-use-primary-address" // LeaderElectionLeaseDuration is the duration that non-leader candidates will wait to // force acquire leadership LeaderElectionLeaseDuration = "leader-election-lease-duration" // LeaderElectionRenewDeadline is the duration that the current acting master in HA deployment // will retry refreshing leadership before giving up the lock. LeaderElectionRenewDeadline = "leader-election-renew-deadline" // LeaderElectionRetryPeriod is the duration the LeaderElector clients should wait between // tries of the actions in operator HA deployment. LeaderElectionRetryPeriod = "leader-election-retry-period" // AlibabaCloudVPCID allows user to specific vpc AlibabaCloudVPCID = "alibaba-cloud-vpc-id" // AlibabaCloudReleaseExcessIPs allows releasing excess free IP addresses from ENI. // Enabling this option reduces waste of IP addresses but may increase // the number of API calls to AlibabaCloud ECS service. AlibabaCloudReleaseExcessIPs = "alibaba-cloud-release-excess-ips" // CESMaxCEPsInCES is the maximum number of cilium endpoints allowed in single // a CiliumEndpointSlice resource. CESMaxCEPsInCES = "ces-max-ciliumendpoints-per-ces" // CESSlicingMode instructs how CEPs are grouped in a CES. CESSlicingMode = "ces-slice-mode" // LoadBalancerL7 enables loadbalancer capabilities for services via envoy proxy LoadBalancerL7 = "loadbalancer-l7" // LoadBalancerL7Ports is a list of service ports that will be automatically redirected to backend. LoadBalancerL7Ports = "loadbalancer-l7-ports" // LoadBalancerL7Algorithm is a default LB algorithm for services that do not specify related annotation LoadBalancerL7Algorithm = "loadbalancer-l7-algorithm" // EnableIngressController enables cilium ingress controller // This must be enabled along with enable-envoy-config in cilium agent. EnableIngressController = "enable-ingress-controller" // EnforceIngressHttps enforces https for host having matching TLS host in Ingress. // Incoming traffic to http listener will return 308 http error code with respective location in header. EnforceIngressHttps = "enforce-ingress-https" // EnableIngressSecretsSync enables fan-in TLS secrets from multiple namespaces to singular namespace (specified // by ingress-secrets-namespace flag EnableIngressSecretsSync = "enable-ingress-secrets-sync" // EnableGatewayAPISecretsSync enables fan-in TLS secrets from multiple namespaces to singular namespace (specified // by gateway-api-secrets-namespace flag EnableGatewayAPISecretsSync = "enable-gateway-api-secrets-sync" // IngressSecretsNamespace is the namespace having tls secrets used by Ingress and CEC. IngressSecretsNamespace = "ingress-secrets-namespace" // GatewayAPISecretsNamespace is the namespace having tls secrets used by GatewayAPI and CEC. GatewayAPISecretsNamespace = "gateway-api-secrets-namespace" // EnableGatewayAPI enables support of Gateway API // This must be enabled along with enable-envoy-config in cilium agent. EnableGatewayAPI = "enable-gateway-api" // CiliumK8sNamespace is the namespace where Cilium pods are running. CiliumK8sNamespace = "cilium-pod-namespace" // CiliumPodLabels specifies the pod labels that Cilium pods is running // with. CiliumPodLabels = "cilium-pod-labels" // RemoveCiliumNodeTaints is the flag to define if the Cilium node taint // should be removed in Kubernetes nodes. RemoveCiliumNodeTaints = "remove-cilium-node-taints" // SetCiliumIsUpCondition sets the CiliumIsUp node condition in Kubernetes // nodes. SetCiliumIsUpCondition = "set-cilium-is-up-condition" // IngressLBAnnotationPrefixes are the annotations which are needed to propagate // from Ingress to the Load Balancer IngressLBAnnotationPrefixes = "ingress-lb-annotation-prefixes" IngressSharedLBServiceName = "ingress-shared-lb-service-name" // IngressDefaultLoadbalancerMode is the default loadbalancer mode for Ingress. // Applicable values: dedicated, shared IngressDefaultLoadbalancerMode = "ingress-default-lb-mode" // EnableK8s operation of Kubernet-related services/controllers. // Intended for operating cilium with CNI-compatible orchestrators // other than Kubernetes. (default is true) EnableK8s = "enable-k8s" )
Variables ¶
View Source
var Config = &OperatorConfig{ IPAMSubnetsIDs: make([]string, 0), IPAMSubnetsTags: make(map[string]string), IPAMInstanceTags: make(map[string]string), AWSInstanceLimitMapping: make(map[string]string), ENITags: make(map[string]string), ENIGarbageCollectionTags: make(map[string]string), }
Config represents the operator configuration.
View Source
var IngressLBAnnotationsDefault = []string{"service.beta.kubernetes.io", "service.kubernetes.io", "cloud.google.com"}
Functions ¶
This section is empty.
Types ¶
type OperatorConfig ¶
type OperatorConfig struct { // CNPNodeStatusGCInterval is the GC interval for nodes which have been // removed from the cluster in CiliumNetworkPolicy and // CiliumClusterwideNetworkPolicy Status. CNPNodeStatusGCInterval time.Duration // CNPStatusUpdateInterval is the interval between status updates // being sent to the K8s apiserver for a given CNP. CNPStatusUpdateInterval time.Duration // NodesGCInterval is the GC interval for CiliumNodes NodesGCInterval time.Duration // SkipCNPStatusStartupClean disables the cleanup of all the CNP // NodeStatus updates at startup. SkipCNPStatusStartupClean bool // CNPStatusCleanupQPS is the rate at which the cleanup operation of the status // nodes updates in CNPs is carried out. It is expressed as queries per second, // and for each query a single CNP status update will be deleted. CNPStatusCleanupQPS float64 // CNPStatusCleanupBurst is the maximum burst of queries allowed for the cleanup // operation of the status nodes updates in CNPs. CNPStatusCleanupBurst int // EnableMetrics enables prometheus metrics. EnableMetrics bool // EndpointGCInterval is the interval between attempts of the CEP GC // controller. // Note that only one node per cluster should run this, and most iterations // will simply return. EndpointGCInterval time.Duration // IdentityGCInterval is the interval in which allocator identities are // attempted to be expired from the kvstore IdentityGCInterval time.Duration // IdentityGCRateInterval is the interval used for rate limiting the GC of // identities. IdentityGCRateInterval time.Duration // IdentityGCRateLimit is the maximum identities used for rate limiting the // GC of identities. IdentityGCRateLimit int64 // IdentityHeartbeatTimeout is the timeout used to GC identities from k8s IdentityHeartbeatTimeout time.Duration OperatorAPIServeAddr string OperatorPrometheusServeAddr string // PProf enables pprof debugging endpoint PProf bool // PProfAddress is the address that the pprof listens on PProfAddress string // PProfPort is the port that the pprof listens on PProfPort int // SyncK8sServices synchronizes k8s services into the kvstore SyncK8sServices bool // SyncK8sNodes synchronizes k8s nodes into the kvstore SyncK8sNodes bool // UnmanagedPodWatcherInterval is the interval to check for unmanaged kube-dns pods (0 to disable) UnmanagedPodWatcherInterval int // LeaderElectionLeaseDuration is the duration that non-leader candidates will wait to // force acquire leadership in Cilium Operator HA deployment. LeaderElectionLeaseDuration time.Duration // LeaderElectionRenewDeadline is the duration that the current acting master in HA deployment // will retry refreshing leadership in before giving up the lock. LeaderElectionRenewDeadline time.Duration // LeaderElectionRetryPeriod is the duration that LeaderElector clients should wait between // retries of the actions in operator HA deployment. LeaderElectionRetryPeriod time.Duration // BGPAnnounceLBIP announces service IPs of type LoadBalancer via BGP beta (deprecated) BGPAnnounceLBIP bool // BGPConfigPath is the file path to the BGP configuration. It is // compatible with MetalLB's configuration. BGPConfigPath string // SkipCRDCreation disables creation of the CustomResourceDefinition // for the operator SkipCRDCreation bool // IPAMAPIBurst is the burst value allowed when accessing external IPAM APIs IPAMAPIBurst int // IPAMAPIQPSLimit is the queries per second limit when accessing external IPAM APIs IPAMAPIQPSLimit float64 // IPAMSubnetsIDs are optional subnets IDs used to filter subnets and interfaces listing IPAMSubnetsIDs []string // IPAMSubnetsTags are optional tags used to filter subnets, and interfaces within those subnets IPAMSubnetsTags map[string]string // IPAMUInstanceTags are optional tags used to filter AWS EC2 instances, and interfaces (ENI) attached to them IPAMInstanceTags map[string]string // ClusterPoolIPv4CIDR is the cluster IPv4 podCIDR that should be used to // allocate pods in the node. ClusterPoolIPv4CIDR []string // ClusterPoolIPv6CIDR is the cluster IPv6 podCIDR that should be used to // allocate pods in the node. ClusterPoolIPv6CIDR []string // NodeCIDRMaskSizeIPv4 is the IPv4 podCIDR mask size that will be used // per node. NodeCIDRMaskSizeIPv4 int // NodeCIDRMaskSizeIPv6 is the IPv6 podCIDR mask size that will be used // per node. NodeCIDRMaskSizeIPv6 int // ENITags are the tags that will be added to every ENI created by the AWS ENI IPAM ENITags map[string]string // ENIGarbageCollectionTags is a tag that will be added to every ENI // created by the AWS ENI IPAM. // Any stale and unattached ENIs with this tag will be garbage // collected by the operator. ENIGarbageCollectionTags map[string]string // ENIGarbageCollectionInterval defines the interval of ENI GC ENIGarbageCollectionInterval time.Duration // ParallelAllocWorkers specifies the number of parallel workers to be used for accessing cloud provider APIs . ParallelAllocWorkers int64 // AWSInstanceLimitMapping allows overwriting AWS instance limits defined in // pkg/aws/eni/limits.go // e.g. {"a1.medium": "2,4,4", "a2.custom2": "4,5,6"} AWSInstanceLimitMapping map[string]string // AWSReleaseExcessIps allows releasing excess free IP addresses from ENI. // Enabling this option reduces waste of IP addresses but may increase // the number of API calls to AWS EC2 service. AWSReleaseExcessIPs bool // AWSEnablePrefixDelegation allows operator to allocate prefixes to ENIs on nitro instances instead of individual // IP addresses. Allows for increased pod density on nodes. AWSEnablePrefixDelegation bool // AWSUsePrimaryAddress specifies whether an interface's primary address should be available for allocations on // node AWSUsePrimaryAddress bool // UpdateEC2AdapterLimitViaAPI configures the operator to use the EC2 API to fill out the // instancetype to adapter limit mapping. UpdateEC2AdapterLimitViaAPI bool // ExcessIPReleaseDelay controls how long operator would wait before an IP previously marked as excess is released. // Defaults to 180 secs ExcessIPReleaseDelay int // EC2APIEndpoint is the custom API endpoint to use for the EC2 AWS service, // e.g. "ec2-fips.us-west-1.amazonaws.com" to use a FIPS endpoint in the us-west-1 region. EC2APIEndpoint string // AzureSubscriptionID is the subscription ID to use when accessing the Azure API AzureSubscriptionID string // AzureResourceGroup is the resource group of the nodes used for the cluster AzureResourceGroup string // AzureUserAssignedIdentityID is the id of the user assigned identity used // for retrieving Azure API credentials AzureUserAssignedIdentityID string // AzureUsePrimaryAddress specify wether we should use or ignore the interface's // primary IPConfiguration AzureUsePrimaryAddress bool // AlibabaCloudVPCID allow user to specific vpc AlibabaCloudVPCID string // AlibabaCloudReleaseExcessIPs allows releasing excess free IP addresses from ENI. // Enabling this option reduces waste of IP addresses but may increase // the number of API calls to AlibabaCloud ECS service. AlibabaCloudReleaseExcessIPs bool // CESMaxCEPsInCES is the maximum number of CiliumEndpoints allowed in single // a CiliumEndpointSlice resource. // The default value of maximum CiliumEndpoints allowed in a CiliumEndpointSlice resource is 100. CESMaxCEPsInCES int // CESSlicingMode instructs how CEPs are grouped in a CES. CESSlicingMode string // LoadBalancerL7 enables loadbalancer capabilities for services. LoadBalancerL7 string // EnvoyLoadBalancerPorts is a list of service ports that will be automatically redirected to Envoy LoadBalancerL7Ports []string // LoadBalancerL7Algorithm is a default LB algorithm for services that do not specify related annotation LoadBalancerL7Algorithm string // EnableIngressController enables cilium ingress controller EnableIngressController bool // EnableGatewayAPI enables support of Gateway API EnableGatewayAPI bool // EnforceIngressHTTPS enforces https if required EnforceIngressHTTPS bool // EnableIngressSecretsSync enables background TLS secret sync for Ingress EnableIngressSecretsSync bool // EnableGatewayAPISecretsSync enables background TLS secret sync for Gateway API EnableGatewayAPISecretsSync bool // IngressSecretsNamespace is the namespace having tls secrets used by CEC for Ingress. IngressSecretsNamespace string // GatewayAPISecretsNamespace is the namespace having tls secrets used by CEC for Gateway API. GatewayAPISecretsNamespace string // CiliumK8sNamespace is the namespace where Cilium pods are running. CiliumK8sNamespace string // CiliumPodLabels specifies the pod labels that Cilium pods is running // with. CiliumPodLabels string // RemoveCiliumNodeTaints is the flag to define if the Cilium node taint // should be removed in Kubernetes nodes. RemoveCiliumNodeTaints bool // SetCiliumIsUpCondition sets the CiliumIsUp node condition in Kubernetes // nodes. SetCiliumIsUpCondition bool // IngressLBAnnotationPrefixes IngressLBAnnotations are the annotation prefixes, // which are used to filter annotations to propagate from Ingress to the Load Balancer IngressLBAnnotationPrefixes []string IngressSharedLBServiceName string // IngressDefaultLoadbalancerMode is the default loadbalancer mode for Ingress. // Applicable values: dedicated, shared IngressDefaultLoadbalancerMode string // Enables/Disables operation of kubernet-related services/controllers. // Intended for operating cilium with CNI-compatible orquestrators // othern than Kubernetes. (default is true) EnableK8s bool }
OperatorConfig is the configuration used by the operator.
func (*OperatorConfig) Populate ¶
func (c *OperatorConfig) Populate(vp *viper.Viper)
Populate sets all options with the values from viper.
Click to show internal directories.
Click to hide internal directories.