kubernetes(k8s)集群安装calico

cat /etc/hosts
10.39.7.51 k8s-master-51
10.39.7.57 k8s-master-57
10.39.7.52 k8s-master-52

wget http://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/hosted/calico.yaml

# 建议下载后 推到自己的镜像仓库
[root@k8s-master-51 ~]# cat calico.yaml |grep image
image: quay.io/calico/node:v3.2.4
image: quay.io/calico/cni:v3.2.4
image: quay.io/calico/kube-controllers:v3.2.4

etcd_endpoints: "https://10.39.7.51:2379,https://10.39.7.52:2379,https://10.39.7.57:2379"

 # If you're using TLS enabled etcd uncomment the following.
  # You must also populate the Secret below with these files.
  etcd_ca: "/calico-secrets/etcd-ca"   # "/calico-secrets/etcd-ca"
  etcd_cert: "/calico-secrets/etcd-cert" # "/calico-secrets/etcd-cert"
  etcd_key: "/calico-secrets/etcd-key # "/calico-secrets/etcd-key"

veth_mtu: "1340"

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: calico-etcd-secrets
  namespace: kube-system
data:
  etcd-key: (cat /etc/kubernetes/ssl/etcd-key.pem | base64 | tr -d '\n')
  etcd-cert: (cat /etc/kubernetes/ssl/etcd.pem | base64 | tr -d '\n')
  etcd-ca: (cat /etc/kubernetes/ssl/ca.pem | base64 | tr -d '\n')

- name: CALICO_IPV4POOL_CIDR
    value: "10.253.0.0/18"

kubectl apply -f calico.yaml

cat > /etc/systemd/system/kubelet.service <<EOF
[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service
Requires=docker.service

[Service]
WorkingDirectory=/var/lib/kubelet
ExecStart=/usr/local/bin/kubelet \
  --hostname-override=k8s-master-51 \
  --pod-infra-container-image=reg.enncloud.cn/enncloud/pause-amd64:3.1 \
  --pod-manifest-path=/etc/kubernetes/manifests  \
  --bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig \
  --kubeconfig=/etc/kubernetes/kubelet.config \
  --config=/etc/kubernetes/kubelet.config.json \
  --cert-dir=/etc/kubernetes/pki \
  --allow-privileged=true \
  --kube-reserved cpu=500m,memory=512m \
  --image-gc-high-threshold=85  --image-gc-low-threshold=70 \
  --logtostderr=true \
  --network-plugin=cni \
  --runtime-cgroups=/systemd/system.slice \
  --kubelet-cgroups=/systemd/system.slice \
  --v=2

[Install]
WantedBy=multi-user.target
EOF

# 重启kubelet
systemctl daemon-reload
systemctl restart kubelet

calico 相关的pod无法创建 日志如下

[root@k8s-master-51 ~]# docker ps -a
CONTAINER ID        IMAGE                                                                                                                 COMMAND                  CREATED              STATUS                      PORTS               NAMES
0dabd1835d53        65733b9f36a6                                                                                                          "/usr/bin/kube-con..."   About a minute ago   Exited (1) 53 seconds ago                       k8s_calico-kube-controllers_calico-kube-controllers-5cf99599ff-hsdqw_kube-system_9175cc10-fdd2-11e8-9144-525463f5581b_13
d434d4ed5e47        e537e5882f91                                                                                                          "start_runit"            About a minute ago   Exited (1) 55 seconds ago

[root@k8s-master-51 ~]# docker logs 0dabd1835d53
#注意：Kubeconfig 字段为空无法连接etcd

2018-12-12 06:39:47.068 [INFO][1] main.go 73: Loaded configuration from environment config=&config.Config{LogLevel:"info", ReconcilerPeriod:"5m", CompactionPeriod:"10m", EnabledControllers:"policy,profile,workloadendpoint,node", WorkloadEndpointWorkers:1, ProfileWorkers:1, PolicyWorkers:1, NodeWorkers:1, Kubeconfig:"", HealthEnabled:true}
2018-12-12 06:39:57.069 [FATAL][1] main.go 85: Failed to start error=failed to build Calico client: context deadline exceeded

[root@k8s-master-51 ~]# docker logs d434d4ed5e47
2018-12-12 06:39:44.948 [INFO][8] startup.go 252: Early log level set to info
2018-12-12 06:39:44.949 [INFO][8] startup.go 272: Using HOSTNAME environment (lowercase) for node name
2018-12-12 06:39:44.949 [INFO][8] startup.go 280: Determined node name: k8s-master-51
Calico node failed to start
ERROR: Error accessing the Calico datastore: context deadline exceeded



# 解决办法：
修改前：
 # If you're using TLS enabled etcd uncomment the following.
  # You must also populate the Secret below with these files.
  etcd_ca: ""   # "/calico-secrets/etcd-ca"
  etcd_cert: "" # "/calico-secrets/etcd-cert"
  etcd_key: ""  # "/calico-secrets/etcd-key"
修改后：
    etcd_ca: "/calico-secrets/etcd-ca"   # "/calico-secrets/etcd-ca"
  etcd_cert: "/calico-secrets/etcd-cert" # "/calico-secrets/etcd-cert"
  etcd_key: "/calico-secrets/etcd-key"  # "/calico-secrets/etcd-key"

[root@k8s-master-51 manifests]# kubectl get po -nkube-system
NAME                                       READY     STATUS    RESTARTS   AGE
calico-kube-controllers-5cf99599ff-zbmn2   0/1       Running   0          1m

[root@k8s-master-51 manifests]# kubectl logs calico-kube-controllers-5cf99599ff-zbmn2 -nkube-system
E1212 10:18:20.617128       1 reflector.go:205] github.com/projectcalico/kube-controllers/pkg/controllers/networkpolicy/policy_controller.go:147: Failed to list *v1.NetworkPolicy: Get https://10.254.0.1:443/apis/networking.k8s.io/v1/networkpolicies?limit=500&resourceVersion=0: dial tcp 10.254.0.1:443: i/o timeout
E1212 10:18:20.657457       1 reflector.go:205] github.com/projectcalico/kube-controllers/pkg/controllers/pod/pod_controller.go:206: Failed to list *v1.Pod: Get https://10.254.0.1:443/api/v1/pods?limit=500&resourceVersion=0: dial tcp 10.254.0.1:443: i/o timeout
2018-12-12 11:01:12.737 [ERROR][1] main.go 188: Failed to reach apiserver error=<nil>

[root@k8s-master-51 manifests]# kubectl describe po calico-kube-controllers-5cf99599ff-zbmn2 -nkube-system
Events:
  Type     Reason     Age                From                    Message
  ----     ------     ----               ----                    -------
  Normal   Scheduled  5m                 default-scheduler       Successfully assigned kube-system/calico-kube-controllers-5cf99599ff-zbmn2 to k8s-master-57
  Normal   Pulling    5m                 kubelet, k8s-master-57  pulling image "quay.io/calico/kube-controllers:v3.2.4"
  Normal   Pulled     5m                 kubelet, k8s-master-57  Successfully pulled image "quay.io/calico/kube-controllers:v3.2.4"
  Normal   Created    5m                 kubelet, k8s-master-57  Created container
  Normal   Started    5m                 kubelet, k8s-master-57  Started container
  Warning  Unhealthy  4m (x3 over 4m)    kubelet, k8s-master-57  Readiness probe failed: initialized to false
  Warning  Unhealthy  28s (x25 over 4m)  kubelet, k8s-master-57  Readiness probe failed: Error reaching apiserver: <nil> with http status code: 0
  
#### fuck  我在51上执行的命令 才发现 calico-controller 一直跑在57上 
### google 有提到cpu的问题  经查看 果不其然啊。。。。。。。
top - 18:28:42 up  1:29,  1 user,  load average: 2.17, 2.15, 1.33
Tasks: 108 total,   1 running, 107 sleeping,   0 stopped,   0 zombie
%Cpu(s): 96.3 us,  3.0 sy,  0.0 ni,  0.5 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st
KiB Mem :  1882600 total,   206224 free,   662924 used,  1013452 buff/cache
KiB Swap:  1048572 total,  1048572 free,        0 used.  1025652 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                                                                              
31230 root      20   0   37076  16788   9372 S 187.7  0.9  20:31.36 kube-controller 



#### 可能是没装kube-proxy   这之间的联系 还没有搞清楚

安装完kube-proxy之后 calico-controller 起来了
[root@k8s-master-51 ~]# kubectl get po -nkube-system
NAME                                       READY     STATUS             RESTARTS   AGE
calico-kube-controllers-5cf99599ff-cbs5l   1/1       Running            0          21h

# Calico Version v3.2.4
# https://docs.projectcalico.org/v3.2/releases#v3.2.4
# This manifest includes the following component versions:
#   calico/node:v3.2.4
#   calico/cni:v3.2.4
#   calico/kube-controllers:v3.2.4

# This ConfigMap is used to configure a self-hosted Calico installation.
kind: ConfigMap
apiVersion: v1
metadata:
  name: calico-config
  namespace: kube-system
data:
  # Configure this with the location of your etcd cluster.
  etcd_endpoints: "https://10.39.7.51:2379,https://10.39.7.52:2379,https://10.39.7.57:2379"

  # If you're using TLS enabled etcd uncomment the following.
  # You must also populate the Secret below with these files.
  etcd_ca: "/calico-secrets/etcd-ca"   # "/calico-secrets/etcd-ca"
  etcd_cert: "/calico-secrets/etcd-cert" # "/calico-secrets/etcd-cert"
  etcd_key: "/calico-secrets/etcd-key"  # "/calico-secrets/etcd-key"
  # Configure the Calico backend to use.
  calico_backend: "bird"

  # Configure the MTU to use
  veth_mtu: "1340"

  # The CNI network configuration to install on each node.  The special
  # values in this config will be automatically populated.
  cni_network_config: |-
    {
      "name": "k8s-pod-network",
      "cniVersion": "0.3.0",
      "plugins": [
        {
          "type": "calico",
          "log_level": "info",
          "etcd_endpoints": "__ETCD_ENDPOINTS__",
          "etcd_key_file": "__ETCD_KEY_FILE__",
          "etcd_cert_file": "__ETCD_CERT_FILE__",
          "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
          "mtu": __CNI_MTU__,
          "ipam": {
              "type": "calico-ipam"
          },
          "policy": {
              "type": "k8s"
          },
          "kubernetes": {
              "kubeconfig": "__KUBECONFIG_FILEPATH__"
          }
        },
        {
          "type": "portmap",
          "snat": true,
          "capabilities": {"portMappings": true}
        }
      ]
    }

---


# The following contains k8s Secrets for use with a TLS enabled etcd cluster.
# For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: calico-etcd-secrets
  namespace: kube-system
data:
  # Populate the following files with etcd TLS configuration if desired, but leave blank if
  # not using TLS for etcd.
  # This self-hosted install expects three files with the following names.  The values
  # should be base64 encoded strings of the entire contents of each file.
  etcd-key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdzhzK0lMUVV5N293d3l4YlBsVTd5NWw1VDhyMXIzUjhqVDhWcFErcFRSbUUxdkwwCmRLZDV0NWszcDRsZGxhcmxLVlh0N3Fob1FQZVdEUVU3dUdQU0lFazZ4REE1VGU3YjJEbFJoa1dUUE1VZWtOTTUKTld2THNrNi83V0lGT1RZNERLUW4rREhGVENHZk9oMFpkOU15RVJ6YmhpbGpXOXRQWWI1anZnQSs1OExob25IbQpzRHJvS0t1aVQ3c0o4cVduOExZL0l0YlNJdWYrUkhPVFZEZ2NyY3NUYnJGakZuWXhWUEU5Q3lyYmdSc1ZXYnd2Ck9oQ3I2YXNVaTVOeXhscFd5SGYveERVS2dTQnlOMVV1bVBTMnNacXdmbFc2NGRrc3BLTUIxSjczeStNSFpLejAKcm9vMG1lUDZ5R1l4MDlLVGt6bmFoNGlYc09GcEN2RThqS0lKTXdJREFRQUJBb0lCQUJQd1ZLbGI3V281MGRGdQphUFJXRmJyTUxGQjE2TU12WjZleXJ1K2FRckY1VWMvWitnOFBKeFFOWkYrSlc2QnNRTjRPeENZenZEb3hmSFJpCi9ndnZEbXovU0I3R2ttOWZUY0FkUmpJWVQ4QTJpc0JRNGxpUVc3UVMxUFRGc0taODRRUllpMEY1UUJCYXRDNWsKM0QwWm90V2ZUTFBDN3oxaGZob0VHNEF6NGpRVHRPNW5QT3d6dWczZERRYTF3eVFnUHB4OUpwb0lhc0piU1dWcQowZ0ZOWXk4TjR6N1dwS2tPZWQ2MWhPb0VGMDdaRlVoL3FTbDlRdFRUaWVhb29WUHA2OVpIOUtzM2FlWG8wRnhTCjJzZkpXb0w2TjdYcG1JcEtId2tWMEZodld6TlRPZURKbllkTUt2NkJZVTVmUFVpOWJ1Ukk2V1RiZWpydEQyM3cKakpHbEQ3RUNnWUVBNU95VVB4MWVrNjRScVd1UHpVeHQ2clgzSC9SeUl1VDR0WGVubFpONk9LMThNYWJkOW4xSgpDZ2R6eWtKc3BWdHc4UjhnSk9VUVRxN1pGTkRyQjJRakJEMytVWi9KUW5IamtqWWdvRHRxeHY0dVpJc3FSTVNECldaRE8rUnc1WjBadU1lMGhiZzVBM3NScGJ0TWNJaUlRY2RLd3F2WHNOZE1DL1Njczd4em5DN2NDZ1lFQTJ2T0oKNkRDUUpEMlI5YTJycWlCekF4YmFVR01pY3RaS1IxQzlTTE1JY0liNnlrY1o4ZkVNZzR2T2VYbnE0c3hHb3VjSApyM1RtSFhuS0pXT1F0d0VmZVRLazFhNjhjWXplNDFZbzJsMnY1aXpwbjZSQmljSVlVeEhORXlUaVVXOVlqbTJECncvYXVEVHd2d1plRm14Wmh0dVhuWjZnaHY4QklxSy9VeHQ2czVtVUNnWUFtbVNVZHh5dnRKb3BmMEh6OGxvaHAKN0tod1FOMEZ1U21lSDBDb1hhZGI2eFJub3NVR0RIWEdOUjkyMk9CTXVUQS8xNG1wN3QxakJ1UWZPR0tJYW4vawo5VGJ1T0V6TTRUc0hxZ3l5TjVKM1h1QWZuNzlPdlB1UW5IUHBXTEx0RU5qL25nWG04b3hKZzBCcnFUaXpJSjg1Ck1kY0wzRThwZkJ5aTVub1REd0o5M1FLQmdRQzJWUGtURXQzMlVBK3N0K09zMlRqdDZhb0VKNG9ZZDd1RGlBa1kKOFg2bHRzSkNrTk5hVjVKRU9iaklFRzg2VDBMRGhnRXdhL2oxc3VaVUhJWDI0RWlGZFZjdlcwUXlpMDFSby82QgpXbU9SR3ZXeXErYW9BYXFnQXNMMG5sS1ozayt3ekNKZW5wNXpCeHY5NjJDbnRndkpjOHN3MXlMRHZDekZ6U2MwCk5WdG13UUtCZ0duUjJJalNIWUZUT0QwS0RNQXF4Wm4xelZjenZRL21oV3I3Y0FFeFZYZUFkU3hNWG9QZTh5V2wKcmQxRFExdzg1UmhGK0IyRlgrcFFxNlgzbUFobmRqTktEdUUvdlhwS3B5MDA2UEdqL3B1dVRKSVhoRzlncTUxbwpHdHZPblBtZmhpYlhZbXJ5ZU5mdUF4MmJuWnBqbmhzUjI5dm4zSzhuQTcwYm13ZVVTVlhCCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
  etcd-cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ5akNDQXQ2Z0F3SUJBZ0lVYUFkc2FYYStsZFZDem83dUM1SE9wNS9zOHU4d0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbAphVXBwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEU0TVRFeE9UQTJOREl3TUZvWERUSTRNVEV4TmpBMk5ESXdNRm93WHpFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbGFXcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUTB3Q3dZRFZRUURFd1JsZEdOa01JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXc4cytJTFFVeTdvd3d5eGJQbFU3eTVsNVQ4cjEKcjNSOGpUOFZwUStwVFJtRTF2TDBkS2Q1dDVrM3A0bGRsYXJsS1ZYdDdxaG9RUGVXRFFVN3VHUFNJRWs2eERBNQpUZTdiMkRsUmhrV1RQTVVla05NNU5XdkxzazYvN1dJRk9UWTRES1FuK0RIRlRDR2ZPaDBaZDlNeUVSemJoaWxqClc5dFBZYjVqdmdBKzU4TGhvbkhtc0Ryb0tLdWlUN3NKOHFXbjhMWS9JdGJTSXVmK1JIT1RWRGdjcmNzVGJyRmoKRm5ZeFZQRTlDeXJiZ1JzVldid3ZPaENyNmFzVWk1Tnl4bHBXeUhmL3hEVUtnU0J5TjFVdW1QUzJzWnF3ZmxXNgo0ZGtzcEtNQjFKNzN5K01IWkt6MHJvbzBtZVA2eUdZeDA5S1Rrem5haDRpWHNPRnBDdkU4aktJSk13SURBUUFCCm80R2pNSUdnTUE0R0ExVWREd0VCL3dRRUF3SUZvREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUIKQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3QURBZEJnTlZIUTRFRmdRVXdlY2NsNzMvcS95ZDl6cmRQRWFOSCt2eQpTcjR3SHdZRFZSMGpCQmd3Rm9BVTB3RHQ2N3p1S1grYU8wTldCd0g1N29qdVIzOHdJUVlEVlIwUkJCb3dHSWNFCmZ3QUFBWWNFQ2ljSE00Y0VDaWNITkljRUNpY0hPVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBRXh1SndZRUEKdm9ZYzU0eHEzL3ZkMmtRMWdRUUpPSFhzM0tDNjFZMTNjNFBwTndWR3VQR0xzVlBwY1hVM2lFdTJTZUp5YWVpQQo4UFFKOVNuS0ZNcGY3QjBqSktKRjNQVGJDeE5taHZ2bGpsMVA3WmxYSS8zTmZGTE40d01Cenl5MFBWVmRlQm9oCjdlMXhpUnIra081SGE0bEVEUCtDeW4zWmxpN3dSeFY5ZUNYTDZGeDBuU2x4N0x2dXZiUVo1M1NEUGc4UjQramMKSHZPT0NVbXpOU3RpNXRhcTNTSFNOMWtFVUR6eFFDTGR2MTUxbVNzdU1pMi9GQkFORGRvbHlwZW9XZEswTWJBagpYZFFBSWEzdk5FY2pKVzVxZW9CRFR2TkQxSFV1RzhJbzB0K0twbjBSTS9oelc4R3FJNXFLVGQyRXJCNUlLRW0zCnU0cThMeGxod3MyL2tRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  etcd-ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2akNDQXFhZ0F3SUJBZ0lVSUFQN1FDd0VTZGlzL2oxVi9YNmUzd0pxNFZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbAphVXBwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEU0TVRFd09EQTFORGN3TUZvWERUSXpNVEV3TnpBMU5EY3dNRm93WlRFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbGFVcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByZFdKbGNtNWxkR1Z6Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeGFiQnl1VGlTaHB5ejR0dHNhdGIKemo1dkhPZ2RhU3hKVExOeGVBOHNBM2RtRnJzN0xScjhTdzBGQkhPQ0taKzZCcVFKb2dPWXVGYXBtWHkxWmNXMgptUW92bnNydDVhSEZGTmNmbndVZGhEa1Q0MG9ZeldTeXRrVnNWTEFPSEZwekVQV1h3TGJvNnI0YndSWkJtRWlNClJBb0JJeFY4dS9PNEV5L1hEM0pRN2wrZEpnSFJZMGlnZzZQeUF0TnJseGdQVDF1VUlhdHRDQUxHK3pDVWJ5ZXYKaW4xYWlqdmZDZVJ3NmtiemZyNisxY3VvbGRTY1lOYnZTK0NJbHBuY0NPdlpURlJxT3BxTU1lOUJ5N0QwcHA1RQpISit6cDV6Qys0YStrbTdnUWVNTHNvT1dnb3RpRU45clNNVFhacDdjZEhJeUVyaEg0WmFDZHk5UDB3Qy9ibEtLCk1RSURBUUFCbzJZd1pEQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFqQWQKQmdOVkhRNEVGZ1FVMHdEdDY3enVLWCthTzBOV0J3SDU3b2p1UjM4d0h3WURWUjBqQkJnd0ZvQVUwd0R0Njd6dQpLWCthTzBOV0J3SDU3b2p1UjM4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFHRU5lYkZnd2F1eFgrbnBNREwyClloUEFyN0lnd2RvQlh0UUlVUTkvRnRQQWR5Y0pKY3pyOFpOZTE3SUM0TUNBanJleFBjckx4WDA2d1NXQVNnWVYKWktwTU8zeEdDY0FiekhuaHNWaFZoekVjeEVGU1lGZk5ZNkR3OGgyV0d0a2pvRGgwNGRaZ1BSU3RwY1Q0UlFiUgo1WW1vOWl3eWRwVVkxNFd2di9OaDVadHcrU1NKdlRGazVDekljUVZmTEdyZENyRWp3ZVptQjdpdFo5eW82UW1rClRQdHVoNW9HMnUrcUg4L1BBeVgyR1lXQmlScEZHNmdWSmp4UERjZVlBRmU2QVNmb0MzREdMOGFqaVcwRFlhTlUKWTZZdU81QWNIc1lCd0JTU3VJNDZnMzR3K0JtdnBHbzRpTENESW51Qi9lKzlsNmdRbU1nNVMvOTlMOVc1VzlKMQpwbzg9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K

---

# This manifest installs the calico/node container, as well
# as the Calico CNI plugins and network config on
# each master and worker node in a Kubernetes cluster.
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: calico-node
  namespace: kube-system
  labels:
    k8s-app: calico-node
spec:
  selector:
    matchLabels:
      k8s-app: calico-node
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        k8s-app: calico-node
      annotations:
        # This, along with the CriticalAddonsOnly toleration below,
        # marks the pod as a critical add-on, ensuring it gets
        # priority scheduling and that its resources are reserved
        # if it ever gets evicted.
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      hostNetwork: true
      tolerations:
        # Make sure calico-node gets scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Mark the pod as a critical add-on for rescheduling.
        - key: CriticalAddonsOnly
          operator: Exists
        - effect: NoExecute
          operator: Exists
      serviceAccountName: calico-node
      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
      terminationGracePeriodSeconds: 0
      containers:
        # Runs calico/node container on each Kubernetes node.  This
        # container programs network policy and routes on each
        # host.
        - name: calico-node
          image: quay.io/calico/node:v3.2.4
          env:
            # The location of the Calico etcd cluster.
            - name: ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_endpoints
            # Location of the CA certificate for etcd.
            - name: ETCD_CA_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: ETCD_KEY_FILE
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: ETCD_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_cert
            # Set noderef for node controller.
            - name: CALICO_K8S_NODE_REF
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            # Choose the backend to use.
            - name: CALICO_NETWORKING_BACKEND
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: calico_backend
            # Cluster type to identify the deployment type
            - name: CLUSTER_TYPE
              value: "k8s,bgp"
            # Auto-detect the BGP IP address.
            - name: IP
              value: "autodetect"
            # Enable IPIP
            - name: CALICO_IPV4POOL_IPIP
              value: "Always"
            # Set MTU for tunnel device used if ipip is enabled
            - name: FELIX_IPINIPMTU
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: veth_mtu
            # The default IPv4 pool to create on startup if none exists. Pod IPs will be
            # chosen from this range. Changing this value after installation will have
            # no effect. This should fall within `--cluster-cidr`.
            - name: CALICO_IPV4POOL_CIDR
              value: "10.253.0.0/18"
            # Disable file logging so `kubectl logs` works.
            - name: CALICO_DISABLE_FILE_LOGGING
              value: "true"
            # Set Felix endpoint to host default action to ACCEPT.
            - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
              value: "ACCEPT"
            # Disable IPv6 on Kubernetes.
            - name: FELIX_IPV6SUPPORT
              value: "false"
            # Set Felix logging to "info"
            - name: FELIX_LOGSEVERITYSCREEN
              value: "info"
            - name: FELIX_HEALTHENABLED
              value: "true"
          securityContext:
            privileged: true
          resources:
            requests:
              cpu: 250m
          livenessProbe:
            httpGet:
              path: /liveness
              port: 9099
              host: localhost
            periodSeconds: 10
            initialDelaySeconds: 10
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
              - /bin/calico-node
              - -bird-ready
              - -felix-ready
            periodSeconds: 10
          volumeMounts:
            - mountPath: /lib/modules
              name: lib-modules
              readOnly: true
            - mountPath: /var/run/calico
              name: var-run-calico
              readOnly: false
            - mountPath: /var/lib/calico
              name: var-lib-calico
              readOnly: false
            - mountPath: /calico-secrets
              name: etcd-certs
        # This container installs the Calico CNI binaries
        # and CNI network config file on each node.
        - name: install-cni
          image: quay.io/calico/cni:v3.2.4
          command: ["/install-cni.sh"]
          env:
            # Name of the CNI config file to create.
            - name: CNI_CONF_NAME
              value: "10-calico.conflist"
            # The location of the Calico etcd cluster.
            - name: ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_endpoints
            # The CNI network config to install on each node.
            - name: CNI_NETWORK_CONFIG
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: cni_network_config
            # CNI MTU Config variable
            - name: CNI_MTU
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: veth_mtu
          volumeMounts:
            - mountPath: /host/opt/cni/bin
              name: cni-bin-dir
            - mountPath: /host/etc/cni/net.d
              name: cni-net-dir
            - mountPath: /calico-secrets
              name: etcd-certs
      volumes:
        # Used by calico/node.
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: var-run-calico
          hostPath:
            path: /var/run/calico
        - name: var-lib-calico
          hostPath:
            path: /var/lib/calico
        # Used to install CNI.
        - name: cni-bin-dir
          hostPath:
            path: /opt/cni/bin
        - name: cni-net-dir
          hostPath:
            path: /etc/cni/net.d
        # Mount in the etcd TLS secrets with mode 400.
        # See https://kubernetes.io/docs/concepts/configuration/secret/
        - name: etcd-certs
          secret:
            secretName: calico-etcd-secrets
            defaultMode: 0400
---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico-node
  namespace: kube-system

---

# This manifest deploys the Calico Kubernetes controllers.
# See https://github.com/projectcalico/kube-controllers
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: calico-kube-controllers
  namespace: kube-system
  labels:
    k8s-app: calico-kube-controllers
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ''
spec:
  # The controllers can only have a single active instance.
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      name: calico-kube-controllers
      namespace: kube-system
      labels:
        k8s-app: calico-kube-controllers
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      # The controllers must run in the host network namespace so that
      # it isn't governed by policy that would prevent it from working.
      hostNetwork: true
      tolerations:
        # Mark the pod as a critical add-on for rescheduling.
        - key: CriticalAddonsOnly
          operator: Exists
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      serviceAccountName: calico-kube-controllers
      containers:
        - name: calico-kube-controllers
          image: quay.io/calico/kube-controllers:v3.2.4
          env:
            # The location of the Calico etcd cluster.
            - name: ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_endpoints
            # Location of the CA certificate for etcd.
            - name: ETCD_CA_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: ETCD_KEY_FILE
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: ETCD_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: etcd_cert
            # Choose which controllers to run.
            - name: ENABLED_CONTROLLERS
              value: policy,profile,workloadendpoint,node
          volumeMounts:
            # Mount in the etcd TLS secrets.
            - mountPath: /calico-secrets
              name: etcd-certs
          readinessProbe:
            exec:
              command:
              - /usr/bin/check-status
              - -r
      volumes:
        # Mount in the etcd TLS secrets with mode 400.
        # See https://kubernetes.io/docs/concepts/configuration/secret/
        - name: etcd-certs
          secret:
            secretName: calico-etcd-secrets
            defaultMode: 0400

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico-kube-controllers
  namespace: kube-system