"Kubeadm(v1.19)高可用集群部署中的calico.yaml配置详解"

需积分: 5 9 浏览量更新于2023-12-24 收藏 80KB DOCX 举报

Kubeadm(v1.19)是一个用于在Kubernetes集群上进行快速配置的工具，而calico是Kubernetes中常用的网络插件之一，它能够为Kubernetes集群中的Pod提供网络通信功能。在Kubeadm(v1.19)高可用集群部署中，需要配置calico.yaml文件来实现对calico网络插件的定制化部署。 calico.yaml是用于配置calico网络插件的配置文件，通过对calico.yaml文件进行修改和设置，可以实现对calico网络插件的各种参数和特性的定制化。对calico.yaml文件的详细配置将直接影响到Kubernetes集群中Pod的网络通信表现和性能。在Kubeadm(v1.19)高可用集群部署中，calico.yaml文件的配置包括了对calico网络插件的IP地址分配、路由配置、策略和安全设置等方面的参数设置。通过对这些参数的灵活设置，可以实现对Kubernetes集群中的网络通信功能进行个性化定制，满足不同场景下的网络需求。根据实际的需求和情况，用户可以对calico.yaml文件进行如下配置： 1. IP地址分配：可以通过配置calico.yaml文件，设置Kubernetes集群中Pod的IP地址分配方式，包括静态IP地址、动态IP地址或者地址池分配等方式，以满足不同场景下对IP地址的需求和管理。 2. 路由配置：通过calico.yaml文件的配置，可以设置Kubernetes集群中Pod的路由规则和路由策略，从而实现对Pod之间和Pod与外部网络之间的路由控制和定制化配置。 3. 策略设置：calico.yaml文件中的配置还可以实现对Kubernetes集群中网络策略的定制化设置，包括网络访问规则、网络安全设置等方面的参数调整，以保障Kubernetes集群中网络通信的安全和稳定性。 4. 安全设置：calico.yaml文件还可以用于配置Kubernetes集群中网络插件的安全设置，包括网络隔离、访问控制、安全策略等方面的参数配置，以确保Kubernetes集群中网络通信的安全和可靠性。总之，calico.yaml文件是Kubeadm(v1.19)高可用集群部署中非常重要的配置文件之一，通过对calico.yaml文件的深入配置和设置，可以实现对Kubernetes集群中网络通信功能的个性化定制，满足不同场景下的网络需求和管理要求。因此，在进行Kubeadm(v1.19)高可用集群部署时，需要对calico.yaml文件的配置进行仔细的调整和设置，以确保Kubernetes集群中网络通信功能的稳定和可靠。

description: 'InterfacePrefix is the interface name prefix that identifies

workload endpoints and so distinguishes them from host endpoint

interfaces. Note: in environments other than bare metal, the

orchestrators

configure this appropriately. For example our Kubernetes and Docker

integrations set the ‘cali’ value, and our OpenStack integration

sets the ‘tap’ value. [Default: cali]'

type: string

ipipEnabled:

type: boolean

ipipMTU:

description: 'IPIPMTU is the MTU to set on the tunnel device. See

Configuring MTU [Default: 1440]'

type: integer

ipsetsRefreshInterval:

description: 'IpsetsRefreshInterval is the period at which Felix re-checks

all iptables state to ensure that no other process has accidentally

broken Calico’s rules. Set to 0 to disable iptables refresh. [Default:

90s]'

type: string

iptablesBackend:

description: IptablesBackend specifies which backend of iptables will

be used. The default is legacy.

type: string

iptablesFilterAllowAction:

type: string

iptablesLockFilePath:

description: 'IptablesLockFilePath is the location of the iptables

lock file. You may need to change this if the lock file is not in

its standard location (for example if you have mapped it into Felix’s

container at a different path). [Default: /run/xtables.lock]'

type: string

iptablesLockProbeInterval:

description: 'IptablesLockProbeInterval is the time that Felix will

wait between attempts to acquire the iptables lock if it is not

available. Lower values make Felix more responsive when the lock

is contended, but use more CPU. [Default: 50ms]'

type: string

iptablesLockTimeout:

description: 'IptablesLockTimeout is the time that Felix will wait

for the iptables lock, or 0, to disable. To use this feature, Felix

must share the iptables lock file with all other processes that

also take the lock. When running Felix inside a container, this

requires the /run directory of the host to be mounted into the

calico/node

or calico/felix container. [Default: 0s disabled]'

type: string

iptablesMangleAllowAction:

type: string

iptablesMarkMask:

description: 'IptablesMarkMask is the mask that Felix selects its

IPTables Mark bits from. Should be a 32 bit hexadecimal number with

at least 8 bits set, none of which clash with any other mark bits

in use on the system. [Default: 0xff000000]'

format: int32

type: integer

iptablesNATOutgoingInterfaceFilter:

type: string

iptablesPostWriteCheckInterval:

description: 'IptablesPostWriteCheckInterval is the period after Felix

has done a write to the dataplane that it schedules an extra read

back in order to check the write was not clobbered by another process.

This should only occur if another application on the system doesn’t

respect the iptables lock. [Default: 1s]'

type: string

iptablesRefreshInterval:

description: 'IptablesRefreshInterval is the period at which Felix

re-checks the IP sets in the dataplane to ensure that no other process

has accidentally broken Calico’s rules. Set to 0 to disable IP sets

refresh. Note: the default for this value is lower than the other

refresh intervals as a workaround for a Linux kernel bug that was

fixed in kernel version 4.11. If you are using v4.11 or greater

you may want to set this to, a higher value to reduce Felix CPU

usage. [Default: 10s]'

type: string

ipv6Support:

type: boolean

kubeNodePortRanges:

description: 'KubeNodePortRanges holds list of port ranges used for

service node ports. Only used if felix detects kube-proxy running

in ipvs mode. Felix uses these ranges to separate host and workload

traffic. [Default: 30000:32767].'

items:

anyOf:

- type: integer

- type: string

pattern: ^.*

x-kubernetes-int-or-string: true

type: array

logFilePath:

description: 'LogFilePath is the full path to the Felix log. Set to

none to disable file logging. [Default: /var/log/calico/felix.log]'

type: string

logPrefix:

description: 'LogPrefix is the log prefix that Felix uses when rendering

LOG rules. [Default: calico-packet]'

type: string

logSeverityFile:

description: 'LogSeverityFile is the log severity above which logs

are sent to the log file. [Default: Info]'

type: string

logSeverityScreen:

description: 'LogSeverityScreen is the log severity above which logs

are sent to the stdout. [Default: Info]'

type: string

logSeveritySys:

description: 'LogSeveritySys is the log severity above which logs

are sent to the syslog. Set to None for no logging to syslog. [Default:

Info]'

type: string

maxIpsetSize:

type: integer

metadataAddr:

description: 'MetadataAddr is the IP address or domain name of the

server that can answer VM queries for cloud-init metadata. In

OpenStack,

this corresponds to the machine running nova-api (or in Ubuntu,

nova-api-metadata). A value of none (case insensitive) means that

Felix should not set up any NAT rule for the metadata path. [Default:

127.0.0.1]'

type: string

metadataPort:

description: 'MetadataPort is the port of the metadata server. This,

combined with global.MetadataAddr (if not ‘None’), is used to set

up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.

In most cases this should not need to be changed [Default: 8775].'

type: integer

natOutgoingAddress:

description: NATOutgoingAddress specifies an address to use when

performing

source NAT for traffic in a natOutgoing pool that is leaving the

network. By default the address used is an address on the interface

the traffic is leaving on (ie it uses the iptables MASQUERADE target)

type: string

natPortRange:

anyOf:

- type: integer

- type: string

description: NATPortRange specifies the range of ports that is used

for port mapping when doing outgoing NAT. When unset the default

behavior of the network stack is used.

pattern: ^.*

x-kubernetes-int-or-string: true

netlinkTimeout:

type: string

openstackRegion:

description: 'OpenstackRegion is the name of the region that a particular

Felix belongs to. In a multi-region Calico/OpenStack deployment,

this must be configured somehow for each Felix (here in the datamodel,

or in felix.cfg or the environment on each compute node), and must

match the [calico] openstack_region value configured in neutron.conf

on each node. [Default: Empty]'

type: string

policySyncPathPrefix:

description: 'PolicySyncPathPrefix is used to by Felix to communicate

policy changes to external services, like Application layer policy.

[Default: Empty]'

type: string

prometheusGoMetricsEnabled:

description: 'PrometheusGoMetricsEnabled disables Go runtime metrics

collection, which the Prometheus client does by default, when set

to false. This reduces the number of metrics reported, reducing

Prometheus load. [Default: true]'

type: boolean

prometheusMetricsEnabled:

description: 'PrometheusMetricsEnabled enables the Prometheus metrics

server in Felix if set to true. [Default: false]'

type: boolean

prometheusMetricsHost:

description: 'PrometheusMetricsHost is the host that the Prometheus

metrics server should bind to. [Default: empty]'

type: string

prometheusMetricsPort:

description: 'PrometheusMetricsPort is the TCP port that the Prometheus

metrics server should bind to. [Default: 9091]'

type: integer

剩余89页未读，继续阅读

爱吃西瓜的程序猿小陈

粉丝: 112
资源: 1

"Kubeadm(v1.19)高可用集群部署中的calico.yaml配置详解"

calico.yaml文件

k8s calico.yml

calico v3.11镜像以及yaml文件

k8s - calico.yaml

calico的yaml配置文件

calico-3.1.yaml

calico-3.10.2.yaml

华普微四通道数字隔离器

基于区块链的分级诊疗数据共享系统全部资料+详细文档.zip

本文简要介绍了sql注入

最新资源