230 lines
4.4 KiB
YAML
230 lines
4.4 KiB
YAML
metallb:
|
|
enabled: false
|
|
|
|
controller:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
effect: NoSchedule
|
|
nodeSelector:
|
|
node-role.kubernetes.io/control-plane: ""
|
|
|
|
ipAddressPools: []
|
|
#- name: my-ip-space
|
|
# protocol: layer2
|
|
# addresses:
|
|
# - 192.168.42.0/24
|
|
|
|
multus:
|
|
enabled: false
|
|
image:
|
|
repository: ghcr.io/k8snetworkplumbingwg/multus-cni
|
|
tag: v3.9.3
|
|
|
|
clusterNetwork: "cilium"
|
|
defaultNetworks: []
|
|
readinessindicatorfile: "/etc/cni/net.d/05-cilium.conflist"
|
|
|
|
cilium:
|
|
enabled: false
|
|
|
|
# breaks preloaded images otherwise
|
|
image:
|
|
useDigest: false
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 1024Mi
|
|
# cpu: 4000m
|
|
|
|
cni:
|
|
binPath: "/usr/libexec/cni"
|
|
logFile: /var/log/cilium-cni.log
|
|
#-- Ensure this is false if multus is enabled
|
|
exclusive: false
|
|
|
|
# bpf:
|
|
# autoMount:
|
|
# enabled: false
|
|
|
|
cluster:
|
|
# This should match the second octet of clusterPoolIPv4PodCIDRList
|
|
# to prevent IP space overlap and easy tracking
|
|
# use 240 as default, less likely to clash with 1
|
|
id: 240
|
|
name: default
|
|
|
|
ipam:
|
|
operator:
|
|
clusterPoolIPv4PodCIDRList:
|
|
- 10.240.0.0/16
|
|
|
|
# Keep it simple for now
|
|
l7Proxy: false
|
|
|
|
#rollOutCiliumPods: true
|
|
|
|
cgroup:
|
|
autoMount:
|
|
enabled: false
|
|
hostRoot: "/sys/fs/cgroup"
|
|
|
|
routingMode: tunnel
|
|
tunnelProtocol: geneve
|
|
|
|
prometheus:
|
|
enabled: false
|
|
serviceMonitor:
|
|
enabled: false
|
|
port: 9091
|
|
|
|
operator:
|
|
replicas: 1
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
effect: NoSchedule
|
|
# the operator removes the taints,
|
|
# so we need to break chicken egg on single controller
|
|
- key: node.cilium.io/agent-not-ready
|
|
effect: NoSchedule
|
|
|
|
nodeSelector:
|
|
node-role.kubernetes.io/control-plane: ""
|
|
prometheus:
|
|
enabled: false
|
|
serviceMonitor:
|
|
enabled: false
|
|
|
|
hubble:
|
|
enabled: false
|
|
relay:
|
|
enabled: false
|
|
ui:
|
|
enabled: false
|
|
tls:
|
|
auto:
|
|
method: cert-manager
|
|
certManagerIssuerRef:
|
|
group: cert-manager.io
|
|
kind: ClusterIssuer
|
|
name: kubezero-local-ca-issuer
|
|
|
|
haproxy:
|
|
enabled: false
|
|
|
|
replicaCount: 1
|
|
|
|
# enable pdb if replica > 1
|
|
PodDisruptionBudget:
|
|
enable: false
|
|
minAvailable: 1
|
|
|
|
containerPorts:
|
|
http: 8080
|
|
https: null
|
|
prometheus: 8404
|
|
stat: null
|
|
|
|
serviceMonitor:
|
|
enabled: false
|
|
endpoints:
|
|
- port: prometheus
|
|
path: /metrics
|
|
scheme: http
|
|
interval: 30s
|
|
params:
|
|
no-maint:
|
|
- empty
|
|
config: |
|
|
frontend fe_main
|
|
bind :8080
|
|
default_backend be_main
|
|
|
|
backend be_main
|
|
server web1 10.0.0.1:8080 check
|
|
|
|
includes:
|
|
global.cfg: |
|
|
global
|
|
log stdout format raw local0
|
|
maxconn 2048
|
|
|
|
defaults
|
|
log global
|
|
mode tcp
|
|
option http-server-close
|
|
timeout connect 10s
|
|
timeout client 30s
|
|
timeout client-fin 30s
|
|
timeout server 30s
|
|
timeout tunnel 1h
|
|
|
|
resolvers coredns
|
|
accepted_payload_size 4096
|
|
parse-resolv-conf
|
|
hold valid 10s
|
|
hold other 10s
|
|
hold refused 10s
|
|
hold nx 10s
|
|
hold timeout 10s
|
|
|
|
prometheus.cfg: |
|
|
frontend prometheus
|
|
bind *:8404
|
|
mode http
|
|
http-request use-service prometheus-exporter if { path /metrics }
|
|
no log
|
|
stats enable
|
|
stats uri /stats
|
|
stats refresh 10s
|
|
stats auth admin:letmein
|
|
|
|
args:
|
|
defaults:
|
|
- "-f"
|
|
- "/usr/local/etc/haproxy/includes/global.cfg"
|
|
- "-f"
|
|
- "/usr/local/etc/haproxy/includes/prometheus.cfg"
|
|
- "-f"
|
|
- "/usr/local/etc/haproxy/haproxy.cfg"
|
|
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
initialDelaySeconds: 0
|
|
timeoutSeconds: 1
|
|
tcpSocket:
|
|
port: 8404
|
|
periodSeconds: 10
|
|
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
initialDelaySeconds: 0
|
|
timeoutSeconds: 1
|
|
tcpSocket:
|
|
port: 8404
|
|
periodSeconds: 10
|
|
|
|
securityContext:
|
|
enabled: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 48Mi
|
|
# limits:
|
|
# cpu: 250m
|
|
# memory: 128Mi
|