mirror of
https://github.com/techno-tim/k3s-ansible.git
synced 2026-10-23 20:22:03 +02:00
Timothy Stewart
ab3de49697
- Bump K3s to v1.36.2+k3s1, Calico to v3.32.1, Cilium to v1.20.0, kube-vip to v1.2.2, kube-vip cloud provider to v0.0.12, and MetalLB to v0.16.0 across sample inventory, role defaults, and argument specs - Pin the Cilium CLI with a new cilium_cli_tag (v0.19.7) instead of the floating stable.txt lookup - Replace the CiliumBGPPeeringPolicy v2alpha1 BGP template with the v2 CiliumBGPClusterConfig, CiliumBGPPeerConfig, CiliumBGPAdvertisement, and CiliumLoadBalancerIPPool resource set - Move Cilium load balancer Helm keys from bpf.loadBalancer to the valid top-level loadBalancer path - Add preflight schema validation and remove the deprecated policy after the v2 objects are accepted - Wait for cilium status after installation - Pin kube-vip RBAC in a repository template instead of fetching a mutable URL, and include EndpointSlice permissions - Fix the kube-vip bgppeers format to address:ASN comma-separated peers - Fail clearly when the MetalLB speaker tag replacement does not apply - Drop the obsolete MetalLB webhook service name version branch
93 lines
2.4 KiB
Django/Jinja
93 lines
2.4 KiB
Django/Jinja
# Cilium BGP Control Plane v2 resources.
|
|
# Replace the deprecated v2alpha1 CiliumBGPPeeringPolicy that was removed
|
|
# in Cilium 1.19.
|
|
{% set _cilium_default_peer = {'peer_address': cilium_bgp_peer_address, 'peer_asn': cilium_bgp_peer_asn} %}
|
|
{% set _cilium_peers = _cilium_bgp_neighbors if _cilium_bgp_neighbors | length > 0 else [_cilium_default_peer] %}
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumBGPPeerConfig
|
|
metadata:
|
|
name: cilium-peer
|
|
spec:
|
|
# Matches the timers and multihop used by the previous v2alpha1 policy.
|
|
ebgpMultihop: 10
|
|
timers:
|
|
connectRetryTimeSeconds: 120
|
|
holdTimeSeconds: 90
|
|
keepAliveTimeSeconds: 30
|
|
gracefulRestart:
|
|
enabled: true
|
|
restartTimeSeconds: 120
|
|
families:
|
|
- afi: ipv4
|
|
safi: unicast
|
|
advertisements:
|
|
matchLabels:
|
|
advertise: "bgp"
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumBGPClusterConfig
|
|
metadata:
|
|
name: cilium-bgp
|
|
spec:
|
|
# Explicitly select every node so the BGP instance runs across the cluster.
|
|
nodeSelector:
|
|
matchExpressions:
|
|
- key: somekey
|
|
operator: NotIn
|
|
values: ['never-used-value']
|
|
bgpInstances:
|
|
- name: "instance-{{ cilium_bgp_my_asn }}"
|
|
localASN: {{ cilium_bgp_my_asn }}
|
|
peers:
|
|
{% for peer in _cilium_peers %}
|
|
- name: "peer-{{ peer.peer_asn }}-{{ loop.index }}"
|
|
peerASN: {{ peer.peer_asn }}
|
|
peerAddress: {{ peer.peer_address }}
|
|
peerConfigRef:
|
|
name: cilium-peer
|
|
{% endfor %}
|
|
{% if cilium_exportPodCIDR %}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumBGPAdvertisement
|
|
metadata:
|
|
name: cilium-pod-cidrs
|
|
labels:
|
|
advertise: "bgp"
|
|
spec:
|
|
advertisements:
|
|
- advertisementType: "PodCIDR"
|
|
{% endif %}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumBGPAdvertisement
|
|
metadata:
|
|
name: cilium-lb-services
|
|
labels:
|
|
advertise: "bgp"
|
|
spec:
|
|
advertisements:
|
|
- advertisementType: "Service"
|
|
service:
|
|
addresses:
|
|
- LoadBalancerIP
|
|
# Advertise all Services carrying an ingress address from the pool.
|
|
selector:
|
|
matchExpressions:
|
|
- key: somekey
|
|
operator: NotIn
|
|
values: ['never-used-value']
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumLoadBalancerIPPool
|
|
metadata:
|
|
name: "01-lb-pool"
|
|
spec:
|
|
blocks:
|
|
{% if "/" in cilium_bgp_lb_cidr %}
|
|
- cidr: {{ cilium_bgp_lb_cidr }}
|
|
{% else %}
|
|
- start: {{ cilium_bgp_lb_cidr.split('-')[0] }}
|
|
stop: {{ cilium_bgp_lb_cidr.split('-')[1] }}
|
|
{% endif %}
|