--- # Source: metallb/templates/service-accounts.yaml apiVersion: v1 kind: ServiceAccount metadata: name: metallb-controller namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller --- # Source: metallb/templates/service-accounts.yaml apiVersion: v1 kind: ServiceAccount metadata: name: metallb-speaker namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: speaker --- # Source: metallb/templates/webhooks.yaml apiVersion: v1 kind: Secret metadata: name: webhook-server-cert namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm --- # Source: metallb/templates/exclude-l2-config.yaml apiVersion: v1 kind: ConfigMap metadata: name: metallb-excludel2 namespace: "metallb-system" data: excludel2.yaml: | announcedInterfacesToExclude: - ^docker.* - ^cbr.* - ^dummy.* - ^virbr.* - ^lxcbr.* - ^veth.* - ^lo$ - ^cali.* - ^tunl.* - ^flannel.* - ^kube-ipvs.* - ^cni.* - ^nodelocaldns.* --- # Source: metallb/templates/speaker.yaml # FRR expects to have these files owned by frr:frr on startup. # Having them in a ConfigMap allows us to modify behaviors: for example enabling more daemons on startup. apiVersion: v1 kind: ConfigMap metadata: name: metallb-frr-startup namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: speaker data: daemons: | # This file tells the frr package which daemons to start. # # Sample configurations for these daemons can be found in # /usr/share/doc/frr/examples/. # # ATTENTION: # # When activating a daemon for the first time, a config file, even if it is # empty, has to be present *and* be owned by the user and group "frr", else # the daemon will not be started by /etc/init.d/frr. The permissions should # be u=rw,g=r,o=. # When using "vtysh" such a config file is also needed. It should be owned by # group "frrvty" and set to ug=rw,o= though. Check /etc/pam.d/frr, too. # # The watchfrr and zebra daemons are always started. # bgpd=yes ospfd=no ospf6d=no ripd=no ripngd=no isisd=no pimd=no ldpd=no nhrpd=no eigrpd=no babeld=no sharpd=no pbrd=no bfdd=yes fabricd=no vrrpd=no # # If this option is set the /etc/init.d/frr script automatically loads # the config via "vtysh -b" when the servers are started. # Check /etc/pam.d/frr if you intend to use "vtysh"! # vtysh_enable=yes zebra_options=" -A 127.0.0.1 -s 90000000" bgpd_options=" -A 127.0.0.1 -p 0" ospfd_options=" -A 127.0.0.1" ospf6d_options=" -A ::1" ripd_options=" -A 127.0.0.1" ripngd_options=" -A ::1" isisd_options=" -A 127.0.0.1" pimd_options=" -A 127.0.0.1" ldpd_options=" -A 127.0.0.1" nhrpd_options=" -A 127.0.0.1" eigrpd_options=" -A 127.0.0.1" babeld_options=" -A 127.0.0.1" sharpd_options=" -A 127.0.0.1" pbrd_options=" -A 127.0.0.1" staticd_options="-A 127.0.0.1" bfdd_options=" -A 127.0.0.1" fabricd_options="-A 127.0.0.1" vrrpd_options=" -A 127.0.0.1" # configuration profile # #frr_profile="traditional" #frr_profile="datacenter" # # This is the maximum number of FD's that will be available. # Upon startup this is read by the control files and ulimit # is called. Uncomment and use a reasonable value for your # setup if you are expecting a large number of peers in # say BGP. #MAX_FDS=1024 # The list of daemons to watch is automatically generated by the init script. #watchfrr_options="" # for debugging purposes, you can specify a "wrap" command to start instead # of starting the daemon directly, e.g. to use valgrind on ospfd: # ospfd_wrap="/usr/bin/valgrind" # or you can use "all_wrap" for all daemons, e.g. to use perf record: # all_wrap="/usr/bin/perf record --call-graph -" # the normal daemon command is added to this at the end. vtysh.conf: |+ service integrated-vtysh-config frr.conf: |+ ! This file gets overriden the first time the speaker renders a config. ! So anything configured here is only temporary. frr version 7.5.1 frr defaults traditional hostname Router line vty log file /etc/frr/frr.log informational --- # Source: metallb/charts/crds/templates/crds.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: addresspools.metallb.io spec: group: metallb.io names: kind: AddressPool listKind: AddressPoolList plural: addresspools singular: addresspool scope: Namespaced conversion: strategy: Webhook webhook: conversionReviewVersions: ["v1alpha1", "v1beta1"] clientConfig: # this is a valid pem format, otherwise the apiserver will reject the deletion of the crds # with "unable to parse bytes as PEM block", The controller will patch it with the right content after it starts caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlGWlRDQ0EwMmdBd0lCQWdJVU5GRW1XcTM3MVpKdGkrMmlSQzk1WmpBV1MxZ3dEUVlKS29aSWh2Y05BUUVMDQpCUUF3UWpFTE1Ba0dBMVVFQmhNQ1dGZ3hGVEFUQmdOVkJBY01ERVJsWm1GMWJIUWdRMmwwZVRFY01Cb0dBMVVFDQpDZ3dUUkdWbVlYVnNkQ0JEYjIxd1lXNTVJRXgwWkRBZUZ3MHlNakEzTVRrd09UTXlNek5hRncweU1qQTRNVGd3DQpPVE15TXpOYU1FSXhDekFKQmdOVkJBWVRBbGhZTVJVd0V3WURWUVFIREF4RVpXWmhkV3gwSUVOcGRIa3hIREFhDQpCZ05WQkFvTUUwUmxabUYxYkhRZ1EyOXRjR0Z1ZVNCTWRHUXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDDQpEd0F3Z2dJS0FvSUNBUUNxVFpxMWZRcC9vYkdlenhES0o3OVB3Ny94azJwellualNzMlkzb1ZYSm5sRmM4YjVlDQpma2ZZQnY2bndscW1keW5PL2phWFBaQmRQSS82aFdOUDBkdVhadEtWU0NCUUpyZzEyOGNXb3F0MGNTN3pLb1VpDQpvcU1tQ0QvRXVBeFFNZjhRZDF2c1gvVllkZ0poVTZBRXJLZEpIaXpFOUJtUkNkTDBGMW1OVW55Rk82UnRtWFZUDQpidkxsTDVYeTc2R0FaQVBLOFB4aVlDa0NtbDdxN0VnTWNiOXlLWldCYmlxQ3VkTXE5TGJLNmdKNzF6YkZnSXV4DQo1L1pXK2JraTB2RlplWk9ZODUxb1psckFUNzJvMDI4NHNTWW9uN0pHZVZkY3NoUnh5R1VpSFpSTzdkaXZVTDVTDQpmM2JmSDFYbWY1ZDQzT0NWTWRuUUV2NWVaOG8zeWVLa3ZrbkZQUGVJMU9BbjdGbDlFRVNNR2dhOGFaSG1URSttDQpsLzlMSmdDYjBnQmtPT0M0WnV4bWh2aERKV1EzWnJCS3pMQlNUZXN0NWlLNVlwcXRWVVk2THRyRW9FelVTK1lsDQpwWndXY2VQWHlHeHM5ZURsR3lNVmQraW15Y3NTU1UvVno2Mmx6MnZCS21NTXBkYldDQWhud0RsRTVqU2dyMjRRDQp0eGNXLys2N3d5KzhuQlI3UXdqVTFITndVRjBzeERWdEwrZ1NHVERnSEVZSlhZelYvT05zMy94TkpoVFNPSkxNDQpoeXNVdyttaGdackdhbUdXcHVIVU1DUitvTWJzMTc1UkcrQjJnUFFHVytPTjJnUTRyOXN2b0ZBNHBBQm8xd1dLDQpRYjRhY3pmeVVscElBOVFoSmFsZEY3S3dPSHVlV3gwRUNrNXg0T2tvVDBvWVp0dzFiR0JjRGtaSmF3SURBUUFCDQpvMU13VVRBZEJnTlZIUTRFRmdRVW90UlNIUm9IWTEyRFZ4R0NCdEhpb1g2ZmVFQXdId1lEVlIwakJCZ3dGb0FVDQpvdFJTSFJvSFkxMkRWeEdDQnRIaW9YNmZlRUF3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcWhraUc5dzBCDQpBUXNGQUFPQ0FnRUFSbkpsWWRjMTFHd0VxWnh6RDF2R3BDR2pDN2VWTlQ3aVY1d3IybXlybHdPYi9aUWFEa0xYDQpvVStaOVVXT1VlSXJTdzUydDdmQUpvVVAwSm5iYkMveVIrU1lqUGhvUXNiVHduOTc2ZldBWTduM3FMOXhCd1Y0DQphek41OXNjeUp0dlhMeUtOL2N5ak1ReDRLajBIMFg0bWJ6bzVZNUtzWWtYVU0vOEFPdWZMcEd0S1NGVGgrSEFDDQpab1Q5YnZHS25adnNHd0tYZFF0Wnh0akhaUjVqK3U3ZGtQOTJBT051RFNabS8rWVV4b2tBK09JbzdSR3BwSHNXDQo1ZTdNY0FTVXRtb1FORXd6dVFoVkJaRWQ1OGtKYjUrV0VWbGNzanlXNnRTbzErZ25tTWNqR1BsMWgxR2hVbjV4DQpFY0lWRnBIWXM5YWo1NmpBSjk1MVQvZjhMaWxmTlVnanBLQ0c1bnl0SUt3emxhOHNtdGlPdm1UNEpYbXBwSkI2DQo4bmdHRVluVjUrUTYwWFJ2OEhSSGp1VG9CRHVhaERrVDA2R1JGODU1d09FR2V4bkZpMXZYWUxLVllWb1V2MXRKDQo4dVdUR1pwNllDSVJldlBqbzg5ZytWTlJSaVFYUThJd0dybXE5c0RoVTlqTjA0SjdVL1RvRDFpNHE3VnlsRUc5DQorV1VGNkNLaEdBeTJIaEhwVncyTGFoOS9lUzdZMUZ1YURrWmhPZG1laG1BOCtqdHNZamJadnR5Mm1SWlF0UUZzDQpUU1VUUjREbUR2bVVPRVRmeStpRHdzK2RkWXVNTnJGeVVYV2dkMnpBQU4ydVl1UHFGY2pRcFNPODFzVTJTU3R3DQoxVzAyeUtYOGJEYmZFdjBzbUh3UzliQnFlSGo5NEM1Mjg0YXpsdTBmaUdpTm1OUEM4ckJLRmhBPQ0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ== service: namespace: metallb-system name: metallb-webhook-service path: /convert versions: - deprecated: true deprecationWarning: metallb.io v1alpha1 AddressPool is deprecated name: v1alpha1 schema: openAPIV3Schema: description: AddressPool is the Schema for the addresspools API. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: AddressPoolSpec defines the desired state of AddressPool. properties: addresses: description: A list of IP address ranges over which MetalLB has authority. You can list multiple ranges in a single pool, they will all share the same settings. Each range can be either a CIDR prefix, or an explicit start-end range of IPs. items: type: string type: array autoAssign: default: true description: AutoAssign flag used to prevent MetallB from automatic allocation for a pool. type: boolean bgpAdvertisements: description: When an IP is allocated from this pool, how should it be translated into BGP announcements? items: properties: aggregationLength: default: 32 description: The aggregation-length advertisement option lets you “roll up” the /32s into a larger prefix. format: int32 minimum: 1 type: integer aggregationLengthV6: default: 128 description: Optional, defaults to 128 (i.e. no aggregation) if not specified. format: int32 type: integer communities: description: BGP communities items: type: string type: array localPref: description: BGP LOCAL_PREF attribute which is used by BGP best path algorithm, Path with higher localpref is preferred over one with lower localpref. format: int32 type: integer type: object type: array protocol: description: Protocol can be used to select how the announcement is done. enum: - layer2 - bgp type: string required: - addresses - protocol type: object status: description: AddressPoolStatus defines the observed state of AddressPool. type: object required: - spec type: object served: true storage: false subresources: status: {} - deprecated: true deprecationWarning: metallb.io v1beta1 AddressPool is deprecated, consider using IPAddressPool name: v1beta1 schema: openAPIV3Schema: description: AddressPool represents a pool of IP addresses that can be allocated to LoadBalancer services. AddressPool is deprecated and being replaced by IPAddressPool. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: AddressPoolSpec defines the desired state of AddressPool. properties: addresses: description: A list of IP address ranges over which MetalLB has authority. You can list multiple ranges in a single pool, they will all share the same settings. Each range can be either a CIDR prefix, or an explicit start-end range of IPs. items: type: string type: array autoAssign: default: true description: AutoAssign flag used to prevent MetallB from automatic allocation for a pool. type: boolean bgpAdvertisements: description: Drives how an IP allocated from this pool should translated into BGP announcements. items: properties: aggregationLength: default: 32 description: The aggregation-length advertisement option lets you “roll up” the /32s into a larger prefix. format: int32 minimum: 1 type: integer aggregationLengthV6: default: 128 description: Optional, defaults to 128 (i.e. no aggregation) if not specified. format: int32 type: integer communities: description: BGP communities to be associated with the given advertisement. items: type: string type: array localPref: description: BGP LOCAL_PREF attribute which is used by BGP best path algorithm, Path with higher localpref is preferred over one with lower localpref. format: int32 type: integer type: object type: array protocol: description: Protocol can be used to select how the announcement is done. enum: - layer2 - bgp type: string required: - addresses - protocol type: object status: description: AddressPoolStatus defines the observed state of AddressPool. type: object required: - spec type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/charts/crds/templates/crds.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: bfdprofiles.metallb.io spec: group: metallb.io names: kind: BFDProfile listKind: BFDProfileList plural: bfdprofiles singular: bfdprofile scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: BFDProfile represents the settings of the bfd session that can be optionally associated with a BGP session. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: BFDProfileSpec defines the desired state of BFDProfile. properties: detectMultiplier: description: Configures the detection multiplier to determine packet loss. The remote transmission interval will be multiplied by this value to determine the connection loss detection timer. format: int32 maximum: 255 minimum: 2 type: integer echoInterval: description: Configures the minimal echo receive transmission interval that this system is capable of handling in milliseconds. Defaults to 50ms format: int32 maximum: 60000 minimum: 10 type: integer echoMode: description: Enables or disables the echo transmission mode. This mode is disabled by default, and not supported on multi hops setups. type: boolean minimumTtl: description: 'For multi hop sessions only: configure the minimum expected TTL for an incoming BFD control packet.' format: int32 maximum: 254 minimum: 1 type: integer passiveMode: description: 'Mark session as passive: a passive session will not attempt to start the connection and will wait for control packets from peer before it begins replying.' type: boolean receiveInterval: description: The minimum interval that this system is capable of receiving control packets in milliseconds. Defaults to 300ms. format: int32 maximum: 60000 minimum: 10 type: integer transmitInterval: description: The minimum transmission interval (less jitter) that this system wants to use to send BFD control packets in milliseconds. Defaults to 300ms format: int32 maximum: 60000 minimum: 10 type: integer type: object status: description: BFDProfileStatus defines the observed state of BFDProfile. type: object type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/charts/crds/templates/crds.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: bgpadvertisements.metallb.io spec: group: metallb.io names: kind: BGPAdvertisement listKind: BGPAdvertisementList plural: bgpadvertisements singular: bgpadvertisement scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: BGPAdvertisement allows to advertise the IPs coming from the selected IPAddressPools via BGP, setting the parameters of the BGP Advertisement. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: BGPAdvertisementSpec defines the desired state of BGPAdvertisement. properties: aggregationLength: default: 32 description: The aggregation-length advertisement option lets you “roll up” the /32s into a larger prefix. Defaults to 32. Works for IPv4 addresses. format: int32 minimum: 1 type: integer aggregationLengthV6: default: 128 description: The aggregation-length advertisement option lets you “roll up” the /128s into a larger prefix. Defaults to 128. Works for IPv6 addresses. format: int32 type: integer communities: description: The BGP communities to be associated with the announcement. Each item can be a community of the form 1234:1234 or the name of an alias defined in the Community CRD. items: type: string type: array ipAddressPoolSelectors: description: A selector for the IPAddressPools which would get advertised via this advertisement. If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array ipAddressPools: description: The list of IPAddressPools to advertise via this advertisement, selected by name. items: type: string type: array localPref: description: The BGP LOCAL_PREF attribute which is used by BGP best path algorithm, Path with higher localpref is preferred over one with lower localpref. format: int32 type: integer nodeSelectors: description: NodeSelectors allows to limit the nodes to announce as next hops for the LoadBalancer IP. When empty, all the nodes having are announced as next hops. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array peers: description: Peers limits the bgppeer to advertise the ips of the selected pools to. When empty, the loadbalancer IP is announced to all the BGPPeers configured. items: type: string type: array type: object status: description: BGPAdvertisementStatus defines the observed state of BGPAdvertisement. type: object type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/charts/crds/templates/crds.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: bgppeers.metallb.io spec: group: metallb.io names: kind: BGPPeer listKind: BGPPeerList plural: bgppeers singular: bgppeer scope: Namespaced conversion: strategy: Webhook webhook: conversionReviewVersions: ["v1beta1", "v1beta2"] clientConfig: # this is a valid pem format, otherwise the apiserver will reject the deletion of the crds # with "unable to parse bytes as PEM block", The controller will patch it with the right content after it starts caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlGWlRDQ0EwMmdBd0lCQWdJVU5GRW1XcTM3MVpKdGkrMmlSQzk1WmpBV1MxZ3dEUVlKS29aSWh2Y05BUUVMDQpCUUF3UWpFTE1Ba0dBMVVFQmhNQ1dGZ3hGVEFUQmdOVkJBY01ERVJsWm1GMWJIUWdRMmwwZVRFY01Cb0dBMVVFDQpDZ3dUUkdWbVlYVnNkQ0JEYjIxd1lXNTVJRXgwWkRBZUZ3MHlNakEzTVRrd09UTXlNek5hRncweU1qQTRNVGd3DQpPVE15TXpOYU1FSXhDekFKQmdOVkJBWVRBbGhZTVJVd0V3WURWUVFIREF4RVpXWmhkV3gwSUVOcGRIa3hIREFhDQpCZ05WQkFvTUUwUmxabUYxYkhRZ1EyOXRjR0Z1ZVNCTWRHUXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDDQpEd0F3Z2dJS0FvSUNBUUNxVFpxMWZRcC9vYkdlenhES0o3OVB3Ny94azJwellualNzMlkzb1ZYSm5sRmM4YjVlDQpma2ZZQnY2bndscW1keW5PL2phWFBaQmRQSS82aFdOUDBkdVhadEtWU0NCUUpyZzEyOGNXb3F0MGNTN3pLb1VpDQpvcU1tQ0QvRXVBeFFNZjhRZDF2c1gvVllkZ0poVTZBRXJLZEpIaXpFOUJtUkNkTDBGMW1OVW55Rk82UnRtWFZUDQpidkxsTDVYeTc2R0FaQVBLOFB4aVlDa0NtbDdxN0VnTWNiOXlLWldCYmlxQ3VkTXE5TGJLNmdKNzF6YkZnSXV4DQo1L1pXK2JraTB2RlplWk9ZODUxb1psckFUNzJvMDI4NHNTWW9uN0pHZVZkY3NoUnh5R1VpSFpSTzdkaXZVTDVTDQpmM2JmSDFYbWY1ZDQzT0NWTWRuUUV2NWVaOG8zeWVLa3ZrbkZQUGVJMU9BbjdGbDlFRVNNR2dhOGFaSG1URSttDQpsLzlMSmdDYjBnQmtPT0M0WnV4bWh2aERKV1EzWnJCS3pMQlNUZXN0NWlLNVlwcXRWVVk2THRyRW9FelVTK1lsDQpwWndXY2VQWHlHeHM5ZURsR3lNVmQraW15Y3NTU1UvVno2Mmx6MnZCS21NTXBkYldDQWhud0RsRTVqU2dyMjRRDQp0eGNXLys2N3d5KzhuQlI3UXdqVTFITndVRjBzeERWdEwrZ1NHVERnSEVZSlhZelYvT05zMy94TkpoVFNPSkxNDQpoeXNVdyttaGdackdhbUdXcHVIVU1DUitvTWJzMTc1UkcrQjJnUFFHVytPTjJnUTRyOXN2b0ZBNHBBQm8xd1dLDQpRYjRhY3pmeVVscElBOVFoSmFsZEY3S3dPSHVlV3gwRUNrNXg0T2tvVDBvWVp0dzFiR0JjRGtaSmF3SURBUUFCDQpvMU13VVRBZEJnTlZIUTRFRmdRVW90UlNIUm9IWTEyRFZ4R0NCdEhpb1g2ZmVFQXdId1lEVlIwakJCZ3dGb0FVDQpvdFJTSFJvSFkxMkRWeEdDQnRIaW9YNmZlRUF3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcWhraUc5dzBCDQpBUXNGQUFPQ0FnRUFSbkpsWWRjMTFHd0VxWnh6RDF2R3BDR2pDN2VWTlQ3aVY1d3IybXlybHdPYi9aUWFEa0xYDQpvVStaOVVXT1VlSXJTdzUydDdmQUpvVVAwSm5iYkMveVIrU1lqUGhvUXNiVHduOTc2ZldBWTduM3FMOXhCd1Y0DQphek41OXNjeUp0dlhMeUtOL2N5ak1ReDRLajBIMFg0bWJ6bzVZNUtzWWtYVU0vOEFPdWZMcEd0S1NGVGgrSEFDDQpab1Q5YnZHS25adnNHd0tYZFF0Wnh0akhaUjVqK3U3ZGtQOTJBT051RFNabS8rWVV4b2tBK09JbzdSR3BwSHNXDQo1ZTdNY0FTVXRtb1FORXd6dVFoVkJaRWQ1OGtKYjUrV0VWbGNzanlXNnRTbzErZ25tTWNqR1BsMWgxR2hVbjV4DQpFY0lWRnBIWXM5YWo1NmpBSjk1MVQvZjhMaWxmTlVnanBLQ0c1bnl0SUt3emxhOHNtdGlPdm1UNEpYbXBwSkI2DQo4bmdHRVluVjUrUTYwWFJ2OEhSSGp1VG9CRHVhaERrVDA2R1JGODU1d09FR2V4bkZpMXZYWUxLVllWb1V2MXRKDQo4dVdUR1pwNllDSVJldlBqbzg5ZytWTlJSaVFYUThJd0dybXE5c0RoVTlqTjA0SjdVL1RvRDFpNHE3VnlsRUc5DQorV1VGNkNLaEdBeTJIaEhwVncyTGFoOS9lUzdZMUZ1YURrWmhPZG1laG1BOCtqdHNZamJadnR5Mm1SWlF0UUZzDQpUU1VUUjREbUR2bVVPRVRmeStpRHdzK2RkWXVNTnJGeVVYV2dkMnpBQU4ydVl1UHFGY2pRcFNPODFzVTJTU3R3DQoxVzAyeUtYOGJEYmZFdjBzbUh3UzliQnFlSGo5NEM1Mjg0YXpsdTBmaUdpTm1OUEM4ckJLRmhBPQ0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ== service: namespace: metallb-system name: metallb-webhook-service path: /convert versions: - name: v1beta1 schema: openAPIV3Schema: description: BGPPeer is the Schema for the peers API. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: BGPPeerSpec defines the desired state of Peer. properties: bfdProfile: type: string ebgpMultiHop: description: EBGP peer is multi-hops away type: boolean holdTime: description: Requested BGP hold time, per RFC4271. type: string keepaliveTime: description: Requested BGP keepalive time, per RFC4271. type: string myASN: description: AS number to use for the local end of the session. format: int32 maximum: 4294967295 minimum: 0 type: integer nodeSelectors: description: Only connect to this peer on nodes that match one of these selectors. items: properties: matchExpressions: items: properties: key: type: string operator: type: string values: items: type: string minItems: 1 type: array required: - key - operator - values type: object type: array matchLabels: additionalProperties: type: string type: object type: object type: array password: description: Authentication password for routers enforcing TCP MD5 authenticated sessions type: string peerASN: description: AS number to expect from the remote end of the session. format: int32 maximum: 4294967295 minimum: 0 type: integer peerAddress: description: Address to dial when establishing the session. type: string peerPort: description: Port to dial when establishing the session. maximum: 16384 minimum: 0 type: integer routerID: description: BGP router ID to advertise to the peer type: string sourceAddress: description: Source address to use when establishing the session. type: string required: - myASN - peerASN - peerAddress type: object status: description: BGPPeerStatus defines the observed state of Peer. type: object type: object served: true storage: false subresources: status: {} - name: v1beta2 schema: openAPIV3Schema: description: BGPPeer is the Schema for the peers API. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: BGPPeerSpec defines the desired state of Peer. properties: bfdProfile: description: The name of the BFD Profile to be used for the BFD session associated to the BGP session. If not set, the BFD session won't be set up. type: string ebgpMultiHop: description: To set if the BGPPeer is multi-hops away. Needed for FRR mode only. type: boolean holdTime: description: Requested BGP hold time, per RFC4271. type: string keepaliveTime: description: Requested BGP keepalive time, per RFC4271. type: string myASN: description: AS number to use for the local end of the session. format: int32 maximum: 4294967295 minimum: 0 type: integer nodeSelectors: description: Only connect to this peer on nodes that match one of these selectors. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array password: description: Authentication password for routers enforcing TCP MD5 authenticated sessions type: string passwordSecret: description: passwordSecret is name of the authentication secret for BGP Peer. the secret must be of type "kubernetes.io/basic-auth", and created in the same namespace as the MetalLB deployment. The password is stored in the secret as the key "password". properties: name: description: Name is unique within a namespace to reference a secret resource. type: string namespace: description: Namespace defines the space within which the secret name must be unique. type: string type: object peerASN: description: AS number to expect from the remote end of the session. format: int32 maximum: 4294967295 minimum: 0 type: integer peerAddress: description: Address to dial when establishing the session. type: string peerPort: default: 179 description: Port to dial when establishing the session. maximum: 16384 minimum: 0 type: integer routerID: description: BGP router ID to advertise to the peer type: string sourceAddress: description: Source address to use when establishing the session. type: string vrf: description: To set if we want to peer with the BGPPeer using an interface belonging to a host vrf type: string required: - myASN - peerASN - peerAddress type: object status: description: BGPPeerStatus defines the observed state of Peer. type: object type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/charts/crds/templates/crds.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: ipaddresspools.metallb.io spec: group: metallb.io names: kind: IPAddressPool listKind: IPAddressPoolList plural: ipaddresspools singular: ipaddresspool scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: IPAddressPool represents a pool of IP addresses that can be allocated to LoadBalancer services. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: IPAddressPoolSpec defines the desired state of IPAddressPool. properties: addresses: description: A list of IP address ranges over which MetalLB has authority. You can list multiple ranges in a single pool, they will all share the same settings. Each range can be either a CIDR prefix, or an explicit start-end range of IPs. items: type: string type: array autoAssign: default: true description: AutoAssign flag used to prevent MetallB from automatic allocation for a pool. type: boolean avoidBuggyIPs: default: false description: AvoidBuggyIPs prevents addresses ending with .0 and .255 to be used by a pool. type: boolean serviceAllocation: description: AllocateTo makes ip pool allocation to specific namespace and/or service. The controller will use the pool with lowest value of priority in case of multiple matches. A pool with no priority set will be used only if the pools with priority can't be used. If multiple matching IPAddressPools are available it will check for the availability of IPs sorting the matching IPAddressPools by priority, starting from the highest to the lowest. If multiple IPAddressPools have the same priority, choice will be random. properties: namespaceSelectors: description: NamespaceSelectors list of label selectors to select namespace(s) for ip pool, an alternative to using namespace list. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array namespaces: description: Namespaces list of namespace(s) on which ip pool can be attached. items: type: string type: array priority: description: Priority priority given for ip pool while ip allocation on a service. type: integer serviceSelectors: description: ServiceSelectors list of label selector to select service(s) for which ip pool can be used for ip allocation. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array type: object required: - addresses type: object status: description: IPAddressPoolStatus defines the observed state of IPAddressPool. type: object required: - spec type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/charts/crds/templates/crds.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: l2advertisements.metallb.io spec: group: metallb.io names: kind: L2Advertisement listKind: L2AdvertisementList plural: l2advertisements singular: l2advertisement scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: L2Advertisement allows to advertise the LoadBalancer IPs provided by the selected pools via L2. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: L2AdvertisementSpec defines the desired state of L2Advertisement. properties: interfaces: description: A list of interfaces to announce from. The LB IP will be announced only from these interfaces. If the field is not set, we advertise from all the interfaces on the host. items: type: string type: array ipAddressPoolSelectors: description: A selector for the IPAddressPools which would get advertised via this advertisement. If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array ipAddressPools: description: The list of IPAddressPools to advertise via this advertisement, selected by name. items: type: string type: array nodeSelectors: description: NodeSelectors allows to limit the nodes to announce as next hops for the LoadBalancer IP. When empty, all the nodes having are announced as next hops. items: description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array type: object status: description: L2AdvertisementStatus defines the observed state of L2Advertisement. type: object type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/charts/crds/templates/crds.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.7.0 creationTimestamp: null name: communities.metallb.io spec: group: metallb.io names: kind: Community listKind: CommunityList plural: communities singular: community scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: Community is a collection of aliases for communities. Users can define named aliases to be used in the BGPPeer CRD. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: CommunitySpec defines the desired state of Community. properties: communities: items: properties: name: description: The name of the alias for the community. type: string value: description: The BGP community value corresponding to the given name. type: string type: object type: array type: object status: description: CommunityStatus defines the observed state of Community. type: object type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: metallb:controller labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm rules: - apiGroups: [""] resources: ["services", "namespaces"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["nodes"] verbs: ["list"] - apiGroups: [""] resources: ["services/status"] verbs: ["update"] - apiGroups: [""] resources: ["events"] verbs: ["create", "patch"] - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] resourceNames: ["metallb-webhook-configuration"] verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] verbs: ["list", "watch"] - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] resourceNames: ["addresspools.metallb.io","bfdprofiles.metallb.io","bgpadvertisements.metallb.io", "bgppeers.metallb.io","ipaddresspools.metallb.io","l2advertisements.metallb.io","communities.metallb.io"] verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] verbs: ["list", "watch"] --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: metallb:speaker labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm rules: - apiGroups: [""] resources: ["services", "endpoints", "nodes", "namespaces"] verbs: ["get", "list", "watch"] - apiGroups: ["discovery.k8s.io"] resources: ["endpointslices"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["events"] verbs: ["create", "patch"] --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: metallb:controller labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm subjects: - kind: ServiceAccount name: metallb-controller namespace: metallb-system roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: metallb:controller --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: metallb:speaker labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm subjects: - kind: ServiceAccount name: metallb-speaker namespace: metallb-system roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: metallb:speaker --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: metallb-pod-lister namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm rules: - apiGroups: [""] resources: ["pods"] verbs: ["list"] - apiGroups: [""] resources: ["secrets"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["addresspools"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["bfdprofiles"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["bgppeers"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["l2advertisements"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["bgpadvertisements"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["ipaddresspools"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["communities"] verbs: ["get", "list", "watch"] --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: metallb-controller namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm rules: - apiGroups: [""] resources: ["secrets"] verbs: ["create", "get", "list", "watch"] - apiGroups: [""] resources: ["secrets"] resourceNames: ["metallb-memberlist"] verbs: ["list"] - apiGroups: ["apps"] resources: ["deployments"] resourceNames: ["metallb-controller"] verbs: ["get"] - apiGroups: [""] resources: ["secrets"] verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] - apiGroups: ["metallb.io"] resources: ["addresspools"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["ipaddresspools"] verbs: ["get", "list", "watch"] - apiGroups: ["metallb.io"] resources: ["bgppeers"] verbs: ["get", "list"] - apiGroups: ["metallb.io"] resources: ["bgpadvertisements"] verbs: ["get", "list"] - apiGroups: ["metallb.io"] resources: ["l2advertisements"] verbs: ["get", "list"] - apiGroups: ["metallb.io"] resources: ["communities"] verbs: ["get", "list","watch"] - apiGroups: ["metallb.io"] resources: ["bfdprofiles"] verbs: ["get", "list","watch"] --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: metallb-pod-lister namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: metallb-pod-lister subjects: - kind: ServiceAccount name: metallb-speaker --- # Source: metallb/templates/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: metallb-controller namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: metallb-controller subjects: - kind: ServiceAccount name: metallb-controller --- # Source: metallb/templates/webhooks.yaml apiVersion: v1 kind: Service metadata: name: metallb-webhook-service namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm spec: ports: - port: 443 targetPort: 9443 selector: app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/component: controller --- # Source: metallb/templates/speaker.yaml apiVersion: apps/v1 kind: DaemonSet metadata: name: metallb-speaker namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: speaker spec: updateStrategy: type: RollingUpdate selector: matchLabels: app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/component: speaker template: metadata: labels: app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/component: speaker spec: serviceAccountName: metallb-speaker terminationGracePeriodSeconds: 0 hostNetwork: true volumes: - name: memberlist secret: secretName: metallb-memberlist defaultMode: 420 - name: metallb-excludel2 configMap: defaultMode: 256 name: metallb-excludel2 - name: frr-sockets emptyDir: {} - name: frr-startup configMap: name: metallb-frr-startup - name: frr-conf emptyDir: {} - name: reloader emptyDir: {} - name: metrics emptyDir: {} initContainers: # Copies the initial config files with the right permissions to the shared volume. - name: cp-frr-files image: quay.io/frrouting/frr:8.5.2 securityContext: runAsUser: 100 runAsGroup: 101 command: ["/bin/sh", "-c", "cp -rLf /tmp/frr/* /etc/frr/"] volumeMounts: - name: frr-startup mountPath: /tmp/frr - name: frr-conf mountPath: /etc/frr # Copies the reloader to the shared volume between the speaker and reloader. - name: cp-reloader image: quay.io/metallb/speaker:v0.13.11 command: ["/bin/sh", "-c", "cp -f /frr-reloader.sh /etc/frr_reloader/"] volumeMounts: - name: reloader mountPath: /etc/frr_reloader # Copies the metrics exporter - name: cp-metrics image: quay.io/metallb/speaker:v0.13.11 command: ["/bin/sh", "-c", "cp -f /frr-metrics /etc/frr_metrics/"] volumeMounts: - name: metrics mountPath: /etc/frr_metrics shareProcessNamespace: true containers: - name: speaker image: quay.io/metallb/speaker:v0.13.11 args: - --port=7472 - --log-level=info env: - name: METALLB_NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: METALLB_HOST valueFrom: fieldRef: fieldPath: status.hostIP - name: METALLB_ML_BIND_ADDR valueFrom: fieldRef: fieldPath: status.podIP - name: METALLB_ML_LABELS value: "app.kubernetes.io/name=metallb,app.kubernetes.io/component=speaker" - name: METALLB_ML_BIND_PORT value: "7946" - name: METALLB_ML_SECRET_KEY_PATH value: "/etc/ml_secret_key" - name: FRR_CONFIG_FILE value: /etc/frr_reloader/frr.conf - name: FRR_RELOADER_PID_FILE value: /etc/frr_reloader/reloader.pid - name: METALLB_BGP_TYPE value: frr ports: - name: monitoring containerPort: 7472 - name: memberlist-tcp containerPort: 7946 protocol: TCP - name: memberlist-udp containerPort: 7946 protocol: UDP livenessProbe: httpGet: path: /metrics port: monitoring initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 1 successThreshold: 1 failureThreshold: 3 readinessProbe: httpGet: path: /metrics port: monitoring initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 1 successThreshold: 1 failureThreshold: 3 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL add: - NET_RAW volumeMounts: - name: memberlist mountPath: /etc/ml_secret_key - name: reloader mountPath: /etc/frr_reloader - name: metallb-excludel2 mountPath: /etc/metallb - name: frr securityContext: capabilities: add: - NET_ADMIN - NET_RAW - SYS_ADMIN - NET_BIND_SERVICE image: quay.io/frrouting/frr:8.5.2 env: - name: TINI_SUBREAPER value: "true" volumeMounts: - name: frr-sockets mountPath: /var/run/frr - name: frr-conf mountPath: /etc/frr # The command is FRR's default entrypoint & waiting for the log file to appear and tailing it. # If the log file isn't created in 60 seconds the tail fails and the container is restarted. # This workaround is needed to have the frr logs as part of kubectl logs -c frr < speaker_pod_name >. command: - /bin/sh - -c - | /sbin/tini -- /usr/lib/frr/docker-start & attempts=0 until [[ -f /etc/frr/frr.log || $attempts -eq 60 ]]; do sleep 1 attempts=$(( $attempts + 1 )) done tail -f /etc/frr/frr.log livenessProbe: httpGet: path: /livez port: 7473 initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 1 successThreshold: 1 failureThreshold: 3 startupProbe: httpGet: path: /livez port: 7473 failureThreshold: 30 periodSeconds: 5 - name: reloader image: quay.io/frrouting/frr:8.5.2 command: ["/etc/frr_reloader/frr-reloader.sh"] volumeMounts: - name: frr-sockets mountPath: /var/run/frr - name: frr-conf mountPath: /etc/frr - name: reloader mountPath: /etc/frr_reloader - name: frr-metrics image: quay.io/frrouting/frr:8.5.2 command: ["/etc/frr_metrics/frr-metrics"] args: - --metrics-port=7473 ports: - containerPort: 7473 name: monitoring volumeMounts: - name: frr-sockets mountPath: /var/run/frr - name: frr-conf mountPath: /etc/frr - name: metrics mountPath: /etc/frr_metrics nodeSelector: "kubernetes.io/os": linux tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane effect: NoSchedule operator: Exists --- # Source: metallb/templates/controller.yaml apiVersion: apps/v1 kind: Deployment metadata: name: metallb-controller namespace: "metallb-system" labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller spec: strategy: type: RollingUpdate selector: matchLabels: app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/component: controller template: metadata: labels: app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/component: controller spec: serviceAccountName: metallb-controller terminationGracePeriodSeconds: 0 securityContext: fsGroup: 65534 runAsNonRoot: true runAsUser: 65534 containers: - name: controller image: quay.io/metallb/controller:v0.13.11 args: - --port=7472 - --log-level=info - --cert-service-name=metallb-webhook-service env: - name: METALLB_ML_SECRET_NAME value: metallb-memberlist - name: METALLB_DEPLOYMENT value: metallb-controller - name: METALLB_BGP_TYPE value: frr ports: - name: monitoring containerPort: 7472 - containerPort: 9443 name: webhook-server protocol: TCP volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true livenessProbe: httpGet: path: /metrics port: monitoring initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 1 successThreshold: 1 failureThreshold: 3 readinessProbe: httpGet: path: /metrics port: monitoring initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 1 successThreshold: 1 failureThreshold: 3 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL nodeSelector: "kubernetes.io/os": linux volumes: - name: cert secret: defaultMode: 420 secretName: webhook-server-cert --- # Source: metallb/templates/webhooks.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: metallb-webhook-configuration labels: helm.sh/chart: metallb-0.13.11 app.kubernetes.io/name: metallb app.kubernetes.io/instance: metallb app.kubernetes.io/version: "v0.13.11" app.kubernetes.io/managed-by: Helm webhooks: - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta1-addresspool failurePolicy: Fail name: addresspoolvalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta1 operations: - CREATE - UPDATE resources: - addresspools sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta2-bgppeer failurePolicy: Fail name: bgppeervalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta2 operations: - CREATE - UPDATE resources: - bgppeers sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta1-ipaddresspool failurePolicy: Fail name: ipaddresspoolvalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta1 operations: - CREATE - UPDATE resources: - ipaddresspools sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta1-bgpadvertisement failurePolicy: Fail name: bgpadvertisementvalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta1 operations: - CREATE - UPDATE resources: - bgpadvertisements sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta1-community failurePolicy: Fail name: communityvalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta1 operations: - CREATE - UPDATE resources: - communities sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta1-bfdprofile failurePolicy: Fail name: bfdprofilevalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta1 operations: - CREATE - DELETE resources: - bfdprofiles sideEffects: None - admissionReviewVersions: - v1 clientConfig: service: name: metallb-webhook-service namespace: metallb-system path: /validate-metallb-io-v1beta1-l2advertisement failurePolicy: Fail name: l2advertisementvalidationwebhook.metallb.io rules: - apiGroups: - metallb.io apiVersions: - v1beta1 operations: - CREATE - UPDATE resources: - l2advertisements sideEffects: None