kubespray/roles/network_plugin/calico/defaults/main.yml

---
# Enables Internet connectivity from containers
nat_outgoing: true

# Use IP-over-IP encapsulation across hosts
ipip: false

# Set to true if you want your calico cni binaries to overwrite the
# ones from hyperkube while leaving other cni plugins intact.
overwrite_hyperkube_cni: true

calico_cert_dir: /etc/calico/certs
etcd_cert_dir: /etc/ssl/etcd/ssl