richard
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1701 Commits
29 Branches
81 Tags
151 MiB
Tree: c3d5fdff64
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'c3d5fdff64'
${ noResults }
kubespray/roles/kubernetes-apps/policy_controller/meta/main.yml

14 lines
452 B
Raw Normal View History

Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
  1. ---
  2. dependencies:
  3. - role: download
  4. file: "{{ downloads.calico_policy }}"
  5. when: enable_network_policy and
  6. kube_network_plugin in ['calico', 'canal']
  7. tags: [download, canal, policy-controller]
  8. - role: policy_controller/calico
  9. when: kube_network_plugin == 'calico' and
  10. enable_network_policy
  11. tags: policy-controller
  12. - role: policy_controller/calico
  13. when: kube_network_plugin == 'canal'
  14. tags: policy-controller