---
layout: null
---
# Canal Version {{site.data.versions[page.version].first.title}}
# https://docs.projectcalico.org/{{page.version}}/releases#{{site.data.versions[page.version].first.title}}
# This manifest includes the following component versions:
#   calico/node:{{site.data.versions[page.version].first.title}}
#   calico/cni:{{site.data.versions[page.version].first.components["calico/cni"].version}}
#   calico/kube-controllers:{{site.data.versions[page.version].first.components["calico/kube-controllers"].version}}
#   coreos/flannel:v0.9.1

# This ConfigMap can be used to configure a self-hosted Canal installation.
kind: ConfigMap
apiVersion: v1
metadata:
  name: canal-config
  namespace: kube-system
data:
  # Configure this with the location of your etcd cluster.
  etcd_endpoints: "https://127.0.0.1:2379"

  # The interface used by canal for host <-> host communication.
  # If left blank, then the interface is chosing using the node's
  # default route.
  canal_iface: ""

  # Whether or not to masquerade traffic to destinations not within
  # the pod network.
  masquerade: "true"

  # The CNI network configuration to install on each node.  The special
  # values in this config will be automatically populated.
  cni_network_config: |-
    {
        "name": "canal",
        "cniVersion": "0.3.0",
        "plugins": [
            {
                "type": "flannel",
                "delegate": {
                    "type": "calico",
                    "etcd_endpoints": "__ETCD_ENDPOINTS__",
                    "etcd_key_file": "__ETCD_KEY_FILE__",
                    "etcd_cert_file": "__ETCD_CERT_FILE__",
                    "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
                    "log_level": "info",
                    "policy": {
                        "type": "k8s",
                        "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
                        "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
                    },
                    "kubernetes": {
                        "kubeconfig": "/etc/cni/net.d/__KUBECONFIG_FILENAME__"
                    }
                }
            },
            {
                "type": "portmap",
                "capabilities": {"portMappings": true},
                "snat": true
            }
        ]
    }

  # If you're using TLS enabled etcd uncomment the following.
  # You must also populate the Secret below with these files.
  etcd_ca: "" # "/calico-secrets/etcd-ca"
  etcd_cert: "" # "/calico-secrets/etcd-cert"
  etcd_key: "" # "/calico-secrets/etcd-key"

---
# The following contains k8s Secrets for use with a TLS enabled etcd cluster.
# For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: calico-etcd-secrets
  namespace: kube-system
data:
  # Populate the following files with etcd TLS configuration if desired, but leave blank if
  # not using TLS for etcd.
  # This self-hosted install expects three files with the following names.  The values
  # should be base64 encoded strings of the entire contents of each file.
  # etcd-key: ""
  # etcd-cert: ""
  # etcd-ca: ""

---

# This manifest installs the per-node agents, as well
# as the CNI plugins and network config on
# each master and worker node in a Kubernetes cluster.
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: canal-node
  namespace: kube-system
  labels:
    k8s-app: canal-node
spec:
  selector:
    matchLabels:
      k8s-app: canal-node
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
      labels:
        k8s-app: canal-node
    spec:
      tolerations:
        # Make sure canal node can be scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Mark the pod as a critical add-on for rescheduling.
        - key: CriticalAddonsOnly
          operator: Exists
        - effect: NoExecute
          operator: Exists
      hostNetwork: true
      serviceAccountName: canal
      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
      terminationGracePeriodSeconds: 0
      containers:
        # Runs the flannel daemon to enable vxlan networking between
        # container hosts.
        - name: flannel
          image: {{page.registry}}{{site.imageNames["flannel"]}}:{{site.data.versions[page.version].first.components["flannel"].version}}
          env:
            # The location of the etcd cluster.
            - name: FLANNELD_ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_endpoints
            # Location of the CA certificate for etcd.
            - name: ETCD_CA_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: ETCD_KEY_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: ETCD_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_cert
            # Location of the CA certificate for etcd.
            - name: FLANNELD_ETCD_CAFILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: FLANNELD_ETCD_KEYFILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: FLANNELD_ETCD_CERTFILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_cert
            # The interface flannel should run on.
            - name: FLANNELD_IFACE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: canal_iface
            # Perform masquerade on traffic leaving the pod cidr.
            - name: FLANNELD_IP_MASQ
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: masquerade
            # Write the subnet.env file to the mounted directory.
            - name: FLANNELD_SUBNET_FILE
              value: "/run/flannel/subnet.env"
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /etc/resolv.conf
              name: resolv
            - mountPath: /run/flannel
              name: run-flannel
            - mountPath: /calico-secrets
              name: etcd-certs
        # Runs calico/node container on each Kubernetes node.  This
        # container programs network policy and local routes on each
        # host.
        - name: calico-node
          image: {{page.registry}}{{site.imageNames["node"]}}:{{site.data.versions[page.version].first.title}}
          env:
            # The location of the etcd cluster.
            - name: ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_endpoints
            # Location of the CA certificate for etcd.
            - name: ETCD_CA_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: ETCD_KEY_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: ETCD_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_cert
            # Disable Calico BGP.  Calico is simply enforcing policy.
            - name: CALICO_NETWORKING_BACKEND
              value: "none"
            # Enable felix logging.
            - name: FELIX_LOGSEVERITYSCREEN
              value: "info"
            # Cluster type to identify the deployment type
            - name: CLUSTER_TYPE
              value: "k8s,canal"
            # Disable file logging so `kubectl logs` works.
            - name: CALICO_DISABLE_FILE_LOGGING
              value: "true"
            # Set noderef for node controller.
            - name: CALICO_K8S_NODE_REF
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: FELIX_HEALTHENABLED
              value: "true"
          securityContext:
            privileged: true
          resources:
            requests:
              cpu: 250m
          livenessProbe:
            httpGet:
              path: /liveness
              port: 9099
            periodSeconds: 10
            initialDelaySeconds: 10
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /readiness
              port: 9099
            periodSeconds: 10
          volumeMounts:
            - mountPath: /lib/modules
              name: lib-modules
              readOnly: true
            - mountPath: /var/run/calico
              name: var-run-calico
              readOnly: false
            - mountPath: /calico-secrets
              name: etcd-certs
        # This container installs the Calico CNI binaries
        # and CNI network config file on each node.
        - name: install-calico-cni
          image: {{page.registry}}{{site.imageNames["cni"]}}:{{site.data.versions[page.version].first.components["calico/cni"].version}}
          imagePullPolicy: Always
          command: ["/install-cni.sh"]
          env:
            # The name of the CNI network config file to install.
            - name: CNI_CONF_NAME
              value: "10-canal.conflist"
            # The location of the etcd cluster.
            - name: ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_endpoints
            # Location of the CA certificate for etcd.
            - name: ETCD_CA_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: ETCD_KEY_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: ETCD_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_cert
            # The CNI network config to install on each node.
            - name: CNI_NETWORK_CONFIG
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: cni_network_config
          volumeMounts:
            - mountPath: /host/opt/cni/bin
              name: cni-bin-dir
            - mountPath: /host/etc/cni/net.d
              name: cni-net-dir
            - mountPath: /calico-secrets
              name: etcd-certs
      volumes:
        # Used by calico/node.
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: var-run-calico
          hostPath:
            path: /var/run/calico
        # Used to install CNI.
        - name: cni-bin-dir
          hostPath:
            path: /opt/cni/bin
        - name: cni-net-dir
          hostPath:
            path: /etc/cni/net.d
        # Used by flannel daemon.
        - name: run-flannel
          hostPath:
            path: /run/flannel
        - name: resolv
          hostPath:
            path: /etc/resolv.conf
        # Mount in the etcd TLS secrets.
        - name: etcd-certs
          secret:
            secretName: calico-etcd-secrets

---

# This manifest deploys a Job which performs one time
# configuration of Canal.
apiVersion: batch/v1
kind: Job
metadata:
  name: configure-canal
  namespace: kube-system
  labels:
    k8s-app: canal
spec:
  template:
    metadata:
      name: configure-canal
    spec:
      hostNetwork: true
      restartPolicy: OnFailure
      containers:
        # Writes basic flannel configuration to etcd.
        - name: configure-flannel
          image: quay.io/coreos/etcd:v3.1.5
          command:
          - "etcdctl"
          - "--cert-file=/calico-secrets/etcd-cert"
          - "--key-file=/calico-secrets/etcd-key"
          - "--ca-file=/calico-secrets/etcd-ca"
          - "--no-sync"
          - "set"
          - "/coreos.com/network/config"
          - '{ "Network": "10.244.0.0/16", "Backend": {"Type": "vxlan"} }'
          env:
            # The location of the etcd cluster.
            - name: ETCDCTL_PEERS
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_endpoints
            # The location of the Calico etcd cluster.
            - name: ETCDCTL_CACERT
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_ca
          volumeMounts:
            # Mount in the etcd TLS secrets.
            - mountPath: /calico-secrets
              name: etcd-certs
      volumes:
        # Mount in the etcd TLS secrets.
        - name: etcd-certs
          secret:
            secretName: calico-etcd-secrets

---

# This manifest deploys the Calico policy controller on Kubernetes.
# See https://github.com/projectcalico/k8s-policy
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: calico-kube-controllers
  namespace: kube-system
  labels:
    k8s-app: calico-kube-controllers
spec:
  # The policy controller can only have a single active instance.
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      name: calico-kube-controllers
      namespace: kube-system
      labels:
        k8s-app: calico-kube-controllers
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      # The policy controller must run in the host network namespace so that
      # it isn't governed by policy that would prevent it from working.
      hostNetwork: true
      tolerations:
        # Make sure canal node can be scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Mark the pod as a critical add-on for rescheduling.
        - key: CriticalAddonsOnly
          operator: Exists
        - effect: NoExecute
          operator: Exists
      containers:
        - name: calico-kube-controllers
          image: {{page.registry}}{{site.imageNames["kubeControllers"]}}:{{site.data.versions[page.version].first.components["calico/kube-controllers"].version}}
          env:
            # The location of the Calico etcd cluster.
            - name: ETCD_ENDPOINTS
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_endpoints
            # Location of the CA certificate for etcd.
            - name: ETCD_CA_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_ca
            # Location of the client key for etcd.
            - name: ETCD_KEY_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_key
            # Location of the client certificate for etcd.
            - name: ETCD_CERT_FILE
              valueFrom:
                configMapKeyRef:
                  name: canal-config
                  key: etcd_cert
            # Choose which controllers to run.
            - name: ENABLED_CONTROLLERS
              value: policy,profile,workloadendpoint,node
          volumeMounts:
            # Mount in the etcd TLS secrets.
            - mountPath: /calico-secrets
              name: etcd-certs
      volumes:
        # Mount in the etcd TLS secrets.
        - name: etcd-certs
          secret:
            secretName: calico-etcd-secrets
---

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: canal
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: canal
subjects:
- kind: ServiceAccount
  name: canal
  namespace: kube-system

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: canal
rules:
  - apiGroups: [""]
    resources:
      - pods
      - nodes
    verbs:
      - get

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: canal
  namespace: kube-system
