92 lines
4.2 KiB
Text
92 lines
4.2 KiB
Text
|
# Cilium TaskServ Contracts - Type Definitions
|
||
|
|
# Migrated from: provisioning/extensions/taskservs/networking/cilium/kcl/cilium.k
|
||
|
|
|
||
|
|
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
||
|
|
|
||
|
|
{
|
||
|
|
# Main Cilium CNI configuration
|
||
|
|
Cilium = {
|
||
|
|
name | String,
|
||
|
|
version | String,
|
||
|
|
cluster_name
|
||
|
|
| String
|
||
|
|
| doc "Kubernetes cluster name passed to cilium install --cluster-name"
|
||
|
|
| default = "",
|
||
|
|
cluster_id
|
||
|
|
| Number
|
||
|
|
| doc "Numeric cluster ID used for ClusterMesh identity (0 = disabled)"
|
||
|
|
| default = 0,
|
||
|
|
enable_ingress_controller
|
||
|
|
| Bool
|
||
|
|
| doc "Enable Cilium's built-in L7 Ingress controller"
|
||
|
|
| default = false,
|
||
|
|
ingress_lb_mode
|
||
|
|
| std.enum.TagOrString
|
||
|
|
| doc "LoadBalancer mode for the ingress controller: shared (one LB per cluster) or dedicated (one LB per Ingress)"
|
||
|
|
| default = 'shared,
|
||
|
|
kube_proxy_replacement
|
||
|
|
| Bool
|
||
|
|
| doc "Replace kube-proxy with Cilium eBPF datapath. Requires kubeadm skip_phases = [\"addon/kube-proxy\"]"
|
||
|
|
| default = false,
|
||
|
|
socket_lb
|
||
|
|
| Bool
|
||
|
|
| doc "Enable socket-level load balancing (eBPF hooks at socket layer). Disable if it interferes with host-network connections (e.g. apiserver→etcd gRPC)"
|
||
|
|
| default = true,
|
||
|
|
envoy_enabled
|
||
|
|
| Bool
|
||
|
|
| doc "Deploy cilium-envoy DaemonSet (required for L7 policies and Gateway API). Must be true when enable_gateway_api=true"
|
||
|
|
| default = true,
|
||
|
|
enable_gateway_api
|
||
|
|
| Bool
|
||
|
|
| doc "Enable Kubernetes Gateway API support. Requires envoy_enabled=true and Gateway API CRDs pre-installed. Installs standard-channel CRDs automatically."
|
||
|
|
| default = false,
|
||
|
|
gateway_api_version
|
||
|
|
| String
|
||
|
|
| doc "Gateway API CRDs version to install when enable_gateway_api=true"
|
||
|
|
| default = "v1.2.1",
|
||
|
|
k8s_service_host
|
||
|
|
| String
|
||
|
|
| doc "Control-plane IP for kubeProxyReplacement init. Empty = auto-detect from KUBECONFIG. Required when kube_proxy_replacement=true on kubeadm clusters (workers cannot reach 127.0.0.1:6443)"
|
||
|
|
| default = "",
|
||
|
|
k8s_service_port
|
||
|
|
| Number
|
||
|
|
| doc "Control-plane API port paired with k8s_service_host"
|
||
|
|
| default = 6443,
|
||
|
|
|
||
|
|
public_fip
|
||
|
|
| String
|
||
|
|
| doc "Public IP for the cluster-level Gateway. When set and enable_gateway_api=true, install-cilium.sh creates a CiliumLoadBalancerIPPool and a Gateway named gateway_name in kube-system. For HCCM-managed clusters (wuji), this is the Cilium LB pool IP; for direct FIP clusters (daoshi), this is the Hetzner FIP IP."
|
||
|
|
| optional,
|
||
|
|
gateway_name
|
||
|
|
| String
|
||
|
|
| doc "Name of the cluster-level Gateway resource created when public_fip is set. Defaults to cluster_name."
|
||
|
|
| optional,
|
||
|
|
gateway_sharing_key
|
||
|
|
| String
|
||
|
|
| doc "When set, the cluster-level Gateway is created with lbipam.cilium.io/sharing-key annotation so multiple Gateways can share the same LB IP. Required on HCCM clusters where multiple services share a single FIP."
|
||
|
|
| optional,
|
||
|
|
private_fip
|
||
|
|
| String
|
||
|
|
| doc "Internal/VPN IP for an optional cluster-level private Gateway. When set and enable_gateway_api=true, install-cilium.sh creates a CiliumLoadBalancerIPPool and a Gateway named private_gateway_name in kube-system. Useful for VPN-only services that share an internal LB IP (e.g. Longhorn dashboard, internal Odoo)."
|
||
|
|
| optional,
|
||
|
|
private_gateway_name
|
||
|
|
| String
|
||
|
|
| doc "Name for the private Gateway resource created when private_fip is set. Defaults to 'private-gateway' to match the catalog component convention."
|
||
|
|
| optional,
|
||
|
|
|
||
|
|
enable_l2_announcement
|
||
|
|
| Bool
|
||
|
|
| doc "Enable Cilium L2 Announcements (ARP-based VIP advertisement on L2 segments). Requires enable_l2_neigh_discovery=true. Needed for LB-IPAM VIPs to be reachable from external hosts on the same Hetzner private network segment."
|
||
|
|
| default = false,
|
||
|
|
enable_l2_neigh_discovery
|
||
|
|
| Bool
|
||
|
|
| doc "Enable Cilium L2 neighbor discovery. Prerequisite for enable_l2_announcement. When true, Cilium detects L2 neighbors and can respond to ARP for LB-IPAM VIPs."
|
||
|
|
| default = false,
|
||
|
|
|
||
|
|
# ServiceConcerns umbrella (ADR-008). CNI controller — state in K8s API.
|
||
|
|
concerns | _concerns_lib.ServiceConcerns | optional,
|
||
|
|
|
||
|
|
..
|
||
|
|
},
|
||
|
|
}
|