Refer to the Kubernetes API documentation for the fields of the

Specification of the desired state for the Tigera API server.

Most recently observed status for the Tigera API server.

Refer to the Kubernetes API documentation for the fields of the

Refer to the Kubernetes API documentation for the fields of the

Refer to the Kubernetes API documentation for the fields of the

Refer to the Kubernetes API documentation for the fields of the

Specification of the desired state for the Calico or Calico Enterprise installation.

Most recently observed state for the Calico or Calico Enterprise installation.

Refer to the Kubernetes API documentation for the fields of the

Refer to the Kubernetes API documentation for the fields of the

Refer to the Kubernetes API documentation for the fields of the

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

Spec is the specification of the API server Deployment.

Name is an enum which identifies the API server Deployment container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named API server Deployment container’s resources. If omitted, the API server Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

Name is an enum which identifies the API server Deployment init container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named API server Deployment init container’s resources. If omitted, the API server Deployment will use its default value for this init container’s resources.

InitContainers is a list of API server init containers. If specified, this overrides the specified API server Deployment init containers. If omitted, the API server Deployment will use its default values for its init containers.

Containers is a list of API server containers. If specified, this overrides the specified API server Deployment containers. If omitted, the API server Deployment will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the API server pods. If specified, this overrides any affinity that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for affinity. WARNING: Please note that this field will override the default API server Deployment affinity.

NodeSelector is the API server pod’s scheduling constraints. If specified, each of the key/value pairs are added to the API server Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the API server Deployment and each of this field’s key/value pairs are added to the API server Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the API server Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default API server Deployment nodeSelector.

TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.

Tolerations is the API server pod’s tolerations. If specified, this overrides any tolerations that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default API server Deployment tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the API server Deployment’s PodSpec.

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for minReadySeconds.

Template describes the API server Deployment pod that will be created.

APIServerDeployment configures the calico-apiserver (or tigera-apiserver in Enterprise) Deployment. If used in conjunction with ControlPlaneNodeSelector or ControlPlaneTolerations, then these overrides take precedence.

State provides user-readable status.

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

NativeIP defines if EgressGateway is to use an AWS backed IPPool. Default: Disabled

ElasticIPs defines the set of elastic IPs that can be used for Egress Gateway pods. NativeIP must be Enabled if elastic IPs are set.

StorageClassName will be used to query for an existing StorageClass with the same as the field value. It will also populate the PersistentVolumeClaim.StorageClassName that is used to provision disks for the Anomaly Detection API pod for model storage. If the field is left blank, Anomaly Detection API will be using EmptyDir VolumeSource. The StorageClassName should only be modified when no StorageClass is currently active. We recommend choosing a storage class dedicated to AnomalyDetection only. Otherwise, model retention cannot be guaranteed during upgrades. See https://docs.tigera.io/maintenance/upgrading for up-to-date instructions. This field is not used for managed clusters in a Multi-cluster management setup.

WebApplicationFirewall controls whether or not ModSecurity enforcement is enabled for the cluster. When enabled, Services may opt-in to having ingress traffic examed by ModSecurity.

Specification for application layer (L7) log collection.

Application Layer Policy controls whether or not ALP enforcement is enabled for the cluster. When enabled, NetworkPolicies with HTTP Match rules may be defined to opt-in workloads for traffic enforcement on the application layer.

User-configurable settings for the Envoy proxy.

State provides user-readable status.

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Default: Info

Default: 100Mi

Default: 30 (days)

Default: 10

Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. For KubernetesProvider GKE, this field defaults to GKE. For KubernetesProvider AKS, this field defaults to AzureVNET. For KubernetesProvider EKS, this field defaults to AmazonVPC. If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico.

For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.

Default: Calico

IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation.

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

Spec is the specification of the csi-node-driver DaemonSet.

Name is an enum which identifies the csi-node-driver DaemonSet container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named csi-node-driver DaemonSet container’s resources. If omitted, the csi-node-driver DaemonSet will use its default value for this container’s resources.

Containers is a list of csi-node-driver containers. If specified, this overrides the specified csi-node-driver DaemonSet containers. If omitted, the csi-node-driver DaemonSet will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the csi-node-driver pods. If specified, this overrides any affinity that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default csi-node-driver DaemonSet affinity.

NodeSelector is the csi-node-driver pod’s scheduling constraints. If specified, each of the key/value pairs are added to the csi-node-driver DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the csi-node-driver DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default csi-node-driver DaemonSet nodeSelector.

Tolerations is the csi-node-driver pod’s tolerations. If specified, this overrides any tolerations that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default csi-node-driver DaemonSet tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the csi-node-driver DaemonSet’s PodSpec.

MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for minReadySeconds.

Template describes the csi-node-driver DaemonSet pod that will be created.

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

Spec is the specification of the calico-kube-controllers Deployment.

Name is an enum which identifies the calico-kube-controllers Deployment container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-kube-controllers Deployment container’s resources. If omitted, the calico-kube-controllers Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

Containers is a list of calico-kube-controllers containers. If specified, this overrides the specified calico-kube-controllers Deployment containers. If omitted, the calico-kube-controllers Deployment will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the calico-kube-controllers pods. If specified, this overrides any affinity that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for affinity. WARNING: Please note that this field will override the default calico-kube-controllers Deployment affinity.

NodeSelector is the calico-kube-controllers pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the calico-kube-controllers Deployment and each of this field’s key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-kube-controllers Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-kube-controllers Deployment nodeSelector.

Tolerations is the calico-kube-controllers pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-kube-controllers Deployment tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the calico-kube-controllers Deployment’s PodSpec.

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for minReadySeconds.

Template describes the calico-kube-controllers Deployment pod that will be created.

LinuxDataplane is used to select the dataplane used for Linux nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, iptables mode is used. Default: Iptables

BGP configures whether or not to enable Calico’s BGP capabilities.

IPPools contains a list of IP pools to create if none exist. At most one IP pool of each address family may be specified. If omitted, a single pool will be configured if needed.

MTU specifies the maximum transmission unit to use on the pod network. If not specified, Calico will perform MTU auto-detection based on the cluster network.

NodeAddressAutodetectionV4 specifies an approach to automatically detect node IPv4 addresses. If not specified, will use default auto-detection settings to acquire an IPv4 address for each node.

NodeAddressAutodetectionV6 specifies an approach to automatically detect node IPv6 addresses. If not specified, IPv6 addresses will not be auto-detected.

HostPorts configures whether or not Calico will support Kubernetes HostPorts. Valid only when using the Calico CNI plugin. Default: Enabled

MultiInterfaceMode configures what will configure multiple interface per pod. Only valid for Calico Enterprise installations using the Calico CNI plugin. Default: None

ContainerIPForwarding configures whether ip forwarding will be enabled for containers in the CNI configuration. Default: Disabled

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

Spec is the specification of the calico-node DaemonSet.

Name is an enum which identifies the calico-node DaemonSet container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet container’s resources. If omitted, the calico-node DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

Name is an enum which identifies the calico-node DaemonSet init container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet init container’s resources. If omitted, the calico-node DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

InitContainers is a list of calico-node init containers. If specified, this overrides the specified calico-node DaemonSet init containers. If omitted, the calico-node DaemonSet will use its default values for its init containers.

Containers is a list of calico-node containers. If specified, this overrides the specified calico-node DaemonSet containers. If omitted, the calico-node DaemonSet will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the calico-node pods. If specified, this overrides any affinity that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node DaemonSet affinity.

NodeSelector is the calico-node pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-node DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-node DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node DaemonSet nodeSelector.

Tolerations is the calico-node pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node DaemonSet tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the calico-node DaemonSet’s PodSpec.

MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for minReadySeconds.

Template describes the calico-node DaemonSet pod that will be created.

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

Spec is the specification of the calico-windows-upgrade DaemonSet.

Name is an enum which identifies the calico-windows-upgrade DaemonSet container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-windows-upgrade DaemonSet container’s resources. If omitted, the calico-windows-upgrade DaemonSet will use its default value for this container’s resources.

Containers is a list of calico-windows-upgrade containers. If specified, this overrides the specified calico-windows-upgrade DaemonSet containers. If omitted, the calico-windows-upgrade DaemonSet will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the calico-windows-upgrade pods. If specified, this overrides any affinity that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet affinity.

NodeSelector is the calico-windows-upgrade pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-windows-upgrade DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-windows-upgrade DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-windows-upgrade DaemonSet nodeSelector.

Tolerations is the calico-windows-upgrade pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the calico-windows-upgrade DaemonSet’s PodSpec.

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for minReadySeconds.

Template describes the calico-windows-upgrade DaemonSet pod that will be created.

Certificate of the authority that signs the CertificateSigningRequests in PEM format.

When a CSR is issued to the certificates.k8s.io API, the signerName is added to the request in order to accommodate for clusters with multiple signers. Must be formatted as: <my-domain>/<my-signername>.

Specify the algorithm used by pods to generate a key pair that is associated with the X.509 certificate request. Default: RSAWithSize2048

Specify the algorithm used for the signature of the X.509 certificate request. Default: SHA256WithRSA

ComponentName is an enum which identifies the component

ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

Name is an enum which identifies the EGW Deployment container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment container’s resources. If omitted, the EGW Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

Name is an enum which identifies the EGW Deployment init container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment init container’s resources. If omitted, the EGW Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

InitContainers is a list of EGW init containers. If specified, this overrides the specified EGW Deployment init containers. If omitted, the EGW Deployment will use its default values for its init containers.

Containers is a list of EGW containers. If specified, this overrides the specified EGW Deployment containers. If omitted, the EGW Deployment will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the EGW pods.

NodeSelector gives more control over the nodes where the Egress Gateway pods will run on.

TerminationGracePeriodSeconds defines the termination grace period of the Egress Gateway pods in seconds.

TopologySpreadConstraints defines how the Egress Gateway pods should be spread across different AZs.

Tolerations is the egress gateway pod’s tolerations. If specified, this overrides any tolerations that may be set on the EGW Deployment. If omitted, the EGW Deployment will use its default value for tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the EGW Deployment’s PodSpec.

HealthTimeoutDataStoreSeconds defines how long Egress Gateway can fail to connect to the datastore before reporting not ready. This value must be greater than 0. Default: 90

ICMPProbe define outgoing ICMP probes that Egress Gateway will use to verify its upstream connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval.

HTTPProbe define outgoing HTTP probes that Egress Gateway will use to verify its upsteam connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval.

Name is the name of the IPPool that the Egress Gateways can use.

CIDR is the IPPool CIDR that the Egress Gateways can use.

Labels is a map of string keys and values that may match replica set and service selectors. Each of these key/value pairs are added to the object’s labels provided the key does not already exist in the object’s labels. If not specified will default to projectcalico.org/egw:[name], where [name] is the name of the Egress Gateway resource.

Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object’s annotations provided the key does not already exist in the object’s annotations.

Replicas defines how many instances of the Egress Gateway pod will run.

IPPools defines the IP Pools that the Egress Gateway pods should be using. Either name or CIDR must be specified. IPPools must match existing IPPools.

ExternalNetworks defines the external network names this Egress Gateway is associated with. ExternalNetworks must match existing external networks.

LogSeverity defines the logging level of the Egress Gateway. Default: Info

Template describes the EGW Deployment pod that will be created.

EgressGatewayFailureDetection is used to configure how Egress Gateway determines readiness. If both ICMP, HTTP probes are defined, one ICMP probe and one HTTP probe should succeed for Egress Gateways to become ready. Otherwise one of ICMP or HTTP probe should succeed for Egress gateways to become ready if configured.

AWS defines the additional configuration options for Egress Gateways on AWS.

State provides user-readable status.

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

The number of additional ingress proxy hops from the right side of the x-forwarded-for HTTP header to trust when determining the origin client’s IP address. 0 is permitted, but >=1 is the typical setting.

If set to true, the Envoy connection manager will use the real remote address of the client connection when determining internal versus external origin and manipulating various headers.

URLs define the list of HTTP probe URLs. Egress Gateway will probe each URL periodically.If all probes fail, Egress Gateway will report non-ready.

IntervalSeconds defines the interval of HTTP probes. Used when URLs is non-empty. Default: 10

TimeoutSeconds defines the timeout value of HTTP probes. Used when URLs is non-empty. Default: 30

IPs define the list of ICMP probe IPs. Egress Gateway will probe each IP periodically. If all probes fail, Egress Gateway will report non-ready.

IntervalSeconds defines the interval of ICMP probes. Used when IPs is non-empty. Default: 5

TimeoutSeconds defines the timeout value of ICMP probes. Used when IPs is non-empty. Default: 15

Specifies the IPAM plugin that will be used in the Calico or Calico Enterprise installation. For CNI Plugin Calico, this field defaults to Calico. For CNI Plugin GKE, this field defaults to HostLocal. For CNI Plugin AzureVNET, this field defaults to AzureVNET. For CNI Plugin AmazonVPC, this field defaults to AmazonVPC.

The IPAM plugin is installed and configured only if the CNI plugin is set to Calico, for all other values of the CNI plugin the plugin binaries and CNI config is a dependency that is expected to be installed separately.

Default: Calico

CIDR contains the address range for the IP Pool in classless inter-domain routing format.

Encapsulation specifies the encapsulation type that will be used with the IP Pool. Default: IPIP

NATOutgoing specifies if NAT will be enabled or disabled for outgoing traffic. Default: Enabled

NodeSelector specifies the node selector that will be set for the IP Pool. Default: ‘all()’

BlockSize specifies the CIDR prefex length to use when allocating per-node IP blocks from the main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)

DisableBGPExport specifies whether routes from this IP pool’s CIDR are exported over BGP. Default: false

Image is an image that the operator deploys and instead of using the built in tag the operator will use the Digest for the image identifier. The value should be the image name without registry or tag or digest. For the image docker.io/calico/node:v3.17.1 it should be represented as calico/node

Digest is the image identifier that will be used for the Image. The field should not include a leading @ and must be prefixed with sha256:.

Images is the list of images to use digests. All images that the operator will deploy must be specified.

Variant is the product to install - one of Calico or TigeraSecureEnterprise Default: Calico

Registry is the default Docker registry used for component Docker images. If specified then the given value must end with a slash character (/) and all images will be pulled from this registry. If not specified then the default registries will be used. A special case value, UseDefault, is supported to explicitly specify the default registries will be used.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <registry> portion of the above format.

ImagePath allows for the path part of an image to be specified. If specified then the specified value will be used as the image path for each image. If not specified or empty, the default for each image will be used. A special case value, UseDefault, is supported to explicitly specify the default image path will be used for each image.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <imagePath> portion of the above format.

ImagePrefix allows for the prefix part of an image to be specified. If specified then the given value will be used as a prefix on each image. If not specified or empty, no prefix will be used. A special case value, UseDefault, is supported to explicitly specify the default image prefix will be used for each image.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <imagePrefix> portion of the above format.

ImagePullSecrets is an array of references to container registry pull secrets to use. These are applied to all images to be pulled.

KubernetesProvider specifies a particular provider of the Kubernetes platform and enables provider-specific configuration. If the specified value is empty, the Operator will attempt to automatically determine the current provider. If the specified value is not empty, the Operator will still attempt auto-detection, but will additionally compare the auto-detected value to the specified value to confirm they match.

CNI specifies the CNI that will be used by this installation.

CalicoNetwork specifies networking configuration options for Calico.

Deprecated. Please use Installation.Spec.TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods.

ControlPlaneNodeSelector is used to select control plane nodes on which to run Calico components. This is globally applied to all resources created by the operator excluding daemonsets.

ControlPlaneTolerations specify tolerations which are then globally applied to all resources created by the operator.

ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed. This field applies to all control plane components that support High Availability. Defaults to 2.

NodeMetricsPort specifies which port calico/node serves prometheus metrics on. By default, metrics are not enabled. If specified, this overrides any FelixConfiguration resources which may exist. If omitted, then prometheus metrics may still be configured through FelixConfiguration.

TyphaMetricsPort specifies which port calico/typha serves prometheus metrics on. By default, metrics are not enabled.

FlexVolumePath optionally specifies a custom path for FlexVolume. If not specified, FlexVolume will be enabled by default. If set to ‘None’, FlexVolume will be disabled. The default is based on the kubernetesProvider.

KubeletVolumePluginPath optionally specifies enablement of Calico CSI plugin. If not specified, CSI will be enabled by default. If set to ‘None’, CSI will be disabled. Default: /var/lib/kubelet

NodeUpdateStrategy can be used to customize the desired update strategy, such as the MaxUnavailable field.

Deprecated. Please use CalicoNodeDaemonSet, TyphaDeployment, and KubeControllersDeployment. ComponentResources can be used to customize the resource requirements for each component. Node, Typha, and KubeControllers are supported for installations.

CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization.

NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible.

CalicoNodeDaemonSet configures the calico-node DaemonSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

CSINodeDriverDaemonSet configures the csi-node-driver DaemonSet.

CalicoKubeControllersDeployment configures the calico-kube-controllers Deployment. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

TyphaDeployment configures the typha Deployment. If used in conjunction with the deprecated ComponentResources or TyphaAffinity, then these overrides take precedence.

CalicoWindowsUpgradeDaemonSet configures the calico-windows-upgrade DaemonSet.

FIPSMode uses images and features only that are using FIPS 140-2 validated cryptographic modules and standards. Default: Disabled

Logging Configuration for Components

Variant is the most recently observed installed variant - one of Calico or TigeraSecureEnterprise

MTU is the most recently observed value for pod network MTU. This may be an explicitly configured value, or based on Calico’s native auto-detetion.

ImageSet is the name of the ImageSet being used, if there is an ImageSet that is being used. If an ImageSet is not being used then this will not be set.

Computed is the final installation including overlaid resources.

CalicoVersion shows the current running version of calico. CalicoVersion along with Variant is needed to know the exact version deployed.

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

This setting enables or disable log collection. Allowed values are Enabled or Disabled.

Interval in seconds for sending L7 log information for processing. Default: 5 sec

Maximum number of unique L7 logs that are sent LogIntervalSeconds. Adjust this to limit the number of L7 logs sent per LogIntervalSeconds to felix for further processing, use negative number to ignore limits. Default: -1

Customized logging specification for calico-cni plugin

Labels is a map of string keys and values that may match replicaset and service selectors. Each of these key/value pairs are added to the object’s labels provided the key does not already exist in the object’s labels.

Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object’s annotations provided the key does not already exist in the object’s annotations.

State provides user-readable status.

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

FirstFound uses default interface matching parameters to select an interface, performing best-effort filtering based on well-known interface names.

Kubernetes configures Calico to detect node addresses based on the Kubernetes API.

Interface enables IP auto-detection based on interfaces that match the given regex.

SkipInterface enables IP auto-detection based on interfaces that do not match the given regex.

CanReach enables IP auto-detection based on which source address on the node is used to reach the specified IP or domain.

CIDRS enables IP auto-detection based on which addresses on the nodes are within one of the provided CIDRs.

The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions.

WARNING: Please note that if the affinity requirements specified by this field are not met at scheduling time, the pod will NOT be scheduled onto the node. There is no fallback to another affinity rules with this setting. This may cause networking disruption or even catastrophic failure! PreferredDuringSchedulingIgnoredDuringExecution should be used for affinity unless there is a specific well understood reason to use RequiredDuringSchedulingIgnoredDuringExecution and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution will always have sufficient nodes to satisfy the requirement. NOTE: RequiredDuringSchedulingIgnoredDuringExecution is set by default for AKS nodes, to avoid scheduling Typhas on virtual-nodes. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

State provides user-readable status.

SecretName indicates the name of the secret in the tigera-operator namespace that contains the private key and certificate that the management cluster uses when it listens for incoming connections.

When set to tigera-management-cluster-connection voltron will use the same cert bundle which Guardian client certs are signed with.

When set to manager-tls, voltron will use the same cert bundle which Manager UI is served with. This cert bundle must be a publicly signed cert created by the user. Note that Tigera Operator will generate a self-signed manager-tls cert if one does not exist, and use of that cert will result in Guardian being unable to verify Voltron’s identity.

If changed on a running cluster with connected managed clusters, all managed clusters will disconnect as they will no longer be able to verify Voltron’s identity. To reconnect existing managed clusters, change the tls.ca of the managed clusters’ ManagementClusterConnection resource.

One of: tigera-management-cluster-connection, manager-tls

Default: tigera-management-cluster-connection

The type of condition. May be Available, Progressing, or Degraded.

The status of the condition. May be True, False, or Unknown.

The timestamp representing the start time for the current status.

A brief reason explaining the condition.

Optionally, a detailed message providing additional context.

observedGeneration represents the generation that the condition was set based upon. For instance, if generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

Conditions represents the latest observed set of conditions for this component. A component may be one or more of Available, Progressing, or Degraded.

NodeAffinity describes node affinity scheduling rules for typha.

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

Spec is the specification of the typha Deployment.

Name is an enum which identifies the typha Deployment container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment container’s resources. If omitted, the typha Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

Name is an enum which identifies the typha Deployment init container by name.

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment init container’s resources. If omitted, the typha Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

InitContainers is a list of typha init containers. If specified, this overrides the specified typha Deployment init containers. If omitted, the typha Deployment will use its default values for its init containers.

Containers is a list of typha containers. If specified, this overrides the specified typha Deployment containers. If omitted, the typha Deployment will use its default values for its containers.

Affinity is a group of affinity scheduling rules for the typha pods. If specified, this overrides any affinity that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for affinity. If used in conjunction with the deprecated TyphaAffinity, then this value takes precedence. WARNING: Please note that this field will override the default calico-typha Deployment affinity.

NodeSelector is the calico-typha pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-typha Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-typha Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-typha Deployment nodeSelector.

Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.

TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.

Tolerations is the typha pod’s tolerations. If specified, this overrides any tolerations that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-typha Deployment tolerations.

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

Spec is the typha Deployment’s PodSpec.

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for minReadySeconds.

Template describes the typha Deployment pod that will be created.

The deployment strategy to use to replace existing pods with new ones.

Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. to be.