Skip to main content
Calico Enterprise 3.19 (latest) documentation

Installation reference

The Kubernetes resources below configure Calico Enterprise installation when using the operator. Each resource is responsible for installing and configuring a different subsystem of Calico Enterprise during installation. Most options can be modified on a running cluster using kubectl.

Packages:

operator.tigera.io/v1

API Schema definitions for configuring the installation of Calico and Calico Enterprise

Resource Types:

APIServer

APIServer installs the Tigera API server and related resources. At most one instance of this resource is supported. It must be named “default” or “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
APIServer
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
APIServerSpec

Specification of the desired state for the Tigera API server.



apiServerDeployment
APIServerDeployment

APIServerDeployment configures the calico-apiserver (or tigera-apiserver in Enterprise) Deployment. If used in conjunction with ControlPlaneNodeSelector or ControlPlaneTolerations, then these overrides take precedence.

status
APIServerStatus

Most recently observed status for the Tigera API server.

ApplicationLayer

ApplicationLayer is the Schema for the applicationlayers API

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
ApplicationLayer
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
ApplicationLayerSpec


webApplicationFirewall
WAFStatusType

WebApplicationFirewall controls whether or not ModSecurity enforcement is enabled for the cluster. When enabled, Services may opt-in to having ingress traffic examed by ModSecurity.

logCollection
LogCollectionSpec

Specification for application layer (L7) log collection.

applicationLayerPolicy
ApplicationLayerPolicyStatusType

Application Layer Policy controls whether or not ALP enforcement is enabled for the cluster. When enabled, NetworkPolicies with HTTP Match rules may be defined to opt-in workloads for traffic enforcement on the application layer.

envoy
EnvoySettings

User-configurable settings for the Envoy proxy.

l7LogCollectorDaemonSet
L7LogCollectorDaemonSet
(Optional)

L7LogCollectorDaemonSet configures the L7LogCollector DaemonSet.

status
ApplicationLayerStatus

Authentication

Authentication is the Schema for the authentications API

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
Authentication
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
AuthenticationSpec


managerDomain
string

ManagerDomain is the domain name of the Manager

usernamePrefix
string
(Optional)

If specified, UsernamePrefix is prepended to each user obtained from the identity provider. Note that Kibana does not support a user prefix, so this prefix is removed from Kubernetes User when translating log access ClusterRoleBindings into Elastic.

groupsPrefix
string
(Optional)

If specified, GroupsPrefix is prepended to each group obtained from the identity provider. Note that Kibana does not support a groups prefix, so this prefix is removed from Kubernetes Groups when translating log access ClusterRoleBindings into Elastic.

oidc
AuthenticationOIDC
(Optional)

OIDC contains the configuration needed to setup OIDC authentication.

openshift
AuthenticationOpenshift
(Optional)

Openshift contains the configuration needed to setup Openshift OAuth authentication.

ldap
AuthenticationLDAP
(Optional)

LDAP contains the configuration needed to setup LDAP authentication.

dexDeployment
DexDeployment
(Optional)

DexDeployment configures the Dex Deployment.

status
AuthenticationStatus

Compliance

Compliance installs the components required for Tigera compliance reporting. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
Compliance
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
ComplianceSpec

Specification of the desired state for Tigera compliance reporting.



complianceControllerDeployment
ComplianceControllerDeployment
(Optional)

ComplianceControllerDeployment configures the Compliance Controller Deployment.

complianceSnapshotterDeployment
ComplianceSnapshotterDeployment
(Optional)

ComplianceSnapshotterDeployment configures the Compliance Snapshotter Deployment.

complianceBenchmarkerDaemonSet
ComplianceBenchmarkerDaemonSet
(Optional)

ComplianceBenchmarkerDaemonSet configures the Compliance Benchmarker DaemonSet.

complianceServerDeployment
ComplianceServerDeployment
(Optional)

ComplianceServerDeployment configures the Compliance Server Deployment.

complianceReporterPodTemplate
ComplianceReporterPodTemplate
(Optional)

ComplianceReporterPodTemplate configures the Compliance Reporter PodTemplate.

status
ComplianceStatus

Most recently observed state for Tigera compliance reporting.

EgressGateway

EgressGateway is the Schema for the egressgateways API

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
EgressGateway
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
EgressGatewaySpec


replicas
int32
(Optional)

Replicas defines how many instances of the Egress Gateway pod will run.

ipPools
[]EgressGatewayIPPool

IPPools defines the IP Pools that the Egress Gateway pods should be using. Either name or CIDR must be specified. IPPools must match existing IPPools.

externalNetworks
[]string
(Optional)

ExternalNetworks defines the external network names this Egress Gateway is associated with. ExternalNetworks must match existing external networks.

logSeverity
LogLevel
(Optional)

LogSeverity defines the logging level of the Egress Gateway. Default: Info

template
EgressGatewayDeploymentPodTemplateSpec
(Optional)

Template describes the EGW Deployment pod that will be created.

egressGatewayFailureDetection
EgressGatewayFailureDetection
(Optional)

EgressGatewayFailureDetection is used to configure how Egress Gateway determines readiness. If both ICMP, HTTP probes are defined, one ICMP probe and one HTTP probe should succeed for Egress Gateways to become ready. Otherwise one of ICMP or HTTP probe should succeed for Egress gateways to become ready if configured.

aws
AWSEgressGateway
(Optional)

AWS defines the additional configuration options for Egress Gateways on AWS.

status
EgressGatewayStatus

ImageSet

ImageSet is used to specify image digests for the images that the operator deploys. The name of the ImageSet is expected to be in the format <variant>-<release>. The variant used is enterprise if the InstallationSpec Variant isTigeraSecureEnterprise otherwise it is calico. The release must match the version of the variant that the operator is built to deploy, this version can be obtained by passing the --version flag to the operator binary.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
ImageSet
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
ImageSetSpec


images
[]Image

Images is the list of images to use digests. All images that the operator will deploy must be specified.

Installation

Installation configures an installation of Calico or Calico Enterprise. At most one instance of this resource is supported. It must be named “default”. The Installation API installs core networking and network policy components, and provides general install-time configuration.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
Installation
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
InstallationSpec

Specification of the desired state for the Calico or Calico Enterprise installation.



variant
ProductVariant
(Optional)

Variant is the product to install - one of Calico or TigeraSecureEnterprise Default: Calico

registry
string
(Optional)

Registry is the default Docker registry used for component Docker images. If specified then the given value must end with a slash character (/) and all images will be pulled from this registry. If not specified then the default registries will be used. A special case value, UseDefault, is supported to explicitly specify the default registries will be used.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <registry> portion of the above format.

imagePath
string
(Optional)

ImagePath allows for the path part of an image to be specified. If specified then the specified value will be used as the image path for each image. If not specified or empty, the default for each image will be used. A special case value, UseDefault, is supported to explicitly specify the default image path will be used for each image.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <imagePath> portion of the above format.

imagePrefix
string
(Optional)

ImagePrefix allows for the prefix part of an image to be specified. If specified then the given value will be used as a prefix on each image. If not specified or empty, no prefix will be used. A special case value, UseDefault, is supported to explicitly specify the default image prefix will be used for each image.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <imagePrefix> portion of the above format.

imagePullSecrets
[]Kubernetes core/v1.LocalObjectReference
(Optional)

ImagePullSecrets is an array of references to container registry pull secrets to use. These are applied to all images to be pulled.

kubernetesProvider
Provider
(Optional)

KubernetesProvider specifies a particular provider of the Kubernetes platform and enables provider-specific configuration. If the specified value is empty, the Operator will attempt to automatically determine the current provider. If the specified value is not empty, the Operator will still attempt auto-detection, but will additionally compare the auto-detected value to the specified value to confirm they match.

cni
CNISpec
(Optional)

CNI specifies the CNI that will be used by this installation.

calicoNetwork
CalicoNetworkSpec
(Optional)

CalicoNetwork specifies networking configuration options for Calico.

typhaAffinity
TyphaAffinity
(Optional)

Deprecated. Please use Installation.Spec.TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods.

controlPlaneNodeSelector
map[string]string
(Optional)

ControlPlaneNodeSelector is used to select control plane nodes on which to run Calico components. This is globally applied to all resources created by the operator excluding daemonsets.

controlPlaneTolerations
[]Kubernetes core/v1.Toleration
(Optional)

ControlPlaneTolerations specify tolerations which are then globally applied to all resources created by the operator.

controlPlaneReplicas
int32
(Optional)

ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed. This field applies to all control plane components that support High Availability. Defaults to 2.

nodeMetricsPort
int32
(Optional)

NodeMetricsPort specifies which port calico/node serves prometheus metrics on. By default, metrics are not enabled. If specified, this overrides any FelixConfiguration resources which may exist. If omitted, then prometheus metrics may still be configured through FelixConfiguration.

typhaMetricsPort
int32
(Optional)

TyphaMetricsPort specifies which port calico/typha serves prometheus metrics on. By default, metrics are not enabled.

flexVolumePath
string
(Optional)

FlexVolumePath optionally specifies a custom path for FlexVolume. If not specified, FlexVolume will be enabled by default. If set to ‘None’, FlexVolume will be disabled. The default is based on the kubernetesProvider.

kubeletVolumePluginPath
string
(Optional)

KubeletVolumePluginPath optionally specifies enablement of Calico CSI plugin. If not specified, CSI will be enabled by default. If set to ‘None’, CSI will be disabled. Default: /var/lib/kubelet

nodeUpdateStrategy
Kubernetes apps/v1.DaemonSetUpdateStrategy
(Optional)

NodeUpdateStrategy can be used to customize the desired update strategy, such as the MaxUnavailable field.

componentResources
[]ComponentResource
(Optional)

Deprecated. Please use CalicoNodeDaemonSet, TyphaDeployment, and KubeControllersDeployment. ComponentResources can be used to customize the resource requirements for each component. Node, Typha, and KubeControllers are supported for installations.

certificateManagement
CertificateManagement
(Optional)

CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization.

nonPrivileged
NonPrivilegedType
(Optional)

NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible.

calicoNodeDaemonSet
CalicoNodeDaemonSet

CalicoNodeDaemonSet configures the calico-node DaemonSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

csiNodeDriverDaemonSet
CSINodeDriverDaemonSet

CSINodeDriverDaemonSet configures the csi-node-driver DaemonSet.

calicoKubeControllersDeployment
CalicoKubeControllersDeployment

CalicoKubeControllersDeployment configures the calico-kube-controllers Deployment. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

typhaDeployment
TyphaDeployment

TyphaDeployment configures the typha Deployment. If used in conjunction with the deprecated ComponentResources or TyphaAffinity, then these overrides take precedence.

calicoWindowsUpgradeDaemonSet
CalicoWindowsUpgradeDaemonSet

Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet configures the calico-windows-upgrade DaemonSet.

calicoNodeWindowsDaemonSet
CalicoNodeWindowsDaemonSet

CalicoNodeWindowsDaemonSet configures the calico-node-windows DaemonSet.

fipsMode
FIPSMode
(Optional)

FIPSMode uses images and features only that are using FIPS 140-2 validated cryptographic modules and standards. Default: Disabled

logging
Logging
(Optional)

Logging Configuration for Components

windowsNodes
WindowsNodeSpec
(Optional)

Windows Configuration

serviceCIDRs
[]string
(Optional)

Kubernetes Service CIDRs. Specifying this is required when using Calico for Windows.

status
InstallationStatus

Most recently observed state for the Calico or Calico Enterprise installation.

IntrusionDetection

IntrusionDetection installs the components required for Tigera intrusion detection. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
IntrusionDetection
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
IntrusionDetectionSpec

Specification of the desired state for Tigera intrusion detection.



componentResources
[]IntrusionDetectionComponentResource
(Optional)

ComponentResources can be used to customize the resource requirements for each component. Only DeepPacketInspection is supported for this spec.

anomalyDetection
AnomalyDetectionSpec
(Optional)

AnomalyDetection is now deprecated, and configuring it has no effect.

intrusionDetectionControllerDeployment
IntrusionDetectionControllerDeployment
(Optional)

IntrusionDetectionControllerDeployment configures the IntrusionDetection Controller Deployment.

status
IntrusionDetectionStatus

Most recently observed state for Tigera intrusion detection.

LogCollector

LogCollector installs the components required for Tigera flow and DNS log collection. At most one instance of this resource is supported. It must be named “tigera-secure”. When created, this installs fluentd on all nodes configured to collect Tigera log data and export it to Tigera’s Elasticsearch cluster as well as any additionally configured destinations.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
LogCollector
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
LogCollectorSpec

Specification of the desired state for Tigera log collection.



additionalStores
AdditionalLogStoreSpec
(Optional)

Configuration for exporting flow, audit, and DNS logs to external storage.

additionalSources
AdditionalLogSourceSpec
(Optional)

Configuration for importing audit logs from managed kubernetes cluster log sources.

collectProcessPath
CollectProcessPathOption
(Optional)

Configuration for enabling/disabling process path collection in flowlogs. If Enabled, this feature sets hostPID to true in order to read process cmdline. Default: Enabled

multiTenantManagementClusterNamespace
string
(Optional)

If running as a multi-tenant management cluster, the namespace in which the management cluster’s tenant services are running.

fluentdDaemonSet
FluentdDaemonSet

FluentdDaemonSet configures the Fluentd DaemonSet.

eksLogForwarderDeployment
EKSLogForwarderDeployment
(Optional)

EKSLogForwarderDeployment configures the EKSLogForwarderDeployment Deployment.

status
LogCollectorStatus

Most recently observed state for Tigera log collection.

LogStorage

LogStorage installs the components required for Tigera flow and DNS log storage. At most one instance of this resource is supported. It must be named “tigera-secure”. When created, this installs an Elasticsearch cluster for use by Calico Enterprise.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
LogStorage
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
LogStorageSpec

Specification of the desired state for Tigera log storage.



nodes
Nodes

Nodes defines the configuration for a set of identical Elasticsearch cluster nodes, each of type master, data, and ingest.

indices
Indices
(Optional)

Index defines the configuration for the indices in the Elasticsearch cluster.

retention
Retention
(Optional)

Retention defines how long data is retained in the Elasticsearch cluster before it is cleared.

storageClassName
string
(Optional)

StorageClassName will populate the PersistentVolumeClaim.StorageClassName that is used to provision disks to the Tigera Elasticsearch cluster. The StorageClassName should only be modified when no LogStorage is currently active. We recommend choosing a storage class dedicated to Tigera LogStorage only. Otherwise, data retention cannot be guaranteed during upgrades. See https://docs.tigera.io/maintenance/upgrading for up-to-date instructions. Default: tigera-elasticsearch

dataNodeSelector
map[string]string
(Optional)

DataNodeSelector gives you more control over the node that Elasticsearch will run on. The contents of DataNodeSelector will be added to the PodSpec of the Elasticsearch nodes. For the pod to be eligible to run on a node, the node must have each of the indicated key-value pairs as labels as well as access to the specified StorageClassName.

componentResources
[]LogStorageComponentResource
(Optional)

ComponentResources can be used to customize the resource requirements for each component. Only ECKOperator is supported for this spec.

eckOperatorStatefulSet
ECKOperatorStatefulSet
(Optional)

ECKOperatorStatefulSet configures the ECKOperator StatefulSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

kibana
Kibana
(Optional)

Kibana configures the Kibana Spec.

linseedDeployment
LinseedDeployment

LinseedDeployment configures the linseed Deployment.

elasticsearchMetricsDeployment
ElasticsearchMetricsDeployment

ElasticsearchMetricsDeployment configures the tigera-elasticsearch-metric Deployment.

status
LogStorageStatus

Most recently observed state for Tigera log storage.

ManagementCluster

The presence of ManagementCluster in your cluster, will configure it to be the management plane to which managed clusters can connect. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
ManagementCluster
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
ManagementClusterSpec


address
string
(Optional)

This field specifies the externally reachable address to which your managed cluster will connect. When a managed cluster is added, this field is used to populate an easy-to-apply manifest that will connect both clusters. Valid examples are: “0.0.0.0:31000”, “example.com:32000”, “[::1]:32500”

tls
TLS
(Optional)

TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster.

ManagementClusterConnection

ManagementClusterConnection represents a link between a managed cluster and a management cluster. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
ManagementClusterConnection
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
ManagementClusterConnectionSpec


managementClusterAddr
string
(Optional)

Specify where the managed cluster can reach the management cluster. Ex.: “10.128.0.10:30449”. A managed cluster should be able to access this address. This field is used by managed clusters only.

tls
ManagementClusterTLS
(Optional)

TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster.

guardianDeployment
GuardianDeployment

GuardianDeployment configures the guardian Deployment.

status
ManagementClusterConnectionStatus

Manager

Manager installs the Calico Enterprise manager graphical user interface. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
Manager
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
ManagerSpec

Specification of the desired state for the Calico Enterprise manager.



managerDeployment
ManagerDeployment
(Optional)

ManagerDeployment configures the Manager Deployment.

status
ManagerStatus

Most recently observed state for the Calico Enterprise manager.

Monitor

Monitor is the Schema for the monitor API. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
Monitor
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
MonitorSpec


externalPrometheus
ExternalPrometheus

ExternalPrometheus optionally configures integration with an external Prometheus for scraping Calico metrics. When specified, the operator will render resources in the defined namespace. This option can be useful for configuring scraping from git-ops tools without the need of post-installation steps.

prometheus
Prometheus
(Optional)

Prometheus is the configuration for the Prometheus.

alertManager
AlertManager
(Optional)

AlertManager is the configuration for the AlertManager.

status
MonitorStatus

PacketCaptureAPI

PacketCaptureAPI is used to configure the resource requirement for PacketCaptureAPI deployment. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
PacketCaptureAPI
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
PacketCaptureAPISpec

Specification of the desired state for the PacketCaptureAPI.



packetCaptureAPIDeployment
PacketCaptureAPIDeployment
(Optional)

PacketCaptureAPIDeployment configures the PacketCaptureAPI Deployment.

status
PacketCaptureAPIStatus

Most recently observed state for the PacketCaptureAPI.

PolicyRecommendation

PolicyRecommendation is the Schema for the policy recommendation API. At most one instance of this resource is supported. It must be named “tigera-secure”.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
PolicyRecommendation
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
PolicyRecommendationSpec


policyRecommendationDeployment
PolicyRecommendationDeployment
(Optional)

PolicyRecommendation configures the PolicyRecommendation Deployment.

status
PolicyRecommendationStatus

TLSPassThroughRoute

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
TLSPassThroughRoute
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
TLSPassThroughRouteSpec

Dest is the destination URL



target
TargetType
sniMatch
SNIMatch

SNIMatch is used to match requests based on the server name for the intended destination server. Matching requests will be proxied to the Destination.

destination
string

Destination is the destination url to proxy the request to.

TLSTerminatedRoute

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
TLSTerminatedRoute
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
TLSTerminatedRouteSpec


target
TargetType
pathMatch
PathMatch

PathMatch is used to match requests based on what’s in the path. Matching requests will be proxied to the Destination defined in this structure.

destination
string

Destination is the destination URL where matching traffic is routed to.

caBundle
Kubernetes core/v1.ConfigMapKeySelector

CABundle is where we read the CA bundle from to authenticate the destination (if non-empty)

mtlsCert
Kubernetes core/v1.SecretKeySelector
(Optional)

ForwardingMTLSCert is the certificate used for mTLS between voltron and the destination. Either both ForwardingMTLSCert and ForwardingMTLSKey must be specified, or neither can be specified.

mtlsKey
Kubernetes core/v1.SecretKeySelector
(Optional)

ForwardingMTLSKey is the key used for mTLS between voltron and the destination. Either both ForwardingMTLSCert and ForwardingMTLSKey must be specified, or neither can be specified.

unauthenticated
bool
(Optional)

Unauthenticated says whether the request should go through authentication. This is only applicable if the Target is UI.

Tenant

Tenant is the Schema for the tenants API

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
Tenant
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
TenantSpec


id
string

ID is the unique identifier for this tenant.

name
string

Name is a human readable name for this tenant.

indices
[]Index

Indices defines the how to store a tenant’s data

elastic
TenantElasticSpec

Elastic configures per-tenant ElasticSearch and Kibana parameters. This field is required for clusters using external ES.

controlPlaneReplicas
int32
(Optional)

ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed in the Tenant’s namespace. Defaults to the controlPlaneReplicas in Installation CR

linseedDeployment
LinseedDeployment

LinseedDeployment configures the linseed Deployment.

dashboardsJob
DashboardsJob

DashboardsJob configures the Dashboards job

status
TenantStatus

TigeraStatus

TigeraStatus represents the most recently observed status for Calico or a Calico Enterprise functional area.

FieldDescription
apiVersion
string
operator.tigera.io/v1
kind
string
TigeraStatus
metadata
Kubernetes meta/v1.ObjectMeta

Refer to the Kubernetes API documentation for the fields of the

metadata field.
spec
TigeraStatusSpec


status
TigeraStatusStatus

APIServerDeployment

(Appears on:

APIServerSpec)

APIServerDeployment is the configuration for the API server Deployment.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
APIServerDeploymentSpec
(Optional)

Spec is the specification of the API server Deployment.



APIServerDeploymentContainer

(Appears on:

APIServerDeploymentPodSpec)

APIServerDeploymentContainer is an API server Deployment container.

FieldDescription
name
string

Name is an enum which identifies the API server Deployment container by name. Supported values are: calico-apiserver, tigera-queryserver

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named API server Deployment container’s resources. If omitted, the API server Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

APIServerDeploymentInitContainer

(Appears on:

APIServerDeploymentPodSpec)

APIServerDeploymentInitContainer is an API server Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the API server Deployment init container by name. Supported values are: calico-apiserver-certs-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named API server Deployment init container’s resources. If omitted, the API server Deployment will use its default value for this init container’s resources.

APIServerDeploymentPodSpec

(Appears on:

APIServerDeploymentPodTemplateSpec)

APIServerDeploymentDeploymentPodSpec is the API server Deployment’s PodSpec.

FieldDescription
initContainers
[]APIServerDeploymentInitContainer
(Optional)

InitContainers is a list of API server init containers. If specified, this overrides the specified API server Deployment init containers. If omitted, the API server Deployment will use its default values for its init containers.

containers
[]APIServerDeploymentContainer
(Optional)

Containers is a list of API server containers. If specified, this overrides the specified API server Deployment containers. If omitted, the API server Deployment will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the API server pods. If specified, this overrides any affinity that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for affinity. WARNING: Please note that this field will override the default API server Deployment affinity.

nodeSelector
map[string]string

NodeSelector is the API server pod’s scheduling constraints. If specified, each of the key/value pairs are added to the API server Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the API server Deployment and each of this field’s key/value pairs are added to the API server Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the API server Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default API server Deployment nodeSelector.

topologySpreadConstraints
[]Kubernetes core/v1.TopologySpreadConstraint
(Optional)

TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the API server pod’s tolerations. If specified, this overrides any tolerations that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default API server Deployment tolerations.

APIServerDeploymentPodTemplateSpec

(Appears on:

APIServerDeploymentSpec)

APIServerDeploymentPodTemplateSpec is the API server Deployment’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
APIServerDeploymentPodSpec
(Optional)

Spec is the API server Deployment’s PodSpec.



APIServerDeploymentSpec

(Appears on:

APIServerDeployment)

APIServerDeploymentSpec defines configuration for the API server Deployment.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for minReadySeconds.

template
APIServerDeploymentPodTemplateSpec
(Optional)

Template describes the API server Deployment pod that will be created.

APIServerSpec

(Appears on:

APIServer)

APIServerSpec defines the desired state of Tigera API server.

FieldDescription
apiServerDeployment
APIServerDeployment

APIServerDeployment configures the calico-apiserver (or tigera-apiserver in Enterprise) Deployment. If used in conjunction with ControlPlaneNodeSelector or ControlPlaneTolerations, then these overrides take precedence.

APIServerStatus

(Appears on:

APIServer)

APIServerStatus defines the observed state of Tigera API server.

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

AWSEgressGateway

(Appears on:

EgressGatewaySpec)

AWSEgressGateway defines the configurations for deploying EgressGateway in AWS

FieldDescription
nativeIP
NativeIP
(Optional)

NativeIP defines if EgressGateway is to use an AWS backed IPPool. Default: Disabled

elasticIPs
[]string
(Optional)

ElasticIPs defines the set of elastic IPs that can be used for Egress Gateway pods. NativeIP must be Enabled if elastic IPs are set.

AdditionalLogSourceSpec

(Appears on:

LogCollectorSpec)

FieldDescription
eksCloudwatchLog
EksCloudwatchLogsSpec
(Optional)

If specified with EKS Provider in Installation, enables fetching EKS audit logs.

AdditionalLogStoreSpec

(Appears on:

LogCollectorSpec)

FieldDescription
s3
S3StoreSpec
(Optional)

If specified, enables exporting of flow, audit, and DNS logs to Amazon S3 storage.

syslog
SyslogStoreSpec
(Optional)

If specified, enables exporting of flow, audit, and DNS logs to syslog.

splunk
SplunkStoreSpec
(Optional)

If specified, enables exporting of flow, audit, and DNS logs to splunk.

AlertManager

(Appears on:

MonitorSpec)

FieldDescription
spec
AlertManagerSpec
(Optional)

Spec is the specification of the Alertmanager.



AlertManagerSpec

(Appears on:

AlertManager)

FieldDescription
resources
Kubernetes core/v1.ResourceRequirements

Define resources requests and limits for single Pods.

AnomalyDetectionSpec

(Appears on:

IntrusionDetectionSpec)

FieldDescription
storageClassName
string
(Optional)

StorageClassName is now deprecated, and configuring it has no effect.

ApplicationLayerPolicyStatusType (string alias)

(Appears on:

ApplicationLayerSpec)

ApplicationLayerSpec

(Appears on:

ApplicationLayer)

ApplicationLayerSpec defines the desired state of ApplicationLayer

FieldDescription
webApplicationFirewall
WAFStatusType

WebApplicationFirewall controls whether or not ModSecurity enforcement is enabled for the cluster. When enabled, Services may opt-in to having ingress traffic examed by ModSecurity.

logCollection
LogCollectionSpec

Specification for application layer (L7) log collection.

applicationLayerPolicy
ApplicationLayerPolicyStatusType

Application Layer Policy controls whether or not ALP enforcement is enabled for the cluster. When enabled, NetworkPolicies with HTTP Match rules may be defined to opt-in workloads for traffic enforcement on the application layer.

envoy
EnvoySettings

User-configurable settings for the Envoy proxy.

l7LogCollectorDaemonSet
L7LogCollectorDaemonSet
(Optional)

L7LogCollectorDaemonSet configures the L7LogCollector DaemonSet.

ApplicationLayerStatus

(Appears on:

ApplicationLayer)

ApplicationLayerStatus defines the observed state of ApplicationLayer

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

AuthMethod (string alias)

AuthenticationLDAP

(Appears on:

AuthenticationSpec)

AuthenticationLDAP is the configuration needed to setup LDAP.

FieldDescription
host
string

The host and port of the LDAP server. Example: ad.example.com:636

startTLS
bool
(Optional)

StartTLS whether to enable the startTLS feature for establishing TLS on an existing LDAP session. If true, the ldap:// protocol is used and then issues a StartTLS command, otherwise, connections will use the ldaps:// protocol.

userSearch
UserSearch

User entry search configuration to match the credentials with a user.

groupSearch
GroupSearch
(Optional)

Group search configuration to find the groups that a user is in.

AuthenticationOIDC

(Appears on:

AuthenticationSpec)

AuthenticationOIDC is the configuration needed to setup OIDC.

FieldDescription
issuerURL
string

IssuerURL is the URL to the OIDC provider.

usernameClaim
string

UsernameClaim specifies which claim to use from the OIDC provider as the username.

requestedScopes
[]string
(Optional)

RequestedScopes is a list of scopes to request from the OIDC provider. If not provided, the following scopes are requested: [“openid”, “email”, “profile”, “groups”, “offline_access”].

usernamePrefix
string
(Optional)

Deprecated. Please use Authentication.Spec.UsernamePrefix instead.

groupsClaim
string
(Optional)

GroupsClaim specifies which claim to use from the OIDC provider as the group.

groupsPrefix
string
(Optional)

Deprecated. Please use Authentication.Spec.GroupsPrefix instead.

emailVerification
EmailVerificationType
(Optional)

Some providers do not include the claim “email_verified” when there is no verification in the user enrollment process or if they are acting as a proxy for another identity provider. By default those tokens are deemed invalid. To skip this check, set the value to “InsecureSkip”. Default: Verify

promptTypes
[]PromptType
(Optional)

PromptTypes is an optional list of string values that specifies whether the identity provider prompts the end user for re-authentication and consent. See the RFC for more information on prompt types:https://openid.net/specs/openid-connect-core-1_0.html. Default: “Consent”

type
OIDCType
(Optional)

Default: “Dex”

AuthenticationOpenshift

(Appears on:

AuthenticationSpec)

AuthenticationOpenshift is the configuration needed to setup Openshift.

FieldDescription
issuerURL
string

IssuerURL is the URL to the Openshift OAuth provider. Ex.: https://api.my-ocp-domain.com:6443

AuthenticationSpec

(Appears on:

Authentication)

AuthenticationSpec defines the desired state of Authentication

FieldDescription
managerDomain
string

ManagerDomain is the domain name of the Manager

usernamePrefix
string
(Optional)

If specified, UsernamePrefix is prepended to each user obtained from the identity provider. Note that Kibana does not support a user prefix, so this prefix is removed from Kubernetes User when translating log access ClusterRoleBindings into Elastic.

groupsPrefix
string
(Optional)

If specified, GroupsPrefix is prepended to each group obtained from the identity provider. Note that Kibana does not support a groups prefix, so this prefix is removed from Kubernetes Groups when translating log access ClusterRoleBindings into Elastic.

oidc
AuthenticationOIDC
(Optional)

OIDC contains the configuration needed to setup OIDC authentication.

openshift
AuthenticationOpenshift
(Optional)

Openshift contains the configuration needed to setup Openshift OAuth authentication.

ldap
AuthenticationLDAP
(Optional)

LDAP contains the configuration needed to setup LDAP authentication.

dexDeployment
DexDeployment
(Optional)

DexDeployment configures the Dex Deployment.

AuthenticationStatus

(Appears on:

Authentication)

AuthenticationStatus defines the observed state of Authentication

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

BGPOption (string alias)

(Appears on:

CalicoNetworkSpec)

BGPOption describes the mode of BGP to use.

One of: Enabled, Disabled

CAType (string alias)

(Appears on:

ManagementClusterTLS)

CAType specifies which verification method the tunnel client should use to verify the tunnel server’s identity.

One of: Tigera, Public

CNILogging

(Appears on:

Logging)

FieldDescription
logSeverity
LogLevel
(Optional)

Default: Info

logFileMaxSize
k8s.io/apimachinery/pkg/api/resource.Quantity
(Optional)

Default: 100Mi

logFileMaxAgeDays
uint32
(Optional)

Default: 30 (days)

logFileMaxCount
uint32
(Optional)

Default: 10

CNIPluginType (string alias)

(Appears on:

CNISpec)

CNIPluginType describes the type of CNI plugin used.

One of: Calico, GKE, AmazonVPC, AzureVNET

CNISpec

(Appears on:

InstallationSpec)

CNISpec contains configuration for the CNI plugin.

FieldDescription
type
CNIPluginType

Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico.

For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.

Default: Calico

ipam
IPAMSpec
(Optional)

IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation.

CSINodeDriverDaemonSet

(Appears on:

InstallationSpec)

CSINodeDriverDaemonSet is the configuration for the csi-node-driver DaemonSet.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

spec
CSINodeDriverDaemonSetSpec
(Optional)

Spec is the specification of the csi-node-driver DaemonSet.



CSINodeDriverDaemonSetContainer

(Appears on:

CSINodeDriverDaemonSetPodSpec)

CSINodeDriverDaemonSetContainer is a csi-node-driver DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the csi-node-driver DaemonSet container by name. Supported values are: calico-csi, csi-node-driver-registrar.

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named csi-node-driver DaemonSet container’s resources. If omitted, the csi-node-driver DaemonSet will use its default value for this container’s resources.

CSINodeDriverDaemonSetPodSpec

(Appears on:

CSINodeDriverDaemonSetPodTemplateSpec)

CSINodeDriverDaemonSetPodSpec is the csi-node-driver DaemonSet’s PodSpec.

FieldDescription
containers
[]CSINodeDriverDaemonSetContainer
(Optional)

Containers is a list of csi-node-driver containers. If specified, this overrides the specified csi-node-driver DaemonSet containers. If omitted, the csi-node-driver DaemonSet will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the csi-node-driver pods. If specified, this overrides any affinity that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default csi-node-driver DaemonSet affinity.

nodeSelector
map[string]string
(Optional)

NodeSelector is the csi-node-driver pod’s scheduling constraints. If specified, each of the key/value pairs are added to the csi-node-driver DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the csi-node-driver DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default csi-node-driver DaemonSet nodeSelector.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the csi-node-driver pod’s tolerations. If specified, this overrides any tolerations that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default csi-node-driver DaemonSet tolerations.

CSINodeDriverDaemonSetPodTemplateSpec

(Appears on:

CSINodeDriverDaemonSetSpec)

CSINodeDriverDaemonSetPodTemplateSpec is the csi-node-driver DaemonSet’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CSINodeDriverDaemonSetPodSpec
(Optional)

Spec is the csi-node-driver DaemonSet’s PodSpec.



CSINodeDriverDaemonSetSpec

(Appears on:

CSINodeDriverDaemonSet)

CSINodeDriverDaemonSetSpec defines configuration for the csi-node-driver DaemonSet.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for minReadySeconds.

template
CSINodeDriverDaemonSetPodTemplateSpec
(Optional)

Template describes the csi-node-driver DaemonSet pod that will be created.

CalicoKubeControllersDeployment

(Appears on:

InstallationSpec)

CalicoKubeControllersDeployment is the configuration for the calico-kube-controllers Deployment.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
CalicoKubeControllersDeploymentSpec
(Optional)

Spec is the specification of the calico-kube-controllers Deployment.



CalicoKubeControllersDeploymentContainer

(Appears on:

CalicoKubeControllersDeploymentPodSpec)

CalicoKubeControllersDeploymentContainer is a calico-kube-controllers Deployment container.

FieldDescription
name
string

Name is an enum which identifies the calico-kube-controllers Deployment container by name. Supported values are: calico-kube-controllers

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-kube-controllers Deployment container’s resources. If omitted, the calico-kube-controllers Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoKubeControllersDeploymentPodSpec

(Appears on:

CalicoKubeControllersDeploymentPodTemplateSpec)

CalicoKubeControllersDeploymentPodSpec is the calico-kube-controller Deployment’s PodSpec.

FieldDescription
containers
[]CalicoKubeControllersDeploymentContainer
(Optional)

Containers is a list of calico-kube-controllers containers. If specified, this overrides the specified calico-kube-controllers Deployment containers. If omitted, the calico-kube-controllers Deployment will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the calico-kube-controllers pods. If specified, this overrides any affinity that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for affinity. WARNING: Please note that this field will override the default calico-kube-controllers Deployment affinity.

nodeSelector
map[string]string

NodeSelector is the calico-kube-controllers pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the calico-kube-controllers Deployment and each of this field’s key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-kube-controllers Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-kube-controllers Deployment nodeSelector.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the calico-kube-controllers pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-kube-controllers Deployment tolerations.

CalicoKubeControllersDeploymentPodTemplateSpec

(Appears on:

CalicoKubeControllersDeploymentSpec)

CalicoKubeControllersDeploymentPodTemplateSpec is the calico-kube-controllers Deployment’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoKubeControllersDeploymentPodSpec
(Optional)

Spec is the calico-kube-controllers Deployment’s PodSpec.



CalicoKubeControllersDeploymentSpec

(Appears on:

CalicoKubeControllersDeployment)

CalicoKubeControllersDeploymentSpec defines configuration for the calico-kube-controllers Deployment.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for minReadySeconds.

template
CalicoKubeControllersDeploymentPodTemplateSpec
(Optional)

Template describes the calico-kube-controllers Deployment pod that will be created.

CalicoNetworkSpec

(Appears on:

InstallationSpec)

CalicoNetworkSpec specifies configuration options for Calico provided pod networking.

FieldDescription
linuxDataplane
LinuxDataplaneOption
(Optional)

LinuxDataplane is used to select the dataplane used for Linux nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, iptables mode is used. Default: Iptables

windowsDataplane
WindowsDataplaneOption
(Optional)

WindowsDataplane is used to select the dataplane used for Windows nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, it is disabled and the operator will not render the Calico Windows nodes daemonset. Default: Disabled

bgp
BGPOption
(Optional)

BGP configures whether or not to enable Calico’s BGP capabilities.

ipPools
[]IPPool
(Optional)

IPPools contains a list of IP pools to create if none exist. At most one IP pool of each address family may be specified. If omitted, a single pool will be configured if needed.

mtu
int32
(Optional)

MTU specifies the maximum transmission unit to use on the pod network. If not specified, Calico will perform MTU auto-detection based on the cluster network.

nodeAddressAutodetectionV4
NodeAddressAutodetection
(Optional)

NodeAddressAutodetectionV4 specifies an approach to automatically detect node IPv4 addresses. If not specified, will use default auto-detection settings to acquire an IPv4 address for each node.

nodeAddressAutodetectionV6
NodeAddressAutodetection
(Optional)

NodeAddressAutodetectionV6 specifies an approach to automatically detect node IPv6 addresses. If not specified, IPv6 addresses will not be auto-detected.

hostPorts
HostPortsType
(Optional)

HostPorts configures whether or not Calico will support Kubernetes HostPorts. Valid only when using the Calico CNI plugin. Default: Enabled

multiInterfaceMode
MultiInterfaceMode
(Optional)

MultiInterfaceMode configures what will configure multiple interface per pod. Only valid for Calico Enterprise installations using the Calico CNI plugin. Default: None

containerIPForwarding
ContainerIPForwardingType
(Optional)

ContainerIPForwarding configures whether ip forwarding will be enabled for containers in the CNI configuration. Default: Disabled

sysctl
[]Sysctl
(Optional)

Sysctl configures sysctl parameters for tuning plugin

linuxPolicySetupTimeoutSeconds
int32
(Optional)

LinuxPolicySetupTimeoutSeconds delays new pods from running containers until their policy has been programmed in the dataplane. The specified delay defines the maximum amount of time that the Calico CNI plugin will wait for policy to be programmed.

Only applies to pods created on Linux nodes.

  • A value of 0 disables pod startup delays.

Default: 0

CalicoNodeDaemonSet

(Appears on:

InstallationSpec)

CalicoNodeDaemonSet is the configuration for the calico-node DaemonSet.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

spec
CalicoNodeDaemonSetSpec
(Optional)

Spec is the specification of the calico-node DaemonSet.



CalicoNodeDaemonSetContainer

(Appears on:

CalicoNodeDaemonSetPodSpec)

CalicoNodeDaemonSetContainer is a calico-node DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the calico-node DaemonSet container by name. Supported values are: calico-node

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet container’s resources. If omitted, the calico-node DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeDaemonSetInitContainer

(Appears on:

CalicoNodeDaemonSetPodSpec)

CalicoNodeDaemonSetInitContainer is a calico-node DaemonSet init container.

FieldDescription
name
string

Name is an enum which identifies the calico-node DaemonSet init container by name. Supported values are: install-cni, hostpath-init, flexvol-driver, mount-bpffs, node-certs-key-cert-provisioner, calico-node-prometheus-server-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet init container’s resources. If omitted, the calico-node DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeDaemonSetPodSpec

(Appears on:

CalicoNodeDaemonSetPodTemplateSpec)

CalicoNodeDaemonSetPodSpec is the calico-node DaemonSet’s PodSpec.

FieldDescription
initContainers
[]CalicoNodeDaemonSetInitContainer
(Optional)

InitContainers is a list of calico-node init containers. If specified, this overrides the specified calico-node DaemonSet init containers. If omitted, the calico-node DaemonSet will use its default values for its init containers.

containers
[]CalicoNodeDaemonSetContainer
(Optional)

Containers is a list of calico-node containers. If specified, this overrides the specified calico-node DaemonSet containers. If omitted, the calico-node DaemonSet will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the calico-node pods. If specified, this overrides any affinity that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node DaemonSet affinity.

nodeSelector
map[string]string
(Optional)

NodeSelector is the calico-node pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-node DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-node DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node DaemonSet nodeSelector.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the calico-node pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node DaemonSet tolerations.

CalicoNodeDaemonSetPodTemplateSpec

(Appears on:

CalicoNodeDaemonSetSpec)

CalicoNodeDaemonSetPodTemplateSpec is the calico-node DaemonSet’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoNodeDaemonSetPodSpec
(Optional)

Spec is the calico-node DaemonSet’s PodSpec.



CalicoNodeDaemonSetSpec

(Appears on:

CalicoNodeDaemonSet)

CalicoNodeDaemonSetSpec defines configuration for the calico-node DaemonSet.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for minReadySeconds.

template
CalicoNodeDaemonSetPodTemplateSpec
(Optional)

Template describes the calico-node DaemonSet pod that will be created.

CalicoNodeWindowsDaemonSet

(Appears on:

InstallationSpec)

CalicoNodeWindowsDaemonSet is the configuration for the calico-node-windows DaemonSet.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

spec
CalicoNodeWindowsDaemonSetSpec
(Optional)

Spec is the specification of the calico-node-windows DaemonSet.



CalicoNodeWindowsDaemonSetContainer

(Appears on:

CalicoNodeWindowsDaemonSetPodSpec)

CalicoNodeWindowsDaemonSetContainer is a calico-node-windows DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the calico-node-windows DaemonSet container by name. Supported values are: calico-node-windows

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node-windows DaemonSet container’s resources. If omitted, the calico-node-windows DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeWindowsDaemonSetInitContainer

(Appears on:

CalicoNodeWindowsDaemonSetPodSpec)

CalicoNodeWindowsDaemonSetInitContainer is a calico-node-windows DaemonSet init container.

FieldDescription
name
string

Name is an enum which identifies the calico-node-windows DaemonSet init container by name. Supported values are: install-cni;hostpath-init, flexvol-driver, mount-bpffs, node-certs-key-cert-provisioner, calico-node-windows-prometheus-server-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node-windows DaemonSet init container’s resources. If omitted, the calico-node-windows DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeWindowsDaemonSetPodSpec

(Appears on:

CalicoNodeWindowsDaemonSetPodTemplateSpec)

CalicoNodeWindowsDaemonSetPodSpec is the calico-node-windows DaemonSet’s PodSpec.

FieldDescription
initContainers
[]CalicoNodeWindowsDaemonSetInitContainer
(Optional)

InitContainers is a list of calico-node-windows init containers. If specified, this overrides the specified calico-node-windows DaemonSet init containers. If omitted, the calico-node-windows DaemonSet will use its default values for its init containers.

containers
[]CalicoNodeWindowsDaemonSetContainer
(Optional)

Containers is a list of calico-node-windows containers. If specified, this overrides the specified calico-node-windows DaemonSet containers. If omitted, the calico-node-windows DaemonSet will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the calico-node-windows pods. If specified, this overrides any affinity that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node-windows DaemonSet affinity.

nodeSelector
map[string]string
(Optional)

NodeSelector is the calico-node-windows pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-node-windows DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-node-windows DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node-windows DaemonSet nodeSelector.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the calico-node-windows pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node-windows DaemonSet tolerations.

CalicoNodeWindowsDaemonSetPodTemplateSpec

(Appears on:

CalicoNodeWindowsDaemonSetSpec)

CalicoNodeWindowsDaemonSetPodTemplateSpec is the calico-node-windows DaemonSet’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoNodeWindowsDaemonSetPodSpec
(Optional)

Spec is the calico-node-windows DaemonSet’s PodSpec.



CalicoNodeWindowsDaemonSetSpec

(Appears on:

CalicoNodeWindowsDaemonSet)

CalicoNodeWindowsDaemonSetSpec defines configuration for the calico-node-windows DaemonSet.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for minReadySeconds.

template
CalicoNodeWindowsDaemonSetPodTemplateSpec
(Optional)

Template describes the calico-node-windows DaemonSet pod that will be created.

CalicoWindowsUpgradeDaemonSet

(Appears on:

InstallationSpec)

Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet is the configuration for the calico-windows-upgrade DaemonSet.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
CalicoWindowsUpgradeDaemonSetSpec
(Optional)

Spec is the specification of the calico-windows-upgrade DaemonSet.



CalicoWindowsUpgradeDaemonSetContainer

(Appears on:

CalicoWindowsUpgradeDaemonSetPodSpec)

CalicoWindowsUpgradeDaemonSetContainer is a calico-windows-upgrade DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the calico-windows-upgrade DaemonSet container by name.

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-windows-upgrade DaemonSet container’s resources. If omitted, the calico-windows-upgrade DaemonSet will use its default value for this container’s resources.

CalicoWindowsUpgradeDaemonSetPodSpec

(Appears on:

CalicoWindowsUpgradeDaemonSetPodTemplateSpec)

CalicoWindowsUpgradeDaemonSetPodSpec is the calico-windows-upgrade DaemonSet’s PodSpec.

FieldDescription
containers
[]CalicoWindowsUpgradeDaemonSetContainer
(Optional)

Containers is a list of calico-windows-upgrade containers. If specified, this overrides the specified calico-windows-upgrade DaemonSet containers. If omitted, the calico-windows-upgrade DaemonSet will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the calico-windows-upgrade pods. If specified, this overrides any affinity that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet affinity.

nodeSelector
map[string]string
(Optional)

NodeSelector is the calico-windows-upgrade pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-windows-upgrade DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-windows-upgrade DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-windows-upgrade DaemonSet nodeSelector.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the calico-windows-upgrade pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet tolerations.

CalicoWindowsUpgradeDaemonSetPodTemplateSpec

(Appears on:

CalicoWindowsUpgradeDaemonSetSpec)

CalicoWindowsUpgradeDaemonSetPodTemplateSpec is the calico-windows-upgrade DaemonSet’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoWindowsUpgradeDaemonSetPodSpec
(Optional)

Spec is the calico-windows-upgrade DaemonSet’s PodSpec.



CalicoWindowsUpgradeDaemonSetSpec

(Appears on:

CalicoWindowsUpgradeDaemonSet)

CalicoWindowsUpgradeDaemonSetSpec defines configuration for the calico-windows-upgrade DaemonSet.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for minReadySeconds.

template
CalicoWindowsUpgradeDaemonSetPodTemplateSpec
(Optional)

Template describes the calico-windows-upgrade DaemonSet pod that will be created.

CertificateManagement

(Appears on:

InstallationSpec)

CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization.

FieldDescription
caCert
[]byte

Certificate of the authority that signs the CertificateSigningRequests in PEM format.

signerName
string

When a CSR is issued to the certificates.k8s.io API, the signerName is added to the request in order to accommodate for clusters with multiple signers. Must be formatted as: <my-domain>/<my-signername>.

keyAlgorithm
string
(Optional)

Specify the algorithm used by pods to generate a key pair that is associated with the X.509 certificate request. Default: RSAWithSize2048

signatureAlgorithm
string
(Optional)

Specify the algorithm used for the signature of the X.509 certificate request. Default: SHA256WithRSA

CollectProcessPathOption (string alias)

(Appears on:

LogCollectorSpec)

CommonPrometheusFields

(Appears on:

PrometheusSpec)

FieldDescription
containers
[]PrometheusContainer
(Optional)

Containers is a list of Prometheus containers. If specified, this overrides the specified Prometheus Deployment containers. If omitted, the Prometheus Deployment will use its default values for its containers.

resources
Kubernetes core/v1.ResourceRequirements

Define resources requests and limits for single Pods.

ComplianceBenchmarkerDaemonSet

(Appears on:

ComplianceSpec)

ComplianceBenchmarkerDaemonSet is the configuration for the Compliance Benchmarker DaemonSet.

FieldDescription
spec
ComplianceBenchmarkerDaemonSetSpec
(Optional)

Spec is the specification of the Compliance Benchmarker DaemonSet.



ComplianceBenchmarkerDaemonSetContainer

(Appears on:

ComplianceBenchmarkerDaemonSetPodSpec)

ComplianceBenchmarkerDaemonSetContainer is a Compliance Benchmarker DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the Compliance Benchmarker DaemonSet container by name. Supported values are: compliance-benchmarker

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Compliance Benchmarker DaemonSet container’s resources. If omitted, the Compliance Benchmarker DaemonSet will use its default value for this container’s resources.

ComplianceBenchmarkerDaemonSetInitContainer

(Appears on:

ComplianceBenchmarkerDaemonSetPodSpec)

ComplianceBenchmarkerDaemonSetInitContainer is a Compliance Benchmarker DaemonSet init container.

FieldDescription
name
string

Name is an enum which identifies the Compliance Benchmarker DaemonSet init container by name. Supported values are: tigera-compliance-benchmarker-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Compliance Benchmarker DaemonSet init container’s resources. If omitted, the Compliance Benchmarker DaemonSet will use its default value for this init container’s resources.

ComplianceBenchmarkerDaemonSetPodSpec

(Appears on:

ComplianceBenchmarkerDaemonSetPodTemplateSpec)

ComplianceBenchmarkerDaemonSetPodSpec is the Compliance Benchmarker DaemonSet’s PodSpec.

FieldDescription
initContainers
[]ComplianceBenchmarkerDaemonSetInitContainer
(Optional)

InitContainers is a list of Compliance benchmark init containers. If specified, this overrides the specified Compliance Benchmarker DaemonSet init containers. If omitted, the Compliance Benchmarker DaemonSet will use its default values for its init containers.

containers
[]ComplianceBenchmarkerDaemonSetContainer
(Optional)

Containers is a list of Compliance benchmark containers. If specified, this overrides the specified Compliance Benchmarker DaemonSet containers. If omitted, the Compliance Benchmarker DaemonSet will use its default values for its containers.

ComplianceBenchmarkerDaemonSetPodTemplateSpec

(Appears on:

ComplianceBenchmarkerDaemonSetSpec)

ComplianceBenchmarkerDaemonSetPodTemplateSpec is the Compliance Benchmarker DaemonSet’s PodTemplateSpec

FieldDescription
spec
ComplianceBenchmarkerDaemonSetPodSpec
(Optional)

Spec is the Compliance Benchmarker DaemonSet’s PodSpec.



ComplianceBenchmarkerDaemonSetSpec

(Appears on:

ComplianceBenchmarkerDaemonSet)

ComplianceBenchmarkerDaemonSetSpec defines configuration for the Compliance Benchmarker DaemonSet.

FieldDescription
template
ComplianceBenchmarkerDaemonSetPodTemplateSpec
(Optional)

Template describes the Compliance Benchmarker DaemonSet pod that will be created.

ComplianceControllerDeployment

(Appears on:

ComplianceSpec)

ComplianceControllerDeployment is the configuration for the compliance controller Deployment.

FieldDescription
spec
ComplianceControllerDeploymentSpec
(Optional)

Spec is the specification of the compliance controller Deployment.



ComplianceControllerDeploymentContainer

(Appears on:

ComplianceControllerDeploymentPodSpec)

ComplianceControllerDeploymentContainer is a compliance controller Deployment container.

FieldDescription
name
string

Name is an enum which identifies the compliance controller Deployment container by name. Supported values are: compliance-controller

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named compliance controller Deployment container’s resources. If omitted, the compliance controller Deployment will use its default value for this container’s resources.

ComplianceControllerDeploymentInitContainer

(Appears on:

ComplianceControllerDeploymentPodSpec)

ComplianceControllerDeploymentInitContainer is a compliance controller Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the compliance controller Deployment init container by name. Supported values are: tigera-compliance-controller-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named compliance controller Deployment init container’s resources. If omitted, the compliance controller Deployment will use its default value for this init container’s resources.

ComplianceControllerDeploymentPodSpec

(Appears on:

ComplianceControllerDeploymentPodTemplateSpec)

ComplianceControllerDeploymentPodSpec is the compliance controller Deployment’s PodSpec.

FieldDescription
initContainers
[]ComplianceControllerDeploymentInitContainer
(Optional)

InitContainers is a list of compliance controller init containers. If specified, this overrides the specified compliance controller Deployment init containers. If omitted, the compliance controller Deployment will use its default values for its init containers.

containers
[]ComplianceControllerDeploymentContainer
(Optional)

Containers is a list of compliance controller containers. If specified, this overrides the specified compliance controller Deployment containers. If omitted, the compliance controller Deployment will use its default values for its containers.

ComplianceControllerDeploymentPodTemplateSpec

(Appears on:

ComplianceControllerDeploymentSpec)

ComplianceControllerDeploymentPodTemplateSpec is the compliance controller Deployment’s PodTemplateSpec

FieldDescription
spec
ComplianceControllerDeploymentPodSpec
(Optional)

Spec is the compliance controller Deployment’s PodSpec.



ComplianceControllerDeploymentSpec

(Appears on:

ComplianceControllerDeployment)

ComplianceControllerDeploymentSpec defines configuration for the compliance controller Deployment.

FieldDescription
template
ComplianceControllerDeploymentPodTemplateSpec
(Optional)

Template describes the compliance controller Deployment pod that will be created.

ComplianceReporterPodSpec

(Appears on:

ComplianceReporterPodTemplateSpec)

ComplianceReporterPodSpec is the ComplianceReporter PodSpec.

FieldDescription
initContainers
[]ComplianceReporterPodTemplateInitContainer
(Optional)

InitContainers is a list of ComplianceReporter PodSpec init containers. If specified, this overrides the specified ComplianceReporter PodSpec init containers. If omitted, the ComplianceServer Deployment will use its default values for its init containers.

containers
[]ComplianceReporterPodTemplateContainer
(Optional)

Containers is a list of ComplianceServer containers. If specified, this overrides the specified ComplianceReporter PodSpec containers. If omitted, the ComplianceServer Deployment will use its default values for its containers.

ComplianceReporterPodTemplate

(Appears on:

ComplianceSpec)

ComplianceReporterPodTemplate is the configuration for the ComplianceReporter PodTemplate.

FieldDescription
template
ComplianceReporterPodTemplateSpec
(Optional)

Spec is the specification of the ComplianceReporter PodTemplateSpec.

ComplianceReporterPodTemplateContainer

(Appears on:

ComplianceReporterPodSpec)

ComplianceReporterPodTemplateContainer is a ComplianceServer Deployment container.

FieldDescription
name
string

Name is an enum which identifies the ComplianceServer Deployment container by name. Supported values are: reporter

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ComplianceServer Deployment container’s resources. If omitted, the ComplianceServer Deployment will use its default value for this container’s resources.

ComplianceReporterPodTemplateInitContainer

(Appears on:

ComplianceReporterPodSpec)

ComplianceReporterPodTemplateInitContainer is a ComplianceServer Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the ComplianceReporter PodSpec init container by name. Supported values are: tigera-compliance-reporter-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ComplianceReporter PodSpec init container’s resources. If omitted, the ComplianceServer Deployment will use its default value for this init container’s resources.

ComplianceReporterPodTemplateSpec

(Appears on:

ComplianceReporterPodTemplate)

ComplianceReporterPodTemplateSpec is the ComplianceReporter PodTemplateSpec.

FieldDescription
spec
ComplianceReporterPodSpec
(Optional)

Spec is the ComplianceReporter PodTemplate’s PodSpec.



ComplianceServerDeployment

(Appears on:

ComplianceSpec)

ComplianceServerDeployment is the configuration for the ComplianceServer Deployment.

FieldDescription
spec
ComplianceServerDeploymentSpec
(Optional)

Spec is the specification of the ComplianceServer Deployment.



ComplianceServerDeploymentContainer

(Appears on:

ComplianceServerDeploymentPodSpec)

ComplianceServerDeploymentContainer is a ComplianceServer Deployment container.

FieldDescription
name
string

Name is an enum which identifies the ComplianceServer Deployment container by name. Supported values are: compliance-server

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ComplianceServer Deployment container’s resources. If omitted, the ComplianceServer Deployment will use its default value for this container’s resources.

ComplianceServerDeploymentInitContainer

(Appears on:

ComplianceServerDeploymentPodSpec)

ComplianceServerDeploymentInitContainer is a ComplianceServer Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the ComplianceServer Deployment init container by name. Supported values are: tigera-compliance-server-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ComplianceServer Deployment init container’s resources. If omitted, the ComplianceServer Deployment will use its default value for this init container’s resources.

ComplianceServerDeploymentPodSpec

(Appears on:

ComplianceServerDeploymentPodTemplateSpec)

ComplianceServerDeploymentPodSpec is the ComplianceServer Deployment’s PodSpec.

FieldDescription
initContainers
[]ComplianceServerDeploymentInitContainer
(Optional)

InitContainers is a list of ComplianceServer init containers. If specified, this overrides the specified ComplianceServer Deployment init containers. If omitted, the ComplianceServer Deployment will use its default values for its init containers.

containers
[]ComplianceServerDeploymentContainer
(Optional)

Containers is a list of ComplianceServer containers. If specified, this overrides the specified ComplianceServer Deployment containers. If omitted, the ComplianceServer Deployment will use its default values for its containers.

ComplianceServerDeploymentPodTemplateSpec

(Appears on:

ComplianceServerDeploymentSpec)

ComplianceServerDeploymentPodTemplateSpec is the ComplianceServer Deployment’s PodTemplateSpec

FieldDescription
spec
ComplianceServerDeploymentPodSpec
(Optional)

Spec is the ComplianceServer Deployment’s PodSpec.



ComplianceServerDeploymentSpec

(Appears on:

ComplianceServerDeployment)

ComplianceServerDeploymentSpec defines configuration for the ComplianceServer Deployment.

FieldDescription
template
ComplianceServerDeploymentPodTemplateSpec
(Optional)

Template describes the ComplianceServer Deployment pod that will be created.

ComplianceSnapshotterDeployment

(Appears on:

ComplianceSpec)

ComplianceSnapshotterDeployment is the configuration for the compliance snapshotter Deployment.

FieldDescription
spec
ComplianceSnapshotterDeploymentSpec
(Optional)

Spec is the specification of the compliance snapshotter Deployment.



ComplianceSnapshotterDeploymentContainer

(Appears on:

ComplianceSnapshotterDeploymentPodSpec)

ComplianceSnapshotterDeploymentContainer is a compliance snapshotter Deployment container.

FieldDescription
name
string

Name is an enum which identifies the compliance snapshotter Deployment container by name. Supported values are: compliance-snapshotter

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named compliance snapshotter Deployment container’s resources. If omitted, the compliance snapshotter Deployment will use its default value for this container’s resources.

ComplianceSnapshotterDeploymentInitContainer

(Appears on:

ComplianceSnapshotterDeploymentPodSpec)

ComplianceSnapshotterDeploymentInitContainer is a compliance snapshotter Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the compliance snapshotter Deployment init container by name. Supported values are: tigera-compliance-snapshotter-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named compliance snapshotter Deployment init container’s resources. If omitted, the compliance snapshotter Deployment will use its default value for this init container’s resources.

ComplianceSnapshotterDeploymentPodSpec

(Appears on:

ComplianceSnapshotterDeploymentPodTemplateSpec)

ComplianceSnapshotterDeploymentPodSpec is the compliance snapshotter Deployment’s PodSpec.

FieldDescription
initContainers
[]ComplianceSnapshotterDeploymentInitContainer
(Optional)

InitContainers is a list of compliance snapshotter init containers. If specified, this overrides the specified compliance snapshotter Deployment init containers. If omitted, the compliance snapshotter Deployment will use its default values for its init containers.

containers
[]ComplianceSnapshotterDeploymentContainer
(Optional)

Containers is a list of compliance snapshotter containers. If specified, this overrides the specified compliance snapshotter Deployment containers. If omitted, the compliance snapshotter Deployment will use its default values for its containers.

ComplianceSnapshotterDeploymentPodTemplateSpec

(Appears on:

ComplianceSnapshotterDeploymentSpec)

ComplianceSnapshotterDeploymentPodTemplateSpec is the compliance snapshotter Deployment’s PodTemplateSpec

FieldDescription
spec
ComplianceSnapshotterDeploymentPodSpec
(Optional)

Spec is the compliance snapshotter Deployment’s PodSpec.



ComplianceSnapshotterDeploymentSpec

(Appears on:

ComplianceSnapshotterDeployment)

ComplianceSnapshotterDeploymentSpec defines configuration for the compliance snapshotter Deployment.

FieldDescription
template
ComplianceSnapshotterDeploymentPodTemplateSpec
(Optional)

Template describes the compliance snapshotter Deployment pod that will be created.

ComplianceSpec

(Appears on:

Compliance)

ComplianceSpec defines the desired state of Tigera compliance reporting capabilities.

FieldDescription
complianceControllerDeployment
ComplianceControllerDeployment
(Optional)

ComplianceControllerDeployment configures the Compliance Controller Deployment.

complianceSnapshotterDeployment
ComplianceSnapshotterDeployment
(Optional)

ComplianceSnapshotterDeployment configures the Compliance Snapshotter Deployment.

complianceBenchmarkerDaemonSet
ComplianceBenchmarkerDaemonSet
(Optional)

ComplianceBenchmarkerDaemonSet configures the Compliance Benchmarker DaemonSet.

complianceServerDeployment
ComplianceServerDeployment
(Optional)

ComplianceServerDeployment configures the Compliance Server Deployment.

complianceReporterPodTemplate
ComplianceReporterPodTemplate
(Optional)

ComplianceReporterPodTemplate configures the Compliance Reporter PodTemplate.

ComplianceStatus

(Appears on:

Compliance)

ComplianceStatus defines the observed state of Tigera compliance reporting capabilities.

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

ComponentName (string alias)

(Appears on:

ComponentResource)

ComponentName represents a single component.

One of: Node, Typha, KubeControllers

ComponentResource

(Appears on:

InstallationSpec)

Deprecated. Please use component resource config fields in Installation.Spec instead. The ComponentResource struct associates a ResourceRequirements with a component by name

FieldDescription
componentName
ComponentName

ComponentName is an enum which identifies the component

resourceRequirements
Kubernetes core/v1.ResourceRequirements

ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

ConditionStatus (string alias)

(Appears on:

TigeraStatusCondition)

ConditionStatus represents the status of a particular condition. A condition may be one of: True, False, Unknown.

ContainerIPForwardingType (string alias)

(Appears on:

CalicoNetworkSpec)

ContainerIPForwardingType specifies whether the CNI config for container ip forwarding is enabled.

DashboardsJob

(Appears on:

TenantSpec)

DashboardsJob is the configuration for the Dashboards job.

FieldDescription
spec
DashboardsJobSpec
(Optional)

Spec is the specification of the dashboards job.



DashboardsJobContainer

(Appears on:

DashboardsJobPodSpec)

DashboardsJobContainer is the Dashboards job container.

FieldDescription
name
string

Name is an enum which identifies the Dashboard Job container by name. Supported values are: dashboards-installer

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Dashboard Job container’s resources. If omitted, the Dashboard Job will use its default value for this container’s resources.

DashboardsJobPodSpec

(Appears on:

DashboardsJobPodTemplateSpec)

DashboardsJobPodSpec is the Dashboards job’s PodSpec.

FieldDescription
containers
[]DashboardsJobContainer
(Optional)

Containers is a list of dashboards job containers. If specified, this overrides the specified Dashboard job containers. If omitted, the Dashboard job will use its default values for its containers.

DashboardsJobPodTemplateSpec

(Appears on:

DashboardsJobSpec)

DashboardsJobPodTemplateSpec is the Dashboards job’s PodTemplateSpec

FieldDescription
spec
DashboardsJobPodSpec
(Optional)

Spec is the Dashboard job’s PodSpec.



DashboardsJobSpec

(Appears on:

DashboardsJob)

DashboardsJobSpec defines configuration for the Dashboards job.

FieldDescription
template
DashboardsJobPodTemplateSpec
(Optional)

Template describes the Dashboards job pod that will be created.

DataType (string alias)

(Appears on:

Index)

DataType represent the type of data stored

DexDeployment

(Appears on:

AuthenticationSpec)

DexDeployment is the configuration for the Dex Deployment.

FieldDescription
spec
DexDeploymentSpec
(Optional)

Spec is the specification of the Dex Deployment.



DexDeploymentContainer

(Appears on:

DexDeploymentPodSpec)

DexDeploymentContainer is a Dex Deployment container.

FieldDescription
name
string

Name is an enum which identifies the Dex Deployment container by name. Supported values are: tigera-dex

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Dex Deployment container’s resources. If omitted, the Dex Deployment will use its default value for this container’s resources.

DexDeploymentInitContainer

(Appears on:

DexDeploymentPodSpec)

DexDeploymentInitContainer is a Dex Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the Dex Deployment init container by name. Supported values are: tigera-dex-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Dex Deployment init container’s resources. If omitted, the Dex Deployment will use its default value for this init container’s resources.

DexDeploymentPodSpec

(Appears on:

DexDeploymentPodTemplateSpec)

DexDeploymentPodSpec is the Dex Deployment’s PodSpec.

FieldDescription
initContainers
[]DexDeploymentInitContainer
(Optional)

InitContainers is a list of Dex init containers. If specified, this overrides the specified Dex Deployment init containers. If omitted, the Dex Deployment will use its default values for its init containers.

containers
[]DexDeploymentContainer
(Optional)

Containers is a list of Dex containers. If specified, this overrides the specified Dex Deployment containers. If omitted, the Dex Deployment will use its default values for its containers.

DexDeploymentPodTemplateSpec

(Appears on:

DexDeploymentSpec)

DexDeploymentPodTemplateSpec is the Dex Deployment’s PodTemplateSpec

FieldDescription
spec
DexDeploymentPodSpec
(Optional)

Spec is the Dex Deployment’s PodSpec.



DexDeploymentSpec

(Appears on:

DexDeployment)

DexDeploymentSpec defines configuration for the Dex Deployment.

FieldDescription
template
DexDeploymentPodTemplateSpec
(Optional)

Template describes the Dex Deployment pod that will be created.

ECKOperatorStatefulSet

(Appears on:

LogStorageSpec)

ECKOperatorStatefulSet is the configuration for the ECKOperator StatefulSet.

FieldDescription
spec
ECKOperatorStatefulSetSpec
(Optional)

Spec is the specification of the ECKOperator StatefulSet.



ECKOperatorStatefulSetContainer

(Appears on:

ECKOperatorStatefulSetPodSpec)

ECKOperatorStatefulSetContainer is a ECKOperator StatefulSet container.

FieldDescription
name
string

Name is an enum which identifies the ECKOperator StatefulSet container by name. Supported values are: manager

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ECKOperator StatefulSet container’s resources. If omitted, the ECKOperator StatefulSet will use its default value for this container’s resources.

ECKOperatorStatefulSetInitContainer

(Appears on:

ECKOperatorStatefulSetPodSpec)

ECKOperatorStatefulSetInitContainer is a ECKOperator StatefulSet init container.

FieldDescription
name
string

Name is an enum which identifies the ECKOperator StatefulSet init container by name.

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ECKOperator StatefulSet init container’s resources. If omitted, the ECKOperator StatefulSet will use its default value for this init container’s resources.

ECKOperatorStatefulSetPodSpec

(Appears on:

ECKOperatorStatefulSetPodTemplateSpec)

ECKOperatorStatefulSetPodSpec is the ECKOperator StatefulSet’s PodSpec.

FieldDescription
initContainers
[]ECKOperatorStatefulSetInitContainer
(Optional)

InitContainers is a list of ECKOperator StatefulSet init containers. If specified, this overrides the specified ECKOperator StatefulSet init containers. If omitted, the ECKOperator StatefulSet will use its default values for its init containers.

containers
[]ECKOperatorStatefulSetContainer
(Optional)

Containers is a list of ECKOperator StatefulSet containers. If specified, this overrides the specified ECKOperator StatefulSet containers. If omitted, the ECKOperator StatefulSet will use its default values for its containers.

ECKOperatorStatefulSetPodTemplateSpec

(Appears on:

ECKOperatorStatefulSetSpec)

ECKOperatorStatefulSetPodTemplateSpec is the ECKOperator StatefulSet’s PodTemplateSpec

FieldDescription
spec
ECKOperatorStatefulSetPodSpec
(Optional)

Spec is the ECKOperator StatefulSet’s PodSpec.



ECKOperatorStatefulSetSpec

(Appears on:

ECKOperatorStatefulSet)

ECKOperatorStatefulSetSpec defines configuration for the ECKOperator StatefulSet.

FieldDescription
template
ECKOperatorStatefulSetPodTemplateSpec
(Optional)

Template describes the ECKOperator StatefulSet pod that will be created.

EGWDeploymentContainer

(Appears on:

EgressGatewayDeploymentPodSpec)

EGWDeploymentContainer is a Egress Gateway Deployment container.

FieldDescription
name
string

Name is an enum which identifies the EGW Deployment container by name. Supported values are: calico-egw

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment container’s resources. If omitted, the EGW Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

EGWDeploymentInitContainer

(Appears on:

EgressGatewayDeploymentPodSpec)

EGWDeploymentInitContainer is a Egress Gateway Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the EGW Deployment init container by name. Supported values are: egress-gateway-init

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment init container’s resources. If omitted, the EGW Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

EKSLogForwarderDeployment

(Appears on:

LogCollectorSpec)

EKSLogForwarderDeployment is the configuration for the EKSLogForwarder Deployment.

FieldDescription
spec
EKSLogForwarderDeploymentSpec
(Optional)

Spec is the specification of the EKSLogForwarder Deployment.



EKSLogForwarderDeploymentContainer

(Appears on:

EKSLogForwarderDeploymentPodSpec)

EKSLogForwarderDeploymentContainer is a EKSLogForwarder Deployment container.

FieldDescription
name
string

Name is an enum which identifies the EKSLogForwarder Deployment container by name. Supported values are: eks-log-forwarder

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EKSLogForwarder Deployment container’s resources. If omitted, the EKSLogForwarder Deployment will use its default value for this container’s resources.

EKSLogForwarderDeploymentInitContainer

(Appears on:

EKSLogForwarderDeploymentPodSpec)

EKSLogForwarderDeploymentInitContainer is a EKSLogForwarder Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the EKSLogForwarder Deployment init container by name. Supported values are: eks-log-forwarder-startup

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EKSLogForwarder Deployment init container’s resources. If omitted, the EKSLogForwarder Deployment will use its default value for this init container’s resources.

EKSLogForwarderDeploymentPodSpec

(Appears on:

EKSLogForwarderDeploymentPodTemplateSpec)

EKSLogForwarderDeploymentPodSpec is the EKSLogForwarder Deployment’s PodSpec.

FieldDescription
initContainers
[]EKSLogForwarderDeploymentInitContainer
(Optional)

InitContainers is a list of EKSLogForwarder init containers. If specified, this overrides the specified EKSLogForwarder Deployment init containers. If omitted, the EKSLogForwarder Deployment will use its default values for its init containers.

containers
[]EKSLogForwarderDeploymentContainer
(Optional)

Containers is a list of EKSLogForwarder containers. If specified, this overrides the specified EKSLogForwarder Deployment containers. If omitted, the EKSLogForwarder Deployment will use its default values for its containers.

EKSLogForwarderDeploymentPodTemplateSpec

(Appears on:

EKSLogForwarderDeploymentSpec)

EKSLogForwarderDeploymentPodTemplateSpec is the EKSLogForwarder Deployment’s PodTemplateSpec

FieldDescription
spec
EKSLogForwarderDeploymentPodSpec
(Optional)

Spec is the EKSLogForwarder Deployment’s PodSpec.



EKSLogForwarderDeploymentSpec

(Appears on:

EKSLogForwarderDeployment)

EKSLogForwarderDeploymentSpec defines configuration for the EKSLogForwarder Deployment.

FieldDescription
template
EKSLogForwarderDeploymentPodTemplateSpec
(Optional)

Template describes the EKSLogForwarder Deployment pod that will be created.

EgressGatewayDeploymentPodSpec

(Appears on:

EgressGatewayDeploymentPodTemplateSpec)

EgressGatewayDeploymentPodSpec is the Egress Gateway Deployment’s PodSpec.

FieldDescription
initContainers
[]EGWDeploymentInitContainer
(Optional)

InitContainers is a list of EGW init containers. If specified, this overrides the specified EGW Deployment init containers. If omitted, the EGW Deployment will use its default values for its init containers.

containers
[]EGWDeploymentContainer
(Optional)

Containers is a list of EGW containers. If specified, this overrides the specified EGW Deployment containers. If omitted, the EGW Deployment will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the EGW pods.

nodeSelector
map[string]string
(Optional)

NodeSelector gives more control over the nodes where the Egress Gateway pods will run on.

terminationGracePeriodSeconds
int64
(Optional)

TerminationGracePeriodSeconds defines the termination grace period of the Egress Gateway pods in seconds.

topologySpreadConstraints
[]Kubernetes core/v1.TopologySpreadConstraint
(Optional)

TopologySpreadConstraints defines how the Egress Gateway pods should be spread across different AZs.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the egress gateway pod’s tolerations. If specified, this overrides any tolerations that may be set on the EGW Deployment. If omitted, the EGW Deployment will use its default value for tolerations.

priorityClassName
string
(Optional)

PriorityClassName allows to specify a PriorityClass resource to be used.

EgressGatewayDeploymentPodTemplateSpec

(Appears on:

EgressGatewaySpec)

EgressGatewayDeploymentPodTemplateSpec is the EGW Deployment’s PodTemplateSpec

FieldDescription
metadata
EgressGatewayMetadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
EgressGatewayDeploymentPodSpec
(Optional)

Spec is the EGW Deployment’s PodSpec.



EgressGatewayFailureDetection

(Appears on:

EgressGatewaySpec)

EgressGatewayFailureDetection defines the fields the needed for determining Egress Gateway readiness.

FieldDescription
healthTimeoutDataStoreSeconds
int32
(Optional)

HealthTimeoutDataStoreSeconds defines how long Egress Gateway can fail to connect to the datastore before reporting not ready. This value must be greater than 0. Default: 90

icmpProbe
ICMPProbe
(Optional)

ICMPProbe define outgoing ICMP probes that Egress Gateway will use to verify its upstream connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval.

httpProbe
HTTPProbe
(Optional)

HTTPProbe define outgoing HTTP probes that Egress Gateway will use to verify its upsteam connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval.

EgressGatewayIPPool

(Appears on:

EgressGatewaySpec)

FieldDescription
name
string
(Optional)

Name is the name of the IPPool that the Egress Gateways can use.

cidr
string
(Optional)

CIDR is the IPPool CIDR that the Egress Gateways can use.

EgressGatewayMetadata

(Appears on:

EgressGatewayDeploymentPodTemplateSpec)

EgressGatewayMetadata contains the standard Kubernetes labels and annotations fields.

FieldDescription
labels
map[string]string
(Optional)

Labels is a map of string keys and values that may match replica set and service selectors. Each of these key/value pairs are added to the object’s labels provided the key does not already exist in the object’s labels. If not specified will default to projectcalico.org/egw:[name], where [name] is the name of the Egress Gateway resource.

annotations
map[string]string
(Optional)

Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object’s annotations provided the key does not already exist in the object’s annotations.

EgressGatewaySpec

(Appears on:

EgressGateway)

EgressGatewaySpec defines the desired state of EgressGateway

FieldDescription
replicas
int32
(Optional)

Replicas defines how many instances of the Egress Gateway pod will run.

ipPools
[]EgressGatewayIPPool

IPPools defines the IP Pools that the Egress Gateway pods should be using. Either name or CIDR must be specified. IPPools must match existing IPPools.

externalNetworks
[]string
(Optional)

ExternalNetworks defines the external network names this Egress Gateway is associated with. ExternalNetworks must match existing external networks.

logSeverity
LogLevel
(Optional)

LogSeverity defines the logging level of the Egress Gateway. Default: Info

template
EgressGatewayDeploymentPodTemplateSpec
(Optional)

Template describes the EGW Deployment pod that will be created.

egressGatewayFailureDetection
EgressGatewayFailureDetection
(Optional)

EgressGatewayFailureDetection is used to configure how Egress Gateway determines readiness. If both ICMP, HTTP probes are defined, one ICMP probe and one HTTP probe should succeed for Egress Gateways to become ready. Otherwise one of ICMP or HTTP probe should succeed for Egress gateways to become ready if configured.

aws
AWSEgressGateway
(Optional)

AWS defines the additional configuration options for Egress Gateways on AWS.

EgressGatewayStatus

(Appears on:

EgressGateway)

EgressGatewayStatus defines the observed state of EgressGateway

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

EksCloudwatchLogsSpec

(Appears on:

AdditionalLogSourceSpec)

EksConfigSpec defines configuration for fetching EKS audit logs.

FieldDescription
region
string

AWS Region EKS cluster is hosted in.

groupName
string

Cloudwatch log-group name containing EKS audit logs.

streamPrefix
string
(Optional)

Prefix of Cloudwatch log stream containing EKS audit logs in the log-group. Default: kube-apiserver-audit-

fetchInterval
int32
(Optional)

Cloudwatch audit logs fetching interval in seconds. Default: 60

ElasticsearchMetricsDeployment

(Appears on:

LogStorageSpec)

ElasticsearchMetricsDeployment is the configuration for the tigera-elasticsearch-metric Deployment.

FieldDescription
spec
ElasticsearchMetricsDeploymentSpec
(Optional)

Spec is the specification of the ElasticsearchMetrics Deployment.



ElasticsearchMetricsDeploymentContainer

(Appears on:

ElasticsearchMetricsDeploymentPodSpec)

ElasticsearchMetricsDeploymentContainer is a ElasticsearchMetricsDeployment container.

FieldDescription
name
string

Name is an enum which identifies the ElasticsearchMetricsDeployment container by name. Supported values are: tigera-elasticsearch-metrics

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ElasticsearchMetricsDeployment container’s resources. If omitted, the ElasticsearchMetrics Deployment will use its default value for this container’s resources.

ElasticsearchMetricsDeploymentInitContainer

(Appears on:

ElasticsearchMetricsDeploymentPodSpec)

ElasticsearchMetricsDeploymentInitContainer is a ElasticsearchMetricsDeployment init container.

FieldDescription
name
string

Name is an enum which identifies the ElasticsearchMetricsDeployment init container by name. Supported values are: tigera-ee-elasticsearch-metrics-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named ElasticsearchMetricsDeployment init container’s resources. If omitted, the ElasticsearchMetrics Deployment will use its default value for this init container’s resources.

ElasticsearchMetricsDeploymentPodSpec

(Appears on:

ElasticsearchMetricsDeploymentPodTemplateSpec)

ElasticsearchMetricsDeploymentPodSpec is the tElasticsearchMetricsDeployment’s PodSpec.

FieldDescription
initContainers
[]ElasticsearchMetricsDeploymentInitContainer
(Optional)

InitContainers is a list of ElasticsearchMetricsDeployment init containers. If specified, this overrides the specified ElasticsearchMetricsDeployment init containers. If omitted, the ElasticsearchMetrics Deployment will use its default values for its init containers.

containers
[]ElasticsearchMetricsDeploymentContainer
(Optional)

Containers is a list of ElasticsearchMetricsDeployment containers. If specified, this overrides the specified ElasticsearchMetricsDeployment containers. If omitted, the ElasticsearchMetrics Deployment will use its default values for its containers.

ElasticsearchMetricsDeploymentPodTemplateSpec

(Appears on:

ElasticsearchMetricsDeploymentSpec)

ElasticsearchMetricsDeploymentPodTemplateSpec is the ElasticsearchMetricsDeployment’s PodTemplateSpec

FieldDescription
spec
ElasticsearchMetricsDeploymentPodSpec
(Optional)

Spec is the ElasticsearchMetrics Deployment’s PodSpec.



ElasticsearchMetricsDeploymentSpec

(Appears on:

ElasticsearchMetricsDeployment)

ElasticsearchMetricsDeploymentSpec defines configuration for the ElasticsearchMetricsDeployment Deployment.

FieldDescription
template
ElasticsearchMetricsDeploymentPodTemplateSpec
(Optional)

Template describes the ElasticsearchMetrics Deployment pod that will be created.

EmailVerificationType (string alias)

(Appears on:

AuthenticationOIDC)

EncapsulationType (string alias)

(Appears on:

IPPool)

EncapsulationType is the type of encapsulation to use on an IP pool.

One of: IPIP, VXLAN, IPIPCrossSubnet, VXLANCrossSubnet, None

EncryptionOption (string alias)

(Appears on:

SyslogStoreSpec)

EncryptionOption specifies the traffic encryption mode when connecting to a Syslog server.

One of: None, TLS

Endpoint

(Appears on:

ServiceMonitor)

Endpoint contains a subset of relevant fields from the Prometheus Endpoint struct.

FieldDescription
params
map[string][]string

Optional HTTP URL parameters Default: scrape all metrics.

bearerTokenSecret
Kubernetes core/v1.SecretKeySelector

Secret to mount to read bearer token for scraping targets. Recommended: when unset, the operator will create a Secret, a ClusterRole and a ClusterRoleBinding.

interval
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1.Duration

Interval at which metrics should be scraped. If not specified Prometheus’ global scrape interval is used.

scrapeTimeout
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1.Duration

Timeout after which the scrape is ended. If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used.

honorLabels
bool

HonorLabels chooses the metric’s labels on collisions with target labels.

honorTimestamps
bool

HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data.

metricRelabelings
[]*github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1.RelabelConfig

MetricRelabelConfigs to apply to samples before ingestion.

relabelings
[]*github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1.RelabelConfig

RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds relabelings for a few standard Kubernetes fields. The original scrape job’s name is available via the __tmp_prometheus_job_name label. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

EnvoySettings

(Appears on:

ApplicationLayerSpec)

FieldDescription
xffNumTrustedHops
int32
(Optional)

The number of additional ingress proxy hops from the right side of the x-forwarded-for HTTP header to trust when determining the origin client’s IP address. 0 is permitted, but >=1 is the typical setting.

useRemoteAddress
bool
(Optional)

If set to true, the Envoy connection manager will use the real remote address of the client connection when determining internal versus external origin and manipulating various headers.

ExternalPrometheus

(Appears on:

MonitorSpec)

FieldDescription
serviceMonitor
ServiceMonitor
(Optional)

ServiceMonitor when specified, the operator will create a ServiceMonitor object in the namespace. It is recommended that you configure labels if you want your prometheus instance to pick up the configuration automatically. The operator will configure 1 endpoint by default: - Params to scrape all metrics available in Calico Enterprise. - BearerTokenSecret (If not overridden, the operator will also create corresponding RBAC that allows authz to the metrics.) - TLSConfig, containing the caFile and serverName.

namespace
string

Namespace is the namespace where the operator will create resources for your Prometheus instance. The namespace must be created before the operator will create Prometheus resources.

FIPSMode (string alias)

(Appears on:

InstallationSpec)

FluentdDaemonSet

(Appears on:

LogCollectorSpec)

FluentdDaemonSet is the configuration for the Fluentd DaemonSet.

FieldDescription
spec
FluentdDaemonSetSpec
(Optional)

Spec is the specification of the Fluentd DaemonSet.



FluentdDaemonSetContainer

(Appears on:

FluentdDaemonSetPodSpec)

FluentdDaemonSetContainer is a Fluentd DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the Fluentd DaemonSet container by name. Supported values are: fluentd

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Fluentd DaemonSet container’s resources. If omitted, the Fluentd DaemonSet will use its default value for this container’s resources.

FluentdDaemonSetInitContainer

(Appears on:

FluentdDaemonSetPodSpec)

FluentdDaemonSetInitContainer is a Fluentd DaemonSet init container.

FieldDescription
name
string

Name is an enum which identifies the Fluentd DaemonSet init container by name. Supported values are: tigera-fluentd-prometheus-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Fluentd DaemonSet init container’s resources. If omitted, the Fluentd DaemonSet will use its default value for this init container’s resources.

FluentdDaemonSetPodSpec

(Appears on:

FluentdDaemonSetPodTemplateSpec)

FluentdDaemonSetPodSpec is the Fluentd DaemonSet’s PodSpec.

FieldDescription
initContainers
[]FluentdDaemonSetInitContainer
(Optional)

InitContainers is a list of Fluentd DaemonSet init containers. If specified, this overrides the specified Fluentd DaemonSet init containers. If omitted, the Fluentd DaemonSet will use its default values for its init containers.

containers
[]FluentdDaemonSetContainer
(Optional)

Containers is a list of Fluentd DaemonSet containers. If specified, this overrides the specified Fluentd DaemonSet containers. If omitted, the Fluentd DaemonSet will use its default values for its containers.

FluentdDaemonSetPodTemplateSpec

(Appears on:

FluentdDaemonSetSpec)

FluentdDaemonSetPodTemplateSpec is the Fluentd DaemonSet’s PodTemplateSpec

FieldDescription
spec
FluentdDaemonSetPodSpec
(Optional)

Spec is the Fluentd DaemonSet’s PodSpec.



FluentdDaemonSetSpec

(Appears on:

FluentdDaemonSet)

FluentdDaemonSetSpec defines configuration for the Fluentd DaemonSet.

FieldDescription
template
FluentdDaemonSetPodTemplateSpec
(Optional)

Template describes the Fluentd DaemonSet pod that will be created.

GroupSearch

(Appears on:

AuthenticationLDAP)

Group search configuration to find the groups that a user is in.

FieldDescription
baseDN
string

BaseDN to start the search from. For example “cn=groups,dc=example,dc=com”

filter
string
(Optional)

Optional filter to apply when searching the directory. For example “(objectClass=posixGroup)”

nameAttribute
string

The attribute of the group that represents its name. This attribute can be used to apply RBAC to a user group.

userMatchers
[]UserMatch

Following list contains field pairs that are used to match a user to a group. It adds an additional requirement to the filter that an attribute in the group must match the user’s attribute value.

GuardianDeployment

(Appears on:

ManagementClusterConnectionSpec)

GuardianDeployment is the configuration for the guardian Deployment.

FieldDescription
spec
GuardianDeploymentSpec
(Optional)

Spec is the specification of the guardian Deployment.



GuardianDeploymentContainer

(Appears on:

GuardianDeploymentPodSpec)

GuardianDeploymentContainer is a guardian Deployment container.

FieldDescription
name
string

Name is an enum which identifies the guardian Deployment container by name. Supported values are: tigera-guardian

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named guardian Deployment container’s resources. If omitted, the guardian Deployment will use its default value for this container’s resources.

GuardianDeploymentInitContainer

(Appears on:

GuardianDeploymentPodSpec)

GuardianDeploymentInitContainer is a guardian Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the guardian Deployment init container by name.

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named guardian Deployment init container’s resources. If omitted, the guardian Deployment will use its default value for this init container’s resources.

GuardianDeploymentPodSpec

(Appears on:

GuardianDeploymentPodTemplateSpec)

GuardianDeploymentPodSpec is the guardian Deployment’s PodSpec.

FieldDescription
initContainers
[]GuardianDeploymentInitContainer
(Optional)

InitContainers is a list of guardian init containers. If specified, this overrides the specified guardian Deployment init containers. If omitted, the guardian Deployment will use its default values for its init containers.

containers
[]GuardianDeploymentContainer
(Optional)

Containers is a list of guardian containers. If specified, this overrides the specified guardian Deployment containers. If omitted, the guardian Deployment will use its default values for its containers.

GuardianDeploymentPodTemplateSpec

(Appears on:

GuardianDeploymentSpec)

GuardianDeploymentPodTemplateSpec is the guardian Deployment’s PodTemplateSpec

FieldDescription
spec
GuardianDeploymentPodSpec
(Optional)

Spec is the guardian Deployment’s PodSpec.



GuardianDeploymentSpec

(Appears on:

GuardianDeployment)

GuardianDeploymentSpec defines configuration for the guardian Deployment.

FieldDescription
template
GuardianDeploymentPodTemplateSpec
(Optional)

Template describes the guardian Deployment pod that will be created.

HTTPProbe

(Appears on:

EgressGatewayFailureDetection)

HTTPProbe defines the HTTP probe configuration for Egress Gateway.

FieldDescription
urls
[]string

URLs define the list of HTTP probe URLs. Egress Gateway will probe each URL periodically.If all probes fail, Egress Gateway will report non-ready.

intervalSeconds
int32
(Optional)

IntervalSeconds defines the interval of HTTP probes. Used when URLs is non-empty. Default: 10

timeoutSeconds
int32
(Optional)

TimeoutSeconds defines the timeout value of HTTP probes. Used when URLs is non-empty. Default: 30

HostPortsType (string alias)

(Appears on:

CalicoNetworkSpec)

HostPortsType specifies host port support.

One of: Enabled, Disabled

ICMPProbe

(Appears on:

EgressGatewayFailureDetection)

ICMPProbe defines the ICMP probe configuration for Egress Gateway.

FieldDescription
ips
[]string

IPs define the list of ICMP probe IPs. Egress Gateway will probe each IP periodically. If all probes fail, Egress Gateway will report non-ready.

intervalSeconds
int32
(Optional)

IntervalSeconds defines the interval of ICMP probes. Used when IPs is non-empty. Default: 5

timeoutSeconds
int32
(Optional)

TimeoutSeconds defines the timeout value of ICMP probes. Used when IPs is non-empty. Default: 15

IPAMPluginType (string alias)

(Appears on:

IPAMSpec)

IPAMSpec

(Appears on:

CNISpec)

IPAMSpec contains configuration for pod IP address management.

FieldDescription
type
IPAMPluginType

Specifies the IPAM plugin that will be used in the Calico or Calico Enterprise installation. * For CNI Plugin Calico, this field defaults to Calico. * For CNI Plugin GKE, this field defaults to HostLocal. * For CNI Plugin AzureVNET, this field defaults to AzureVNET. * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC.

The IPAM plugin is installed and configured only if the CNI plugin is set to Calico, for all other values of the CNI plugin the plugin binaries and CNI config is a dependency that is expected to be installed separately.

Default: Calico

IPPool

(Appears on:

CalicoNetworkSpec)

FieldDescription
name
string

Name is the name of the IP pool. If omitted, this will be generated.

cidr
string

CIDR contains the address range for the IP Pool in classless inter-domain routing format.

encapsulation
EncapsulationType
(Optional)

Encapsulation specifies the encapsulation type that will be used with the IP Pool. Default: IPIP

natOutgoing
NATOutgoingType
(Optional)

NATOutgoing specifies if NAT will be enabled or disabled for outgoing traffic. Default: Enabled

nodeSelector
string
(Optional)

NodeSelector specifies the node selector that will be set for the IP Pool. Default: ‘all()’

blockSize
int32
(Optional)

BlockSize specifies the CIDR prefex length to use when allocating per-node IP blocks from the main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)

disableBGPExport
bool
(Optional)

DisableBGPExport specifies whether routes from this IP pool’s CIDR are exported over BGP. Default: false

allowedUses
[]IPPoolAllowedUse

AllowedUse controls what the IP pool will be used for. If not specified or empty, defaults to [“Tunnel”, “Workload”] for back-compatibility

IPPoolAllowedUse (string alias)

(Appears on:

IPPool)

Image

(Appears on:

ImageSetSpec)

FieldDescription
image
string

Image is an image that the operator deploys and instead of using the built in tag the operator will use the Digest for the image identifier. The value should be the image name without registry or tag or digest. For the image docker.io/calico/node:v3.17.1 it should be represented as calico/node

digest
string

Digest is the image identifier that will be used for the Image. The field should not include a leading @ and must be prefixed with sha256:.

ImageSetSpec

(Appears on:

ImageSet)

ImageSetSpec defines the desired state of ImageSet.

FieldDescription
images
[]Image

Images is the list of images to use digests. All images that the operator will deploy must be specified.

Index

(Appears on:

TenantSpec)

Index defines how to store a tenant’s data

FieldDescription
baseIndexName
string

BaseIndexName defines the name of the index that will be used to store data (this name excludes the numerical identifier suffix)

dataType
DataType

DataType represents the type of data stored in the defined index

Indices

(Appears on:

LogStorageSpec)

Indices defines the configuration for the indices in an Elasticsearch cluster.

FieldDescription
replicas
int32
(Optional)

Replicas defines how many replicas each index will have. See https://www.elastic.co/guide/en/elasticsearch/reference/current/scalability.html

InstallationSpec

(Appears on:

Installation,InstallationStatus)

InstallationSpec defines configuration for a Calico or Calico Enterprise installation.

FieldDescription
variant
ProductVariant
(Optional)

Variant is the product to install - one of Calico or TigeraSecureEnterprise Default: Calico

registry
string
(Optional)

Registry is the default Docker registry used for component Docker images. If specified then the given value must end with a slash character (/) and all images will be pulled from this registry. If not specified then the default registries will be used. A special case value, UseDefault, is supported to explicitly specify the default registries will be used.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <registry> portion of the above format.

imagePath
string
(Optional)

ImagePath allows for the path part of an image to be specified. If specified then the specified value will be used as the image path for each image. If not specified or empty, the default for each image will be used. A special case value, UseDefault, is supported to explicitly specify the default image path will be used for each image.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <imagePath> portion of the above format.

imagePrefix
string
(Optional)

ImagePrefix allows for the prefix part of an image to be specified. If specified then the given value will be used as a prefix on each image. If not specified or empty, no prefix will be used. A special case value, UseDefault, is supported to explicitly specify the default image prefix will be used for each image.

Image format:<registry><imagePath>/<imagePrefix><imageName>:<image-tag>

This option allows configuring the <imagePrefix> portion of the above format.

imagePullSecrets
[]Kubernetes core/v1.LocalObjectReference
(Optional)

ImagePullSecrets is an array of references to container registry pull secrets to use. These are applied to all images to be pulled.

kubernetesProvider
Provider
(Optional)

KubernetesProvider specifies a particular provider of the Kubernetes platform and enables provider-specific configuration. If the specified value is empty, the Operator will attempt to automatically determine the current provider. If the specified value is not empty, the Operator will still attempt auto-detection, but will additionally compare the auto-detected value to the specified value to confirm they match.

cni
CNISpec
(Optional)

CNI specifies the CNI that will be used by this installation.

calicoNetwork
CalicoNetworkSpec
(Optional)

CalicoNetwork specifies networking configuration options for Calico.

typhaAffinity
TyphaAffinity
(Optional)

Deprecated. Please use Installation.Spec.TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods.

controlPlaneNodeSelector
map[string]string
(Optional)

ControlPlaneNodeSelector is used to select control plane nodes on which to run Calico components. This is globally applied to all resources created by the operator excluding daemonsets.

controlPlaneTolerations
[]Kubernetes core/v1.Toleration
(Optional)

ControlPlaneTolerations specify tolerations which are then globally applied to all resources created by the operator.

controlPlaneReplicas
int32
(Optional)

ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed. This field applies to all control plane components that support High Availability. Defaults to 2.

nodeMetricsPort
int32
(Optional)

NodeMetricsPort specifies which port calico/node serves prometheus metrics on. By default, metrics are not enabled. If specified, this overrides any FelixConfiguration resources which may exist. If omitted, then prometheus metrics may still be configured through FelixConfiguration.

typhaMetricsPort
int32
(Optional)

TyphaMetricsPort specifies which port calico/typha serves prometheus metrics on. By default, metrics are not enabled.

flexVolumePath
string
(Optional)

FlexVolumePath optionally specifies a custom path for FlexVolume. If not specified, FlexVolume will be enabled by default. If set to ‘None’, FlexVolume will be disabled. The default is based on the kubernetesProvider.

kubeletVolumePluginPath
string
(Optional)

KubeletVolumePluginPath optionally specifies enablement of Calico CSI plugin. If not specified, CSI will be enabled by default. If set to ‘None’, CSI will be disabled. Default: /var/lib/kubelet

nodeUpdateStrategy
Kubernetes apps/v1.DaemonSetUpdateStrategy
(Optional)

NodeUpdateStrategy can be used to customize the desired update strategy, such as the MaxUnavailable field.

componentResources
[]ComponentResource
(Optional)

Deprecated. Please use CalicoNodeDaemonSet, TyphaDeployment, and KubeControllersDeployment. ComponentResources can be used to customize the resource requirements for each component. Node, Typha, and KubeControllers are supported for installations.

certificateManagement
CertificateManagement
(Optional)

CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization.

nonPrivileged
NonPrivilegedType
(Optional)

NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible.

calicoNodeDaemonSet
CalicoNodeDaemonSet

CalicoNodeDaemonSet configures the calico-node DaemonSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

csiNodeDriverDaemonSet
CSINodeDriverDaemonSet

CSINodeDriverDaemonSet configures the csi-node-driver DaemonSet.

calicoKubeControllersDeployment
CalicoKubeControllersDeployment

CalicoKubeControllersDeployment configures the calico-kube-controllers Deployment. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

typhaDeployment
TyphaDeployment

TyphaDeployment configures the typha Deployment. If used in conjunction with the deprecated ComponentResources or TyphaAffinity, then these overrides take precedence.

calicoWindowsUpgradeDaemonSet
CalicoWindowsUpgradeDaemonSet

Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet configures the calico-windows-upgrade DaemonSet.

calicoNodeWindowsDaemonSet
CalicoNodeWindowsDaemonSet

CalicoNodeWindowsDaemonSet configures the calico-node-windows DaemonSet.

fipsMode
FIPSMode
(Optional)

FIPSMode uses images and features only that are using FIPS 140-2 validated cryptographic modules and standards. Default: Disabled

logging
Logging
(Optional)

Logging Configuration for Components

windowsNodes
WindowsNodeSpec
(Optional)

Windows Configuration

serviceCIDRs
[]string
(Optional)

Kubernetes Service CIDRs. Specifying this is required when using Calico for Windows.

InstallationStatus

(Appears on:

Installation)

InstallationStatus defines the observed state of the Calico or Calico Enterprise installation.

FieldDescription
variant
ProductVariant

Variant is the most recently observed installed variant - one of Calico or TigeraSecureEnterprise

mtu
int32

MTU is the most recently observed value for pod network MTU. This may be an explicitly configured value, or based on Calico’s native auto-detetion.

imageSet
string
(Optional)

ImageSet is the name of the ImageSet being used, if there is an ImageSet that is being used. If an ImageSet is not being used then this will not be set.

computed
InstallationSpec
(Optional)

Computed is the final installation including overlaid resources.

calicoVersion
string

CalicoVersion shows the current running version of calico. CalicoVersion along with Variant is needed to know the exact version deployed.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

IntrusionDetectionComponentName (string alias)

(Appears on:

IntrusionDetectionComponentResource)

IntrusionDetectionComponentResource

(Appears on:

IntrusionDetectionSpec)

The ComponentResource struct associates a ResourceRequirements with a component by name

FieldDescription
componentName
IntrusionDetectionComponentName

ComponentName is an enum which identifies the component

resourceRequirements
Kubernetes core/v1.ResourceRequirements

ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

IntrusionDetectionControllerDeployment

(Appears on:

IntrusionDetectionSpec)

IntrusionDetectionControllerDeployment is the configuration for the IntrusionDetectionController Deployment.

FieldDescription
spec
IntrusionDetectionControllerDeploymentSpec
(Optional)

Spec is the specification of the IntrusionDetectionController Deployment.



IntrusionDetectionControllerDeploymentContainer

(Appears on:

IntrusionDetectionControllerDeploymentPodSpec)

IntrusionDetectionControllerDeploymentContainer is a IntrusionDetectionController Deployment container.

FieldDescription
name
string

Name is an enum which identifies the IntrusionDetectionController Deployment container by name. Supported values are: controller, webhooks-processor

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named IntrusionDetectionController Deployment container’s resources. If omitted, the IntrusionDetection Deployment will use its default value for this container’s resources.

IntrusionDetectionControllerDeploymentInitContainer

(Appears on:

IntrusionDetectionControllerDeploymentPodSpec)

IntrusionDetectionControllerDeploymentInitContainer is a IntrusionDetectionController Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the IntrusionDetectionController Deployment init container by name. Supported values are: intrusion-detection-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named IntrusionDetectionController Deployment init container’s resources. If omitted, the IntrusionDetectionController Deployment will use its default value for this init container’s resources.

IntrusionDetectionControllerDeploymentPodSpec

(Appears on:

IntrusionDetectionControllerDeploymentPodTemplateSpec)

IntrusionDetectionControllerDeploymentPodSpec is the IntrusionDetectionController Deployment’s PodSpec.

FieldDescription
initContainers
[]IntrusionDetectionControllerDeploymentInitContainer
(Optional)

InitContainers is a list of IntrusionDetectionController init containers. If specified, this overrides the specified IntrusionDetectionController Deployment init containers. If omitted, the IntrusionDetectionController Deployment will use its default values for its init containers.

containers
[]IntrusionDetectionControllerDeploymentContainer
(Optional)

Containers is a list of IntrusionDetectionController containers. If specified, this overrides the specified IntrusionDetectionController Deployment containers. If omitted, the IntrusionDetectionController Deployment will use its default values for its containers.

IntrusionDetectionControllerDeploymentPodTemplateSpec

(Appears on:

IntrusionDetectionControllerDeploymentSpec)

IntrusionDetectionControllerDeploymentPodTemplateSpec is the IntrusionDetectionController Deployment’s PodTemplateSpec

FieldDescription
spec
IntrusionDetectionControllerDeploymentPodSpec
(Optional)

Spec is the IntrusionDetectionController Deployment’s PodSpec.



IntrusionDetectionControllerDeploymentSpec

(Appears on:

IntrusionDetectionControllerDeployment)

IntrusionDetectionControllerDeploymentSpec defines configuration for the IntrusionDetectionController Deployment.

FieldDescription
template
IntrusionDetectionControllerDeploymentPodTemplateSpec
(Optional)

Template describes the IntrusionDetectionController Deployment pod that will be created.

IntrusionDetectionSpec

(Appears on:

IntrusionDetection)

IntrusionDetectionSpec defines the desired state of Tigera intrusion detection capabilities.

FieldDescription
componentResources
[]IntrusionDetectionComponentResource
(Optional)

ComponentResources can be used to customize the resource requirements for each component. Only DeepPacketInspection is supported for this spec.

anomalyDetection
AnomalyDetectionSpec
(Optional)

AnomalyDetection is now deprecated, and configuring it has no effect.

intrusionDetectionControllerDeployment
IntrusionDetectionControllerDeployment
(Optional)

IntrusionDetectionControllerDeployment configures the IntrusionDetection Controller Deployment.

IntrusionDetectionStatus

(Appears on:

IntrusionDetection)

IntrusionDetectionStatus defines the observed state of Tigera intrusion detection capabilities.

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Kibana

(Appears on:

LogStorageSpec)

Kibana is the configuration for the Kibana.

FieldDescription
spec
KibanaSpec
(Optional)

Spec is the specification of the Kibana.



KibanaContainer

(Appears on:

KibanaPodSpec)

KibanaContainer is a Kibana container.

FieldDescription
name
string

Name is an enum which identifies the Kibana Deployment container by name. Supported values are: kibana

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Kibana container’s resources. If omitted, the Kibana will use its default value for this container’s resources.

KibanaInitContainer

(Appears on:

KibanaPodSpec)

KibanaInitContainer is a Kibana init container.

FieldDescription
name
string

Name is an enum which identifies the Kibana init container by name. Supported values are: key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Kibana Deployment init container’s resources. If omitted, the Kibana Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

KibanaPodSpec

(Appears on:

KibanaPodTemplateSpec)

KibanaPodSpec is the Kibana Deployment’s PodSpec.

FieldDescription
initContainers
[]KibanaInitContainer
(Optional)

InitContainers is a list of Kibana init containers. If specified, this overrides the specified Kibana Deployment init containers. If omitted, the Kibana Deployment will use its default values for its init containers.

containers
[]KibanaContainer
(Optional)

Containers is a list of Kibana containers. If specified, this overrides the specified Kibana Deployment containers. If omitted, the Kibana Deployment will use its default values for its containers.

KibanaPodTemplateSpec

(Appears on:

KibanaSpec)

KibanaPodTemplateSpec is the Kibana’s PodTemplateSpec

FieldDescription
spec
KibanaPodSpec
(Optional)

Spec is the Kibana’s PodSpec.



KibanaSpec

(Appears on:

Kibana)

FieldDescription
template
KibanaPodTemplateSpec
(Optional)

Template describes the Kibana pod that will be created.

KubernetesAutodetectionMethod (string alias)

(Appears on:

NodeAddressAutodetection)

KubernetesAutodetectionMethod is a method of detecting an IP address based on the Kubernetes API.

One of: NodeInternalIP

L7LogCollectorDaemonSet

(Appears on:

ApplicationLayerSpec)

L7LogCollectorDaemonSet is the configuration for the L7LogCollector DaemonSet.

FieldDescription
spec
L7LogCollectorDaemonSetSpec
(Optional)

Spec is the specification of the L7LogCollector DaemonSet.



L7LogCollectorDaemonSetContainer

(Appears on:

L7LogCollectorDaemonSetPodSpec)

L7LogCollectorDaemonSetContainer is a L7LogCollector DaemonSet container.

FieldDescription
name
string

Name is an enum which identifies the L7LogCollector DaemonSet container by name. Supported values are: l7-collector, envoy-proxy, dikastes

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named L7LogCollector DaemonSet container’s resources. If omitted, the L7LogCollector DaemonSet will use its default value for this container’s resources.

L7LogCollectorDaemonSetInitContainer

(Appears on:

L7LogCollectorDaemonSetPodSpec)

L7LogCollectorDaemonSetInitContainer is a L7LogCollector DaemonSet init container.

FieldDescription
name
string

Name is an enum which identifies the L7LogCollector DaemonSet init container by name.

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named L7LogCollector DaemonSet init container’s resources. If omitted, the L7LogCollector DaemonSet will use its default value for this init container’s resources.

L7LogCollectorDaemonSetPodSpec

(Appears on:

L7LogCollectorDaemonSetPodTemplateSpec)

L7LogCollectorDaemonSetPodSpec is the L7LogCollector DaemonSet’s PodSpec.

FieldDescription
initContainers
[]L7LogCollectorDaemonSetInitContainer
(Optional)

InitContainers is a list of L7LogCollector DaemonSet init containers. If specified, this overrides the specified L7LogCollector DaemonSet init containers. If omitted, the L7LogCollector DaemonSet will use its default values for its init containers.

containers
[]L7LogCollectorDaemonSetContainer
(Optional)

Containers is a list of L7LogCollector DaemonSet containers. If specified, this overrides the specified L7LogCollector DaemonSet containers. If omitted, the L7LogCollector DaemonSet will use its default values for its containers.

L7LogCollectorDaemonSetPodTemplateSpec

(Appears on:

L7LogCollectorDaemonSetSpec)

L7LogCollectorDaemonSetPodTemplateSpec is the L7LogCollector DaemonSet’s PodTemplateSpec

FieldDescription
spec
L7LogCollectorDaemonSetPodSpec
(Optional)

Spec is the L7LogCollector DaemonSet’s PodSpec.



L7LogCollectorDaemonSetSpec

(Appears on:

L7LogCollectorDaemonSet)

L7LogCollectorDaemonSetSpec defines configuration for the L7LogCollector DaemonSet.

FieldDescription
template
L7LogCollectorDaemonSetPodTemplateSpec
(Optional)

Template describes the L7LogCollector DaemonSet pod that will be created.

LinseedDeployment

(Appears on:

LogStorageSpec,TenantSpec)

LinseedDeployment is the configuration for the linseed Deployment.

FieldDescription
spec
LinseedDeploymentSpec
(Optional)

Spec is the specification of the linseed Deployment.



LinseedDeploymentContainer

(Appears on:

LinseedDeploymentPodSpec)

LinseedDeploymentContainer is a linseed Deployment container.

FieldDescription
name
string

Name is an enum which identifies the linseed Deployment container by name. Supported values are: tigera-linseed

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named linseed Deployment container’s resources. If omitted, the linseed Deployment will use its default value for this container’s resources.

LinseedDeploymentInitContainer

(Appears on:

LinseedDeploymentPodSpec)

LinseedDeploymentInitContainer is a linseed Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the linseed Deployment init container by name. Supported values are: tigera-secure-linseed-token-tls-key-cert-provisioner,tigera-secure-linseed-cert-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named linseed Deployment init container’s resources. If omitted, the linseed Deployment will use its default value for this init container’s resources.

LinseedDeploymentPodSpec

(Appears on:

LinseedDeploymentPodTemplateSpec)

LinseedDeploymentPodSpec is the linseed Deployment’s PodSpec.

FieldDescription
initContainers
[]LinseedDeploymentInitContainer
(Optional)

InitContainers is a list of linseed init containers. If specified, this overrides the specified linseed Deployment init containers. If omitted, the linseed Deployment will use its default values for its init containers.

containers
[]LinseedDeploymentContainer
(Optional)

Containers is a list of linseed containers. If specified, this overrides the specified linseed Deployment containers. If omitted, the linseed Deployment will use its default values for its containers.

LinseedDeploymentPodTemplateSpec

(Appears on:

LinseedDeploymentSpec)

LinseedDeploymentPodTemplateSpec is the linseed Deployment’s PodTemplateSpec

FieldDescription
spec
LinseedDeploymentPodSpec
(Optional)

Spec is the linseed Deployment’s PodSpec.



LinseedDeploymentSpec

(Appears on:

LinseedDeployment)

LinseedDeploymentSpec defines configuration for the linseed Deployment.

FieldDescription
template
LinseedDeploymentPodTemplateSpec
(Optional)

Template describes the linseed Deployment pod that will be created.

LinuxDataplaneOption (string alias)

(Appears on:

CalicoNetworkSpec)

LinuxDataplaneOption controls which dataplane is to be used on Linux nodes.

One of: Iptables, BPF

LogCollectionSpec

(Appears on:

ApplicationLayerSpec)

FieldDescription
collectLogs
LogCollectionStatusType
(Optional)

This setting enables or disable log collection. Allowed values are Enabled or Disabled.

logIntervalSeconds
int64
(Optional)

Interval in seconds for sending L7 log information for processing. Default: 5 sec

logRequestsPerInterval
int64
(Optional)

Maximum number of unique L7 logs that are sent LogIntervalSeconds. Adjust this to limit the number of L7 logs sent per LogIntervalSeconds to felix for further processing, use negative number to ignore limits. Default: -1

LogCollectionStatusType (string alias)

(Appears on:

LogCollectionSpec)

LogCollectorSpec

(Appears on:

LogCollector)

LogCollectorSpec defines the desired state of Tigera flow, audit, and DNS log collection.

FieldDescription
additionalStores
AdditionalLogStoreSpec
(Optional)

Configuration for exporting flow, audit, and DNS logs to external storage.

additionalSources
AdditionalLogSourceSpec
(Optional)

Configuration for importing audit logs from managed kubernetes cluster log sources.

collectProcessPath
CollectProcessPathOption
(Optional)

Configuration for enabling/disabling process path collection in flowlogs. If Enabled, this feature sets hostPID to true in order to read process cmdline. Default: Enabled

multiTenantManagementClusterNamespace
string
(Optional)

If running as a multi-tenant management cluster, the namespace in which the management cluster’s tenant services are running.

fluentdDaemonSet
FluentdDaemonSet

FluentdDaemonSet configures the Fluentd DaemonSet.

eksLogForwarderDeployment
EKSLogForwarderDeployment
(Optional)

EKSLogForwarderDeployment configures the EKSLogForwarderDeployment Deployment.

LogCollectorStatus

(Appears on:

LogCollector)

LogCollectorStatus defines the observed state of Tigera flow and DNS log collection

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

LogLevel (string alias)

(Appears on:

CNILogging,EgressGatewaySpec)

LogStorageComponentName (string alias)

(Appears on:

LogStorageComponentResource)

LogStorageComponentName CRD enum

LogStorageComponentResource

(Appears on:

LogStorageSpec)

The ComponentResource struct associates a ResourceRequirements with a component by name

FieldDescription
componentName
LogStorageComponentName

Deprecated. Please use ECKOperatorStatefulSet. ComponentName is an enum which identifies the component

resourceRequirements
Kubernetes core/v1.ResourceRequirements

ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

LogStorageSpec

(Appears on:

LogStorage)

LogStorageSpec defines the desired state of Tigera flow and DNS log storage.

FieldDescription
nodes
Nodes

Nodes defines the configuration for a set of identical Elasticsearch cluster nodes, each of type master, data, and ingest.

indices
Indices
(Optional)

Index defines the configuration for the indices in the Elasticsearch cluster.

retention
Retention
(Optional)

Retention defines how long data is retained in the Elasticsearch cluster before it is cleared.

storageClassName
string
(Optional)

StorageClassName will populate the PersistentVolumeClaim.StorageClassName that is used to provision disks to the Tigera Elasticsearch cluster. The StorageClassName should only be modified when no LogStorage is currently active. We recommend choosing a storage class dedicated to Tigera LogStorage only. Otherwise, data retention cannot be guaranteed during upgrades. See https://docs.tigera.io/maintenance/upgrading for up-to-date instructions. Default: tigera-elasticsearch

dataNodeSelector
map[string]string
(Optional)

DataNodeSelector gives you more control over the node that Elasticsearch will run on. The contents of DataNodeSelector will be added to the PodSpec of the Elasticsearch nodes. For the pod to be eligible to run on a node, the node must have each of the indicated key-value pairs as labels as well as access to the specified StorageClassName.

componentResources
[]LogStorageComponentResource
(Optional)

ComponentResources can be used to customize the resource requirements for each component. Only ECKOperator is supported for this spec.

eckOperatorStatefulSet
ECKOperatorStatefulSet
(Optional)

ECKOperatorStatefulSet configures the ECKOperator StatefulSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.

kibana
Kibana
(Optional)

Kibana configures the Kibana Spec.

linseedDeployment
LinseedDeployment

LinseedDeployment configures the linseed Deployment.

elasticsearchMetricsDeployment
ElasticsearchMetricsDeployment

ElasticsearchMetricsDeployment configures the tigera-elasticsearch-metric Deployment.

LogStorageStatus

(Appears on:

LogStorage)

LogStorageStatus defines the observed state of Tigera flow and DNS log storage.

FieldDescription
state
string

State provides user-readable status.

elasticsearchHash
string

ElasticsearchHash represents the current revision and configuration of the installed Elasticsearch cluster. This is an opaque string which can be monitored for changes to perform actions when Elasticsearch is modified.

kibanaHash
string

KibanaHash represents the current revision and configuration of the installed Kibana dashboard. This is an opaque string which can be monitored for changes to perform actions when Kibana is modified.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Logging

(Appears on:

InstallationSpec)

FieldDescription
cni
CNILogging
(Optional)

Customized logging specification for calico-cni plugin

ManagementClusterConnectionSpec

(Appears on:

ManagementClusterConnection)

ManagementClusterConnectionSpec defines the desired state of ManagementClusterConnection

FieldDescription
managementClusterAddr
string
(Optional)

Specify where the managed cluster can reach the management cluster. Ex.: “10.128.0.10:30449”. A managed cluster should be able to access this address. This field is used by managed clusters only.

tls
ManagementClusterTLS
(Optional)

TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster.

guardianDeployment
GuardianDeployment

GuardianDeployment configures the guardian Deployment.

ManagementClusterConnectionStatus

(Appears on:

ManagementClusterConnection)

ManagementClusterConnectionStatus defines the observed state of ManagementClusterConnection

FieldDescription
conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

ManagementClusterSpec

(Appears on:

ManagementCluster)

ManagementClusterSpec defines the desired state of a ManagementCluster

FieldDescription
address
string
(Optional)

This field specifies the externally reachable address to which your managed cluster will connect. When a managed cluster is added, this field is used to populate an easy-to-apply manifest that will connect both clusters. Valid examples are: “0.0.0.0:31000”, “example.com:32000”, “[::1]:32500”

tls
TLS
(Optional)

TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster.

ManagementClusterTLS

(Appears on:

ManagementClusterConnectionSpec)

FieldDescription
ca
CAType

CA indicates which verification method the tunnel client should use to verify the tunnel server’s identity.

When left blank or set to ‘Tigera’, the tunnel client will expect a self-signed cert to be included in the certificate bundle and will expect the cert to have a Common Name (CN) of ‘voltron’.

When set to ‘Public’, the tunnel client will use its installed system certs and will use the managementClusterAddr to verify the tunnel server’s identity.

Default: Tigera

ManagerDeployment

(Appears on:

ManagerSpec)

ManagerDeployment is the configuration for the Manager Deployment.

FieldDescription
spec
ManagerDeploymentSpec
(Optional)

Spec is the specification of the Manager Deployment.



ManagerDeploymentContainer

(Appears on:

ManagerDeploymentPodSpec)

ManagerDeploymentContainer is a Manager Deployment container.

FieldDescription
name
string

Name is an enum which identifies the Manager Deployment container by name. Supported values are: tigera-voltron, tigera-manager, tigera-es-proxy

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Manager Deployment container’s resources. If omitted, the Manager Deployment will use its default value for this container’s resources.

ManagerDeploymentInitContainer

(Appears on:

ManagerDeploymentPodSpec)

ManagerDeploymentInitContainer is a Manager Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the Manager Deployment init container by name. Supported values are: manager-tls-key-cert-provisioner, internal-manager-tls-key-cert-provisioner, tigera-voltron-linseed-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Manager Deployment init container’s resources. If omitted, the Manager Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

ManagerDeploymentPodSpec

(Appears on:

ManagerDeploymentPodTemplateSpec)

ManagerDeploymentPodSpec is the Manager Deployment’s PodSpec.

FieldDescription
initContainers
[]ManagerDeploymentInitContainer
(Optional)

InitContainers is a list of Manager init containers. If specified, this overrides the specified Manager Deployment init containers. If omitted, the Manager Deployment will use its default values for its init containers.

containers
[]ManagerDeploymentContainer
(Optional)

Containers is a list of Manager containers. If specified, this overrides the specified Manager Deployment containers. If omitted, the Manager Deployment will use its default values for its containers.

ManagerDeploymentPodTemplateSpec

(Appears on:

ManagerDeploymentSpec)

ManagerDeploymentPodTemplateSpec is the Manager Deployment’s PodTemplateSpec

FieldDescription
spec
ManagerDeploymentPodSpec
(Optional)

Spec is the Manager Deployment’s PodSpec.



ManagerDeploymentSpec

(Appears on:

ManagerDeployment)

ManagerDeploymentSpec defines configuration for the Manager Deployment.

FieldDescription
template
ManagerDeploymentPodTemplateSpec
(Optional)

Template describes the Manager Deployment pod that will be created.

ManagerSpec

(Appears on:

Manager)

ManagerSpec defines configuration for the Calico Enterprise manager GUI.

FieldDescription
managerDeployment
ManagerDeployment
(Optional)

ManagerDeployment configures the Manager Deployment.

ManagerStatus

(Appears on:

Manager)

ManagerStatus defines the observed state of the Calico Enterprise manager GUI.

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Metadata

(Appears on:

APIServerDeployment,APIServerDeploymentPodTemplateSpec,CSINodeDriverDaemonSet,CSINodeDriverDaemonSetPodTemplateSpec,CalicoKubeControllersDeployment,CalicoKubeControllersDeploymentPodTemplateSpec,CalicoNodeDaemonSet,CalicoNodeDaemonSetPodTemplateSpec,CalicoNodeWindowsDaemonSet,CalicoNodeWindowsDaemonSetPodTemplateSpec,CalicoWindowsUpgradeDaemonSet,CalicoWindowsUpgradeDaemonSetPodTemplateSpec,TyphaDeployment,TyphaDeploymentPodTemplateSpec)

Metadata contains the standard Kubernetes labels and annotations fields.

FieldDescription
labels
map[string]string
(Optional)

Labels is a map of string keys and values that may match replicaset and service selectors. Each of these key/value pairs are added to the object’s labels provided the key does not already exist in the object’s labels.

annotations
map[string]string
(Optional)

Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object’s annotations provided the key does not already exist in the object’s annotations.

MonitorSpec

(Appears on:

Monitor)

MonitorSpec defines the desired state of Tigera monitor.

FieldDescription
externalPrometheus
ExternalPrometheus

ExternalPrometheus optionally configures integration with an external Prometheus for scraping Calico metrics. When specified, the operator will render resources in the defined namespace. This option can be useful for configuring scraping from git-ops tools without the need of post-installation steps.

prometheus
Prometheus
(Optional)

Prometheus is the configuration for the Prometheus.

alertManager
AlertManager
(Optional)

AlertManager is the configuration for the AlertManager.

MonitorStatus

(Appears on:

Monitor)

MonitorStatus defines the observed state of Tigera monitor.

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

MultiInterfaceMode (string alias)

(Appears on:

CalicoNetworkSpec)

MultiInterfaceMode describes the method of providing multiple pod interfaces.

One of: None, Multus

NATOutgoingType (string alias)

(Appears on:

IPPool)

NATOutgoingType describe the type of outgoing NAT to use.

One of: Enabled, Disabled

NativeIP (string alias)

(Appears on:

AWSEgressGateway)

NativeIP defines if Egress Gateway pods should have AWS IPs. When NativeIP is enabled, the IPPools should be backed by AWS subnet.

NodeAddressAutodetection

(Appears on:

CalicoNetworkSpec)

NodeAddressAutodetection provides configuration options for auto-detecting node addresses. At most one option can be used. If no detection option is specified, then IP auto detection will be disabled for this address family and IPs must be specified directly on the Node resource.

FieldDescription
firstFound
bool
(Optional)

FirstFound uses default interface matching parameters to select an interface, performing best-effort filtering based on well-known interface names.

kubernetes
KubernetesAutodetectionMethod
(Optional)

Kubernetes configures Calico to detect node addresses based on the Kubernetes API.

interface
string
(Optional)

Interface enables IP auto-detection based on interfaces that match the given regex.

skipInterface
string
(Optional)

SkipInterface enables IP auto-detection based on interfaces that do not match the given regex.

canReach
string
(Optional)

CanReach enables IP auto-detection based on which source address on the node is used to reach the specified IP or domain.

cidrs
[]string

CIDRS enables IP auto-detection based on which addresses on the nodes are within one of the provided CIDRs.

NodeAffinity

(Appears on:

TyphaAffinity)

NodeAffinity is similar to *v1.NodeAffinity, but allows us to limit available schedulers.

FieldDescription
preferredDuringSchedulingIgnoredDuringExecution
[]Kubernetes core/v1.PreferredSchedulingTerm
(Optional)

The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions.

requiredDuringSchedulingIgnoredDuringExecution
Kubernetes core/v1.NodeSelector
(Optional)

WARNING: Please note that if the affinity requirements specified by this field are not met at scheduling time, the pod will NOT be scheduled onto the node. There is no fallback to another affinity rules with this setting. This may cause networking disruption or even catastrophic failure! PreferredDuringSchedulingIgnoredDuringExecution should be used for affinity unless there is a specific well understood reason to use RequiredDuringSchedulingIgnoredDuringExecution and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution will always have sufficient nodes to satisfy the requirement. NOTE: RequiredDuringSchedulingIgnoredDuringExecution is set by default for AKS nodes, to avoid scheduling Typhas on virtual-nodes. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

NodeSet

(Appears on:

Nodes)

NodeSets defines configuration specific to each Elasticsearch Node Set

FieldDescription
selectionAttributes
[]NodeSetSelectionAttribute

SelectionAttributes defines K8s node attributes a NodeSet should use when setting the Node Affinity selectors and Elasticsearch cluster awareness attributes for the Elasticsearch nodes. The list of SelectionAttributes are used to define Node Affinities and set the node awareness configuration in the running Elasticsearch instance.

NodeSetSelectionAttribute

(Appears on:

NodeSet)

NodeSetSelectionAttribute defines a K8s node “attribute” the Elasticsearch nodes should be aware of. The “Name” and “Value” are used together to set the “awareness” attributes in Elasticsearch, while the “NodeLabel” and “Value” are used together to define Node Affinity for the Pods created for the Elasticsearch nodes.

FieldDescription
name
string
nodeLabel
string
value
string

Nodes

(Appears on:

LogStorageSpec)

Nodes defines the configuration for a set of identical Elasticsearch cluster nodes, each of type master, data, and ingest.

FieldDescription
count
int64

Count defines the number of nodes in the Elasticsearch cluster.

nodeSets
[]NodeSet
(Optional)

NodeSets defines configuration specific to each Elasticsearch Node Set

resourceRequirements
Kubernetes core/v1.ResourceRequirements
(Optional)

ResourceRequirements defines the resource limits and requirements for the Elasticsearch cluster.

NonPrivilegedType (string alias)

(Appears on:

InstallationSpec)

NonPrivilegedType specifies whether Calico runs as permissioned or not

One of: Enabled, Disabled

OIDCType (string alias)

(Appears on:

AuthenticationOIDC)

OIDCType defines how OIDC is configured for Tigera Enterprise. Dex should be the best option for most use-cases. The Tigera option can help in specific use-cases, for instance, when you are unable to configure a client secret. One of: Dex, Tigera

PacketCaptureAPIDeployment

(Appears on:

PacketCaptureAPISpec)

PacketCaptureAPIDeployment is the configuration for the PacketCaptureAPI Deployment.

FieldDescription
spec
PacketCaptureAPIDeploymentSpec
(Optional)

Spec is the specification of the PacketCaptureAPI Deployment.



PacketCaptureAPIDeploymentContainer

(Appears on:

PacketCaptureAPIDeploymentPodSpec)

PacketCaptureAPIDeploymentContainer is a PacketCaptureAPI Deployment container.

FieldDescription
name
string

Name is an enum which identifies the PacketCaptureAPI Deployment container by name. Supported values are: tigera-packetcapture-server

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PacketCaptureAPI Deployment container’s resources. If omitted, the PacketCaptureAPI Deployment will use its default value for this container’s resources.

PacketCaptureAPIDeploymentInitContainer

(Appears on:

PacketCaptureAPIDeploymentPodSpec)

PacketCaptureAPIDeploymentInitContainer is a PacketCaptureAPI Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the PacketCaptureAPI Deployment init container by name. Supported values are: tigera-packetcapture-server-tls-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PacketCaptureAPI Deployment init container’s resources. If omitted, the PacketCaptureAPI Deployment will use its default value for this init container’s resources.

PacketCaptureAPIDeploymentPodSpec

(Appears on:

PacketCaptureAPIDeploymentPodTemplateSpec)

PacketCaptureAPIDeploymentPodSpec is the PacketCaptureAPI Deployment’s PodSpec.

FieldDescription
initContainers
[]PacketCaptureAPIDeploymentInitContainer
(Optional)

InitContainers is a list of PacketCaptureAPI init containers. If specified, this overrides the specified PacketCaptureAPI Deployment init containers. If omitted, the PacketCaptureAPI Deployment will use its default values for its init containers.

containers
[]PacketCaptureAPIDeploymentContainer
(Optional)

Containers is a list of PacketCaptureAPI containers. If specified, this overrides the specified PacketCaptureAPI Deployment containers. If omitted, the PacketCaptureAPI Deployment will use its default values for its containers.

PacketCaptureAPIDeploymentPodTemplateSpec

(Appears on:

PacketCaptureAPIDeploymentSpec)

PacketCaptureAPIDeploymentPodTemplateSpec is the PacketCaptureAPI Deployment’s PodTemplateSpec

FieldDescription
spec
PacketCaptureAPIDeploymentPodSpec
(Optional)

Spec is the PacketCaptureAPI Deployment’s PodSpec.



PacketCaptureAPIDeploymentSpec

(Appears on:

PacketCaptureAPIDeployment)

PacketCaptureAPIDeploymentSpec defines configuration for the PacketCaptureAPI Deployment.

FieldDescription
template
PacketCaptureAPIDeploymentPodTemplateSpec
(Optional)

Template describes the PacketCaptureAPI Deployment pod that will be created.

PacketCaptureAPISpec

(Appears on:

PacketCaptureAPI)

PacketCaptureAPISpec defines configuration for the Packet Capture API.

FieldDescription
packetCaptureAPIDeployment
PacketCaptureAPIDeployment
(Optional)

PacketCaptureAPIDeployment configures the PacketCaptureAPI Deployment.

PacketCaptureAPIStatus

(Appears on:

PacketCaptureAPI)

PacketCaptureAPIStatus defines the observed state of the Packet Capture API.

FieldDescription
state
string

State provides user-readable status.

conditions
[]Kubernetes meta/v1.Condition
(Optional)

Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

PathMatch

(Appears on:

TLSTerminatedRouteSpec)

FieldDescription
path
string

Path is the path portion of the URL based on which we proxy.

pathRegexp
string
(Optional)

PathRegexp, if not nil, checks if Regexp matches the path.

pathReplace
string
(Optional)

PathReplace if not nil will be used to replace PathRegexp matches.

PolicyRecommendationDeployment

(Appears on:

PolicyRecommendationSpec)

PolicyRecommendationDeployment is the configuration for the PolicyRecommendation Deployment.

FieldDescription
spec
PolicyRecommendationDeploymentSpec
(Optional)

Spec is the specification of the PolicyRecommendation Deployment.



PolicyRecommendationDeploymentContainer

(Appears on:

PolicyRecommendationDeploymentPodSpec)

PolicyRecommendationDeploymentContainer is a PolicyRecommendation Deployment container.

FieldDescription
name
string

Name is an enum which identifies the PolicyRecommendation Deployment container by name. Supported values are: policy-recommendation-controller

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PolicyRecommendation Deployment container’s resources. If omitted, the PolicyRecommendation Deployment will use its default value for this container’s resources.

PolicyRecommendationDeploymentInitContainer

(Appears on:

PolicyRecommendationDeploymentPodSpec)

PolicyRecommendationDeploymentInitContainer is a PolicyRecommendation Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the PolicyRecommendation Deployment init container by name.

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PolicyRecommendation Deployment init container’s resources. If omitted, the PolicyRecommendation Deployment will use its default value for this init container’s resources.

PolicyRecommendationDeploymentPodSpec

(Appears on:

PolicyRecommendationDeploymentPodTemplateSpec)

PolicyRecommendationDeploymentPodSpec is the PolicyRecommendation Deployment’s PodSpec.

FieldDescription
initContainers
[]PolicyRecommendationDeploymentInitContainer
(Optional)

InitContainers is a list of PolicyRecommendation init containers. If specified, this overrides the specified PolicyRecommendation Deployment init containers. If omitted, the PolicyRecommendation Deployment will use its default values for its init containers.

containers
[]PolicyRecommendationDeploymentContainer
(Optional)

Containers is a list of PolicyRecommendation containers. If specified, this overrides the specified PolicyRecommendation Deployment containers. If omitted, the PolicyRecommendation Deployment will use its default values for its containers.

PolicyRecommendationDeploymentPodTemplateSpec

(Appears on:

PolicyRecommendationDeploymentSpec)

PolicyRecommendationDeploymentPodTemplateSpec is the PolicyRecommendation Deployment’s PodTemplateSpec

FieldDescription
spec
PolicyRecommendationDeploymentPodSpec
(Optional)

Spec is the PolicyRecommendation Deployment’s PodSpec.



PolicyRecommendationDeploymentSpec

(Appears on:

PolicyRecommendationDeployment)

PolicyRecommendationDeploymentSpec defines configuration for the PolicyRecommendation Deployment.

FieldDescription
template
PolicyRecommendationDeploymentPodTemplateSpec
(Optional)

Template describes the PolicyRecommendation Deployment pod that will be created.

PolicyRecommendationSpec

(Appears on:

PolicyRecommendation)

PolicyRecommendationSpec defines configuration for the Calico Enterprise Policy Recommendation service.

FieldDescription
policyRecommendationDeployment
PolicyRecommendationDeployment
(Optional)

PolicyRecommendation configures the PolicyRecommendation Deployment.

PolicyRecommendationStatus

(Appears on:

PolicyRecommendation)

PolicyRecommendationStatus defines the observed state of Tigera policy recommendation.

FieldDescription
state
string

State provides user-readable status.

ProductVariant (string alias)

(Appears on:

InstallationSpec,InstallationStatus)

ProductVariant represents the variant of the product.

One of: Calico, TigeraSecureEnterprise

Prometheus

(Appears on:

MonitorSpec)

FieldDescription
spec
PrometheusSpec
(Optional)

Spec is the specification of the Prometheus.



PrometheusContainer

(Appears on:

CommonPrometheusFields)

PrometheusContainer is a Prometheus container.

FieldDescription
name
string

Name is an enum which identifies the Prometheus Deployment container by name. Supported values are: authn-proxy

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Prometheus container’s resources. If omitted, the Prometheus will use its default value for this container’s resources.

PrometheusSpec

(Appears on:

Prometheus)

FieldDescription
commonPrometheusFields
CommonPrometheusFields

CommonPrometheusFields are the options available to both the Prometheus server and agent.

PromptType (string alias)

(Appears on:

AuthenticationOIDC)

PromptType is a value that specifies whether the identity provider prompts the end user for re-authentication and consent. One of: None, Login, Consent, SelectAccount.

Provider (string alias)

(Appears on:

InstallationSpec)

Provider represents a particular provider or flavor of Kubernetes. Valid options are: EKS, GKE, AKS, RKE2, OpenShift, DockerEnterprise, TKG.

Retention

(Appears on:

LogStorageSpec)

Retention defines how long data is retained in an Elasticsearch cluster before it is cleared.

FieldDescription
flows
int32
(Optional)

Flows configures the retention period for flow logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 8

auditReports
int32
(Optional)

AuditReports configures the retention period for audit logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 91

snapshots
int32
(Optional)

Snapshots configures the retention period for snapshots, in days. Snapshots are periodic captures of resources which along with audit events are used to generate reports. Consult the Compliance Reporting documentation for more details on snapshots. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 91

complianceReports
int32
(Optional)

ComplianceReports configures the retention period for compliance reports, in days. Reports are output from the analysis of the system state and audit events for compliance reporting. Consult the Compliance Reporting documentation for more details on reports. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 91

dnsLogs
int32
(Optional)

DNSLogs configures the retention period for DNS logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 8

bgpLogs
int32
(Optional)

BGPLogs configures the retention period for BGP logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 8

S3StoreSpec

(Appears on:

AdditionalLogStoreSpec)

S3StoreSpec defines configuration for exporting logs to Amazon S3.

FieldDescription
region
string

AWS Region of the S3 bucket

bucketName
string

Name of the S3 bucket to send logs

bucketPath
string

Path in the S3 bucket where to send logs

SNIMatch

(Appears on:

TLSPassThroughRouteSpec)

FieldDescription
serverName
string

ServerName is used to match the server name for the request.

ServiceMonitor

(Appears on:

ExternalPrometheus)

FieldDescription
labels
map[string]string

Labels are the metadata.labels of the ServiceMonitor. When combined with spec.serviceMonitorSelector.matchLabels on your prometheus instance, the service monitor will automatically be picked up. Default: k8s-app=tigera-prometheus

endpoints
[]Endpoint

The endpoints to scrape. This struct contains a subset of the Endpoint as defined in the prometheus docs. Fields related to connecting to our Prometheus server are automatically set by the operator.

SplunkStoreSpec

(Appears on:

AdditionalLogStoreSpec)

SplunkStoreSpec defines configuration for exporting logs to splunk.

FieldDescription
endpoint
string

Location for splunk’s http event collector end point. example https://1.2.3.4:8088

StatusConditionType (string alias)

(Appears on:

TigeraStatusCondition)

StatusConditionType is a type of condition that may apply to a particular component.

Sysctl

(Appears on:

CalicoNetworkSpec)

FieldDescription
key
string
value
string

SyslogLogType (string alias)

(Appears on:

SyslogStoreSpec)

SyslogLogType represents the allowable log types for syslog. Allowable values are Audit, DNS, Flows and IDSEvents. * Audit corresponds to audit logs for both Kubernetes resources and Enterprise custom resources. * DNS corresponds to DNS logs generated by Calico node. * Flows corresponds to flow logs generated by Calico node. * IDSEvents corresponds to event logs for the intrusion detection system (anomaly detection, suspicious IPs, suspicious domains and global alerts).

SyslogStoreSpec

(Appears on:

AdditionalLogStoreSpec)

SyslogStoreSpec defines configuration for exporting logs to syslog.

FieldDescription
endpoint
string

Location of the syslog server. example: tcp://1.2.3.4:601

packetSize
int32
(Optional)

PacketSize defines the maximum size of packets to send to syslog. In general this is only needed if you notice long logs being truncated. Default: 1024

logTypes
[]SyslogLogType

If no values are provided, the list will be updated to include log types Audit, DNS and Flows. Default: Audit, DNS, Flows

encryption
EncryptionOption
(Optional)

Encryption configures traffic encryption to the Syslog server. Default: None

TLS

(Appears on:

ManagementClusterSpec)

FieldDescription
secretName
string
(Optional)

SecretName indicates the name of the secret in the tigera-operator namespace that contains the private key and certificate that the management cluster uses when it listens for incoming connections.

When set to tigera-management-cluster-connection voltron will use the same cert bundle which Guardian client certs are signed with.

When set to manager-tls, voltron will use the same cert bundle which Manager UI is served with. This cert bundle must be a publicly signed cert created by the user. Note that Tigera Operator will generate a self-signed manager-tls cert if one does not exist, and use of that cert will result in Guardian being unable to verify Voltron’s identity.

If changed on a running cluster with connected managed clusters, all managed clusters will disconnect as they will no longer be able to verify Voltron’s identity. To reconnect existing managed clusters, change the tls.ca of the managed clusters’ ManagementClusterConnection resource.

One of: tigera-management-cluster-connection, manager-tls

Default: tigera-management-cluster-connection

TLSPassThroughRouteSpec

(Appears on:

TLSPassThroughRoute)

FieldDescription
target
TargetType
sniMatch
SNIMatch

SNIMatch is used to match requests based on the server name for the intended destination server. Matching requests will be proxied to the Destination.

destination
string

Destination is the destination url to proxy the request to.

TLSTerminatedRouteSpec

(Appears on:

TLSTerminatedRoute)

FieldDescription
target
TargetType
pathMatch
PathMatch

PathMatch is used to match requests based on what’s in the path. Matching requests will be proxied to the Destination defined in this structure.

destination
string

Destination is the destination URL where matching traffic is routed to.

caBundle
Kubernetes core/v1.ConfigMapKeySelector

CABundle is where we read the CA bundle from to authenticate the destination (if non-empty)

mtlsCert
Kubernetes core/v1.SecretKeySelector
(Optional)

ForwardingMTLSCert is the certificate used for mTLS between voltron and the destination. Either both ForwardingMTLSCert and ForwardingMTLSKey must be specified, or neither can be specified.

mtlsKey
Kubernetes core/v1.SecretKeySelector
(Optional)

ForwardingMTLSKey is the key used for mTLS between voltron and the destination. Either both ForwardingMTLSCert and ForwardingMTLSKey must be specified, or neither can be specified.

unauthenticated
bool
(Optional)

Unauthenticated says whether the request should go through authentication. This is only applicable if the Target is UI.

TargetType (string alias)

(Appears on:

TLSPassThroughRouteSpec,TLSTerminatedRouteSpec)

TenantElasticSpec

(Appears on:

TenantSpec)

FieldDescription
url
string
kibanaURL
string
mutualTLS
bool

TenantSpec

(Appears on:

Tenant)

FieldDescription
id
string

ID is the unique identifier for this tenant.

name
string

Name is a human readable name for this tenant.

indices
[]Index

Indices defines the how to store a tenant’s data

elastic
TenantElasticSpec

Elastic configures per-tenant ElasticSearch and Kibana parameters. This field is required for clusters using external ES.

controlPlaneReplicas
int32
(Optional)

ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed in the Tenant’s namespace. Defaults to the controlPlaneReplicas in Installation CR

linseedDeployment
LinseedDeployment

LinseedDeployment configures the linseed Deployment.

dashboardsJob
DashboardsJob

DashboardsJob configures the Dashboards job

TenantStatus

(Appears on:

Tenant)

TigeraStatusCondition

(Appears on:

TigeraStatusStatus)

TigeraStatusCondition represents a condition attached to a particular component.

FieldDescription
type
StatusConditionType

The type of condition. May be Available, Progressing, or Degraded.

status
ConditionStatus

The status of the condition. May be True, False, or Unknown.

lastTransitionTime
Kubernetes meta/v1.Time

The timestamp representing the start time for the current status.

reason
string

A brief reason explaining the condition.

message
string

Optionally, a detailed message providing additional context.

observedGeneration
int64
(Optional)

observedGeneration represents the generation that the condition was set based upon. For instance, if generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

TigeraStatusReason (string alias)

TigeraStatusReason represents the reason for a particular condition.

TigeraStatusSpec

(Appears on:

TigeraStatus)

TigeraStatusSpec defines the desired state of TigeraStatus

TigeraStatusStatus

(Appears on:

TigeraStatus)

TigeraStatusStatus defines the observed state of TigeraStatus

FieldDescription
conditions
[]TigeraStatusCondition

Conditions represents the latest observed set of conditions for this component. A component may be one or more of Available, Progressing, or Degraded.

TyphaAffinity

(Appears on:

InstallationSpec)

Deprecated. Please use TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods.

FieldDescription
nodeAffinity
NodeAffinity
(Optional)

NodeAffinity describes node affinity scheduling rules for typha.

TyphaDeployment

(Appears on:

InstallationSpec)

TyphaDeployment is the configuration for the typha Deployment.

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
TyphaDeploymentSpec
(Optional)

Spec is the specification of the typha Deployment.



TyphaDeploymentContainer

(Appears on:

TyphaDeploymentPodSpec)

TyphaDeploymentContainer is a typha Deployment container.

FieldDescription
name
string

Name is an enum which identifies the typha Deployment container by name. Supported values are: calico-typha

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment container’s resources. If omitted, the typha Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

TyphaDeploymentInitContainer

(Appears on:

TyphaDeploymentPodSpec)

TyphaDeploymentInitContainer is a typha Deployment init container.

FieldDescription
name
string

Name is an enum which identifies the typha Deployment init container by name. Supported values are: typha-certs-key-cert-provisioner

resources
Kubernetes core/v1.ResourceRequirements
(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment init container’s resources. If omitted, the typha Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

TyphaDeploymentPodSpec

(Appears on:

TyphaDeploymentPodTemplateSpec)

TyphaDeploymentPodSpec is the typha Deployment’s PodSpec.

FieldDescription
initContainers
[]TyphaDeploymentInitContainer
(Optional)

InitContainers is a list of typha init containers. If specified, this overrides the specified typha Deployment init containers. If omitted, the typha Deployment will use its default values for its init containers.

containers
[]TyphaDeploymentContainer
(Optional)

Containers is a list of typha containers. If specified, this overrides the specified typha Deployment containers. If omitted, the typha Deployment will use its default values for its containers.

affinity
Kubernetes core/v1.Affinity
(Optional)

Affinity is a group of affinity scheduling rules for the typha pods. If specified, this overrides any affinity that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for affinity. If used in conjunction with the deprecated TyphaAffinity, then this value takes precedence. WARNING: Please note that this field will override the default calico-typha Deployment affinity.

nodeSelector
map[string]string

NodeSelector is the calico-typha pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-typha Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-typha Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-typha Deployment nodeSelector.

terminationGracePeriodSeconds
int64
(Optional)

Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.

topologySpreadConstraints
[]Kubernetes core/v1.TopologySpreadConstraint
(Optional)

TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.

tolerations
[]Kubernetes core/v1.Toleration
(Optional)

Tolerations is the typha pod’s tolerations. If specified, this overrides any tolerations that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-typha Deployment tolerations.

TyphaDeploymentPodTemplateSpec

(Appears on:

TyphaDeploymentSpec)

TyphaDeploymentPodTemplateSpec is the typha Deployment’s PodTemplateSpec

FieldDescription
metadata
Metadata
(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
TyphaDeploymentPodSpec
(Optional)

Spec is the typha Deployment’s PodSpec.



TyphaDeploymentSpec

(Appears on:

TyphaDeployment)

TyphaDeploymentSpec defines configuration for the typha Deployment.

FieldDescription
minReadySeconds
int32
(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for minReadySeconds.

template
TyphaDeploymentPodTemplateSpec
(Optional)

Template describes the typha Deployment pod that will be created.

strategy
TyphaDeploymentStrategy
(Optional)

The deployment strategy to use to replace existing pods with new ones.

TyphaDeploymentStrategy

(Appears on:

TyphaDeploymentSpec)

TyphaDeploymentStrategy describes how to replace existing pods with new ones. Only RollingUpdate is supported at this time so the Type field is not exposed.

FieldDescription
rollingUpdate
Kubernetes apps/v1.RollingUpdateDeployment
(Optional)

Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. to be.

UserMatch

(Appears on:

GroupSearch)

UserMatch when the value of a UserAttribute and a GroupAttribute match, a user belongs to the group.

FieldDescription
userAttribute
string

The attribute of a user that links it to a group.

groupAttribute
string

The attribute of a group that links it to a user.

UserSearch

(Appears on:

AuthenticationLDAP)

User entry search configuration to match the credentials with a user.

FieldDescription
baseDN
string

BaseDN to start the search from. For example “cn=users,dc=example,dc=com”

filter
string
(Optional)

Optional filter to apply when searching the directory. For example “(objectClass=person)”

nameAttribute
string
(Optional)

A mapping of the attribute that is used as the username. This attribute can be used to apply RBAC to a user. Default: uid

WAFStatusType (string alias)

(Appears on:

ApplicationLayerSpec)

WindowsDataplaneOption (string alias)

(Appears on:

CalicoNetworkSpec)

WindowsNodeSpec

(Appears on:

InstallationSpec)

FieldDescription
cniBinDir
string
(Optional)

CNIBinDir is the path to the CNI binaries directory on Windows, it must match what is used as ‘bin_dir’ under [plugins] [plugins.“io.containerd.grpc.v1.cri”] [plugins.“io.containerd.grpc.v1.cri”.cni] on the containerd ‘config.toml’ file on the Windows nodes.

cniConfigDir
string
(Optional)

CNIConfigDir is the path to the CNI configuration directory on Windows, it must match what is used as ‘conf_dir’ under [plugins] [plugins.“io.containerd.grpc.v1.cri”] [plugins.“io.containerd.grpc.v1.cri”.cni] on the containerd ‘config.toml’ file on the Windows nodes.

cniLogDir
string
(Optional)

CNILogDir is the path to the Calico CNI logs directory on Windows.

vxlanMACPrefix
string
(Optional)

VXLANMACPrefix is the prefix used when generating MAC addresses for virtual NICs

vxlanAdapter
string
(Optional)

VXLANAdapter is the Network Adapter used for VXLAN, leave blank for primary NIC