github.com/zhyoulun/cilium@v1.6.12/pkg/defaults/defaults.go (about) 1 // Copyright 2016-2019 Authors of Cilium 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 package defaults 16 17 import ( 18 "time" 19 ) 20 21 const ( 22 // IPv6ClusterAllocCIDR is the default value for option.IPv6ClusterAllocCIDR 23 IPv6ClusterAllocCIDR = IPv6ClusterAllocCIDRBase + "/64" 24 25 // IPv6ClusterAllocCIDRBase is the default base for IPv6ClusterAllocCIDR 26 IPv6ClusterAllocCIDRBase = "f00d::" 27 28 // RuntimePath is the default path to the runtime directory 29 RuntimePath = "/var/run/cilium" 30 31 // RuntimePathRights are the default access rights of the RuntimePath directory 32 RuntimePathRights = 0775 33 34 // StateDirRights are the default access rights of the state directory 35 StateDirRights = 0770 36 37 //StateDir is the default path for the state directory relative to RuntimePath 38 StateDir = "state" 39 40 // TemplatesDir is the default path for the compiled template objects relative to StateDir 41 TemplatesDir = "templates" 42 43 // TemplatePath is the default path for a symlink to a template relative to StateDir/<EPID> 44 TemplatePath = "template.o" 45 46 // BpfDir is the default path for template files relative to LibDir 47 BpfDir = "bpf" 48 49 // LibraryPath is the default path to the cilium libraries directory 50 LibraryPath = "/var/lib/cilium" 51 52 // SockPath is the path to the UNIX domain socket exposing the API to clients locally 53 SockPath = RuntimePath + "/cilium.sock" 54 55 // SockPathEnv is the environment variable to overwrite SockPath 56 SockPathEnv = "CILIUM_SOCK" 57 58 // MonitorSockPath1_0 is the path to the UNIX domain socket used to 59 // distribute BPF and agent events to listeners. 60 // This is the 1.0 protocol version. 61 MonitorSockPath1_0 = RuntimePath + "/monitor.sock" 62 63 // MonitorSockPath1_2 is the path to the UNIX domain socket used to 64 // distribute BPF and agent events to listeners. 65 // This is the 1.2 protocol version. 66 MonitorSockPath1_2 = RuntimePath + "/monitor1_2.sock" 67 68 // PidFilePath is the path to the pid file for the agent. 69 PidFilePath = RuntimePath + "/cilium.pid" 70 71 // EnableHostIPRestore controls whether the host IP should be restored 72 // from previous state automatically 73 EnableHostIPRestore = true 74 75 // DefaultMapRoot is the default path where BPFFS should be mounted 76 DefaultMapRoot = "/sys/fs/bpf" 77 78 // DefaultCgroupRoot is the default path where cilium cgroup2 should be mounted 79 DefaultCgroupRoot = "/var/run/cilium/cgroupv2" 80 81 // SockopsEnable controsl whether sockmap should be used 82 SockopsEnable = false 83 84 // DefaultMapRootFallback is the path which is used when /sys/fs/bpf has 85 // a mount, but with the other filesystem than BPFFS. 86 DefaultMapRootFallback = "/run/cilium/bpffs" 87 88 // DefaultMapPrefix is the default prefix for all BPF maps. 89 DefaultMapPrefix = "tc/globals" 90 91 // ToFQDNsMinTTL is the default lower bound for TTLs used with ToFQDNs rules. 92 // This or ToFQDNsMinTTLPoller is used in DaemonConfig.Populate 93 ToFQDNsMinTTL = 604800 // 1 week in seconds 94 95 // ToFQDNsMinTTLPoller is the default lower bound for TTLs used with ToFQDNs 96 // rules when the poller is enabled. 97 // This or ToFQDNsMinTTL is used in DaemonConfig.Populate 98 ToFQDNsMinTTLPoller = 3600 // 1 hour in seconds 99 100 // ToFQDNsMaxIPsPerHost defines the maximum number of IPs to maintain 101 // for each FQDN name in an endpoint's FQDN cache 102 ToFQDNsMaxIPsPerHost = 50 103 104 // ToFQDNsPreCache is a path to a file with DNS cache data to insert into the 105 // global cache on startup. 106 // The file is not re-read after agent start. 107 ToFQDNsPreCache = "" 108 109 // IdentityChangeGracePeriod is the default value for 110 // option.IdentityChangeGracePeriod 111 IdentityChangeGracePeriod = 5 * time.Second 112 113 // ExecTimeout is a timeout for executing commands. 114 ExecTimeout = 300 * time.Second 115 116 // StatusCollectorInterval is the interval between a probe invocations 117 StatusCollectorInterval = 5 * time.Second 118 119 // StatusCollectorWarningThreshold is the duration after which a probe 120 // is declared as stale 121 StatusCollectorWarningThreshold = 15 * time.Second 122 123 // StatusCollectorFailureThreshold is the duration after which a probe 124 // is considered failed 125 StatusCollectorFailureThreshold = 1 * time.Minute 126 127 // EnableIPv4 is the default value for IPv4 enablement 128 EnableIPv4 = true 129 130 // EnableIPv6 is the default value for IPv6 enablement 131 EnableIPv6 = true 132 133 // EnableL7Proxy is the default value for L7 proxy enablement 134 EnableL7Proxy = true 135 136 // PreAllocateMaps is the default value for BPF map preallocation 137 PreAllocateMaps = true 138 139 // EnableIPSec is the default value for IPSec enablement 140 EnableIPSec = false 141 142 // EncryptNode enables encrypting traffic from host networking applications 143 // which are not part of Cilium manged pods. 144 EncryptNode = false 145 146 // MonitorQueueSizePerCPU is the default value for the monitor queue 147 // size per CPU 148 MonitorQueueSizePerCPU = 1024 149 150 // MonitorQueueSizePerCPUMaximum is the maximum value for the monitor 151 // queue size when derived from the number of CPUs 152 MonitorQueueSizePerCPUMaximum = 16384 153 154 // NodeInitTimeout is the time the agent is waiting until giving up to 155 // initialize the local node with the kvstore 156 NodeInitTimeout = 15 * time.Minute 157 158 // ClientConnectTimeout is the time the cilium-agent client is 159 // (optionally) waiting before returning an error. 160 ClientConnectTimeout = 30 * time.Second 161 162 // DatapathMode is the default value for the datapath mode. 163 DatapathMode = "veth" 164 165 // EnableXTSocketFallback is the default value for EnableXTSocketFallback 166 EnableXTSocketFallback = true 167 168 // EnableAutoDirectRouting is the default value for EnableAutoDirectRouting 169 EnableAutoDirectRouting = false 170 171 // EnableHealthChecking is the default value for EnableHealthChecking 172 EnableHealthChecking = true 173 174 // EnableEndpointHealthChecking is the default value for 175 // EnableEndpointHealthChecking 176 EnableEndpointHealthChecking = true 177 178 // AlignCheckerName is the BPF object name for the alignchecker. 179 AlignCheckerName = "bpf_alignchecker.o" 180 181 // KVstorePeriodicSync is the default kvstore periodic sync interval 182 KVstorePeriodicSync = 5 * time.Minute 183 184 // KVstoreConnectivityTimeout is the timeout when performing kvstore operations 185 KVstoreConnectivityTimeout = 2 * time.Minute 186 187 // KVStoreStaleLockTimeout is the timeout for when a lock is held for 188 // a kvstore path for too long. 189 KVStoreStaleLockTimeout = 30 * time.Second 190 191 // IPAllocationTimeout is the timeout when allocating CIDRs 192 IPAllocationTimeout = 2 * time.Minute 193 194 // PolicyQueueSize is the default queue size for policy-related events. 195 PolicyQueueSize = 100 196 197 // KVstoreQPS is default rate limit for kv store operations 198 KVstoreQPS = 20 199 200 // EndpointQueueSize is the default queue size for an endpoint. 201 EndpointQueueSize = 25 202 203 // SelectiveRegeneration specifies whether regeneration of endpoints will be 204 // invoked only for endpoints which are selected by policy changes. 205 SelectiveRegeneration = true 206 207 // K8sSyncTimeout specifies the standard time to allow for synchronizing 208 // local caches with Kubernetes state before exiting. 209 K8sSyncTimeout = 3 * time.Minute 210 211 // K8sWatcherEndpointSelector specifies the k8s endpoints that Cilium 212 // should watch for. 213 K8sWatcherEndpointSelector = "metadata.name!=kube-scheduler,metadata.name!=kube-controller-manager,metadata.name!=etcd-operator,metadata.name!=gcp-controller-manager" 214 215 // ConntrackGCMaxLRUInterval is the maximum conntrack GC interval when using LRU maps 216 ConntrackGCMaxLRUInterval = 12 * time.Hour 217 218 // ConntrackGCMaxInterval is the maximum conntrack GC interval for non-LRU maps 219 ConntrackGCMaxInterval = 30 * time.Minute 220 221 // ConntrackGCMinInterval is the minimum conntrack GC interval 222 ConntrackGCMinInterval = 10 * time.Second 223 224 // ConntrackGCStartingInterval is the default starting interval for 225 // connection tracking garbage collection 226 ConntrackGCStartingInterval = 5 * time.Minute 227 228 // PolicyMapEntries is the default number of entries allowed in an 229 // endpoint's policymap, ie the maximum number of peer identities that 230 // the endpoint could send/receive traffic to/from. 231 PolicyMapEntries = 16384 // Cilium 1.5 and earlier value 232 233 // K8sEventHandover enables use of the kvstore to optimize Kubernetes 234 // event handling by listening for k8s events in the operator and 235 // mirroring it into the kvstore for reduced overhead in large 236 // clusters. 237 K8sEventHandover = false 238 239 // LoopbackIPv4 is the default address for service loopback 240 LoopbackIPv4 = "169.254.42.1" 241 242 // EndpointInterfaceNamePrefix is the default prefix name of the 243 // interface names shared by all endpoints 244 EndpointInterfaceNamePrefix = "lxc+" 245 246 // BlacklistConflictingRoutes removes all IPs from the IPAM block if a 247 // local route not owned by Cilium conflicts with it 248 BlacklistConflictingRoutes = true 249 250 // ForceLocalPolicyEvalAtSource is the default value for 251 // option.ForceLocalPolicyEvalAtSource. It is enabled by default to 252 // provide backwards compatibility, it can be disabled via an option 253 ForceLocalPolicyEvalAtSource = true 254 255 // EnableEndpointRoutes is the value for option.EnableEndpointRoutes. 256 // It is disabled by default for backwards compatibility. 257 EnableEndpointRoutes = false 258 259 // AnnotateK8sNode is the default value for option.AnnotateK8sNode. It is 260 // enabled by default to annotate kubernetes node and can be disabled using 261 // the provided option. 262 AnnotateK8sNode = true 263 264 // MonitorBufferPages is the default number of pages to use for the 265 // ring buffer interacting with the kernel 266 MonitorBufferPages = 64 267 268 // NodeDeleteDelay is the delay before an unreliable node delete is 269 // handled. During this delay, the node can re-appear and the delete 270 // event is ignored. 271 NodeDeleteDelay = 30 * time.Second 272 273 // KVstoreLeaseTTL is the time-to-live of the kvstore lease. 274 KVstoreLeaseTTL = 15 * time.Minute 275 276 // KVstoreKeepAliveIntervalFactor is the factor to calculate the interval 277 // from KVstoreLeaseTTL in which KVstore lease is being renewed. 278 KVstoreKeepAliveIntervalFactor = 3 279 280 // LockLeaseTTL is the time-to-live of the lease dedicated for locks of Kvstore. 281 LockLeaseTTL = 25 * time.Second 282 283 // KVstoreLeaseMaxTTL is the upper bound for KVStore lease TTL value. 284 // It is calculated as Min(int64 positive max, etcd MaxLeaseTTL, consul MaxLeaseTTL) 285 KVstoreLeaseMaxTTL = 86400 * time.Second 286 287 // ENIPreAllocation is the default value for 288 // CiliumNode.Spec.ENI.PreAllocate if no value is set 289 ENIPreAllocation = 8 290 291 // AutoCreateCiliumNodeResource enables automatic creation of a 292 // CiliumNode resource for the local node 293 AutoCreateCiliumNodeResource = true 294 295 // PolicyTriggerInterval is default amount of time between triggers of 296 // policy updates are invoked. 297 PolicyTriggerInterval = 1 * time.Second 298 299 // K8sClientQPSLimit is the default qps for the k8s client. It is set to 0 because the the k8s client 300 // has its own default. 301 K8sClientQPSLimit float32 = 0.0 302 303 // K8sClientBurst is the default burst for the k8s client. It is set to 0 because the the k8s client 304 // has its own default. 305 K8sClientBurst = 0 306 307 // K8sServiceCacheSize is the default value for option.K8sServiceCacheSize 308 // which denotes the value of Cilium's K8s service cache size. 309 K8sServiceCacheSize = 128 310 311 // RestoreV4Addr is used as match for cilium_host v4 address 312 RestoreV4Addr = "cilium.v4.internal.raw " 313 314 // RestoreV6Addr is used as match for cilium_host v6 (router) address 315 RestoreV6Addr = "cilium.v6.internal.raw " 316 317 // IPAMExpiration is the timeout after which an IP subject to expiratio 318 // is being released again if no endpoint is being created in time. 319 IPAMExpiration = 3 * time.Minute 320 )