Commit 436f150d authored by Muhammad Umair Khan's avatar Muhammad Umair Khan
Browse files

change pod network CIDR to 10.244.0.0/16 to avoid VPN pool conflict 

192.168.0.0/16 overlaps the VPN address pool. Use 10.244.0.0/16 for
kubeadm --pod-network-cidr and render the Calico custom-resources-bpf
manifest from a template so its IP pool CIDR follows pod_network_cidr.

Co-Authored-By: default avatarClaude Opus 5.5 <noreply@anthropic.com>
parent cdfaa97a

deploy/pyinfra/group_data/all.py

+6 −2
Changes for deploy/pyinfra/group_data/all.py: 6 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -89,7 +89,9 @@ kubernetes_repo_apt_key_url = f"https://pkgs.k8s.io/core:/stable:/{kubernetes_ve 
kubernetes_repo_apt_entry = f"deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/{kubernetes_version_series}/deb/ /"



kubeadm_cluster_name = "mec-sandbox"

pod_network_cidr = "192.168.0.0/16"

# Pod CIDR is used for both `kubeadm init --pod-network-cidr` and the Calico IP pool.

# Must not overlap with node/LAN/VPN networks (192.168.0.0/16 is our VPN pool) or service_cidr.

pod_network_cidr = "10.244.0.0/16"

service_cidr = "10.96.0.0/12"

apiserver_advertise_address = "127.0.0.1"
@@ -99,7 +101,9 @@ apiserver_advertise_address = "127.0.0.1" 
calico_version = "v3.31.4"

calico_operator_crds_manifest = f"https://raw.githubusercontent.com/projectcalico/calico/{calico_version}/manifests/operator-crds.yaml"

calico_operator_manifest = f"https://raw.githubusercontent.com/projectcalico/calico/{calico_version}/manifests/tigera-operator.yaml"

calico_custom_resources_manifest = f"https://raw.githubusercontent.com/projectcalico/calico/{calico_version}/manifests/custom-resources-bpf.yaml"

# Rendered from templates/calico-custom-resources-bpf.yaml.j2 (upstream custom-resources-bpf.yaml

# with the IP pool CIDR set from pod_network_cidr) and applied from this path on the master.

calico_custom_resources_manifest = "/etc/kubernetes/addons/calico-custom-resources.yaml"



helm_version = "v3.14.4"

deploy/pyinfra/tasks/k8s_cluster/cni_calico.py

+22 −0
Changes for deploy/pyinfra/tasks/k8s_cluster/cni_calico.py: 22 added lines, 0 removed lines.
Original line number Diff line number Diff line 
import os



from pyinfra import host

from pyinfra.operations import files

from lib.operations import kubernetes



target_user = host.data.get('target_user')
@@ -27,6 +30,25 @@ kubernetes.apply( 
    wait_timeout="300s"

)



# Render Calico custom resources so the IP pool matches kubeadm's --pod-network-cidr

files.directory(

    name="Create Kubernetes addons directory",

    path=os.path.dirname(calico_custom_resources_manifest),

    mode="0755",

    present=True,

    _sudo=True

)



files.template(

    name="Render Calico custom resources manifest",

    src="templates/calico-custom-resources-bpf.yaml.j2",

    dest=calico_custom_resources_manifest,

    mode="0644",

    calico_version=host.data.get('calico_version'),

    pod_network_cidr=host.data.get('pod_network_cidr'),

    _sudo=True

)



# Apply Calico custom resources manifest

kubernetes.apply(

    name="Apply Calico custom resources manifest",

deploy/pyinfra/templates/calico-custom-resources-bpf.yaml.j2

0 → 100644
+48 −0
Changes for deploy/pyinfra/templates/calico-custom-resources-bpf.yaml.j2: 48 added lines, 0 removed lines.
Original line number Diff line number Diff line 
# Rendered by pyinfra from upstream Calico manifests/custom-resources-bpf.yaml

# (https://github.com/projectcalico/calico/blob/{{ calico_version }}/manifests/custom-resources-bpf.yaml).

# The only deviation from upstream is that the IP pool CIDR comes from

# `pod_network_cidr` so it always matches `kubeadm init --pod-network-cidr`.

# When bumping `calico_version`, diff this file against the new upstream manifest.



# This section includes base Calico installation configuration.

# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation

apiVersion: operator.tigera.io/v1

kind: Installation

metadata:

  name: default

spec:

  # Configures Calico networking.

  calicoNetwork:

    linuxDataplane: BPF

    bpfNetworkBootstrap: Enabled

    kubeProxyManagement: Enabled

    ipPools:

      - name: default-ipv4-ippool

        blockSize: 26

        cidr: {{ pod_network_cidr }}

        encapsulation: VXLANCrossSubnet

        natOutgoing: Enabled

        nodeSelector: all()



---

# This section configures the Calico API server.

# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer

apiVersion: operator.tigera.io/v1

kind: APIServer

metadata:

  name: default

spec: {}



---

# Configures the Calico Goldmane flow aggregator.

apiVersion: operator.tigera.io/v1

kind: Goldmane

metadata:

  name: default



---

# Configures the Calico Whisker observability UI.

apiVersion: operator.tigera.io/v1

kind: Whisker

metadata:

  name: default