values.yaml

---
contiv:
  nodeToNodeTransport: "vxlan"  # possible values: "vxlan", "srv6", "nooverlay"
  useSRv6ForServices: false
  useSRv6ForServiceFunctionChaining: false
  useDX6ForSrv6NodetoNodeTransport: false
  useTAPInterfaces: true
  tapInterfaceVersion: 2
  tapv2RxRingSize: 256
  tapv2TxRingSize: 256
  enableGSO: true
  vmxnet3RxRingSize: 1024
  vmxnet3TxRingSize: 1024
  interfaceRxMode: "default"
  stealFirstNIC: false
  stnVersion: 2
  natExternalTraffic: true
  mtuSize: 1450
  cleanupIdleNATSessions: true
  tcpNATSessionTimeout: 180
  otherNATSessionTimeout: 5
  scanIPNeighbors: true
  ipNeighborScanInterval: 1
  ipNeighborStaleThreshold: 4
  serviceLocalEndpointWeight: 1
  disableNATVirtualReassembly: false
  enablePacketTrace: false
  routeServiceCIDRToVPP: false
  crdNodeConfigurationDisabled: true
  ipamConfig:
    podSubnetCIDR: 10.1.0.0/16
    podSubnetOneNodePrefixLen: 24
    vppHostSubnetCIDR: 172.30.0.0/16
    vppHostSubnetOneNodePrefixLen: 24
    nodeInterconnectCIDR: 192.168.16.0/24
    vxlanCIDR: 192.168.30.0/24
    nodeInterconnectDHCP: false
    # defaultGateway: 192.168.16.100
    # serviceCIDR: "10.96.0.0/12"
    # example of node configuration for VPP interfaces
    # nodeConfig:
    # - name: "vm1"
    #   mainInterface:
    #     interfaceName: "GigabitEthernet0/4/0"
    #     ip: 192.168.16.101/24
    #   gateway: 192.168.1.1
    #   otherInterfaces:
    #     - interfaceName: "GigabitEthernet0/5/0"
    #       ip: "1.2.3.4/24"
    #     - interfaceName: "GigabitEthernet0/6/0"
    #       ip: "2.3.4.5/24"
    # - name: "vm2"
    #   useDHCPOnMainInt: False
    #   mainInterface:
    #     interfaceName: "GigabitEthernet0/9/0"
    #     useDHCP: True
    #   gateway: 192.168.1.1
    #   otherInterfaces:
    #     - interfaceName: "GigabitEthernet0/7/0"
    #       ip: "3.4.5.6/24"
    #     - interfaceName: "GigabitEthernet0/7/0"
    #       ip: "5.6.7.8/24"
    srv6:
      servicePolicyBSIDSubnetCIDR: 8fff::/16
      servicePodLocalSIDSubnetCIDR: 9300::/16
      serviceHostLocalSIDSubnetCIDR: 9300::/16
      serviceNodeLocalSIDSubnetCIDR: 9000::/16
      nodeToNodePodLocalSIDSubnetCIDR: 9501::/16
      nodeToNodeHostLocalSIDSubnetCIDR: 9500::/16
      nodeToNodePodPolicySIDSubnetCIDR: 8501::/16
      nodeToNodeHostPolicySIDSubnetCIDR: 8500::/16
      sfcPolicyBSIDSubnetCIDR: 8eee::/16
      sfcServiceFunctionSIDSubnetCIDR: 9600::/16
      sfcEndLocalSIDSubnetCIDR: 9310::/16
      sfcIDLengthUsedInSidForServiceFunction: 16
logs:
  defaultLevel: debug

controller:
  enableRetry: true
  delayRetry: 1000000000
  maxRetryAttempts: 3
  enableExpBackoffRetry: true
  delayLocalResync: 5000000000
  startupResyncDeadline: 30000000000
  enablePeriodicHealing: false
  periodicHealingInterval: 30000000000
  delayAfterErrorHealing: 5000000000
  remoteDBProbingInterval: 3000000000
  recordEventHistory: true
  eventHistoryAgeLimit: 60
  permanentlyRecordedInitPeriod: 10


# ETCD server to be used by Contiv
etcd:
  image:
    repository: quay.io/coreos/etcd
    tag: v3.3.24
    pullPolicy: IfNotPresent
  service:
    # nodePort where contiv-etcd can be reached on any node.
    nodePort: 32379
    # if set to true <NodeIP>:<nodeport> will be used to access service,
    # <localhost>:<nodeport> if set to false
    useNodeIP: true
  enableLivenessProbe: true
  livenessProbeInitialDelaySeconds: 20
  probePeriodSeconds: 3
  dataDir: /var/etcd
  usePersistentVolume: false
  persistentVolumeSize: 2Gi
  useExternalInstance: false
  externalInstance:
    secretName: my-etcd-secrets
    endpoints:
      - 127.0.0.1:31379
  # if secureTransport is enabled, secrets need to point to proper certificates
  secureTransport: false
  secrets:
    # if mountFromHost is true, certificates must be present in the mountDir on each host.
    # if mountFromHost is false, certificates must be present in the current directory, and will be distributed to each host via k8s secret feature.
    mountFromHost: true
    mountDir: /var/contiv/etcd-secrets
    # names of individual files in the 'secrets.location' folder
    caCert: ca.pem
    serverCert: server.pem
    serverKey: server-key.pem
    clientCert: client.pem
    clientKey: client-key.pem
  updateStrategy: RollingUpdate
  cpuRequest: 100m
  cpuLimit: 0
  cipherSuites:
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384


vswitch:
  image:
    repository: contivvpp/vswitch
    # tag: latest
    pullPolicy: IfNotPresent
  enableLivenessReadinessProbes: true
  readinessProbeInitialDelaySeconds: 15
  livenessProbeInitialDelaySeconds: 60
  probePeriodSeconds: 3
  probeTimeoutSeconds: 2
  probeFailureThreshold: 3
  defineMemoryLimits: true
  hugePages2miLimit: 512Mi
  memoryLimit: 512Mi
  updateStrategy: RollingUpdate
  cpuRequest: 250m
  cpuLimit: 0
  enableCoreDumps: true
  coreDumpsDir: /var/contiv/dumps
  useSocketVPPConnection: true
  enableInterfaceStats: false
  httpPort: 9999
  grpcPort: 9111

cni:
  image:
    repository: contivvpp/cni
    # tag: latest
    pullPolicy: IfNotPresent

ksr:
  image:
    repository: contivvpp/ksr
    # tag: latest
    pullPolicy: IfNotPresent
  updateStrategy: RollingUpdate
  enableLivenessReadinessProbes: true
  readinessProbeInitialDelaySeconds: 10
  livenessProbeInitialDelaySeconds: 30
  probePeriodSeconds: 3
  probeTimeoutSeconds: 2
  probeFailureThreshold: 3
  cpuRequest: 100m
  cpuLimit: 0
  httpPort: 9191

crd:
  image:
    repository: contivvpp/crd
    # tag: latest
    pullPolicy: IfNotPresent
  disableNetctlREST: true
  updateStrategy: RollingUpdate
  validateInterval: 5  # in minutes, 0 to disable
  validateState: SB  # select one of the: "internal", "SB", "NB"
  enableLivenessReadinessProbes: true
  readinessProbeInitialDelaySeconds: 10
  livenessProbeInitialDelaySeconds: 30
  probePeriodSeconds: 3
  probeTimeoutSeconds: 2
  probeFailureThreshold: 3
  cpuRequest: 100m
  cpuLimit: 0
  httpPort: 9090

# GoVPP configuration
# It contains time intervals used for VPP health probing (in nanoseconds).
# After a health check probe is not received within the health-check-reply-timeout
# period health-check-threshold times, VPP is considered to be dead by the contiv-agent.
govpp:
  healthCheckProbeInterval: 3000000000
  healthCheckReplyTimeout: 500000000
  healthCheckThreshold: 3
  replyTimeout: 3000000000

http:
  enableBasicAuth: false
  enableServerCert: false
  # if mountFromHost is true, certificates must be present in the mountDir on each host.
  # if mountFromHost is false, certificates must be present in the current directory, and will be distributed to each host via k8s secret feature.
  mountFromHost: false
  mountDir: /var/certs
  serverCert: server.crt
  serverKey: server.key
  # credentials to be used by basic-auth, format <username>:<password>
  basicAuth: user:pass

telemetry:
  pollingInterval: 30000000000
  disabled: true

init:
  image:
    repository: busybox
    tag: 1.29.3

bolt:
  debug: false
  dataDir: /var/bolt

k8sVersion:
  post_1_9: true