kubespray/roles/network_plugin/calico/defaults/main.yml

---
# Enables Internet connectivity from containers
nat_outgoing: true

# add default ippool name
calico_pool_name: "default-pool"

# Use IP-over-IP encapsulation across hosts
ipip: true
ipip_mode: Always  # change to "CrossSubnet" if you only want ipip encapsulation on traffic going across subnets

# Set to true if you want your calico cni binaries to overwrite the
# ones from hyperkube while leaving other cni plugins intact.
overwrite_hyperkube_cni: true

calico_cert_dir: /etc/calico/certs
etcd_cert_dir: /etc/ssl/etcd/ssl

# Global as_num (/calico/bgp/v1/global/as_num)
global_as_num: "64512"

# You can set MTU value here. If left undefined or empty, it will
# not be specified in calico CNI config, so Calico will use built-in
# defaults. The value should be a number, not a string.
# calico_mtu: 1500

# Limits for apps
calico_node_memory_limit: 500M
calico_node_cpu_limit: 300m
calico_node_memory_requests: 64M
calico_node_cpu_requests: 150m
calicoctl_memory_limit: 170M
calicoctl_cpu_limit: 100m
calicoctl_memory_requests: 32M
calicoctl_cpu_requests: 50m

# Enable Prometheus Metrics endpoint for felix
calico_felix_prometheusmetricsenabled: "false"
calico_felix_prometheusmetricsport: 9091
calico_felix_prometheusgometricsenabled: "true"
calico_felix_prometheusprocessmetricsenabled: "true"

### check latest version https://github.com/projectcalico/calico-upgrade/releases
calico_upgrade_enabled: true
calico_upgrade_version: v1.0.5

# Should calico ignore kernel's RPF check setting,
# see https://github.com/projectcalico/felix/blob/ab8799eaea66627e5db7717e62fca61fd9c08646/python/calico/felix/config.py#L198
calico_node_ignorelooserpf: false

# If you want to use non default IP_AUTODETECTION_METHOD for calico node set this option to one of:
# * can-reach=DESTINATION
# * interface=INTERFACE-REGEX
# see https://docs.projectcalico.org/v3.0/reference/node/configuration#ip-autodetection-methods
# calico_ip_auto_method: "interface=eth.*"

calico_baremetal_nodename: "{{ inventory_hostname }}"

### do not enable this, this is detected in scope of tasks, this is just a default value
calico_upgrade_needed: false