kubespray/roles/kubernetes-apps/policy_controller/meta/main.yml

---
dependencies:
  - role: policy_controller/calico
    when:
      - kube_network_plugin == 'calico'
      - enable_network_policy
      - calico_datastore != "kdd" or calico_policy_version is version('v3.6.0', '>=')
    tags:
      - policy-controller

  - role: policy_controller/calico
    when:
      - kube_network_plugin == 'canal'
      - calico_datastore != "kdd" or calico_policy_version is version('v3.6.0', '>=')
    tags:
      - policy-controller
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132 2017-03-13 23:04:31 +08:00			`---`
			`dependencies:`
			`- role: policy_controller/calico`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`when:`
			`- kube_network_plugin == 'calico'`
			`- enable_network_policy`
Add calico 3.7.3 support (#4953) * Add calico 3.7.3 support * add calico_datastore variable to policy controller role * add missing clusterrole rules for calico policy controller * disable calico kube controller when kdd mode is used for versions < 3.6 2019-07-10 03:42:28 +08:00			`- calico_datastore != "kdd" or calico_policy_version is version('v3.6.0', '>=')`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`tags:`
			`- policy-controller`

Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132 2017-03-13 23:04:31 +08:00			`- role: policy_controller/calico`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`when:`
			`- kube_network_plugin == 'canal'`
Add calico 3.7.3 support (#4953) * Add calico 3.7.3 support * add calico_datastore variable to policy controller role * add missing clusterrole rules for calico policy controller * disable calico kube controller when kdd mode is used for versions < 3.6 2019-07-10 03:42:28 +08:00			`- calico_datastore != "kdd" or calico_policy_version is version('v3.6.0', '>=')`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`tags:`
			`- policy-controller`