Add affinities to calico-typha and calico-kube-controllers

roles/kubernetes-apps/policy_controller/calico/defaults/main.yml

@@ -5,6 +5,16 @@ calico_policy_controller_memory_limit: 256M
 calico_policy_controller_cpu_requests: 30m
 calico_policy_controller_memory_requests: 64M
 calico_policy_controller_deployment_nodeselector: "kubernetes.io/os: linux"
+# calico_policy_controller_affinity:
+#   nodeAffinity:
+#     preferredDuringSchedulingIgnoredDuringExecution:
+#       - weight: 100
+#         preference:
+#           matchExpressions:
+#             - key: node-role.kubernetes.io/control-plane
+#               operator: In
+#               values:
+#                 - ''
 
 # SSL
 calico_cert_dir: "/etc/calico/certs"

roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2

@@ -6,6 +6,8 @@ metadata:
   labels:
     k8s-app: calico-kube-controllers
 spec:
+  # XXX The controllers can only have a single active instance.
+  # See: https://github.com/projectcalico/calico/blob/master/charts/calico/templates/calico-kube-controllers.yaml#L10
   replicas: 1
   strategy:
     type: Recreate
@@ -30,6 +32,10 @@ spec:
           operator: Exists
         - key: node-role.kubernetes.io/control-plane
           effect: NoSchedule
+{% if calico_policy_controller_affinity is defined %}
+      affinity:
+        {{ calico_policy_controller_affinity | to_nice_yaml(indent=2) | indent(8) }}
+{% endif %}
 {% if policy_controller_extra_tolerations is defined %}
         {{ policy_controller_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }}
 {% endif %}

roles/network_plugin/calico/templates/calico-typha.yml.j2

@@ -64,6 +64,10 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: NoSchedule
+{% if calico_typha_affinity is defined %}
+      affinity:
+        {{ calico_typha_affinity | to_nice_yaml(indent=2) | indent(8) }}
+{% endif %}
       # Since Calico can't network a pod until Typha is up, we need to run Typha itself
       # as a host-networked pod.
       serviceAccountName: calico-node

roles/network_plugin/calico_defaults/defaults/main.yml

@@ -141,6 +141,24 @@ typha_max_connections_lower_limit: 300
 # Generate certifcates for typha<->calico-node communication
 typha_secure: false
 
+# Add typha affinities
+# calico_typha_affinity:
+#   nodeAffinity:
+#     preferredDuringSchedulingIgnoredDuringExecution:
+#       - weight: 100
+#         preference:
+#           matchExpressions:
+#             - key: node-role.kubernetes.io/control-plane
+#               operator: In
+#               values:
+#                 - ''
+#   podAntiAffinity:
+#     requiredDuringSchedulingIgnoredDuringExecution:
+#       - labelSelector:
+#           matchLabels:
+#             k8s-app: calico-typha
+#         topologyKey: kubernetes.io/hostname
+
 calico_feature_control: {}
 
 # Calico default BGP port