Add calico variable that enables ignoring Kernel's RPF Setting (#1493)

roles/network_plugin/calico/defaults/main.yml

@@ -30,3 +30,7 @@ calicoctl_memory_limit: 170M
 calicoctl_cpu_limit: 100m
 calicoctl_memory_requests: 32M
 calicoctl_cpu_requests: 50m
+
+# Should calico ignore kernel's RPF check setting,
+# see https://github.com/projectcalico/felix/blob/ab8799eaea66627e5db7717e62fca61fd9c08646/python/calico/felix/config.py#L198
+calico_node_ignorelooserpf: false

roles/network_plugin/calico/templates/calico-node.service.j2

@@ -20,6 +20,9 @@ ExecStart={{ docker_bin_dir }}/docker run --net=host --privileged \
  -e ETCD_CA_CERT_FILE=${ETCD_CA_CERT_FILE} \
  -e ETCD_CERT_FILE=${ETCD_CERT_FILE} \
  -e ETCD_KEY_FILE=${ETCD_KEY_FILE} \
+{% if calico_node_ignorelooserpf %}
+ -e FELIX_IGNORELOOSERPF=true \
+{% endif %}
  -v /var/log/calico:/var/log/calico \
  -v /run/docker/plugins:/run/docker/plugins \
  -v /lib/modules:/lib/modules \