From 409c87571393daff74935ff4d46500acd5c4da51 Mon Sep 17 00:00:00 2001 From: Mike Kolesnik Date: Wed, 8 Jan 2020 11:52:24 +0200 Subject: [PATCH 1/5] Add support for the Globalnet controller Added a chart for the globalnet controller which uses the global CIDR. Also added the global CIDR to the submariner engine pod env so it can utilize it. The controller will only be deployed if the CIDR is specified. --- submariner/templates/engine-deploy.yaml | 4 +- submariner/templates/globalnet.yaml | 59 +++++++++++++++++++++++++ submariner/values.yaml | 1 + 3 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 submariner/templates/globalnet.yaml diff --git a/submariner/templates/engine-deploy.yaml b/submariner/templates/engine-deploy.yaml index 85e44ff..dd18f80 100644 --- a/submariner/templates/engine-deploy.yaml +++ b/submariner/templates/engine-deploy.yaml @@ -60,6 +60,8 @@ spec: value: "{{ .Values.submariner.clusterCidr }}" - name: SUBMARINER_SERVICECIDR value: "{{ .Values.submariner.serviceCidr }}" + - name: SUBMARINER_GLOBALCIDR + value: "{{ .Values.submariner.globalCidr }}" - name: SUBMARINER_TOKEN value: "{{ .Values.submariner.apiToken }}" - name: SUBMARINER_CLUSTERID @@ -124,4 +126,4 @@ spec: schedulerName: default-scheduler securityContext: {} terminationGracePeriodSeconds: 0 - serviceAccountName: {{ template "submariner.engineServiceAccountName" . }} \ No newline at end of file + serviceAccountName: {{ template "submariner.engineServiceAccountName" . }} diff --git a/submariner/templates/globalnet.yaml b/submariner/templates/globalnet.yaml new file mode 100644 index 0000000..6efd7aa --- /dev/null +++ b/submariner/templates/globalnet.yaml @@ -0,0 +1,59 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ template "submariner.fullname" . }}-globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.fullname" . }}-globalnet + component: globalnet +spec: + selector: + matchLabels: + app: {{ template "submariner.fullname" . }}-globalnet + template: + metadata: + labels: + app: {{ template "submariner.fullname" . }}-globalnet + spec: + hostNetwork: true + serviceAccountName: submariner-globalnet + serviceAccount: submariner-globalnet + nodeSelector: +{{- if eq .Values.submariner.globalCidr "" }} + nowhere: 'noplace' +{{- else }} + submariner.io/gateway: 'true' +{{- end }} + containers: + - name: {{ template "submariner.fullname" . }}-globalnet + image: submariner-globalnet:local + imagePullPolicy: IfNotPresent + env: + - name: SUBMARINER_CLUSTERID + value: '{{ .Values.submariner.clusterId }}' + - name: SUBMARINER_GLOBALCIDR + value: '{{ .Values.submariner.globalCidr }}' + - name: SUBMARINER_EXCLUDENS + value: 'submariner,kube-system,operators' + - name: SUBMARINER_NAMESPACE + value: '{{ .Release.Namespace }}' + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ALL + privileged: true + readOnlyRootFilesystem: false + runAsNonRoot: false + volumeMounts: + # Because we don't actually run iptables locally, but chroot in to the host + - mountPath: /host + name: host-slash + readOnly: true + volumes: + - name: host-slash + hostPath: + path: / + diff --git a/submariner/values.yaml b/submariner/values.yaml index c674e94..e0ba61e 100644 --- a/submariner/values.yaml +++ b/submariner/values.yaml @@ -4,6 +4,7 @@ submariner: token: "" clusterCidr: "10.42.0.0/16" serviceCidr: "10.43.0.0/16" + globalCidr: "" natEnabled: false colorCodes: blue debug: false From afac49e68ee8cbd375df636e4af482050fe62855 Mon Sep 17 00:00:00 2001 From: Mike Kolesnik Date: Tue, 21 Jan 2020 11:49:45 +0200 Subject: [PATCH 2/5] Remove GLOBALCIDR, empty yaml if disabled --- submariner/templates/globalnet.yaml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/submariner/templates/globalnet.yaml b/submariner/templates/globalnet.yaml index 6efd7aa..84666a6 100644 --- a/submariner/templates/globalnet.yaml +++ b/submariner/templates/globalnet.yaml @@ -1,3 +1,4 @@ +{{- if ne .Values.submariner.globalCidr "" }} apiVersion: apps/v1 kind: DaemonSet metadata: @@ -21,11 +22,7 @@ spec: serviceAccountName: submariner-globalnet serviceAccount: submariner-globalnet nodeSelector: -{{- if eq .Values.submariner.globalCidr "" }} - nowhere: 'noplace' -{{- else }} submariner.io/gateway: 'true' -{{- end }} containers: - name: {{ template "submariner.fullname" . }}-globalnet image: submariner-globalnet:local @@ -33,8 +30,6 @@ spec: env: - name: SUBMARINER_CLUSTERID value: '{{ .Values.submariner.clusterId }}' - - name: SUBMARINER_GLOBALCIDR - value: '{{ .Values.submariner.globalCidr }}' - name: SUBMARINER_EXCLUDENS value: 'submariner,kube-system,operators' - name: SUBMARINER_NAMESPACE @@ -56,4 +51,4 @@ spec: - name: host-slash hostPath: path: / - +{{- end }} From 35417fa669babb20dcd8e35be1e6a9ed63426b66 Mon Sep 17 00:00:00 2001 From: Mike Kolesnik Date: Wed, 22 Jan 2020 16:50:32 +0200 Subject: [PATCH 3/5] Add globalnet service account creation Signed-off-by: Mike Kolesnik --- submariner/templates/_helpers.tpl | 13 ++++++++++++- submariner/templates/svc-acct.yaml | 14 +++++++++++++- submariner/values.yaml | 3 +++ 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/submariner/templates/_helpers.tpl b/submariner/templates/_helpers.tpl index 30808f6..6c860bd 100644 --- a/submariner/templates/_helpers.tpl +++ b/submariner/templates/_helpers.tpl @@ -51,4 +51,15 @@ Create the name of the submariner-route-agent service account to use {{- else -}} {{ default "default" .Values.serviceAccounts.routeAgent.name }} {{- end -}} -{{- end -}} \ No newline at end of file +{{- end -}} + +{{/* +Create the name of the submariner-globalnet service account to use +*/}} +{{- define "submariner.globalnetServiceAccountName" -}} +{{- if .Values.serviceAccounts.globalnet.create -}} + {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.globalnet.name }} +{{- end -}} +{{- end -}} diff --git a/submariner/templates/svc-acct.yaml b/submariner/templates/svc-acct.yaml index d433db2..4b819cf 100644 --- a/submariner/templates/svc-acct.yaml +++ b/submariner/templates/svc-acct.yaml @@ -20,4 +20,16 @@ metadata: release: {{ .Release.Name | quote }} chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} -{{- end }} \ No newline at end of file +{{- end }} +--- +{{- if .Values.serviceAccounts.globalnet.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.globalnetServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +{{- end }} diff --git a/submariner/values.yaml b/submariner/values.yaml index e0ba61e..1d1274f 100644 --- a/submariner/values.yaml +++ b/submariner/values.yaml @@ -56,3 +56,6 @@ serviceAccounts: routeAgent: create: true name: "" + globalnet: + create: false + name: "" From fb754f5f2f8835a3a838dc67b06579b970c6f2c6 Mon Sep 17 00:00:00 2001 From: Mike Kolesnik Date: Thu, 23 Jan 2020 14:36:26 +0200 Subject: [PATCH 4/5] Added the role & binding for globalnet Signed-off-by: Mike Kolesnik --- submariner/templates/rbac.yaml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml index e953321..2544989 100644 --- a/submariner/templates/rbac.yaml +++ b/submariner/templates/rbac.yaml @@ -61,4 +61,34 @@ subjects: - kind: ServiceAccount name: {{ template "submariner.routeAgentServiceAccountName" . }} namespace: {{ .Release.Namespace }} +--- +{{- if ne .Values.submariner.globalCidr "" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:globalnet +rules: +- apiGroups: [""] + resources: ["services", "namespaces", "pods"] + verbs: ["get", "list", "watch", "update"] +- apiGroups: [""] + resources: ["nodes"] + verbs: ["get"] +- apiGroups: ["submariner.io"] + resources: ["endpoints"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:globalnet +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:globalnet +subjects: +- kind: ServiceAccount + name: {{ template "submariner.globalnetServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} {{- end -}} From 04865e056b09a836c28dd67a3c8bc099296c089a Mon Sep 17 00:00:00 2001 From: Mike Kolesnik Date: Tue, 28 Jan 2020 08:27:25 +0200 Subject: [PATCH 5/5] Added clusters to rbac --- submariner/templates/rbac.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml index 2544989..de2b6ec 100644 --- a/submariner/templates/rbac.yaml +++ b/submariner/templates/rbac.yaml @@ -75,7 +75,7 @@ rules: resources: ["nodes"] verbs: ["get"] - apiGroups: ["submariner.io"] - resources: ["endpoints"] + resources: ["endpoints", "clusters"] verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1