Reset terminationGracePeriodSeconds for SM Pods (#50)

In one of the earlier PRs, we modified the terminationGracePeriodSeconds
to 10 secs. However, its seen that this is causing more CI failures
during e2e redundancy tests. Ideally, once the Pods are terminated,
it should cleanup itself ASAP but it is seen that SM Pods are sometimes
taking time to exit and during this Period since there is no active SM
Pod running, this is triggering some failures.

Until we figure out the exact reason why the Pods are taking time for
cleanup, this PR reduces the terminationGracePeriodSeconds.

This issue would be properly addressed via
https://github.com/submariner-io/submariner/issues/694

Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>

.github/workflows/dco-check.yml

@@ -0,0 +1,17 @@
+name: DCO Check
+on: pull_request
+
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    name: DCO Check
+    steps:
+    - name: Get PR Commits
+      id: 'get-pr-commits'
+      uses: tim-actions/get-pr-commits@master
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+    - name: DCO Check
+      uses: tim-actions/dco@master
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}

.travis.yml

@@ -8,6 +8,7 @@ env:
     - GH_URL=https://submariner-io.github.io/submariner-charts/charts
     - CHARTS_DIR=charts
     - YAMLLINT_VERSION=1.17.0
+    - HELM_FLAGS='--set submariner.serviceDiscovery=true,serviceAccounts.globalnet.create=true,globalCidr="169.254.0.0/16"'
 
 install:
   - wget -q ${HELM_URL}/${HELM_TGZ}
@@ -17,7 +18,7 @@ install:
   - sudo pip install yamllint=="${YAMLLINT_VERSION}"
 
 script:
-  - for dir in submariner submariner-k8s-broker; do helm lint $dir; done
+  - for dir in submariner submariner-k8s-broker; do helm lint $dir $HELM_FLAGS; done
   - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
   - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
 

CODEOWNERS

@@ -0,0 +1 @@
+* @mangelajo @tpantelis @Oats87

submariner-k8s-broker/Chart.yaml

@@ -1,12 +1,12 @@
 ---
 name: submariner-k8s-broker
-version: 0.0.1
+version: 0.4.1
-appVersion: v0.0.1
+appVersion: 0.4.1
 description: Submariner Kubernetes Broker
 keywords:
-home: https://submariner.io/
+home: https://submariner-io.github.io/
 sources:
 - https://submariner-io.github.io/submariner-charts/charts
 maintainers:
-- name: Rancher Labs
+- name: Submariner Developers
-  email: charts@rancher.com
+  email: submariner-dev@googlegroups.com

submariner-k8s-broker/templates/crd.yaml

@@ -26,4 +26,66 @@ spec:
     kind: Endpoint
     plural: endpoints
   scope: Namespaced
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+{{- end -}}
 {{- end -}}

submariner-k8s-broker/templates/rbac.yaml

@@ -12,6 +12,9 @@ rules:
 - apiGroups: ["submariner.io"]
   resources: ["clusters", "endpoints"]
   verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["lighthouse.submariner.io"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

submariner-k8s-broker/values.yaml

@@ -7,3 +7,5 @@ serviceAccounts:
   client:
     create: true
     name: ""
+submariner:
+  serviceDiscovery: false

submariner/Chart.yaml

@@ -1,12 +1,12 @@
 ---
 name: submariner
-version: 0.0.3
+version: 0.4.0
-appVersion: v0.0.3
+appVersion: 0.4.0
-description: k8s 1.16.x support
+description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
 keywords:
-home: https://submariner.io/
+home: https://submariner-io.github.io/
 sources:
   - https://submariner-io.github.io/submariner-charts/charts
 maintainers:
-  - name: Rancher Labs
+  - name: Submariner Developers
-    email: charts@rancher.com
+    email: submariner-dev@googlegroups.com

submariner/questions.yml

@@ -130,3 +130,9 @@ questions:
   group: "Advanced Configuration"
   description: "Enable Charon debug mode"
   label: "Charon Enabled"
+- variable: submariner.cableDriver
+  type: string
+  default: ""
+  group: "Advanced Configuration"
+  description: "Cable driver implementation"
+  label: "Cable Driver"

submariner/templates/_helpers.tpl

@@ -63,3 +63,21 @@ Create the name of the submariner-globalnet service account to use
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse service account to use
+*/}}
+{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- if .Values.submariner.serviceDiscovery -}}
+    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service name to use
+*/}}
+{{- define "submariner.lighthouseDnsName" -}}
+{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
+{{- end -}}

submariner/templates/crd.yaml

@@ -40,4 +40,71 @@ spec:
     kind: Gateway
     plural: gateways
   scope: Namespaced
+  additionalPrinterColumns:
+  - name: ha-status
+    type: string
+    description: High Availability Status of the Gateway
+    JSONPath: .status.haStatus
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+{{- end }}
 {{- end -}}

submariner/templates/engine-deploy.yaml

@@ -13,7 +13,7 @@ spec:
   selector:
     matchLabels:
       app: {{ template "submariner.fullname" . }}-engine
-  strategy:
+  updateStrategy:
     rollingUpdate:
       maxUnavailable: 1
     type: RollingUpdate
@@ -71,6 +71,8 @@ spec:
           value: "{{ .Values.submariner.natEnabled }}"
         - name: SUBMARINER_BROKER
           value: "{{ .Values.broker.type }}"
+        - name: SUBMARINER_CABLEDRIVER
+          value: "{{ .Values.submariner.cableDriver }}"
 {{- if eq .Values.broker.type "phpapi" }}
         - name: BROKER_PHPAPI_PROTO
           value: "{{ .Values.broker.proto }}"
@@ -106,7 +108,7 @@ spec:
           value: "{{ .Values.leadership.renewDeadline }}"
         - name: LEADERSHIP_RETRYPERIOD
           value: "{{ .Values.leadership.retryPeriod }}"
-        image: {{ .Values.engine.image.repository }}:{{ .Values.engine.image.tag }}
+        image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
         imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
         name: submariner
         resources:
@@ -128,5 +130,5 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
-      terminationGracePeriodSeconds: 0
+      terminationGracePeriodSeconds: 1
       serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}

submariner/templates/globalnet.yaml

@@ -13,6 +13,10 @@ spec:
   selector:
     matchLabels:
       app: {{ template "submariner.fullname" . }}-globalnet
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
   template:
     metadata:
       labels:
@@ -21,17 +25,18 @@ spec:
       hostNetwork: true
       serviceAccountName: submariner-globalnet
       serviceAccount: submariner-globalnet
+      terminationGracePeriodSeconds: 2
       nodeSelector:
         submariner.io/gateway: 'true'
       containers:
         - name: {{ template "submariner.fullname" . }}-globalnet
-          image: {{ .Values.globalnet.image.repository }}:{{ .Values.globalnet.image.tag }}
+          image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
           imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
           env:
             - name: SUBMARINER_CLUSTERID
               value: '{{ .Values.submariner.clusterId }}'
             - name: SUBMARINER_EXCLUDENS
-              value: 'submariner,kube-system,operators'
+              value: 'submariner-operator,kube-system,operators'
             - name: SUBMARINER_NAMESPACE
               value: '{{ .Release.Namespace }}'
           securityContext:

submariner/templates/lighthouse-coredns.yaml

@@ -0,0 +1,74 @@
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "submariner.lighthouseDnsName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.lighthouseDnsName" . }}
+    component: lighthouse-coredns
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.lighthouseDnsName" . }}
+  replicas: 2
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.lighthouseDnsName" . }}
+    spec:
+      containers:
+        - args:
+            - -conf
+            - /etc/coredns/Corefile
+          image: {{ .Values.lighthouseCoredns.image.repository }}:{{  default .Chart.AppVersion .Values.lighthouseCoredns.image.tag }}
+          imagePullPolicy: {{ .Values.lighthouseCoredns.image.pullPolicy }}
+          name: {{ template "submariner.lighthouseDnsName" . }}
+          volumeMounts:
+            - mountPath: /etc/coredns
+              name: config-volume
+              readOnly: true
+      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      volumes:
+        - configMap:
+            defaultMode: 420
+            items:
+              - key: Corefile
+                path: Corefile
+            name: {{ template "submariner.lighthouseDnsName" . }}
+          name: config-volume
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "submariner.lighthouseDnsName" . }}
+  labels:
+    app: {{ template "submariner.lighthouseDnsName" . }}
+spec:
+  ports:
+    - name: udp
+      port: 53
+      protocol: UDP
+      targetPort: 53
+  selector:
+    app: {{ template "submariner.lighthouseDnsName" . }}
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "submariner.lighthouseDnsName" . }}
+data:
+  Corefile: |
+    supercluster.local:53 {
+{{- if .Values.submariner.debug }}
+        log
+{{- end }}
+        lighthouse
+        errors
+        health
+        ready
+    }
+{{- end }}

submariner/templates/lighthouse.yaml

@@ -0,0 +1,55 @@
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "submariner.fullname" . }}-lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-lighthouse-agent
+    component: lighthouse
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-lighthouse-agent
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.fullname" . }}-lighthouse-agent
+    spec:
+      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      containers:
+      - command:
+        - lighthouse-agent.sh
+        env:
+        - name: SUBMARINER_NAMESPACE
+          value: "{{ .Release.Namespace }}"
+        - name: SUBMARINER_CLUSTERID
+          value: "{{ .Values.submariner.clusterId }}"
+        - name: SUBMARINER_DEBUG
+          value: "{{ .Values.submariner.debug }}"
+{{- if ne .Values.submariner.globalCidr "" }}
+        - name: SUBMARINER_GLOBALNET_ENABLED
+          value: "true"
+{{- end }}
+        - name: BROKER_K8S_APISERVER
+          value: "{{ .Values.broker.server }}"
+        - name: BROKER_K8S_APISERVERTOKEN
+          value: "{{ .Values.broker.token }}"
+        - name: BROKER_K8S_REMOTENAMESPACE
+          value: "{{ .Values.broker.namespace }}"
+{{- if .Values.broker.insecure }}
+        - name: BROKER_K8S_INSECURE
+          value: "true"
+{{- else }}
+        - name: BROKER_K8S_CA
+          value: "{{ .Values.broker.ca }}"
+{{- end }}
+        name: {{ template "submariner.fullname" . }}-lighthouse-agent
+        image: {{ .Values.lighthouse.image.repository }}:{{  default .Chart.AppVersion  .Values.lighthouse.image.tag }}
+        imagePullPolicy: {{ .Values.lighthouse.image.pullPolicy }}
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 0
+{{- end }}

submariner/templates/rbac.yaml

@@ -109,5 +109,32 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "submariner.globalnetServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse
+rules:
+  - apiGroups: [""]
+    resources: ["services", "namespaces", "configmaps"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["lighthouse.submariner.io"]
+    resources: ["*"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner/templates/route-agent-ds.yaml

@@ -12,6 +12,10 @@ spec:
   selector:
     matchLabels:
       app: {{ template "submariner.fullname" . }}-routeagent
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
   template:
     metadata:
       labels:
@@ -22,13 +26,13 @@ spec:
         component: routeagent
     spec:
       serviceAccountName: {{ template "submariner.routeAgentServiceAccountName" . }}
-      terminationGracePeriodSeconds: 0
+      terminationGracePeriodSeconds: 1
       hostNetwork: true
       containers:
       - name: routeagent
         command:
         - submariner-route-agent.sh
-        image: {{ .Values.routeAgent.image.repository }}:{{ .Values.routeAgent.image.tag }}
+        image: {{ .Values.routeAgent.image.repository }}:{{  default .Chart.AppVersion .Values.routeAgent.image.tag }}
         imagePullPolicy: {{ .Values.routeAgent.image.pullPolicy }}
         env:
         - name: SUBMARINER_NAMESPACE

submariner/templates/svc-acct.yaml

@@ -33,3 +33,15 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouse.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}

submariner/values.yaml

@@ -8,6 +8,7 @@ submariner:
   natEnabled: false
   colorCodes: blue
   debug: false
+  serviceDiscovery: false
 crd:
   create: true
 broker:
@@ -25,38 +26,43 @@ ipsec:
   ikePort: 500
   natPort: 4500
 leadership:
-  leaseDuration: 5
+  leaseDuration: 10
-  renewDeadline: 3
+  renewDeadline: 5
   retryPeriod: 2
 engine:
   image:
-    repository: rancher/submariner
+    repository: quay.io/submariner/submariner
-    tag: v0.0.2
+    tag: ""
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
   resources: {}
-    # limits:
-  # cpu: 100m
-  # memory: 100Mi
   nodeSelectorEnabled: true
   nodeSelector: {}
   tolerations: []
   affinity: {}
 routeAgent:
   image:
-    repository: rancher/submariner-route-agent
+    repository: quay.io/submariner/submariner-route-agent
-    tag: v0.0.2
+    tag: ""
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
   resources: {}
-  # limits:
-  # cpu: 100m
-  # memory: 100Mi
   nodeSelector: {}
   tolerations: []
   affinity: {}
 globalnet:
   image:
-    repository: submariner-globalnet
+    repository: quay.io/submariner/submariner-globalnet
-    tag: local
+    tag: ""
+    pullPolicy: IfNotPresent
+lighthouse:
+  image:
+    repository: quay.io/submariner/lighthouse-agent
+    tag: ""
+    pullPolicy: IfNotPresent
+lighthouseCoredns:
+  name: ""
+  image:
+    repository: quay.io/submariner/lighthouse-coredns
+    tag: ""
     pullPolicy: IfNotPresent
 serviceAccounts:
   engine:
@@ -68,3 +74,6 @@ serviceAccounts:
   globalnet:
     create: false
     name: ""
+  lighthouse:
+    create: false
+    name: ""