Update the README file (#19)

* Update the README file

* update README file with shipyard changes

.gitignore

@@ -0,0 +1,2 @@
+.idea
+*.tgz

.travis.yml

@@ -0,0 +1,46 @@
+language: python
+
+env:
+  global:
+    - HELM_URL=https://storage.googleapis.com/kubernetes-helm
+    - HELM_TGZ=helm-v2.14.3-linux-amd64.tar.gz
+    - TARGET_BR=gh-pages
+    - GH_URL=https://submariner-io.github.io/submariner-charts/charts
+    - CHARTS_DIR=charts
+    - YAMLLINT_VERSION=1.17.0
+
+install:
+  - wget -q ${HELM_URL}/${HELM_TGZ}
+  - tar xzfv ${HELM_TGZ}
+  - PATH=`pwd`/linux-amd64/:$PATH
+  - helm init --client-only
+  - sudo pip install yamllint=="${YAMLLINT_VERSION}"
+
+script:
+  - for dir in submariner submariner-k8s-broker; do helm lint $dir; done
+  - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
+  - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
+
+after_success:
+  - >
+    if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then
+      set -e
+      for dir in submariner submariner-k8s-broker; do
+        helm dep update $dir
+        helm package $dir
+      done
+      REPO_URL=`git config remote.origin.url`
+      git clone ${REPO_URL} out && cd out && git checkout gh-pages && mkdir -p ${CHARTS_DIR}
+      cp -f ../submariner-*.tgz ${CHARTS_DIR}/
+      if [ -f charts/index.yaml ]; then
+        helm repo index ${CHARTS_DIR} --url ${GH_URL} --merge index.yaml
+      else
+        helm repo index ${CHARTS_DIR} --url ${GH_URL}
+      fi
+      git config user.name "Travis CI"
+      git config user.email "travis@travis-ci.org"
+      git add -f ${CHARTS_DIR}/*
+      git commit -m "Travis build: $TRAVIS_BUILD_NUMBER"
+      git remote add origin-pages https://${GH_TOKEN}@github.com/submariner-io/submariner-charts.git > /dev/null 2>&1
+      git push --quiet -f -u origin-pages gh-pages
+    fi

.yamllint.yml

@@ -0,0 +1,15 @@
+---
+extends: default
+rules:
+  comments: disable
+  comments-indentation: disable
+  line-length:
+    max: 150
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 0
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 0
+  indentation:
+    indent-sequences: consistent

README.md

@@ -1,3 +1,116 @@
 # submariner-charts
 
-Please see https://github.com/rancher/submariner for more information. This is only a supporting repository for Submariner
+Please see https://github.com/submariner-io/submariner for more information. This is only a supporting repository for Submariner
+
+# Dev workflow.
+
+### Prerequisites
+
+- [helm]
+- [docker] or [podman]
+
+### Create a fork and checkout.
+
+[Create a fork] of the original repository, clone it locally and checkout a new branch from master. 
+
+Example:
+
+```bash
+git clone https://github.com/myuser/submariner-charts.git
+cd submariner-charts
+git checkout -b new-feature
+```
+
+Now you can modify the helm charts according to your needs.
+
+### Serve the modified charts
+
+Before serving the modified charts, the charts must be packaged for local usage.
+
+```bash
+helm package ./submariner
+helm package ./submariner-k8s-broker
+```
+Note: if you just installed helm, you have to init the helm, by running
+```bash
+helm init --client-only
+```
+ 
+
+
+Serve the packaged charts through a local helm repository:
+
+```bash
+docker run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
+```
+
+or 
+ 
+```bash
+sudo podman run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
+```
+
+Get the container internal ip:
+
+```bash
+docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo
+```
+
+The local container will serve the charts locally on port 8080.
+
+Get logs for the container:
+
+```bash
+docker logs -f helm-repo
+```
+
+### Use the modified charts
+
+Init helm
+
+```bash
+helm init --client-only
+```
+
+Add your local repository to helm
+
+```bash
+internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+helm repo add test-repo http://$internal_ip:8080
+```
+
+List the repos:
+
+```bash
+helm repo list
+```
+
+You should be able to see test-repo in the list
+
+Search the new repo for submariner charts:
+
+```bash
+helm search -l test-repo
+```
+
+### Modify submariner e2e tests helm deployment script to use your local test-repo.
+
+You can test your helm-charts with e2e tests from the [shipyard](https://github.com/submariner-io/shipyard) repository.
+In the file `scripts/shared/lib/deploy_helm` change the line from:
+
+```bash
+helm repo add submariner-latest https://submariner-io.github.io/submariner-charts/charts
+```
+
+to 
+
+```bash
+internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+helm repo add submariner-latest http://$internal_ip:8080
+```
+
+<!--links-->
+[helm]: https://helm.sh/docs/using_helm/#installing-helm
+[docker]: https://docs.docker.com/install/
+[podman]: https://podman.io/getting-started/installation
+[Create a fork]: https://help.github.com/en/articles/fork-a-repo

submariner-k8s-broker/Chart.yaml

@@ -1,3 +1,4 @@
+---
 name: submariner-k8s-broker
 version: 0.0.1
 appVersion: v0.0.1
@@ -5,7 +6,7 @@ description: Submariner Kubernetes Broker
 keywords:
 home: https://submariner.io/
 sources:
-- https://github.com/rancher/submariner-charts
+- https://submariner-io.github.io/submariner-charts/charts
 maintainers:
 - name: Rancher Labs
   email: charts@rancher.com

submariner-k8s-broker/templates/NOTES.txt

@@ -2,7 +2,7 @@ The Submariner Kubernetes Broker is now setup.
 
 You can retrieve the server URL by running
 
-  $ SUBMARINER_BROKER_URL=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[0].port}")
+  $ SUBMARINER_BROKER_URL=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[?(@.name=='https')].port}")
 
 The broker client token and CA can be retrieved by running
 

submariner-k8s-broker/values.yaml

@@ -1,3 +1,4 @@
+---
 rbac:
   create: true
 crd:

submariner/Chart.yaml

@@ -1,11 +1,12 @@
+---
 name: submariner
-version: 0.0.1
+version: 0.0.3
-appVersion: v0.0.1
+appVersion: v0.0.3
-description: Submariner
+description: k8s 1.16.x support
 keywords:
 home: https://submariner.io/
 sources:
-- https://github.com/rancher/submariner-charts
+  - https://submariner-io.github.io/submariner-charts/charts
 maintainers:
-- name: Rancher Labs
+  - name: Rancher Labs
     email: charts@rancher.com

submariner/questions.yml

@@ -8,12 +8,12 @@ questions:
   group: "Container Images"
   subquestions:
   - variable: engine.image.repository
-    default: "oats87/submariner-engine"
+    default: "rancher/submariner"
     description: "Submariner Engine Image Repository"
     type: string
     label: Submariner Engine Image Repository
   - variable: engine.image.tag
-    default: "dev"
+    default: "v0.0.2"
     description: "Submariner Engine Image Tag"
     type: string
     label: Submariner Engine Image Tag
@@ -26,12 +26,12 @@ questions:
   group: "Container Images"
   subquestions:
   - variable: routeAgent.image.repository
-    default: "oats87/submariner-route-agent"
+    default: "rancher/submariner-route-agent"
     description: "Submariner Route Agent Image Repository"
     type: string
     label: Submariner Route Agent Image Repository
   - variable: routeAgent.image.tag
-    default: "dev"
+    default: "v0.0.2"
     description: "Submariner Route Agent Image Tag"
     type: string
     label: Submariner Route Agent Image Tag
@@ -70,7 +70,7 @@ questions:
   label: "Broker Server"
   description: "Broker server to use (without the https://)"
 - variable: broker.insecure
-  type: bool
+  type: boolean
   default: false
   show_subquestion_if: false
   group: "Broker Configuration"

submariner/templates/_helpers.tpl

@@ -52,3 +52,14 @@ Create the name of the submariner-route-agent service account to use
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the submariner-globalnet service account to use
+*/}}
+{{- define "submariner.globalnetServiceAccountName" -}}
+{{- if .Values.serviceAccounts.globalnet.create -}}
+    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.globalnet.name }}
+{{- end -}}
+{{- end -}}

submariner/templates/crd.yaml

@@ -26,4 +26,18 @@ spec:
     kind: Endpoint
     plural: endpoints
   scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
 {{- end -}}

submariner/templates/engine-deploy.yaml

@@ -1,5 +1,5 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
-kind: Deployment
+kind: DaemonSet
 metadata:
   labels:
     heritage: {{ .Release.Service | quote }}
@@ -7,18 +7,15 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.fullname" . }}-engine
     component: engine
-  name: {{ template "submariner.fullname" . }}
+  name: {{ template "submariner.fullname" . }}-gateway
 spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
   revisionHistoryLimit: 5
   selector:
     matchLabels:
       app: {{ template "submariner.fullname" . }}-engine
   strategy:
     rollingUpdate:
-      maxSurge: 1
+      maxUnavailable: 1
-      maxUnavailable: 0
     type: RollingUpdate
   template:
     metadata:
@@ -60,6 +57,8 @@ spec:
           value: "{{ .Values.submariner.clusterCidr }}"
         - name: SUBMARINER_SERVICECIDR
           value: "{{ .Values.submariner.serviceCidr }}"
+        - name: SUBMARINER_GLOBALCIDR
+          value: "{{ .Values.submariner.globalCidr }}"
         - name: SUBMARINER_TOKEN
           value: "{{ .Values.submariner.apiToken }}"
         - name: SUBMARINER_CLUSTERID
@@ -97,6 +96,16 @@ spec:
           value: "{{ .Values.ipsec.psk }}"
         - name: CE_IPSEC_DEBUG
           value: "{{ .Values.ipsec.debug }}"
+        - name: CE_IPSEC_IKEPORT
+          value: "{{ .Values.ipsec.ikePort }}"
+        - name: CE_IPSEC_NATTPORT
+          value: "{{ .Values.ipsec.natPort }}"
+        - name: LEADERSHIP_LEASEDURATION
+          value: "{{ .Values.leadership.leaseDuration }}"
+        - name: LEADERSHIP_RENEWDEADLINE
+          value: "{{ .Values.leadership.renewDeadline }}"
+        - name: LEADERSHIP_RETRYPERIOD
+          value: "{{ .Values.leadership.retryPeriod }}"
         image: {{ .Values.engine.image.repository }}:{{ .Values.engine.image.tag }}
         imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
         name: submariner

submariner/templates/globalnet.yaml

@@ -0,0 +1,54 @@
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "submariner.fullname" . }}-globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-globalnet
+    component: globalnet
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-globalnet
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.fullname" . }}-globalnet
+    spec:
+      hostNetwork: true
+      serviceAccountName: submariner-globalnet
+      serviceAccount: submariner-globalnet
+      nodeSelector:
+        submariner.io/gateway: 'true'
+      containers:
+        - name: {{ template "submariner.fullname" . }}-globalnet
+          image: {{ .Values.globalnet.image.repository }}:{{ .Values.globalnet.image.tag }}
+          imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
+          env:
+            - name: SUBMARINER_CLUSTERID
+              value: '{{ .Values.submariner.clusterId }}'
+            - name: SUBMARINER_EXCLUDENS
+              value: 'submariner,kube-system,operators'
+            - name: SUBMARINER_NAMESPACE
+              value: '{{ .Release.Namespace }}'
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - ALL
+            privileged: true
+            readOnlyRootFilesystem: false
+            runAsNonRoot: false
+          volumeMounts:
+            # Because we don't actually run iptables locally, but chroot in to the host
+            - mountPath: /host
+              name: host-slash
+              readOnly: true
+      volumes:
+        - name: host-slash
+          hostPath:
+            path: /
+{{- end }}

submariner/templates/rbac.yaml

@@ -13,7 +13,7 @@ rules:
   resources: ["configmaps"]
   verbs: ["create", "get", "list", "watch", "patch", "update"]
 - apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints"]
+  resources: ["clusters", "endpoints", "gateways"]
   verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 - apiGroups: [""]
   resources: ["events"]
@@ -30,8 +30,11 @@ metadata:
     app: {{ template "submariner.name" . }}
 rules:
 - apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints"]
+  resources: ["clusters", "endpoints", "gateways"]
   verbs: ["create", "get", "list", "watch", "patch", "update"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -58,4 +61,53 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "submariner.routeAgentServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+rules:
+- apiGroups: [""]
+  resources: ["services", "namespaces", "pods", "nodes"]
+  verbs: ["get", "list", "watch", "update"]
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints", "gateways"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
 {{- end -}}

submariner/templates/route-agent-ds.yaml

@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ template "submariner.fullname" . }}-routeagent
@@ -37,6 +37,10 @@ spec:
           value: "{{ .Values.submariner.clusterId }}"
         - name: SUBMARINER_DEBUG
           value: "{{ .Values.submariner.debug }}"
+        - name: SUBMARINER_CLUSTERCIDR                                                                                                                                                        
+          value: "{{ .Values.submariner.clusterCidr }}"
+        - name: SUBMARINER_SERVICECIDR
+          value: "{{ .Values.submariner.serviceCidr }}"
         resources:
 {{ toYaml .Values.routeAgent.resources | indent 10 }}
         securityContext:
@@ -47,6 +51,11 @@ spec:
           privileged: true
           readOnlyRootFilesystem: false
           runAsNonRoot: false
+        volumeMounts:
+        # Because we don't actually run iptables locally, but chroot in to the host
+        - mountPath: /host
+          name: host-slash
+          readOnly: true
 {{- with .Values.routeAgent.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}
@@ -59,3 +68,7 @@ spec:
       affinity:
 {{ toYaml . | indent 8 }}
 {{- end }}
+      volumes:
+      - name: host-slash
+        hostPath:
+          path: /

submariner/templates/svc-acct.yaml

@@ -21,3 +21,15 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
+---
+{{- if .Values.serviceAccounts.globalnet.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}

submariner/values.yaml

@@ -1,8 +1,10 @@
+---
 submariner:
   clusterId: ""
   token: ""
   clusterCidr: "10.42.0.0/16"
   serviceCidr: "10.43.0.0/16"
+  globalCidr: ""
   natEnabled: false
   colorCodes: blue
   debug: false
@@ -20,10 +22,16 @@ rbac:
 ipsec:
   psk: ""
   debug: false
+  ikePort: 500
+  natPort: 4500
+leadership:
+  leaseDuration: 5
+  renewDeadline: 3
+  retryPeriod: 2
 engine:
   image:
     repository: rancher/submariner
-    tag: v0.0.1
+    tag: v0.0.2
     pullPolicy: Always
   resources: {}
     # limits:
@@ -36,7 +44,7 @@ engine:
 routeAgent:
   image:
     repository: rancher/submariner-route-agent
-    tag: v0.0.1
+    tag: v0.0.2
     pullPolicy: Always
   resources: {}
   # limits:
@@ -45,6 +53,11 @@ routeAgent:
   nodeSelector: {}
   tolerations: []
   affinity: {}
+globalnet:
+  image:
+    repository: submariner-globalnet
+    tag: local
+    pullPolicy: IfNotPresent
 serviceAccounts:
   engine:
     create: true
@@ -52,3 +65,6 @@ serviceAccounts:
   routeAgent:
     create: true
     name: ""
+  globalnet:
+    create: false
+    name: ""