These all default to true and there doesn't seem to be any reason
a user would want to set any to false as Submariner woild not work
without these resources. Removing them simplifies the charts.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The submariner-operator repo is the source of truth for the
CRD and RBAC resource yaml used by subctl and the ACM add-on so
we should use it for the helm charts as well. This will avoid
having to duplicate changes from the submariner-operator repo.
All the yaml is assembled in the pkg/embeddedyamls/yamls.go file
in submariner-operator so download and extract the yaml into
template files in the chart templates directories which can then
be included in other manifest files.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The operator no longer runs leader-for-life election so enable
leader-with-lease via the CLI arg in the pod spec.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
On Openshift, the operator failed with error
"\"submariner-gateway\" is forbidden: cannot set blockOwnerDeletion
if an ownerReference refers to a resource you can't set finalizers on"
Openshift enables OwnerReferencesPermissionEnforcement, so
in order to set blockOwnerDeletion for an object, the user needs
update permission for the finalizers subresource of the referenced
owner. In this case the owner is the Submariner object.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
Bump to the latest commit, which updates node from 12 to 16 in addition
to an actions/core update.
Relates-to: submariner-io/subctl#537
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the '--app-version' parameter to 'helm package' to dynamically
set the chart 'appVersion' field. We can then omit the hardcoded
'appVersion' field in the Chart.yaml file.
The chart 'version' field is also set by 'helm package' but we still
need to define it in the Chart.yaml file since 'help dep update'
requires it. The placeholder 'version' field is now set to 0.0.0 just
to give it some value.
For E2E, since the version fields are no longer hardcoded, it now
simulates a release by running 'helm package' and extracting the tar
files to HELM_REPO_LOCATION, now set to ./helm_repo.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
There's no mention in the upstream helm docs about this file nor is
there any docs about interactive user prompting at all (that I can see).
Nor do we document any mechanism for user prompting. It would seem this
is an obsolete remnant from an earlier version of helm so let's remove
it. This also eliminates hard-coded image versions that need to be
updated.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
...from the top shield banner. I don't see any reason why we
need that. This eliminate places we need to update when we release a
new chart version. The other places where it references a version is
in the sample values. I changed those to just 0.14.0 but we don't
really need to update these as they're intended to be examples.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.
> Error: Resource not accessible by integration
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Due to a bug in LH which was fixed in devel, but not yet backported, we
have to preload the LH images to get latest versions (and operator due
to a similar reason).
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
When releasing, since the job pushes to the git repository, it needs
to have write permission on "contents".
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The release frequency of some GHAs means we end up with daily
dependabot PRs, which results in lots of not-particularly-useful
review work. Reducing the update cadence to weekly shouldn't expose us
to much risk and will reduce PR churn.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Set the GitHub Actions token permission to null in most workflows.
This results in:
GITHUB_TOKEN Permissions
Metadata: read
The default permissions, used without the null override, are either
GITHUB_TOKEN Permissions
Actions: write
Checks: write
Contents: write
Deployments: write
Discussions: write
Issues: write
Metadata: read
Packages: write
Pages: write
PullRequests: write
RepositoryProjects: write
SecurityEvents: write
Statuses: write
or
GITHUB_TOKEN Permissions
Actions: read
Checks: read
Contents: read
Deployments: read
Discussions: read
Issues: read
Metadata: read
Packages: read
Pages: read
PullRequests: read
RepositoryProjects: read
SecurityEvents: read
Statuses: read
Jobs triggered by PRs get read permissions, other jobs get write.
One job requires non-null permissions to function.
The dependent issues GHA needs PR/issues write permissions to add/remove
`dependent` labels. It needs status write permission to block/unblock
PRs when dependencies are missing/met. Fails with HttpError otherwise.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Instead of using a copy of the deploy file, use Shipyard's deploy as it
could (and does) diverge.
This also obviates the need for a copy of `Dockerfile.dapper` which
can now be taken directly from Shipyard.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
This will ensure that we deploy the current development version of
Submariner and that our artifacts are considered the latest (currently
our latest is 0.11.2!).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Use Kubernetes 1.24 as the default version for end-to-end tests.
Remove Kubernetes 1.21 end-to-end tests as it's end of life.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
We don't really need to run the entire E2E suite anymore since we're
deploying the operator and it takes care of the entire deployment cycle.
Hence, the testing on operator should suffice and the helm testing can
be much slimmer and only use 2 single-node clusters.
This won't run the non-gw node tests, but as it's all tested on the
operator anyhow, there's no need to re-test it here.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Starting with Kubernetes 1.24, secrets are no longer automatically
created for SAs. This adds secrets to the relevant templates; creating
secrets in this way is supported in all Kubernetes versions.
This also enables testing with 1.24 in CI, to make sure that the fix
actually works.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
See https://github.blog/2022-04-12-git-security-vulnerability-announced/
for context. git now refuses to handle repositories which don't belong
to the current user by default; such repositories need to be
explicitly marked as safe, in the global configuration for the current user.
This fixes the failing release job.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
Add Dependabot configuration to automatically update GitHub Actions on
the release-0.12 branch.
This will facilitate quick updates while using SHA-based versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
All docs.github.com URLs return 403 Forbidden, although they work.
This seems to be a new behavior, as it was working less than a week ago.
This happens in CI across submariner-io repos and locally.
$ curl -I https://docs.github.com/
HTTP/2 403
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
For quicker updates and easier, more consistent maintenance.
SHA-based versions should always be used to be sure the code we pull in
can't be changed without us, for security reasons at least. Dependabot
now supports SHA-based versions for GHAs. This patch should facilitate
their continued use.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the yamlint make target provided by Shipyard instead of a third
party GitHub action for running the same tool.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This adds a feature, but nothing that seems relevant to us.
github.com/tim-actions/get-pr-commits/compare/v1.1.0...v1.2.0
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Bumps the version of markdown-link-check from 3.8.7 to 3.9.3.
Changes base image from node:alpine to node:lts-alpine.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Remove tests for Kubernetes 1.20, as it is End of Life and Submariner
supports all versions upstream-Kubernetes supports and no EOL versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Commits produced using "git commit --fix" are great for review, but
must be squashed before a PR is merged.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Update the versions of Kubernetes tested in the E2E CI. Add 1.23 as the
new default for most tests, remove 1.19 as it is now EOL.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Globalnet controller now uses internal services with external-ips
to support exported services. On OCP Clusters, we require an explicit
RBAC to create services with external-ips, this PR includes the
necessary RBAC for Globalnet pods.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
As part of Globalnet enhancement where kubeproxy dependency
is removed, the Globalnet Pod will now create internal
services for every exported service in the respective
namespace where the original service resides. This PR
adds the necessary clusterRole to allow Globalnet pod
to create/delete such internal services.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
connectionHealthCheck in submariner CR is a nested field
but is being added as a variable. This means it is ignored
and the field isn't set correctly in gateway pods.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Right now auto release logic updates `devel` to the stable branch name
when creating stable branches. This leads to this job "sharding" into
multiple jobs, and messes up branch protections.
To keep things simple, the main job name will remain the same so that
there's no "PR targets X" and "PR targets Y" jobs, just the one "PR
targets branch" job
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Per GitHub's security guidelines, GHAs should be pinned using full
length commit SHAs instead of tags.
The SHAs are of the commits currently resolved by the versions.
Even "trusted" GHAs from GitHub developers are pinned because it's
possible their repo rights could be compromised and a malicious GHA
published. These core repos are not frequently substantially updated.
Submariner-internal GHAs are left pinned at devel because we want
automatic updates from Shipyard's shared tooling.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
As we do with the Flake Finder and other periodic jobs, skip the checks
for PR dependencies on forks.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Submariner, k8s, OS and kernel information
are collected as part of `subctl gather`. Don't
ask for them explicitly in bug report.
Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>
This job marks a PR `dependent` whenever a dependent PR
is mentioned via `Depends on/ depends on` keyword.
The job fails until the dependent PR is not merged. This
helps in properly managing merging of dependent PRs.
Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>
`lighthouse-agent` `ClusterRole` requires access to `globalingressips`
for Globalnetv2 in Lighthouse.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Globalnetv2 requires `globalnet` `ClusterRole` for Egress/IngressIPs
but those were added as `globalnet` `Role` instead. This change
moves the permissions from `Role` to `ClusterRole`
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Add a linting job to verify that no commit message in a PR contains the
case insensitive string "Apply suggestions from code review". Commits
with exactly this title are generated by GitHub automatically when a
batch of proposed changes from code review are accepted from the GitHub
UI. A number of such commits have made it into various Submariner/*
repos.
Commits addressing code review feedback should typically be squashed
into the commits under review, or made into well-commented discrete
commits.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Will configure the submariner-bot to add the /ready-to-test label when a
PR has two approvals, causing the full E2E workflow to run.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Add docs generated by helm-docs for each chart. The docs will be kept
up-to-date with CI and the contents of the docs can be improved in
future changes to inline commenting.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
The maintainers table generated by helm-docs includes a raw URL in
Markdown, which fails markdownlint. I sent a PR upstream to fix the root
of the issue, but for now we have to disable this linter rule.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Somehow the GitHub Pages URL we use to publish and install the charts
works to install the charts in CI but also fails with a 404 in CI.
The URL is successfully used by Shipyard here:
https://github.com/submariner-io/shipyard/blob/
33dc2ffdadf6e520a2101368f7f7456c031bace0/scripts/shared/lib/
deploy_helm#L14
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Following the pattern from other repos, split the E2E test job into a
default job that runs a single default-only test always on PRs and a
full job that runs the full matrix when the ready-to-test label is
added.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
The colon in these field names isn't allowed by K8s, and fails ct
linting. Use the new names from submariner-operator, which have already
been renamed to fix this.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This field is required by standard chart schemas. It should be v2 for
Charts that support Helm v3, as we do.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use copyright notice wording required by CNCF for the maintainers field
for both Chart.yaml files.
Also fix an indentation error in one Chart.yaml file.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Add a template for PRs with tips and pointers to docs.
This completes a recommendation of the CII Best Practices program:
> It is SUGGESTED that this policy on adding tests (see test_policy) be
documented in the instructions for change proposals.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Add Submariner's CII Best Practices badge to the README.
Add badges for workflows run against merged code.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Don't run jobs that aren't triggered on pull request on forks.
Forks aren't likely to need these jobs, and theyre more likely to fail
there.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Use the new ability of the shared E2E GHA to configure the Kubernetes
version. Add jobs that cover the latest available patch versions
(limited by kind images) from the three most recent minor versions.
Only run one E2E job with all-default configuration per K8s version, for
some coverage with minimal overhead.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This was deprecated in favour of the operator-based chart. This only
removes the Submariner chart, the broker chart will be addressed
separately.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Periodically run E2E tests against the merged (must have passed E2E
gating) code to detect breakages due to external changes or flaky
failures.
Also supports debugging Helm-related failures in other repositories, by
verifying (or not) what's passing here.
Use the same test matrix as the current E2E job.
Mirrors similar tests in other Submariner repositories.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Instead of redefining the dapper file here, download it from Shiyard
Also use the BASE_BRANCH env variable for the dapper file
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
The script has been migrated to `Makefile.versions` so we can just rely
on the `$VERSION` from there.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Instead of an external GitHub action, use the same markdownlint make
target from Shipyard that we use in other repos.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
To determine the changed files, the Markdown linter needs to know the
base branch; instead of using the default everywhere, use the base
branch set in the PR.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The submainer-engine now access the node object as part
of golbalnet-healthcheck support and the required roles are
added
Signed-off-by: Aswin Surayanarayanan <asuryana@redhat.com>
Use new GHA for reporting issues when broken links are detected. This
logic was verified to work by the frequently-run flaky test finder.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
With v3, we no longer need to initialise Helm or even provide a local
repository; the charts can be installed directly. We now support make
deploy and make e2e too, document that.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
In the new event framework we use node listeners to support certain use-cases.
Currently in helm, routeagent does not have that role, so e2e tests are failing.
This PR enables it.
Related to: https://github.com/submariner-io/submariner/issues/858
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
Currently, we lose updated charts when we check the gh-pages branch
out. This patch generates the charts in the base directory, and moves
them into place after checking the target branch out.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
In an OCP Cluster, openshift-dns namespace has dns-default
service and this is controlled by its operator.
When Globalnet is deployed on OCP, it was seen that globalip
annotation added to it is periodically getting deleted by the
operator, so Globalnet tries to re-add the annotation and this
goes on forever. This will cause Globalnet to consume CPU
unnecessarily and could affect user-experience with Submariner
Globalnet. We have plans to enhance Globalnet to improve its
scalability, but until then we can exclude annotating services
in openshift-dns namespace.
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
In an OCP Cluster, openshift-monitoring namespace has couple of
services and these are controlled by their respective operators.
When Globalnet is deployed on OCP, it was seen that globalip
annotation added to such services are periodically getting
deleted by the operators, so Globalnet tries to re-add the
annotation and this goes on forever. This will cause Globalnet
to consume CPU unnecessarily and could affect user-experience
with Submariner Globalnet. We have plans to enhance Globalnet
to improve its scalability, but until then we can exclude
annotating services in openshift-monitoring namespace.
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
chart-releaser looks at the project history to determine whether a
chart changed, we mustn't limit the fetch depth.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
All tests and release work has been transferred to run on GitHub
Actions, like the rest of Subariner's repos.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the official Helm chart releasing GitHub Action instead of our
custom bash.
Travis CI can be removed after this commit, as all tests will have
equivalents for GHAs.
Closes: #71
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
It seems most CNCF projects provide a CODE-OF-CONDUCT.md file at the
root of their repositories, even if they have their Code of Conduct on
their website. To better fit into the CNCF ecosystem and be a more
welcoming project, follow that pattern.
Relates-to: submariner-io/submariner#804
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
It seems most CNCF projects provide a CONTRIBUTING.md file at the root
of their repositories, even if they have their contributing docs on
their website. To better fit into the CNCF ecosystem and be a more
welcoming project, follow that pattern.
Relates-to: submariner-io/submariner#804
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
The submariner-operator Helm chart deploys Submariner using the
Submariner operator: it deploys the CRDs, roles, and SAs required to
run the operator and Submariner, then pushes a Submariner CR to
instruct the operator to deploy Submariner.
This patch also adds a Makefile to validate the deployments; run
make deploy
to test the Helm charts (this will bring up two clusters, install the
broker on one of them and the operator on both, and end with a
connectivity test).
Fixes: #17
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This installs the `multicluster.x-k8s.io` CRDs and roles for them
Fixes:submariner-io/lighthouse#336
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
YAML linting currently runs on Travis. Convert to a GHA, to align with
other repos and prepare for future optimizations.
Only run against values.yaml and Chart.yaml files, as is currently the
case in the Travis-driven workflow.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Convert MD-lint Workflow into general periodic Workflow.
Minor tweaks from refactoring in other repos.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Combine linting GitHub Actions into a single Workflow.
Minor updates to reflect refactoring in other repos.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Adds support for check-modified-files-only config, which currently isn't
honored and throws a warning.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Currently, the updateStrategy for Route-agent pods is set to RollingUpdate
with maxUnavailable as 1. Because of this, when the route-agent DaemonSet
is updated, the Pods are updated one after the other. While the rolling
update strategy is good for user-facing services, for route-agent DaemonSet
its not the most suitable one as it takes time for all the route-agent pods
to be updated in a large cluster.
Ideally, it would have been great if "Recreate" updateStrategy was supported
for DaemonSets, but unfortunately K8s does not support it. But an alternate
way to achieve something similar is to configure rollingUpdate.maxUnavailable
to 100% so that the DaemonSet controller can update all the route-agent Pods
in a single go.
https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#daemonset-update-strategy
Fixes issue: https://github.com/submariner-io/submariner/issues/734
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
* Add clusterrole to give lighthouse serviceaccount access to endpoints and
endpointslices
* Add role to give broker serviceaccont access to endpoint slices
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
If crd.create is set to false when installing submariner on same cluster
as broker, gateways CRD never gets installed because it is missing from
broker charts. This change is to install the CRD even on broker, as a
cleaner alternative to adding more flags.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Adds following permissions to lighthouse clusterrole
for `gateways.submariner.io`
- get
- list
- watch
This allows lighthouse to track changes to gateway status and know which
clusters are connected.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
In one of the earlier PRs, we modified the terminationGracePeriodSeconds
to 10 secs. However, its seen that this is causing more CI failures
during e2e redundancy tests. Ideally, once the Pods are terminated,
it should cleanup itself ASAP but it is seen that SM Pods are sometimes
taking time to exit and during this Period since there is no active SM
Pod running, this is triggering some failures.
Until we figure out the exact reason why the Pods are taking time for
cleanup, this PR reduces the terminationGracePeriodSeconds.
This issue would be properly addressed via
https://github.com/submariner-io/submariner/issues/694
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
* Update versioning and image repositories
Update helm charts to follow the submariner versioning,
and include the image repositories by default.
Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>
* Update final version
Signed-off-by: Miguel Angel Ajo Pelayo <majopela@redhat.com>
To optimize Lighthouse for Globalnet, Lighthouse needs to know if
globalnet was enabled.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Add GitHub Action validating presence of signed-off-by line to accept
the Developer Certificate of Origin, as required for CNCF.
Relates-to: submariner-io/submariner#666
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
In K8s the default termination grace period for a Pod is 30
secs. However, for Submariner Pods, we were configuring this as
0 secs, because of which, cleanup was not happening in a
consistent manner and we are seeing failures in CI jobs.
This PR modifies the terminationGracePeriodSeconds to 10 secs.
Along with this change, it also uses the proper namespace of
submariner in the excluded namespaces.
Fixes issue: https://github.com/submariner-io/submariner-charts/issues/39
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
The CI job currently only checks the bare chart, with optional flags set
to defaults which cause it to miss those parts. Set the flags so that
the job also checks those parts.
Add a GitHub CODEOWNERS file to support disaggregating commit rights.
Allows the Committer process in the Community Membership docs to be
implemented.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
It was missing the post-deletion operator which caused it to generate:
name:
submariner-lighthouse
Instead of `name: submariner-lighthouse`
Now it should be fine
As part of supporting connectivity from HostNetwork to remoteClusters, globalnet
controller requires the CNIInterfaceIP on each node. This PR adds the necessary
clusterRoles for the route-agent daemonSet which will annotate the node with the
CNIInterfaceIP on that respective node.
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
As part of supporting connectivity from HostNetwork to remoteClusters, globalnet
controller annotates a node with globalIP. This PR adds the necessary roles for
globalnetController.
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
This PR provides a mechanism to configure the following
Submariner Gateway leader election values
1. leaseDuration
2. renewDeadline
3. retryPeriod
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
In previous upstream discussions we talked about renaming submariner
engine "deployment" (now daemonset) to submariner-gateway to make
identification of the gateway easier to admins and avoid confusion.
Also see: https://github.com/submariner-io/submariner-operator/pull/145
Currently, the Submariner Engine is a deployment with nodeSelector
(for submariner.io/gateway=true). It is seen that when the label
is removed from the node after SM engine is deployed, SM engine
continues to run on that node. This behavior is not in Sync with
the DaemonSet (used by GlobalnetController) behavior where the POD
is immediately terminated when the label is removed from the node.
This PR updates SM engine as DaemonSet so that we have consistent
behavior between the SM Engine POD and GlobalnetController POD.
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
Added a chart for the globalnet controller which uses the global CIDR.
Also added the global CIDR to the submariner engine pod env so it can
utilize it.
The controller will only be deployed if the CIDR is specified.
Submariner-route-agent daemonset pod needs to query the list of other sm-route-agent
pods in the cluster for their hostIP addresses. The ipaddress will be used as remote
VxLAN Vtep IPs. Currently, sm-route-agent pod does not have the necessary privileges
to list the pods in the submariner namespace of local cluster. This patch addresses
this issue by adding the necessary role.
Error seen:
Failed to list *v1.Pod: pods is forbidden: User
"system:serviceaccount:submariner:submariner-routeagent" cannot list resource "pods"
in API group "" in the namespace "submariner"
Both iptables and nftables use netfilter framework in the kernel for
packet filtering. Many distributions are moving in the direction of
using nftables over iptables. Although, nftables uses a new command
line utility (named nft), starting from iptables >=1.8, it uses
nftables under the hood while continuing to support the same iptables
syntax from the user.
Quoting from Dan's comment [#]
"In iptables 1.8, the maintainers have "deprecated" the classic ip_tables:
the iptables tool now does userspace translation from the legacy UI/UX,
and uses nf_tables under the hood. So, the commands look and feel the
same, but they're now programming a different kernel subsystem.
The problem arises when you mix and match invocations of iptables 1.6
(the previous stable) and 1.8 on the same machine, because although they
look identical, they're programming different kernel subsystems.
Empirically, this causes weird and wonderful things to happen - things
like if you trace a packet coming from a pod, you see it flowing through
both ip_tables and nf_tables, but even if both accept the packet, it then
vanishes entirely and never gets forwarded"
So, as long as we are programming either nf_tables or iptables, we would
not have any issues. Currently, there is no easy way to identify what type
of rules are programmed on the host. This patch follows the same approach
(as described here [*]) that is taken in OpenShift where the host file
system is mounted inside the docker container and iptables utility on the
host is exec'ed for programming any firewall rules.
[#] https://github.com/kubernetes/kubernetes/issues/71305#issuecomment-448052889
[*] https://github.com/kubernetes/kubernetes/issues/71305#issuecomment-521978797
Normally in a vanilla kubernetes deployment, there is a single endpoint for kubernetes.
However, in some deployments (like OpenShift), there could be multiple endpoints.
This patch updates the SUBMARINER_BROKER_URL to use the appropriate "https" endpoint.
<!-- Thanks for sending a pull request! Here are some tips for you:
1. If this is your first time, please read our developer guide: https://submariner.io/development/
2. Ensure you have added the appropriate tests for your PR: https://submariner.io/development/code-review/#test-new-functionality
3. Read the code review guide to ease the review process: https://submariner.io/development/code-review/
4. If the PR is unfinished, mark it as a draft: https://submariner.io/development/code-review/#mark-work-in-progress-prs-as-drafts
5. If you are using CI to debug, use your private fork: https://submariner.io/development/code-review/#use-private-forks-for-debugging-prs-by-running-ci
If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
{{- end }}
By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
description:"Restrict submariner to nodes labeled with submariner.io/gateway=true"
label:Restrict gateway deployments to specific nodes
type:boolean
group:"Gateway Configuration"
- variable:submariner.clusterId
default:""
description:"Enter a unique cluster ID to identify this cluster"
type:string
label:"Cluster ID"
group:"Configuration"
required:true
- variable:ipsec.psk
default:""
description:"Enter the pre-shared key for the IPsec Cable Engine"
type:string
label:"IPsec Pre-Shared Key"
group:"Configuration"
required:true
- variable:broker.type
type:enum
default:k8s
options:
- k8s
group:"Broker Configuration"
label:"Broker Type"
description:"Type of Broker to use"
- variable:broker.server
type:string
default:""
group:"Broker Configuration"
label:"Broker Server"
description:"Broker server to use (without the https://)"
- variable:broker.insecure
type:bool
default:false
show_subquestion_if:false
group:"Broker Configuration"
label:"Insecure Broker"
description:"Connect to K8s broker without validating CA"
subquestions:
- variable:broker.ca
type:string
description:"Base64 encoded broker ca.crt"
label:"Broker CA encoded in base64"
default:""
- variable:broker.token
type:string
group:"Broker Configuration"
label:"Broker Token"
description:"Bearer token for broker"
- variable:broker.namespace
type:string
group:"Broker Configuration"
label:"Broker Namespace"
description:"Enter namespace to use on central broker"
- variable:submariner.clusterCidr
default:""
description:"Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster"
type:string
label:"Cluster CIDR"
group:"CIDR Configuration"
required:true
- variable:submariner.serviceCidr
default:""
description:"Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster"
type:string
label:"Service CIDR"
group:"CIDR Configuration"
required:true
- variable:submariner.natEnabled
type:boolean
default:false
group:"Advanced Configuration"
description:"If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT"
label:"NAT Enabled"
- variable:crd.create
type:boolean
default:true
group:"Advanced Configuration"
description:"Create the Submariner CRDs, if deploying Submariner into the same cluster as the submariner-k8s-broker, you probably shouldn't create CRDs"
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
