-
Notifications
You must be signed in to change notification settings - Fork 321
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CNI: Add support for OpenShift and Multus
- Loading branch information
1 parent
2b2a8ed
commit 8a97da4
Showing
16 changed files
with
465 additions
and
73 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
25 changes: 25 additions & 0 deletions
25
charts/consul/templates/cni-networkattachmentdefinition.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
{{- if (and (.Values.connectInject.cni.enabled) (.Values.connectInject.cni.multus)) }} | ||
apiVersion: "k8s.cni.cncf.io/v1" | ||
kind: NetworkAttachmentDefinition | ||
metadata: | ||
name: {{ template "consul.fullname" . }}-cni | ||
namespace: {{ .Release.Namespace }} | ||
labels: | ||
app: {{ template "consul.name" . }} | ||
chart: {{ template "consul.chart" . }} | ||
heritage: {{ .Release.Service }} | ||
release: {{ .Release.Name }} | ||
component: cni | ||
spec: | ||
config: '{ | ||
"cniVersion": "0.3.1", | ||
"type": "consul-cni", | ||
"cni_bin_dir": "{{ .Values.connectInject.cni.cniBinDir }}", | ||
"cni_net_dir": "{{ .Values.connectInject.cni.cniNetDir }}", | ||
"kubeconfig": "ZZZ-consul-cni-kubeconfig", | ||
"log_level": "{{ default .Values.global.logLevel .Values.connectInject.cni.logLevel }}", | ||
"multus": true, | ||
"name": "consul-cni", | ||
"type": "consul-cni" | ||
}' | ||
{{- end }} |
50 changes: 50 additions & 0 deletions
50
charts/consul/templates/cni-securitycontextconstraints.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,50 @@ | ||
{{- if (and (.Values.connectInject.cni.enabled) (.Values.global.openshift.enabled)) }} | ||
apiVersion: security.openshift.io/v1 | ||
kind: SecurityContextConstraints | ||
metadata: | ||
name: {{ template "consul.fullname" . }}-cni | ||
namespace: {{ .Release.Namespace }} | ||
labels: | ||
app: {{ template "consul.name" . }} | ||
chart: {{ template "consul.chart" . }} | ||
heritage: {{ .Release.Service }} | ||
release: {{ .Release.Name }} | ||
component: cni | ||
annotations: | ||
kubernetes.io/description: {{ template "consul.fullname" . }}-cni are the security context constraints required | ||
to run consul-cni. | ||
allowHostDirVolumePlugin: true | ||
allowHostIPC: false | ||
allowHostNetwork: true | ||
allowHostPID: false | ||
allowHostPorts: true | ||
allowPrivilegeEscalation: true | ||
allowPrivilegedContainer: true | ||
allowedCapabilities: null | ||
defaultAddCapabilities: null | ||
fsGroup: | ||
type: MustRunAs | ||
groups: [] | ||
priority: null | ||
readOnlyRootFilesystem: false | ||
requiredDropCapabilities: | ||
- KILL | ||
- MKNOD | ||
- SETUID | ||
- SETGID | ||
runAsUser: | ||
type: MustRunAsRange | ||
seLinuxContext: | ||
type: MustRunAs | ||
supplementalGroups: | ||
type: MustRunAs | ||
users: [] | ||
volumes: | ||
- configMap | ||
- downwardAPI | ||
- emptyDir | ||
- persistentVolumeClaim | ||
- projected | ||
- secret | ||
- hostPath | ||
{{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
charts/consul/test/unit/cni-networkattachmentdefinition.bats
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,61 @@ | ||
#!/usr/bin/env bats | ||
|
||
load _helpers | ||
|
||
@test "cni/NetworkAttachmentDefinition: disabled by default" { | ||
cd `chart_dir` | ||
assert_empty helm template \ | ||
-s templates/cni-networkattachmentdefinition.yaml \ | ||
. | ||
} | ||
|
||
@test "cni/NetworkAttachmentDefinition: disabled when cni enabled and multus disabled" { | ||
cd `chart_dir` | ||
assert_empty helm template \ | ||
-s templates/cni-securitycontextconstraints.yaml \ | ||
--set 'connectInject.enabled=true' \ | ||
--set 'connectInject.cni.enabled=true' \ | ||
--set 'connectInject.cni.multus=false' \ | ||
. | ||
} | ||
|
||
@test "cni/NetworkAttachmentDefinition: enabled when cni enabled and multus enabled" { | ||
cd `chart_dir` | ||
local actual=$(helm template \ | ||
-s templates/cni-networkattachmentdefinition.yaml \ | ||
--set 'connectInject.enabled=true' \ | ||
--set 'connectInject.cni.enabled=true' \ | ||
--set 'connectInject.cni.multus=true' \ | ||
. | tee /dev/stderr | | ||
yq -s 'length > 0' | tee /dev/stderr) | ||
[ "${actual}" = "true" ] | ||
} | ||
|
||
@test "cni/NetworkAttachmentDefinition: config is set" { | ||
cd `chart_dir` | ||
local cmd=$(helm template \ | ||
-s templates/cni-networkattachmentdefinition.yaml \ | ||
--set 'connectInject.cni.enabled=true' \ | ||
--set 'connectInject.enabled=true' \ | ||
--set 'connectInject.cni.multus=true' \ | ||
--set 'connectInject.cni.logLevel=bar' \ | ||
--set 'connectInject.cni.cniBinDir=baz' \ | ||
--set 'connectInject.cni.cniNetDir=foo' \ | ||
bar \ | ||
. | tee /dev/stderr | | ||
yq -rc '.spec.config' | tee /dev/stderr) | ||
|
||
local actual=$(echo "$cmd" | | ||
yq '.log_level' | tee /dev/stderr) | ||
[ "${actual}" = '"bar"' ] | ||
|
||
local actual=$(echo "$cmd" | | ||
yq '.cni_bin_dir' | tee /dev/stderr) | ||
[ "${actual}" = '"baz"' ] | ||
|
||
local actual=$(echo "$cmd" | | ||
yq '.cni_net_dir' | tee /dev/stderr) | ||
[ "${actual}" = '"foo"' ] | ||
|
||
} | ||
|
33 changes: 33 additions & 0 deletions
33
charts/consul/test/unit/cni-securitycontextcontstraints.bats
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,33 @@ | ||
#!/usr/bin/env bats | ||
|
||
load _helpers | ||
|
||
@test "cni/SecurityContextConstraints: disabled by default" { | ||
cd `chart_dir` | ||
assert_empty helm template \ | ||
-s templates/cni-securitycontextconstraints.yaml \ | ||
. | ||
} | ||
|
||
@test "cni/SecurityContextConstraints: disabled when cni disabled and global.openshift.enabled=true" { | ||
cd `chart_dir` | ||
assert_empty helm template \ | ||
-s templates/cni-securitycontextconstraints.yaml \ | ||
--set 'connectInject.enabled=true' \ | ||
--set 'connectInject.cni.enabled=false' \ | ||
--set 'global.openshift.enabled=true' \ | ||
. | ||
} | ||
|
||
@test "cni/SecurityContextConstraints: enabled when cni enabled and global.openshift.enabled=true" { | ||
cd `chart_dir` | ||
local actual=$(helm template \ | ||
-s templates/cni-securitycontextconstraints.yaml \ | ||
--set 'connectInject.enabled=true' \ | ||
--set 'connectInject.cni.enabled=true' \ | ||
--set 'global.openshift.enabled=true' \ | ||
. | tee /dev/stderr | | ||
yq -s 'length > 0' | tee /dev/stderr) | ||
[ "${actual}" = "true" ] | ||
} | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.