Skip to content

Commit 007d5b4

Browse files
georgethebeatlegeorgethebeatle
authored
Merge pull request #4117 from marsteg/ms/issue-4100
Issue 4100
2 parents 2fad750 + 783119b commit 007d5b4

File tree

11 files changed

+35902
-1
lines changed

11 files changed

+35902
-1
lines changed

‎helm/korifi/templates/calico-deny-apps-egress-policy.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if .Values.experimental.securityGroups.enabled }}
2+
apiVersion: crd.projectcalico.org/v1
3+
kind: GlobalNetworkPolicy
4+
metadata:
5+
name: default.deny-apps-egress
6+
spec:
7+
order: 100
8+
namespaceSelector: has(korifi.cloudfoundry.org/space-guid)
9+
types:
10+
- Egress
11+
{{- end }}

‎scripts/assets/calico-allow-apps-egress-policy.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: crd.projectcalico.org/v1
2+
kind: GlobalNetworkPolicy
3+
metadata:
4+
name: default.allow-apps-egress
5+
spec:
6+
order: 10
7+
namespaceSelector: has(korifi.cloudfoundry.org/space-guid)
8+
types:
9+
- Egress
10+
egress:
11+
- action: Allow
12+
protocol: TCP
13+
destination:
14+
ports:
15+
- 1:65535
16+
- action: Allow
17+
protocol: UDP
18+
destination:
19+
ports:
20+
- 1:65535
21+
- action: Allow
22+
protocol: TCP
23+
destination:
24+
services:
25+
name: localregistry-docker-registry
26+
namespace: default

‎scripts/deploy-on-kind.sh‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,9 @@ function ensure_local_registry() {
122122
function install_dependencies() {
123123
pushd "${ROOT_DIR}" >/dev/null
124124
{
125-
"${SCRIPT_DIR}/install-dependencies.sh" -i
125+
"${SCRIPT_DIR}/install-dependencies.sh" \
126+
--insecure-tls-metrics-server \
127+
--install-vendored-calico
126128
}
127129
popd >/dev/null
128130
}
@@ -263,6 +265,10 @@ function create_cluster_builder() {
263265
kubectl wait --for=condition=ready clusterbuilder --all=true --timeout=15m
264266
}
265267

268+
function allow_apps_egress() {
269+
kubectl apply -f "$SCRIPT_DIR/assets/calico-allow-apps-egress-policy.yaml"
270+
}
271+
266272
function main() {
267273
make -C "$ROOT_DIR" bin/yq
268274

@@ -271,6 +277,7 @@ function main() {
271277
ensure_kind_cluster "$CLUSTER_NAME"
272278
ensure_local_registry
273279
install_dependencies
280+
allow_apps_egress
274281
create_namespaces
275282
create_registry_secret
276283
deploy_korifi

‎scripts/install-dependencies.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ Usage:
1818
flags:
1919
-i, --insecure-tls-metrics-server
2020
(optional) Provide insecure TLS args to Metrics Server. This is useful for distributions such as Kind, Minikube, etc.
21+
-c, --install-vendored-calico
22+
(optional) Installed vendored calico. Useful for testing on Kind.
2123
EOF
2224
exit 1
2325
}
@@ -37,6 +39,10 @@ while [[ $# -gt 0 ]]; do
3739
INSECURE_TLS_METRICS_SERVER=true
3840
shift
3941
;;
42+
-c | --install-vendored-calico)
43+
INSTALL_VENDORED_CALICO=true
44+
shift
45+
;;
4046
*)
4147
echo -e "Error: Unknown flag: ${i/=*/}\n" >&2
4248
usage_text >&2
@@ -105,3 +111,24 @@ if ! kubectl get apiservice v1beta1.metrics.k8s.io >/dev/null 2>&1; then
105111
kubectl apply -f "$VENDOR_DIR/metrics-server-local"
106112
fi
107113
fi
114+
115+
if [[ "${INSTALL_VENDORED_CALICO:-}" == "true" ]]; then
116+
echo "********************"
117+
echo " Installing Calico"
118+
echo "********************"
119+
120+
kubectl apply -f "$VENDOR_DIR/calico/operator-crds.yaml" --server-side
121+
kubectl apply -f "$VENDOR_DIR/calico/tigera-operator.yaml" --server-side
122+
123+
kubectl -n tigera-operator rollout status deployment/tigera-operator --watch=true
124+
125+
TEMP_FILES+=("$DEP_DIR/calico/custom-resources.yaml")
126+
cp "$VENDOR_DIR/calico/custom-resources.yaml" "$DEP_DIR/calico/custom-resources.yaml"
127+
kubectl apply -k "$DEP_DIR/calico"
128+
129+
while ! kubectl get ns calico-system >/dev/null 2>&1; do
130+
sleep 1
131+
done
132+
kubectl -n calico-system rollout status deployment/whisker --watch=true
133+
sleep 1
134+
fi

‎tests/assets/dorifi-golang/main.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ func main() {
3232
http.HandleFunc("/servicebindingroot", serviceBindingRootHandler)
3333
http.HandleFunc("/servicebindings", serviceBindingsHandler)
3434
http.HandleFunc("/exit", exitHandler)
35+
http.HandleFunc("/outbound", outboundHandler)
3536
http.HandleFunc("/log", logHandler)
3637

3738
port := os.Getenv("PORT")
@@ -86,6 +87,21 @@ func helloWorldHandler(arg string) func(w http.ResponseWriter, _ *http.Request)
8687
}
8788
}
8889

90+
func outboundHandler(w http.ResponseWriter, _ *http.Request) {
91+
client := &http.Client{
92+
Timeout: 2 * time.Second,
93+
}
94+
resp, err := client.Get("http://google.com/")
95+
if err != nil {
96+
http.Error(w, fmt.Sprintf("Failed to make outbound request: %v", err), http.StatusBadRequest)
97+
return
98+
}
99+
defer resp.Body.Close()
100+
w.WriteHeader(http.StatusOK)
101+
fmt.Fprintln(w, "Outbound request to google.com was successful")
102+
fmt.Fprintln(w, "Response status code:", resp.StatusCode)
103+
}
104+
89105
func envJsonHandler(w http.ResponseWriter, _ *http.Request) {
90106
envJson := map[string]string{}
91107
env := os.Environ()

‎tests/dependencies/calico/kustomization.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resources:
2+
- custom-resources.yaml
3+
4+
patches:
5+
- patch: |-
6+
- op: replace
7+
path: /spec/calicoNetwork/ipPools/0/cidr
8+
value: 10.244.0.0/16
9+
target:
10+
kind: Installation
11+
group: operator.tigera.io
12+
version: v1
13+
name: default

‎tests/vendir.lock.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,12 @@ directories:
1313
tag: v1.19.0
1414
url: https://api.github.com/repos/cert-manager/cert-manager/releases/252689218
1515
path: cert-manager
16+
- git:
17+
commitTitle: Fix parent-release-branch
18+
sha: 068c7aa62a62c7459c9ecbf929c92f2a6594f22d
19+
tags:
20+
- v3.30.3
21+
path: calico
1622
- git:
1723
commitTitle: Update Contour Docker image to v1.33.0....
1824
sha: 3635b068e25d74b7089c272eefd6ccb6a08f2861

‎tests/vendir.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,18 @@ directories:
2020
latest: true
2121
disableAutoChecksumValidation: true
2222
assetNames: ["cert-manager*.yaml"]
23+
- path: calico
24+
git:
25+
url: https://github.com/projectcalico/calico
26+
depth: 1
27+
refSelection:
28+
semver:
29+
constraints: ">=3.30.2"
30+
includePaths:
31+
- manifests/operator-crds.yaml
32+
- manifests/tigera-operator.yaml
33+
- manifests/custom-resources.yaml
34+
newRootPath: manifests
2335
- path: contour
2436
git:
2537
url: https://github.com/projectcontour/contour

‎tests/vendor/calico/custom-resources.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# This section includes base Calico installation configuration.
2+
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
3+
apiVersion: operator.tigera.io/v1
4+
kind: Installation
5+
metadata:
6+
name: default
7+
spec:
8+
# Configures Calico networking.
9+
calicoNetwork:
10+
ipPools:
11+
- name: default-ipv4-ippool
12+
blockSize: 26
13+
cidr: 192.168.0.0/16
14+
encapsulation: VXLANCrossSubnet
15+
natOutgoing: Enabled
16+
nodeSelector: all()
17+
18+
---
19+
20+
# This section configures the Calico API server.
21+
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
22+
apiVersion: operator.tigera.io/v1
23+
kind: APIServer
24+
metadata:
25+
name: default
26+
spec: {}
27+
28+
---
29+
30+
# Configures the Calico Goldmane flow aggregator.
31+
apiVersion: operator.tigera.io/v1
32+
kind: Goldmane
33+
metadata:
34+
name: default
35+
36+
---
37+
38+
# Configures the Calico Whisker observability UI.
39+
apiVersion: operator.tigera.io/v1
40+
kind: Whisker
41+
metadata:
42+
name: default

0 commit comments

Comments
 (0)