Skip to content

Commit 836cc51

Browse files
willie-yaowillie-yao
committed
Add templates to test Azure Linux 3
1 parent b7c1f0d commit 836cc51

21 files changed

+3272
-3
lines changed

‎templates/test/ci/cluster-template-prow-azl3.yaml‎

Lines changed: 482 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎templates/test/ci/cluster-template-prow-ci-version-azl3.yaml‎

Lines changed: 1438 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎templates/test/ci/cluster-template-prow-dalec-custom-builds.yaml‎

Lines changed: 696 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎templates/test/ci/prow-azl3/kustomization.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: default
4+
resources:
5+
- ../../../flavors/default
6+
- ../../../addons/cluster-api-helm/calico.yaml
7+
- ../../../addons/cluster-api-helm/azuredisk-csi-driver.yaml
8+
- ../../../addons/cluster-api-helm/cloud-provider-azure.yaml
9+
- ../../../addons/cluster-api-helm/cloud-provider-azure-ci.yaml
10+
patches:
11+
- path: ../patches/tags.yaml
12+
- path: ../patches/mhc.yaml
13+
- path: ../patches/controller-manager.yaml
14+
- path: ../patches/uami-md-0.yaml
15+
- path: ../patches/uami-control-plane.yaml
16+
- path: ../patches/cluster-label-calico.yaml
17+
- path: ../patches/cluster-label-cloud-provider-azure.yaml
18+
- path: patches/controller-manager.yaml
19+
target:
20+
group: controlplane.cluster.x-k8s.io
21+
kind: KubeadmControlPlane
22+
name: .*-control-plane
23+
version: v1beta1
24+
- path: patches/kubeadm-config-template-azl3.yaml
25+
target:
26+
group: bootstrap.cluster.x-k8s.io
27+
kind: KubeadmConfigTemplate
28+
name: .*-md-0
29+
namespace: default
30+
version: v1beta1
31+
- path: patches/azuremachinetemplate-azl3-image.yaml
32+
- path: patches/cloud-provider-azure-cacertdir.yaml
33+
- path: patches/cloud-provider-azure-ci-cacertdir.yaml
34+
35+
sortOptions:
36+
order: fifo

‎templates/test/ci/prow-azl3/patches/azuremachinetemplate-azl3-image.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
2+
kind: AzureMachineTemplate
3+
metadata:
4+
name: ${CLUSTER_NAME}-control-plane
5+
spec:
6+
template:
7+
spec:
8+
image:
9+
computeGallery:
10+
gallery: ClusterAPI-f72ceb4f-5159-4c26-a0fe-2ea738f0d019
11+
name: capi-azurelinux-3
12+
version: ${AZL3_VERSION}
13+
---
14+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
15+
kind: AzureMachineTemplate
16+
metadata:
17+
name: ${CLUSTER_NAME}-md-0
18+
spec:
19+
template:
20+
spec:
21+
image:
22+
computeGallery:
23+
gallery: ClusterAPI-f72ceb4f-5159-4c26-a0fe-2ea738f0d019
24+
name: capi-azurelinux-3
25+
version: ${AZL3_VERSION}

‎templates/test/ci/prow-azl3/patches/cloud-provider-azure-cacertdir.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: addons.cluster.x-k8s.io/v1alpha1
2+
kind: HelmChartProxy
3+
metadata:
4+
name: cloud-provider-azure-chart
5+
spec:
6+
valuesTemplate: |
7+
infra:
8+
clusterName: {{ .Cluster.metadata.name }}
9+
cloudControllerManager:
10+
caCertDir: "/etc/pki/tls/certs"
11+
clusterCIDR: {{ .Cluster.spec.clusterNetwork.pods.cidrBlocks | join "," }}
12+
logVerbosity: 4

‎templates/test/ci/prow-azl3/patches/cloud-provider-azure-ci-cacertdir.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: addons.cluster.x-k8s.io/v1alpha1
2+
kind: HelmChartProxy
3+
metadata:
4+
name: cloud-provider-azure-chart-ci
5+
spec:
6+
valuesTemplate: |
7+
infra:
8+
clusterName: {{ .Cluster.metadata.name }}
9+
cloudControllerManager:
10+
caCertDir: "/etc/pki/tls/certs"
11+
cloudConfig: ${CLOUD_CONFIG:-"/etc/kubernetes/azure.json"}
12+
cloudConfigSecretName: ${CONFIG_SECRET_NAME:-""}
13+
clusterCIDR: {{ .Cluster.spec.clusterNetwork.pods.cidrBlocks | join "," }}
14+
imageName: "${CCM_IMAGE_NAME:-""}"
15+
imageRepository: "${IMAGE_REGISTRY:-""}"
16+
imageTag: "${IMAGE_TAG_CCM:-""}"
17+
logVerbosity: ${CCM_LOG_VERBOSITY:-4}
18+
replicas: ${CCM_COUNT:-1}
19+
enableDynamicReloading: ${ENABLE_DYNAMIC_RELOADING:-false}
20+
cloudNodeManager:
21+
imageName: "${CNM_IMAGE_NAME:-""}"
22+
imageRepository: "${IMAGE_REGISTRY:-""}"
23+
imageTag: "${IMAGE_TAG_CNM:-""}"

‎templates/test/ci/prow-azl3/patches/controller-manager.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
- op: add
2+
path: /spec/kubeadmConfigSpec/files/0
3+
value:
4+
content: |
5+
#!/bin/bash
6+
7+
set -o nounset
8+
set -o pipefail
9+
set -o errexit
10+
11+
# Install ca-certificates packages for Azure Linux
12+
tdnf install -y ca-certificates ca-certificates-legacy
13+
update-ca-trust
14+
15+
# Allow Azure service IP addresses (required for Azure resources)
16+
iptables -A INPUT -s 168.63.129.16 -j ACCEPT
17+
iptables -A OUTPUT -d 168.63.129.16 -j ACCEPT
18+
19+
# Kubernetes API Server (port 6443) - bound to all IPv6 interfaces, needs external access
20+
iptables -A INPUT -p tcp --dport 6443 -j ACCEPT
21+
22+
# etcd server communication
23+
iptables -A INPUT -p tcp --dport 2379 -j ACCEPT
24+
iptables -A INPUT -p tcp --dport 2380 -j ACCEPT
25+
26+
# Allow traffic to Kubernetes service network (10.96.0.0/12)
27+
iptables -A OUTPUT -d 10.96.0.0/12 -j ACCEPT
28+
iptables -A INPUT -s 10.96.0.0/12 -j ACCEPT
29+
30+
# Allow traffic to/from node network (10.1.0.0/24)
31+
iptables -A OUTPUT -d 10.1.0.0/24 -j ACCEPT
32+
iptables -A INPUT -s 10.1.0.0/24 -j ACCEPT
33+
34+
# Allow traffic to/from Calico pod network
35+
iptables -A OUTPUT -d 192.168.0.0/24 -j ACCEPT
36+
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
37+
38+
# Save the rules following Azure Linux 3 approach
39+
iptables-save > /etc/systemd/scripts/ip4save
40+
path: /tmp/azl3-setup.sh
41+
owner: "root:root"
42+
permissions: "0744"
43+
- op: add
44+
path: /spec/kubeadmConfigSpec/preKubeadmCommands/0
45+
value:
46+
bash -c /tmp/azl3-setup.sh

‎templates/test/ci/prow-azl3/patches/disable-vm-bootstrap-extension.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
2+
kind: AzureMachineTemplate
3+
metadata:
4+
name: ${CLUSTER_NAME}-control-plane
5+
spec:
6+
template:
7+
spec:
8+
disableVMBootstrapExtension: true
9+
---
10+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
11+
kind: AzureMachineTemplate
12+
metadata:
13+
name: ${CLUSTER_NAME}-md-0
14+
spec:
15+
template:
16+
spec:
17+
disableVMBootstrapExtension: true

‎templates/test/ci/prow-azl3/patches/kubeadm-config-template-azl3.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
- op: add
2+
path: /spec/template/spec/files/0
3+
value:
4+
content: |
5+
#!/bin/bash
6+
7+
set -o nounset
8+
set -o pipefail
9+
set -o errexit
10+
11+
# Allow Azure service IP addresses (required for Azure resources)
12+
iptables -A INPUT -s 168.63.129.16 -j ACCEPT
13+
iptables -A OUTPUT -d 168.63.129.16 -j ACCEPT
14+
15+
# Allow localhost traffic
16+
iptables -A INPUT -i lo -j ACCEPT
17+
iptables -A OUTPUT -o lo -j ACCEPT
18+
19+
# Allow established and related connections
20+
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
21+
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
22+
23+
# SSH (port 22)
24+
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
25+
26+
# Kubelet API (port 10250)
27+
iptables -A INPUT -p tcp --dport 10250 -j ACCEPT
28+
29+
# Allow traffic to Kubernetes service network (10.96.0.0/12)
30+
iptables -A OUTPUT -d 10.96.0.0/12 -j ACCEPT
31+
iptables -A INPUT -s 10.96.0.0/12 -j ACCEPT
32+
33+
# Allow traffic to/from Calico pod network (192.168.0.0/16)
34+
iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
35+
iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
36+
37+
# Allow traffic to/from node network (10.1.0.0/24)
38+
iptables -A OUTPUT -d 10.1.0.0/24 -j ACCEPT
39+
iptables -A INPUT -s 10.1.0.0/24 -j ACCEPT
40+
41+
# Calico networking requirements
42+
# Calico Typha (port 5473)
43+
iptables -A INPUT -p tcp --dport 5473 -j ACCEPT
44+
45+
# VXLAN for overlay networking (port 4789 UDP)
46+
iptables -A INPUT -p udp --dport 4789 -j ACCEPT
47+
48+
# BGP for node-to-node communication (port 179)
49+
iptables -A INPUT -p tcp --d port 179 -j ACCEPT
50+
51+
# DNS (port 53)
52+
iptables -A INPUT -p udp --dport 53 -j ACCEPT
53+
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
54+
55+
# Save the rules following Azure Linux 3 approach
56+
iptables-save > /etc/systemd/scripts/ip4save
57+
path: /tmp/azl3-setup.sh
58+
owner: "root:root"
59+
permissions: "0744"
60+
- op: add
61+
path: /spec/template/spec/preKubeadmCommands/0
62+
value:
63+
bash -c /tmp/azl3-setup.sh

0 commit comments

Comments
 (0)