Skip to content

Commit 81ce9fb

Browse files
mrnicegyu11mrnicegyu11
committed
Merge remote-tracking branch 'upstream/main'
2 parents b856eb0 + b8fdc8b commit 81ce9fb

26 files changed

+428
-106
lines changed

‎charts/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@ values.yaml
22
values.*.yaml
33
k8s_hosts.ini
44
helmfile.y?ml
5+
6+
*.tgz

‎charts/Makefile‎

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# to be executed on kubernetes control nodes
12
REPO_BASE_DIR := $(shell git rev-parse --show-toplevel)
23

34
include ${REPO_BASE_DIR}/scripts/common.Makefile
@@ -23,40 +24,16 @@ helmfile-lint: .check-helmfile-installed helmfile.yaml ## Lints the helmfile
2324
set -a; source $(REPO_CONFIG_LOCATION); set +a; \
2425
helmfile lint
2526

26-
.PHONY: .helmfile-local-post-install
27-
.helmfile-local-post-install: ## Post install steps for local helmfile deployment
28-
@$(MAKE) -s configure-local-hosts
29-
@echo "";
30-
@echo "Cluster has been deployed locally: https://$(MACHINE_FQDN)";
31-
@echo " For secure connections self-signed certificates are used.";
32-
@echo "";
33-
3427
.PHONY: helmfile-apply
3528
helmfile-apply: .check-helmfile-installed helmfile.yaml ## Applies the helmfile configuration
3629
set -a; source $(REPO_CONFIG_LOCATION); set +a; \
3730
helmfile -f $(REPO_BASE_DIR)/charts/helmfile.yaml apply
3831

39-
@if [ "$(MACHINE_FQDN)" = "osparc.local" ]; then \
40-
$(MAKE) -s .helmfile-local-post-install; \
41-
fi
42-
4332
.PHONY: helmfile-sync
4433
helmfile-sync: .check-helmfile-installed helmfile.yaml ## Syncs the helmfile configuration (use `helmfile-apply` to deploy the app)
4534
set -a; source $(REPO_CONFIG_LOCATION); set +a; \
4635
helmfile -f $(REPO_BASE_DIR)/charts/helmfile.yaml sync
4736

48-
@if [ "$(MACHINE_FQDN)" = "osparc.local" ]; then \
49-
$(MAKE) -s .helmfile-local-post-install; \
50-
fi
51-
52-
.PHONY: configure-local-hosts
53-
configure-local-hosts: $(REPO_CONFIG_LOCATION) ## Adds local hosts entries for the machine
54-
# "Updating /etc/hosts with k8s $(MACHINE_FQDN) hosts ..."
55-
@set -a; source $(REPO_CONFIG_LOCATION); set +a; \
56-
grep -q "127.0.0.1 $$K8S_MONITORING_FQDN" /etc/hosts || echo "127.0.0.1 $$K8S_MONITORING_FQDN" | sudo tee -a /etc/hosts
57-
@set -a; source $(REPO_CONFIG_LOCATION); set +a; \
58-
grep -q "127.0.0.1 $$K8S_PRIVATE_FQDN" /etc/hosts || echo "127.0.0.1 $$K8S_PRIVATE_FQDN" | sudo tee -a /etc/hosts
59-
6037
.PHONY: helmfile-diff
6138
helmfile-diff: .check-helmfile-installed helmfile.yaml ## Shows the differences that would be applied by helmfile
6239
@set -a; source $(REPO_CONFIG_LOCATION); set +a; \

‎charts/README.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,4 @@ helmfile init
4545

4646
## Running k8s cluster locally
4747

48-
```bash
49-
cd ./osparc-ops-environments
50-
./scripts/create_local_k8s_cluster.bash
51-
```
48+
Use `./local-k8s.Makefile` targets

‎charts/adminer/templates/deployment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ spec:
1313
{{- include "adminer.selectorLabels" . | nindent 6 }}
1414
template:
1515
metadata:
16-
{{- with .Values.podAnnotations }}
16+
{{- if .Values.podAnnotations }}
1717
annotations:
18-
{{- toYaml . | nindent 8 }}
18+
{{- tpl (toYaml .Values.podAnnotations) . | nindent 8 }}
1919
{{- end }}
2020
labels:
2121
{{- include "adminer.labels" . | nindent 8 }}

‎charts/adminer/templates/networkpolicy.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: projectcalico.org/v3
2+
kind: NetworkPolicy
3+
metadata:
4+
name: adminer-network-policy
5+
labels:
6+
{{- include "adminer.labels" . | nindent 4 }}
7+
spec:
8+
selector: app.kubernetes.io/instance == "{{ .Release.Name }}"
9+
ingress:
10+
- action: Allow
11+
protocol: TCP
12+
destination:
13+
ports:
14+
- {{ .Values.service.port }}
15+
egress:
16+
- action: Allow
17+
protocol: TCP
18+
destination:
19+
ports:
20+
- 5432

‎charts/adminer/values.yaml.gotmpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@ serviceAccount:
2525
# If not set and create is true, a name is generated using the fullname template
2626
name: ""
2727

28-
podAnnotations: {}
28+
podAnnotations:
29+
# automatically restart pod on network policy change (to be sure new rules are applied)
30+
checksum/networkpolicy: '{{`{{ include (print $.Template.BasePath "/networkpolicy.yaml") . | sha256sum }}`}}'
2931
podLabels: {}
3032

3133
podSecurityContext:

‎charts/calico-configuration/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/calico-configuration/Chart.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: calico-configuration
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.0.1
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "3.26.4"

‎charts/calico-configuration/README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
## How to add network policy (local deployment)
2+
3+
How to discover ports / networks that are used by application
4+
* observe existing traffic (see `Debug network policies` below)
5+
* add staged policies to make sure all cases are included https://docs.tigera.io/calico/3.30/network-policy/staged-network-policies
6+
- make sure deployed calico version supports it
7+
* based on observations, create a needed network policy
8+
9+
## Debug network policies
10+
11+
if calico version 3.30+ is installed
12+
* observe traffic and check `policies` field in whisker logs
13+
- https://docs.tigera.io/calico/3.30/observability/enable-whisker
14+
- https://docs.tigera.io/calico/3.30/observability/view-flow-logs
15+
16+
if calico version <= 3.29
17+
* create network policy with action log (read more https://docs.tigera.io/calico/latest/network-policy/policy-rules/log-rules)
18+
```yaml
19+
apiVersion: projectcalico.org/v3
20+
kind: NetworkPolicy
21+
metadata:
22+
name: log ingress requests
23+
spec:
24+
selector: app == 'db'
25+
ingress:
26+
- action: Log
27+
```
28+
* apply policy and see logs via journalctl (you can grep with `calico-packet` on the node where the pod is running)
29+
* Note: one may implement policy step by step (allowing all traffic that is known and making last rule `Log` to see what traffic is still missing)
30+
31+
## Known issues
32+
33+
If network policy is created after pod, pod **MUST** be restarted for policy to take effect. Read more https://github.com/projectcalico/calico/issues/10753#issuecomment-3140717418
34+
* To automate this, we can add annotations with network policy checksum to pods (see https://stackoverflow.com/questions/58602311/will-helm-upgrade-restart-pods-even-if-they-are-not-affected-by-upgrade)
35+
36+
## How to view existing policies
37+
38+
via kubectl:
39+
* `kubectl get networkpolicies.crd.projectcalico.org -n adminer`
40+
* `kubectl describe networkpolicies.crd.projectcalico.org -n adminer default.adminer-network-policy`
41+
42+
via calicoctl:
43+
* `calicoctl get networkpolicy -n adminer -o yaml`
44+
45+
Note:
46+
* global network policies and network policies are separate resources for calico
47+
* To see all calico resources execute `kubectl get crd | grep calico` or `calicoctl get --help`
48+
49+
Warning:
50+
* Network policies update are only applied to "new connections". To make them act, one may need to restart affected applications (pods)

‎charts/calico-configuration/templates/NOTES.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
This chart configures Calico but does not deploy Calico itself. Calico is deployed during the Kubernetes cluster creation.
2+
3+
Note: to make sure network policies are applied correctly, you may need to restart targeted application pods.

0 commit comments

Comments
 (0)