X-Git-Url: https://gerrit.akraino.org/r/gitweb?a=blobdiff_plain;f=deploy%2Fcluster%2Fcluster.sh;h=222954c805ed62170d6107c0d9ba31b17d63b182;hb=8449ef6adc2f9a44780eac1e959b61d331e8c066;hp=85fa2f146f9e750d7ea63fdfb8806d5b37261baf;hpb=41cb4be441a1e391a6547becbdcc1141b912a236;p=icn.git diff --git a/deploy/cluster/cluster.sh b/deploy/cluster/cluster.sh index 85fa2f1..222954c 100755 --- a/deploy/cluster/cluster.sh +++ b/deploy/cluster/cluster.sh @@ -7,14 +7,7 @@ LIBDIR="$(dirname $(dirname ${SCRIPTDIR}))/env/lib" source $LIBDIR/logging.sh source $LIBDIR/common.sh -FLANNEL_VERSION="v0.15.0" - -# This may be used to update the in-place addon YAML files from the -# upstream projects -function build_source { - mkdir -p ${SCRIPTDIR}/addons - - # Flannel +function build_source_flannel { curl -sL https://raw.githubusercontent.com/coreos/flannel/${FLANNEL_VERSION}/Documentation/kube-flannel.yml -o ${SCRIPTDIR}/addons/flannel.yaml cat <${SCRIPTDIR}/templates/flannel-addon.yaml {{- if eq .Values.cni "flannel" }} @@ -24,11 +17,33 @@ $(kubectl create configmap flannel-addon --from-file=${SCRIPTDIR}/addons/flannel EOF sed -i -e 's/ name: flannel-addon/ name: {{ .Values.clusterName }}-flannel-addon/' ${SCRIPTDIR}/templates/flannel-addon.yaml sed -i -e 's/10.244.0.0\/16/{{ .Values.podCidr }}/' ${SCRIPTDIR}/templates/flannel-addon.yaml +} - # Flux - flux install --export >${SCRIPTDIR}/addons/flux-system.yaml +function build_source_flux { + # NOTE: This reaches outside this directory to + # deploy/site/cluster-addons/flux-system. This is to ensure that + # the day-0 config of a cluster using deploy/site/cluster-addons + # is in sync with the chart. + flux install --export >${SCRIPTDIR}/../site/cluster-addons/flux-system/gotk-components.yaml + kustomize build ${SCRIPTDIR}/../site/cluster-addons/flux-system >${SCRIPTDIR}/addons/flux-system.yaml + cat <>${SCRIPTDIR}/addons/flux-system.yaml +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: psp:privileged:flux-system + namespace: flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: psp:privileged +subjects: +- kind: Group + name: system:serviceaccounts:flux-system + apiGroup: rbac.authorization.k8s.io +EOF # The name "sync" must be sorted after "flux-system" to ensure - # Flux CRDs are instantiated first + # CRDs are instantiated first cat <<'EOF' >${SCRIPTDIR}/addons/sync.yaml {{- if .Values.flux.decryptionSecret }} --- @@ -81,7 +96,9 @@ $(kubectl create configmap flux-addon --from-file=${SCRIPTDIR}/addons/flux-syste {{- end }} EOF sed -i -e 's/ name: flux-addon/ name: {{ .Values.clusterName }}-flux-addon/' ${SCRIPTDIR}/templates/flux-addon.yaml +} +function build_source_podsecurity { # PodSecurityPolicy is being replaced in future versions of K8s. # The recommended practice is described by K8s at # - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#recommended-practice @@ -226,11 +243,220 @@ EOF $(kubectl create configmap podsecurity-addon --from-file=${SCRIPTDIR}/addons/podsecurity.yaml -o yaml --dry-run=client) EOF sed -i -e 's/ name: podsecurity-addon/ name: {{ .Values.clusterName }}-podsecurity-addon/' ${SCRIPTDIR}/templates/podsecurity-addon.yaml +} +function build_source_calico { + mkdir -p ${SCRIPTDIR}/addons/calico/{base,ipv4,dualstack,ipv6} + curl -sL https://docs.projectcalico.org/archive/${CALICO_VERSION%.*}/manifests/calico.yaml -o ${SCRIPTDIR}/addons/calico/base/calico.yaml + # Remove trailing whitespace so that kubectl create configmap + # doesn't insert explicit newlines + sed -i -r 's/\s+$//g' ${SCRIPTDIR}/addons/calico/base/calico.yaml + pushd ${SCRIPTDIR}/addons/calico/base && rm -f kustomization.yaml && kustomize create --autodetect && popd + + # IPv4 only (the default) + cat <${SCRIPTDIR}/addons/calico/ipv4/ip-autodetection-method-patch.yaml +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: calico-node + namespace: kube-system +spec: + template: + spec: + containers: + - name: calico-node + env: + - name: IP_AUTODETECTION_METHOD + value: can-reach=www.google.com +EOF + cat <${SCRIPTDIR}/addons/calico/ipv4/kustomization.yaml +resources: +- ../base +patches: +- path: ip-autodetection-method-patch.yaml +EOF + kustomize build ${SCRIPTDIR}/addons/calico/ipv4 >${SCRIPTDIR}/addons/calico/ipv4.yaml + # Dual stack + cat <<'EOF' >${SCRIPTDIR}/addons/calico/dualstack/configmap-patch.yaml +kind: ConfigMap +apiVersion: v1 +metadata: + name: calico-config + namespace: kube-system +data: + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "log_file_path": "/var/log/calico/cni/cni.log", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "calico-ipam", + "assign_ipv4": "true", + "assign_ipv6": "true" + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } +EOF + cat <${SCRIPTDIR}/addons/calico/dualstack/ip-autodetection-method-patch.yaml +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: calico-node + namespace: kube-system +spec: + template: + spec: + containers: + - name: calico-node + env: + - name: IP_AUTODETECTION_METHOD + value: can-reach=www.google.com + - name: IP6_AUTODETECTION_METHOD + value: can-reach=www.google.com + - name: IP6 + value: autodetect + - name: FELIX_IPV6SUPPORT + value: true +EOF + cat <${SCRIPTDIR}/addons/calico/dualstack/kustomization.yaml +resources: +- ../base +patches: +- path: configmap-patch.yaml +- path: ip-autodetection-method-patch.yaml +EOF + kustomize build ${SCRIPTDIR}/addons/calico/dualstack >${SCRIPTDIR}/addons/calico/dualstack.yaml + # IPv6 only + cat <<'EOF' >${SCRIPTDIR}/addons/calico/ipv6/configmap-patch.yaml +kind: ConfigMap +apiVersion: v1 +metadata: + name: calico-config + namespace: kube-system +data: + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "log_file_path": "/var/log/calico/cni/cni.log", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "calico-ipam", + "assign_ipv4": "false", + "assign_ipv6": "true" + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } +EOF + cat <${SCRIPTDIR}/addons/calico/ipv6/ip-autodetection-method-patch.yaml +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: calico-node + namespace: kube-system +spec: + template: + spec: + containers: + - name: calico-node + env: + - name: IP6_AUTODETECTION_METHOD + value: can-reach=www.google.com + - name: IP6 + value: autodetect + - name: FELIX_IPV6SUPPORT + value: true + - name: IP + value: none + - name: CALICO_ROUTER_ID + value: hash +EOF + cat <${SCRIPTDIR}/addons/calico/ipv6/kustomization.yaml +resources: +- ../base +patches: +- path: configmap-patch.yaml +- path: ip-autodetection-method-patch.yaml +EOF + kustomize build ${SCRIPTDIR}/addons/calico/ipv6 >${SCRIPTDIR}/addons/calico/ipv6.yaml + + cat <${SCRIPTDIR}/templates/calico-addon.yaml +{{- if eq .Values.cni "calico" }} +{{- if eq .Values.ipam "ipv4" }} +--- +$(kubectl create configmap calico-addon --from-file=calico.yaml=${SCRIPTDIR}/addons/calico/ipv4.yaml -o yaml --dry-run=client) +{{- end }} +{{- if eq .Values.ipam "dualstack" }} +--- +$(kubectl create configmap calico-addon --from-file=calico.yaml=${SCRIPTDIR}/addons/calico/dualstack.yaml -o yaml --dry-run=client) +{{- end }} +{{- if eq .Values.ipam "ipv6" }} +--- +$(kubectl create configmap calico-addon --from-file=calico.yaml=${SCRIPTDIR}/addons/calico/ipv6.yaml -o yaml --dry-run=client) +{{- end }} +{{- end }} +EOF + sed -i -e 's/ name: calico-addon/ name: {{ .Values.clusterName }}-calico-addon/' ${SCRIPTDIR}/templates/calico-addon.yaml +} + +# This may be used to update the in-place addon YAML files from the +# upstream projects +function build_source { + mkdir -p ${SCRIPTDIR}/addons + build_source_calico + build_source_flannel + build_source_flux + build_source_podsecurity } case $1 in "build-source") build_source ;; + "foo") build_source_calico ;; *) cat <