Skip to content

Commit f2a9f66

Browse files
jaydeokarjaydeokar
authored
Adding Helm chart for controller installation (#73)
<!-- Thanks for sending a pull request! Here are some tips for you: 1. Ensure you have added the unit tests for your changes. 2. Ensure you have included output of manual testing done in the Testing section. 3. Ensure number of lines of code for new or existing methods are within the reasonable limit. 4. Ensure your change works on existing clusters after upgrade. --> **What type of PR is this?** Scripts <!-- Add one of the following: bug cleanup documentation feature --> **Which issue does this PR fix**: N/A **What does this PR do / Why do we need it**: This adds helm chart for the controller that can be used to install it on dataplane **If an issue # is not available please add steps to reproduce and the controller logs**: N/A **Testing done on this change**: Yes <!-- output of manual testing/integration tests results and also attach logs showing the fix being resolved --> **Automation added to e2e**: N/A <!-- List the e2e tests you added as part of this PR. If no, create an issue with enhancement/testing label --> **Will this PR introduce any new dependencies?**: N/A <!-- e.g. new K8s API --> **Will this break upgrades or downgrades. Has updating a running cluster been tested?**: N/A **Does this PR introduce any user-facing change?**: N/A <!-- If yes, a release note update is required: Enter your extended release note in the block below. If the PR requires additional actions from users switching to the new release, include the string "action required". --> By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
2 parents 5322072 + 58fc5a6 commit f2a9f66

File tree

12 files changed

+704
-29
lines changed

12 files changed

+704
-29
lines changed

‎Makefile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -195,16 +195,16 @@ format: ## Format all Go source code files.
195195

196196
run-cyclonus-test: ## Runs cyclonus tests on an existing cluster. Call with CLUSTER_NAME=<name of your cluster> to execute cyclonus test
197197
ifdef CLUSTER_NAME
198-
CLUSTER_NAME=$(CLUSTER_NAME) DISABLE_CP_NETWORK_POLICY_CONTROLLER=$(DISABLE_CP_NETWORK_POLICY_CONTROLLER) ./scripts/run-cyclonus-tests.sh
198+
CLUSTER_NAME=$(CLUSTER_NAME) ./scripts/run-cyclonus-tests.sh
199199
else
200200
@echo 'Pass CLUSTER_NAME parameter'
201201
endif
202202

203203
./PHONY: deploy-controller-on-dataplane
204-
deploy-controller-on-dataplane: ## Deploys the Network Policy controller on an existing cluster. Optionally call with AMAZON_NP_CONTROLLER=<Image URI> to update the image
205-
./scripts/update-controller-image-dataplane.sh AMAZON_NP_CONTROLLER=$(AMAZON_NP_CONTROLLER)
204+
deploy-controller-on-dataplane: ## Deploys the Network Policy controller on an existing cluster. Optionally call with NP_CONTROLLER_IMAGE=<Image URI> to update the image
205+
./scripts/deploy-controller-on-dataplane.sh NP_CONTROLLER_IMAGE=$(NP_CONTROLLER_IMAGE)
206206

207207
./PHONY: deploy-and-test
208-
deploy-and-test: ## Deploys the Network Policy controller on an existing cluster and runs cyclonus tests. Call with CLUSTER_NAME=<name of the cluster> and AMAZON_NP_CONTROLLER=<Image URI>
209-
$(MAKE) deploy-controller-on-dataplane AMAZON_NP_CONTROLLER=$(AMAZON_NP_CONTROLLER)
210-
$(MAKE) run-cyclonus-test CLUSTER_NAME=$(CLUSTER_NAME) DISABLE_CP_NETWORK_POLICY_CONTROLLER=true
208+
deploy-and-test: ## Deploys the Network Policy controller on an existing cluster and runs cyclonus tests. Call with CLUSTER_NAME=<name of the cluster> and NP_CONTROLLER_IMAGE=<Image URI>
209+
$(MAKE) deploy-controller-on-dataplane NP_CONTROLLER_IMAGE=$(NP_CONTROLLER_IMAGE)
210+
$(MAKE) run-cyclonus-test CLUSTER_NAME=$(CLUSTER_NAME)

‎charts/amazon-network-policy-controller-k8s/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj
22+
.vscode/
23+
crds/kustomization.yaml

‎charts/amazon-network-policy-controller-k8s/Chart.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v2
2+
name: amazon-network-policy-controller-k8s
3+
version: 1.0.4
4+
appVersion: v1.0.4
5+
description: A Helm chart for Amazon Network Policy Controller K8s
6+
icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png
7+
home: https://github.com/aws/amazon-network-policy-controller-k8s
8+
sources:
9+
- https://github.com/aws/amazon-network-policy-controller-k8s
10+
keywords:
11+
- eks
12+
- networking
13+
- network-policy

‎charts/amazon-network-policy-controller-k8s/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# AMAZON NETWORK POLICY CONTROLLER
2+
3+
This chart provides a Kubernetes deployment for the Amazon Network Policy Controller
4+
5+
## Prerequisites
6+
7+
- Kubernetes 1.24+ running on AWS
8+
- Helm 3.0+
9+
10+
## Installing the Chart
11+
12+
To install the chart with the release name `amazon-network-policy-controller-k8s` and default configuration:
13+
14+
```shell
15+
$ helm install amazon-network-policy-controller-k8s --namespace kube-system charts/amazon-network-policy-controller-k8s
16+
```
17+
18+
19+
## Configuration
20+
21+
The following table lists the configurable parameters for this chart and their default values.
22+
23+
| Parameter | Description | Default |
24+
|------------------------------|---------------------------------------------------------------|---------------------------------------------------------|
25+
| fullnameOverride | Override the fullname of the chart | amazon-network-policy-controller-k8s |
26+
| nameOverride | override for the name of the Helm Chart | amazon-network-policy-controller-k8s |
27+
| image.repository | ECR repository to use. Should match your cluster | public.ecr.aws/eks/amazon-network-policy-controller-k8s |
28+
| image.tag | Image tag | v1.0.4 |
29+
| enableConfigMapCheck | Enable configmap check to enable/disable controller in Control Plane | false |
30+
| endpointChunkSize | Number of endpoints to include in a single policy endpoints resource | 1000 |
31+
| maxConcurrentReconciles | Maximum number of concurrent reconcile loops | 3 |
32+
| podUpdateBatchPeriodDuration | Duration between batch updates of pods in seconds | 1 |
33+
| livenessProbe | Liveness Probe configuration for controller | see `values.yaml` |
34+
| readinessProbe | Readiness Probe configuration for controller | see `values.yaml` |
35+
36+
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install` or provide a YAML file containing the values for the above parameters:
37+
38+
```shell
39+
$ helm install amazon-network-policy-controller-k8s --namespace kube-system ./charts/amazon-network-policy-controller-k8s --values values.yaml
40+
```

‎charts/amazon-network-policy-controller-k8s/crds/crds.yaml‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.11.3
6+
creationTimestamp: null
7+
labels:
8+
app.kubernetes.io/name: amazon-network-policy-controller-k8s
9+
name: policyendpoints.networking.k8s.aws
10+
spec:
11+
group: networking.k8s.aws
12+
names:
13+
kind: PolicyEndpoint
14+
listKind: PolicyEndpointList
15+
plural: policyendpoints
16+
singular: policyendpoint
17+
scope: Namespaced
18+
versions:
19+
- name: v1alpha1
20+
schema:
21+
openAPIV3Schema:
22+
description: PolicyEndpoint is the Schema for the policyendpoints API
23+
properties:
24+
apiVersion:
25+
description: 'APIVersion defines the versioned schema of this representation
26+
of an object. Servers should convert recognized schemas to the latest
27+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
28+
type: string
29+
kind:
30+
description: 'Kind is a string value representing the REST resource this
31+
object represents. Servers may infer this from the endpoint the client
32+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
33+
type: string
34+
metadata:
35+
type: object
36+
spec:
37+
description: PolicyEndpointSpec defines the desired state of PolicyEndpoint
38+
properties:
39+
egress:
40+
description: Egress is the list of egress rules containing resolved
41+
network addresses
42+
items:
43+
description: EndpointInfo defines the network endpoint information
44+
for the policy ingress/egress
45+
properties:
46+
cidr:
47+
description: CIDR is the network address(s) of the endpoint
48+
type: string
49+
except:
50+
description: Except is the exceptions to the CIDR ranges mentioned
51+
above.
52+
items:
53+
type: string
54+
type: array
55+
ports:
56+
description: Ports is the list of ports
57+
items:
58+
description: Port contains information about the transport
59+
port/protocol
60+
properties:
61+
endPort:
62+
description: Endport specifies the port range port to
63+
endPort port must be defined and an integer, endPort
64+
> port
65+
format: int32
66+
type: integer
67+
port:
68+
description: Port specifies the numerical port for the
69+
protocol. If empty applies to all ports
70+
format: int32
71+
type: integer
72+
protocol:
73+
default: TCP
74+
description: Protocol specifies the transport protocol,
75+
default TCP
76+
type: string
77+
type: object
78+
type: array
79+
required:
80+
- cidr
81+
type: object
82+
type: array
83+
ingress:
84+
description: Ingress is the list of ingress rules containing resolved
85+
network addresses
86+
items:
87+
description: EndpointInfo defines the network endpoint information
88+
for the policy ingress/egress
89+
properties:
90+
cidr:
91+
description: CIDR is the network address(s) of the endpoint
92+
type: string
93+
except:
94+
description: Except is the exceptions to the CIDR ranges mentioned
95+
above.
96+
items:
97+
type: string
98+
type: array
99+
ports:
100+
description: Ports is the list of ports
101+
items:
102+
description: Port contains information about the transport
103+
port/protocol
104+
properties:
105+
endPort:
106+
description: Endport specifies the port range port to
107+
endPort port must be defined and an integer, endPort
108+
> port
109+
format: int32
110+
type: integer
111+
port:
112+
description: Port specifies the numerical port for the
113+
protocol. If empty applies to all ports
114+
format: int32
115+
type: integer
116+
protocol:
117+
default: TCP
118+
description: Protocol specifies the transport protocol,
119+
default TCP
120+
type: string
121+
type: object
122+
type: array
123+
required:
124+
- cidr
125+
type: object
126+
type: array
127+
podIsolation:
128+
description: PodIsolation specifies whether the pod needs to be isolated
129+
for a particular traffic direction Ingress or Egress, or both. If
130+
default isolation is not specified, and there are no ingress/egress
131+
rules, then the pod is not isolated from the point of view of this
132+
policy. This follows the NetworkPolicy spec.PolicyTypes.
133+
items:
134+
description: PolicyType string describes the NetworkPolicy type
135+
This type is beta-level in 1.8
136+
type: string
137+
type: array
138+
podSelector:
139+
description: PodSelector is the podSelector from the policy resource
140+
properties:
141+
matchExpressions:
142+
description: matchExpressions is a list of label selector requirements.
143+
The requirements are ANDed.
144+
items:
145+
description: A label selector requirement is a selector that
146+
contains values, a key, and an operator that relates the key
147+
and values.
148+
properties:
149+
key:
150+
description: key is the label key that the selector applies
151+
to.
152+
type: string
153+
operator:
154+
description: operator represents a key's relationship to
155+
a set of values. Valid operators are In, NotIn, Exists
156+
and DoesNotExist.
157+
type: string
158+
values:
159+
description: values is an array of string values. If the
160+
operator is In or NotIn, the values array must be non-empty.
161+
If the operator is Exists or DoesNotExist, the values
162+
array must be empty. This array is replaced during a strategic
163+
merge patch.
164+
items:
165+
type: string
166+
type: array
167+
required:
168+
- key
169+
- operator
170+
type: object
171+
type: array
172+
matchLabels:
173+
additionalProperties:
174+
type: string
175+
description: matchLabels is a map of {key,value} pairs. A single
176+
{key,value} in the matchLabels map is equivalent to an element
177+
of matchExpressions, whose key field is "key", the operator
178+
is "In", and the values array contains only "value". The requirements
179+
are ANDed.
180+
type: object
181+
type: object
182+
x-kubernetes-map-type: atomic
183+
podSelectorEndpoints:
184+
description: PodSelectorEndpoints contains information about the pods
185+
matching the podSelector
186+
items:
187+
description: PodEndpoint defines the summary information for the
188+
pods
189+
properties:
190+
hostIP:
191+
description: HostIP is the IP address of the host the pod is
192+
currently running on
193+
type: string
194+
name:
195+
description: Name is the pod name
196+
type: string
197+
namespace:
198+
description: Namespace is the pod namespace
199+
type: string
200+
podIP:
201+
description: PodIP is the IP address of the pod
202+
type: string
203+
required:
204+
- hostIP
205+
- name
206+
- namespace
207+
- podIP
208+
type: object
209+
type: array
210+
policyRef:
211+
description: PolicyRef is a reference to the Kubernetes NetworkPolicy
212+
resource.
213+
properties:
214+
name:
215+
description: Name is the name of the Policy
216+
type: string
217+
namespace:
218+
description: Namespace is the namespace of the Policy
219+
type: string
220+
required:
221+
- name
222+
- namespace
223+
type: object
224+
required:
225+
- policyRef
226+
type: object
227+
status:
228+
description: PolicyEndpointStatus defines the observed state of PolicyEndpoint
229+
type: object
230+
type: object
231+
served: true
232+
storage: true
233+
subresources:
234+
status: {}

0 commit comments

Comments
 (0)