From 88e7a8acf6d26716eb725cdac151a28f66f80586 Mon Sep 17 00:00:00 2001 From: Brandon Stoll Date: Thu, 9 Jul 2026 18:36:25 +0000 Subject: [PATCH] style: format Markdown files and YAML manifests (2/5) This is part 2/5 of an overall cleanup effort to fix linter issues and format files across the repository. In this step: - Update codespell, gitleaks, and markdownlint configurations to support repo formatting. - Format Markdown files across docs, examples, and READMEs. - Add document start markers (---) and fix indentation in YAML manifests, CloudBuild configs, and deploy templates. - Remove trailing whitespace from protobuf definitions. --- .github/linters/.codespellrc | 1 + .github/linters/.gitleaks.toml | 1 + .github/linters/.markdown-lint.yml | 4 +- README.md | 103 +- cloudbuild/postsubmit.yaml | 55 +- cloudbuild/presubmit.yaml | 3 +- cloudbuild/vendors/deployment.yaml | 1 + cmd/deploy/testdata/kind-deployment.yaml | 1 + deploy/kne/external-multinode-cdnos.yaml | 1 + deploy/kne/external-multinode.yaml | 1 + deploy/kne/external.yaml | 1 + deploy/kne/kind-bridge-cdnos.yaml | 3 +- deploy/kne/kind-bridge.yaml | 1 + deploy/kne/kubeadm.yaml | 1 + deploy/ubuntu/serviceaccount.yaml | 33 +- deploy/ubuntu/ubuntu.yaml | 69 +- docs/README.md | 34 +- docs/create_topology.md | 154 +- docs/interact_topology.md | 48 +- docs/kubernetes_reference.md | 6 +- docs/multinode.md | 3 +- docs/setup.md | 10 +- docs/vendor.md | 83 +- examples/cisco/8000e/README.md | 97 +- examples/gobgp/r1.yaml | 13 +- examples/gobgp/r2.yaml | 13 +- examples/juniper/cptx-ixia/README.md | 64 +- load/testdata/deploy/kne/kind-bridge.yaml | 1 + load/testdata/kind/kind-no-cni.yaml | 1 + .../controllers/ceoslab/manifest.yaml | 705 ++-- .../controllers/lemming/manifest.yaml | 800 ++-- .../controllers/srlinux/manifest.yaml | 543 +-- .../manifests/keysight/ixiatg-configmap.yaml | 1 + .../manifests/keysight/ixiatg-operator.yaml | 527 +-- load/testdata/manifests/kind/kind-bridge.yaml | 125 +- .../manifests/meshnet/grpc/manifest.yaml | 217 +- .../manifests/meshnet/vxlan/manifest.yaml | 217 +- load/testdata/manifests/metallb/manifest.yaml | 2923 ++++++++------- manifests/base/kustomization.yaml | 8 +- manifests/base/namespace.yaml | 3 +- manifests/base/neo4j.yaml | 82 +- manifests/base/serviceaccount.yaml | 1 + manifests/controllers/cdnos/manifest.yaml | 848 +++-- manifests/controllers/ceoslab/manifest.yaml | 705 ++-- manifests/controllers/lemming/manifest.yaml | 836 +++-- manifests/controllers/srlinux/manifest.yaml | 634 ++-- manifests/flannel/manifest.yaml | 216 +- manifests/keysight/ixiatg-configmap.yaml | 1 + manifests/keysight/ixiatg-operator.yaml | 527 +-- manifests/kind/bridge.yaml | 125 +- manifests/kind/config.yaml | 11 +- manifests/kind/kind-bridge.yaml | 125 +- .../kube/credential-provider-config.yaml | 25 +- manifests/meshnet/grpc/manifest.yaml | 469 +-- manifests/meshnet/vxlan/manifest.yaml | 469 +-- manifests/metallb/manifest.yaml | 3324 +++++++++-------- third_party/meshnet/README.md | 156 +- .../proto/meshnet/v1beta1/meshnet.proto | 38 +- third_party/meshnet/docs/implementation.md | 81 +- topo/node/inclusterproxy/README.md | 59 +- topo/testdata/invalid_topo.yaml | 1 + topo/testdata/valid_topo.yaml | 1 + x/webhook/README.md | 26 +- x/webhook/manifests/deploy.yaml | 3 +- x/webhook/manifests/mutating.config.yaml | 1 + x/webhook/manifests/namespace.yaml | 1 + x/webhook/manifests/tls.secret.yaml | 1 + 67 files changed, 8058 insertions(+), 7583 deletions(-) diff --git a/.github/linters/.codespellrc b/.github/linters/.codespellrc index 577b22986..cf0bf4c2c 100644 --- a/.github/linters/.codespellrc +++ b/.github/linters/.codespellrc @@ -1,2 +1,3 @@ [codespell] skip = *.pdf,*.png,*.jpg,*.gif,*.ico,go.sum +ignore-words-list = notin,NotIn diff --git a/.github/linters/.gitleaks.toml b/.github/linters/.gitleaks.toml index 9d0b308f0..f820c075c 100644 --- a/.github/linters/.gitleaks.toml +++ b/.github/linters/.gitleaks.toml @@ -209,6 +209,7 @@ title = "gitleaks config" paths = [ '''^\.?gitleaks.toml$''', '''topo/node/srl/generate_certificate_success$''', # exclude dummy test file with random cert + '''x/webhook/manifests/tls\.secret\.yaml$''', '''(.*?)super-linter.log$''', # exclude linter logs which might contain past errored runs with keys/certs '''(.*?)(png|jpg|gif|doc|docx|pdf|bin|xls|pyc|zip)$''', '''(go.mod|go.sum)$''' diff --git a/.github/linters/.markdown-lint.yml b/.github/linters/.markdown-lint.yml index 64f68b737..f9b628240 100644 --- a/.github/linters/.markdown-lint.yml +++ b/.github/linters/.markdown-lint.yml @@ -1,4 +1,6 @@ +--- default: true +extends: markdownlint/style/prettier MD001: false # header levels @@ -6,4 +8,4 @@ MD013: false # line length MD028: false # blank lines between indents -MD033: false # inline HTML \ No newline at end of file +MD033: false # inline HTML diff --git a/README.md b/README.md index 9cd435b50..8819cb67b 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,6 @@ [![Go Report Card](https://goreportcard.com/badge/github.com/openconfig/kne)](https://goreportcard.com/report/github.com/openconfig/kne) [![GoDoc](https://godoc.org/istio.io/istio?status.svg)](https://pkg.go.dev/github.com/openconfig/kne) [![License: BSD](https://img.shields.io/badge/license-Apache%202-blue)](https://opensource.org/licenses/Apache-2.0) -[![GitHub Super-Linter](https://github.com/openconfig/kne/workflows/Lint%20Code%20Base/badge.svg)](https://github.com/marketplace/actions/super-linter) [![Coverage Status](https://coveralls.io/repos/github/openconfig/kne/badge.svg?branch=main)](https://coveralls.io/github/openconfig/kne?branch=main) This is not an officially supported Google product. @@ -12,42 +11,44 @@ This is not an officially supported Google product. ## Goal For network emulation, there are many approaches using VM's for emulation of a -hardware router. Arista, Cisco, Juniper, Drivenets, and Nokia have multiple implementations -of their network operating system and various generations of hardware emulation. -These systems are very good for most validation of vendor control plane -implementations and data plane for limited certifications. The idea of this -project is to provide a standard "interface" so that vendors can produce a -standard container implementation which can be used to build complex topologies. - -* Have standard lifecycle management infrastructure for allowing multiple vendor - device emulations to be present in a single "topology" -* Allow for control plane access via standard k8s networking -* Provide a common networking interface for the forwarding plane between network - pods. - * Data plane wires between pods - * Control plane wires between topology manager -* Define service implementation for allowing interaction with the topology +hardware router. Arista, Cisco, Juniper, Drivenets, and Nokia have multiple +implementations of their network operating system and various generations of +hardware emulation. These systems are very good for most validation of vendor +control plane implementations and data plane for limited certifications. The +idea of this project is to provide a standard "interface" so that vendors can +produce a standard container implementation which can be used to build complex +topologies. + +- Have standard lifecycle management infrastructure for allowing multiple + vendor device emulations to be present in a single "topology" +- Allow for control plane access via standard k8s networking +- Provide a common networking interface for the forwarding plane between + network pods. + - Data plane wires between pods + - Control plane wires between topology manager +- Define service implementation for allowing interaction with the topology manager service. - * Topology manager is the public API for allowing external users to manipulate - the link state in the topology. - * The topology manager will run as a service in k8s environment. - * It will provide a gRPC interface for tests to interact with - * It will listen to CRDs published via the network device pods for discovery -* Data plane connections for connectivity between pods must be a public + - Topology manager is the public API for allowing external users to + manipulate the link state in the topology. + - The topology manager will run as a service in k8s environment. + - It will provide a gRPC interface for tests to interact with + - It will listen to CRDs published via the network device pods for + discovery +- Data plane connections for connectivity between pods must be a public transport mechanism - * This can't be implemented as just exposing "x eth devices on the pod" - because Linux doesn't understand the associated control messages which are - needed to make this work like a wire. - * Transceiver state, optical characteristics, wire state, packet filtering / - shaping / drops - * LACP or other port aggregation protocols or APS cannot be simulated + - This can't be implemented as just exposing "x eth devices on the pod" + because Linux doesn't understand the associated control messages which + are needed to make this work like a wire. + - Transceiver state, optical characteristics, wire state, packet filtering + / shaping / drops + - LACP or other port aggregation protocols or APS cannot be simulated correctly - * The topology manager will start a topology agent on each host for the pod to - directly interact with. - * The topology agent will provide the connectivity between nodes -* Define how pods boot an initial configuration - * Ideally, this method would allow for dynamic -* Define how pods express services for use in-cluster as well as external + - The topology manager will start a topology agent on each host for the + pod to directly interact with. + - The topology agent will provide the connectivity between nodes +- Define how pods boot an initial configuration + - Ideally, this method would allow for dynamic +- Define how pods express services for use in-cluster as well as external services ## Use Cases @@ -88,23 +89,23 @@ Kubernetes Network Emulation (KNE). ### Usage Metrics Reporting -The KNE CLI optionally collects anonymous usage metrics. **This is turned OFF -by default.** We use the metrics to gauge the health and performance of various -KNE operations (i.e. cluster deployment, topology creation) on an **opt-in** -basis. There is a global flag `--report_usage` that when provided shares -anonymous details about certain KNE CLI commands. Collected data can be seen in -the [event proto definition](proto/event.proto). **Usage metrics are NOT shared -by default.** Additionally the PubSub project and topic the events are published -to are configurable. If you want to track your own private metrics about your -KNE usage then that is supported by providing a Cloud PubSub project/topic of -your choosing. Full details about how/when usage events are published can be -found in the codebase [here](metrics/metrics.go). We appreciate usage metric -reporting as it helps us develop a better KNE experience for all of our users. -Whether that be detecting an abnormally high number of cluster deployment -failures due to an upgrade to an underlying dependency introduced by a new -commit, or detecting a bug from a scenario where the failure rate for topologies -over *n* links is far greater than *n-1* links. Usage metric reporting is -helpful tool for the KNE developers. +The KNE CLI optionally collects anonymous usage metrics. **This is turned OFF by +default.** We use the metrics to gauge the health and performance of various KNE +operations (i.e. cluster deployment, topology creation) on an **opt-in** basis. +There is a global flag `--report_usage` that when provided shares anonymous +details about certain KNE CLI commands. Collected data can be seen in the +[event proto definition](proto/event.proto). **Usage metrics are NOT shared by +default.** Additionally the PubSub project and topic the events are published to +are configurable. If you want to track your own private metrics about your KNE +usage then that is supported by providing a Cloud PubSub project/topic of your +choosing. Full details about how/when usage events are published can be found in +the [codebase](metrics/metrics.go). We appreciate usage metric reporting as it +helps us develop a better KNE experience for all of our users. Whether that be +detecting an abnormally high number of cluster deployment failures due to an +upgrade to an underlying dependency introduced by a new commit, or detecting a +bug from a scenario where the failure rate for topologies over _n_ links is far +greater than _n-1_ links. Usage metric reporting is helpful tool for the KNE +developers. ## Thanks diff --git a/cloudbuild/postsubmit.yaml b/cloudbuild/postsubmit.yaml index 956bc85f5..189de3c01 100644 --- a/cloudbuild/postsubmit.yaml +++ b/cloudbuild/postsubmit.yaml @@ -1,35 +1,46 @@ +--- steps: - id: packer_init_external name: "us-west1-docker.pkg.dev/gep-kne/packer/packer:1.9.1" - args: ["init", "cloudbuild/external.pkr.hcl"] - waitFor: ["-"] # run the builds concurrently - + args: + - "init" + - "cloudbuild/external.pkr.hcl" + waitFor: + - "-" # run the builds concurrently + - id: packer_build_external name: "us-west1-docker.pkg.dev/gep-kne/packer/packer:1.9.1" - args: ["build", "cloudbuild/external.pkr.hcl"] - env: [ - "PKR_VAR_build_id=$BUILD_ID", - "PKR_VAR_short_sha=$SHORT_SHA", - "PKR_VAR_branch_name=$BRANCH_NAME", - "PKR_VAR_zone=${_ZONE}", - ] - waitFor: [packer_init_external] - + args: + - "build" + - "cloudbuild/external.pkr.hcl" + env: + - "PKR_VAR_build_id=$BUILD_ID" + - "PKR_VAR_short_sha=$SHORT_SHA" + - "PKR_VAR_branch_name=$BRANCH_NAME" + - "PKR_VAR_zone=${_ZONE}" + waitFor: + - packer_init_external + - id: packer_init_internal name: "us-west1-docker.pkg.dev/gep-kne/packer/packer:1.9.1" - args: ["init", "cloudbuild/internal.pkr.hcl"] - waitFor: ["-"] # run the builds concurrently + args: + - "init" + - "cloudbuild/internal.pkr.hcl" + waitFor: + - "-" # run the builds concurrently - id: packer_build_internal name: "us-west1-docker.pkg.dev/gep-kne/packer/packer:1.9.1" - args: ["build", "cloudbuild/internal.pkr.hcl"] - env: [ - "PKR_VAR_build_id=$BUILD_ID", - "PKR_VAR_short_sha=$SHORT_SHA", - "PKR_VAR_branch_name=$BRANCH_NAME", - "PKR_VAR_zone=${_ZONE}", - ] - waitFor: [packer_init_internal] + args: + - "build" + - "cloudbuild/internal.pkr.hcl" + env: + - "PKR_VAR_build_id=$BUILD_ID" + - "PKR_VAR_short_sha=$SHORT_SHA" + - "PKR_VAR_branch_name=$BRANCH_NAME" + - "PKR_VAR_zone=${_ZONE}" + waitFor: + - packer_init_internal timeout: 5400s diff --git a/cloudbuild/presubmit.yaml b/cloudbuild/presubmit.yaml index 2d659273b..13adf9b4c 100644 --- a/cloudbuild/presubmit.yaml +++ b/cloudbuild/presubmit.yaml @@ -1,3 +1,4 @@ +--- steps: - id: kne_test name: us-west1-docker.pkg.dev/$PROJECT_ID/utilities/remote-builder @@ -26,4 +27,4 @@ timeout: 2700s options: pool: - name: 'projects/kne-external/locations/us-central1/workerPools/kne-cloudbuild-pool' + name: "projects/kne-external/locations/us-central1/workerPools/kne-cloudbuild-pool" diff --git a/cloudbuild/vendors/deployment.yaml b/cloudbuild/vendors/deployment.yaml index fdd38c018..0103a30a5 100644 --- a/cloudbuild/vendors/deployment.yaml +++ b/cloudbuild/vendors/deployment.yaml @@ -1,6 +1,7 @@ # kind-bridge.yaml cluster config file sets up a kind cluster where default PTP CNI plugin # is swapped with the Bridge CNI plugin. # Bridge CNI plugin is required by some Network OSes to operate. +--- cluster: kind: Kind spec: diff --git a/cmd/deploy/testdata/kind-deployment.yaml b/cmd/deploy/testdata/kind-deployment.yaml index b7faf3241..f40a3a6af 100644 --- a/cmd/deploy/testdata/kind-deployment.yaml +++ b/cmd/deploy/testdata/kind-deployment.yaml @@ -1,3 +1,4 @@ +--- cluster: kind: Kind spec: diff --git a/deploy/kne/external-multinode-cdnos.yaml b/deploy/kne/external-multinode-cdnos.yaml index 256496eb5..40884be34 100644 --- a/deploy/kne/external-multinode-cdnos.yaml +++ b/deploy/kne/external-multinode-cdnos.yaml @@ -1,6 +1,7 @@ # external-multinode.yaml cluster config file sets up ingress, cni, and controllers in an existing k8 cluster. # This spec instructs Metallb to use a docker network named multinode. # The "external" cluster lifecycle is not managed by the KNE deployment. +--- cluster: kind: External spec: diff --git a/deploy/kne/external-multinode.yaml b/deploy/kne/external-multinode.yaml index 56665504c..2f63acc0a 100644 --- a/deploy/kne/external-multinode.yaml +++ b/deploy/kne/external-multinode.yaml @@ -1,6 +1,7 @@ # external-multinode.yaml cluster config file sets up ingress, cni, and controllers in an existing k8 cluster. # This spec instructs Metallb to use a docker network named multinode. # The "external" cluster lifecycle is not managed by the KNE deployment. +--- cluster: kind: External spec: diff --git a/deploy/kne/external.yaml b/deploy/kne/external.yaml index 4d808e182..b8dc3dcb5 100644 --- a/deploy/kne/external.yaml +++ b/deploy/kne/external.yaml @@ -1,5 +1,6 @@ # external.yaml cluster config file sets up ingress, cni, and controllers in an existing k8 cluster. # The "external" cluster lifecycle is not managed by the KNE deployment. +--- cluster: kind: External ingress: diff --git a/deploy/kne/kind-bridge-cdnos.yaml b/deploy/kne/kind-bridge-cdnos.yaml index c07f19e32..7cefa0fc0 100644 --- a/deploy/kne/kind-bridge-cdnos.yaml +++ b/deploy/kne/kind-bridge-cdnos.yaml @@ -1,6 +1,7 @@ # kind-bridge.yaml cluster config file sets up a kind cluster where default PTP CNI plugin # is swapped with the Bridge CNI plugin. # Bridge CNI plugin is required by some Network OSes to operate. +--- cluster: kind: Kind spec: @@ -36,4 +37,4 @@ controllers: operator: ../../manifests/controllers/lemming/manifest.yaml - kind: Cdnos spec: - operator: ../../manifests/controllers/cdnos/manifest.yaml \ No newline at end of file + operator: ../../manifests/controllers/cdnos/manifest.yaml diff --git a/deploy/kne/kind-bridge.yaml b/deploy/kne/kind-bridge.yaml index afe6d381b..54a3fe36b 100644 --- a/deploy/kne/kind-bridge.yaml +++ b/deploy/kne/kind-bridge.yaml @@ -1,6 +1,7 @@ # kind-bridge.yaml cluster config file sets up a kind cluster where default PTP CNI plugin # is swapped with the Bridge CNI plugin. # Bridge CNI plugin is required by some Network OSes to operate. +--- cluster: kind: Kind spec: diff --git a/deploy/kne/kubeadm.yaml b/deploy/kne/kubeadm.yaml index a2bd07a0d..827ef7a67 100644 --- a/deploy/kne/kubeadm.yaml +++ b/deploy/kne/kubeadm.yaml @@ -1,6 +1,7 @@ # kubeadm.yaml cluster config file sets up ingress, cni, and controllers in a new k8 cluster # created using kubeadm. The kubeadm cluster starts as a single node cluster but can be joined # from other hosts to create a multinode cluster. +--- cluster: kind: Kubeadm spec: diff --git a/deploy/ubuntu/serviceaccount.yaml b/deploy/ubuntu/serviceaccount.yaml index a52b76bb9..1e5b74588 100644 --- a/deploy/ubuntu/serviceaccount.yaml +++ b/deploy/ubuntu/serviceaccount.yaml @@ -1,11 +1,12 @@ +--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: podrunner subjects: -- kind: ServiceAccount - name: podrunner - namespace: default + - kind: ServiceAccount + name: podrunner + namespace: default roleRef: kind: ClusterRole name: podrunner @@ -19,19 +20,19 @@ metadata: labels: k8s-app: foo rules: -- apiGroups: [""] - resources: - - pods - - services - - logs - verbs: - - create - - update - - patch - - delete - - get - - watch - - list + - apiGroups: [""] + resources: + - pods + - services + - logs + verbs: + - create + - update + - patch + - delete + - get + - watch + - list --- apiVersion: v1 kind: ServiceAccount diff --git a/deploy/ubuntu/ubuntu.yaml b/deploy/ubuntu/ubuntu.yaml index 916a57fb4..f59d8c549 100644 --- a/deploy/ubuntu/ubuntu.yaml +++ b/deploy/ubuntu/ubuntu.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Pod metadata: @@ -7,40 +8,40 @@ metadata: namespace: default spec: containers: - - args: - - sleep - - "90000" - image: hfam/ubuntu:latest - imagePullPolicy: IfNotPresent - name: foo - resources: {} - stdin: true - stdinOnce: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - tty: true - volumeMounts: - - mountPath: /var/run/secrets/kubernetes.io/serviceaccount - name: kube-api-access-m6mv6 - readOnly: true + - args: + - sleep + - "90000" + image: hfam/ubuntu:latest + imagePullPolicy: IfNotPresent + name: foo + resources: {} + stdin: true + stdinOnce: true + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + tty: true + volumeMounts: + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: kube-api-access-m6mv6 + readOnly: true restartPolicy: Never serviceAccountName: podrunner volumes: - - name: kube-api-access-m6mv6 - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - expirationSeconds: 3607 - path: token - - configMap: - items: - - key: ca.crt - path: ca.crt - name: kube-root-ca.crt - - downwardAPI: - items: - - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - path: namespace + - name: kube-api-access-m6mv6 + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + expirationSeconds: 3607 + path: token + - configMap: + items: + - key: ca.crt + path: ca.crt + name: kube-root-ca.crt + - downwardAPI: + items: + - fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + path: namespace diff --git a/docs/README.md b/docs/README.md index 030e23f92..c18d273ea 100644 --- a/docs/README.md +++ b/docs/README.md @@ -11,12 +11,12 @@ of containers running various device OSes. This document is meant to serve as a How-To guide for various KNE usage. The guide is broken up into multiple sections spanning multiple documents. -* [Setup](setup.md): A guide to first time setup for KNE. -* [Create a topology](create_topology.md): A guide to deploying a KNE cluster +- [Setup](setup.md): A guide to first time setup for KNE. +- [Create a topology](create_topology.md): A guide to deploying a KNE cluster and creating a topology. -* [Interact with a topology](interact_topology.md): A guide to interacting with +- [Interact with a topology](interact_topology.md): A guide to interacting with a KNE topology after creation. -* [Troubleshooting](troubleshoot.md): A troubleshooting guide if anything goes +- [Troubleshooting](troubleshoot.md): A troubleshooting guide if anything goes wrong along the way. They are recommended to be done in order. @@ -26,15 +26,15 @@ They are recommended to be done in order. [KNE with a Multi Node Cluster](multinode.md) KNE can easily be scaled to run large topologies utilizing its Kubernetes -backbone. This guide describes how to set up a k8s multi worker node cluster -and get a 150 node KNE topology up and running. +backbone. This guide describes how to set up a k8s multi worker node cluster and +get a 150 node KNE topology up and running. ## Vendor Image Requirements [Vendor Image Requirements](vendor.md) -KNE uses vendor supplied images. This document describes the expectations -for those images. +KNE uses vendor supplied images. This document describes the expectations for +those images. ## Kubernetes Reference @@ -45,7 +45,17 @@ concepts and how they are used in KNE by running through an example topology creation. ## Support for AlpineVS in KNE -[AlpineVS](https://github.com/sonic-net/sonic-alpine/blob/master/README.md) (AVS) is a SONiC Virtual Switch with dataplane deployed as a k8s Pod within KNE. It provides switch capabilities in a simulated environment with following key features: -* **Dual-Container Architecture:** Encloses a SwitchStack container (running SONiC VM) and an ASIC Simulation container through vendor node definition for [alpine](../topo/node/alpine/alpine.go). -* **Multiple Dataplanes:** Integrates with Lucius (default gRPC-based SAI implementation) as well as vendor ASIC simulations. -* **Natively in KNE:** Runs natively in KNE with simple [2-switch topologies](https://github.com/sonic-net/sonic-alpine/blob/master/src/deploy/kne/twodut-alpine-vs.pb.txt) and scaled topologies for automated testing of the SONiC stack. + +[AlpineVS](https://github.com/sonic-net/sonic-alpine/blob/master/README.md) +(AVS) is a SONiC Virtual Switch with dataplane deployed as a k8s Pod within KNE. +It provides switch capabilities in a simulated environment with following key +features: + +- **Dual-Container Architecture:** Encloses a SwitchStack container (running + SONiC VM) and an ASIC Simulation container through vendor node definition for + [alpine](https://github.com/openconfig/kne/blob/main/topo/node/alpine/alpine.go). +- **Multiple Dataplanes:** Integrates with Lucius (default gRPC-based SAI + implementation) as well as vendor ASIC simulations. +- **Natively in KNE:** Runs natively in KNE with simple + [2-switch topologies](https://github.com/sonic-net/sonic-alpine/blob/master/src/deploy/kne/twodut-alpine-vs.pb.txt) + and scaled topologies for automated testing of the SONiC stack. diff --git a/docs/create_topology.md b/docs/create_topology.md index 3f0ce0181..50994386f 100644 --- a/docs/create_topology.md +++ b/docs/create_topology.md @@ -31,12 +31,12 @@ Global Flags: -v, --verbosity string log level (default "info") ``` -A deployment yaml file specifies 4 things (*optional in italics*): +A deployment yaml file specifies 4 things (_optional in italics_): 1. A cluster spec 2. An ingress spec 3. A CNI spec -4. *A list of controller specs* +4. _A list of controller specs_ Expand the below section for a full description of all fields in the deployment yaml. @@ -48,106 +48,106 @@ yaml. > NOTE: ~~Strikethrough~~ fields are DEPRECATED and should not be used. -Field | Type | Description -------------- | ---------------- | --------------------------------------------- -`cluster` | ClusterSpec | Spec for the cluster. -`ingress` | IngressSpec | Spec for the ingress. -`cni` | CNISpec | Spec for the CNI. -`controllers` | []ControllerSpec | List of specs for the additional controllers. +| Field | Type | Description | +| ------------- | ---------------- | --------------------------------------------- | +| `cluster` | ClusterSpec | Spec for the cluster. | +| `ingress` | IngressSpec | Spec for the ingress. | +| `cni` | CNISpec | Spec for the CNI. | +| `controllers` | []ControllerSpec | List of specs for the additional controllers. | #### Cluster -Field | Type | Description ------- | --------- | --------------------------------------------------- -`kind` | string | Name of the cluster type. The options currently are `Kind` or `External`. -`spec` | yaml.Node | Fields that set the options for the cluster type. +| Field | Type | Description | +| ------ | --------- | ------------------------------------------------------------------------- | +| `kind` | string | Name of the cluster type. The options currently are `Kind` or `External`. | +| `spec` | yaml.Node | Fields that set the options for the cluster type. | ##### Kind -Field | Type | Description --------------------------- | ----------------- | -------------------------- -`name` | string | Cluster name, overrides `KIND_CLUSTER_NAME`, config (default `kind`). -`recycle` | bool | Reuse an existing cluster of the same name if it exists. -`version` | string | Desired version of the `kubectl` client. -`image` | string | Node docker image to use for booting the cluster. -`retain` | bool | Retain nodes for debugging when cluster creation fails. -`wait` | time.Duration | Wait for control plane node to be ready (default 0s). -`kubecfg` | string | Sets kubeconfig path instead of `$KUBECONFIG` or `$HOME/.kube/config`. -`googleArtifactRegistries` | []string | List of Google Artifact Registries to setup credentials for in the cluster. Example value for registry would be `us-west1-docker.pkg.dev`. Credentials used are associated with the configured `gcloud` user on the host. -`containerImages` | map[string]string | Map of source images to target images for containers to load in the cluster. Empty values cause the source image to be loaded into the cluster without being renamed. -`config` | string | Path to a kind config file. -`additionalManifests` | []string | List of paths to manifests to be applied using `kubectl` directly after cluster creation. +| Field | Type | Description | +| -------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `name` | string | Cluster name, overrides `KIND_CLUSTER_NAME`, config (default `kind`). | +| `recycle` | bool | Reuse an existing cluster of the same name if it exists. | +| `version` | string | Desired version of the `kubectl` client. | +| `image` | string | Node docker image to use for booting the cluster. | +| `retain` | bool | Retain nodes for debugging when cluster creation fails. | +| `wait` | time.Duration | Wait for control plane node to be ready (default 0s). | +| `kubecfg` | string | Sets kubeconfig path instead of `$KUBECONFIG` or `$HOME/.kube/config`. | +| `googleArtifactRegistries` | []string | List of Google Artifact Registries to setup credentials for in the cluster. Example value for registry would be `us-west1-docker.pkg.dev`. Credentials used are associated with the configured `gcloud` user on the host. | +| `containerImages` | map[string]string | Map of source images to target images for containers to load in the cluster. Empty values cause the source image to be loaded into the cluster without being renamed. | +| `config` | string | Path to a kind config file. | +| `additionalManifests` | []string | List of paths to manifests to be applied using `kubectl` directly after cluster creation. | ##### External -Field | Type | Description ---------- | ------ | ------------------------------------------------------- -`network` | string | Name of the docker network to create a pool of external IP addresses for ingress to assign to services. +| Field | Type | Description | +| --------- | ------ | ------------------------------------------------------------------------------------------------------- | +| `network` | string | Name of the docker network to create a pool of external IP addresses for ingress to assign to services. | #### Ingress -Field | Type | Description ------- | --------- | ------------------------------------------------------ -`kind` | string | Name of the ingress type. The only option currently is `MetalLB`. -`spec` | yaml.Node | Fields that set the options for the ingress type. +| Field | Type | Description | +| ------ | --------- | ----------------------------------------------------------------- | +| `kind` | string | Name of the ingress type. The only option currently is `MetalLB`. | +| `spec` | yaml.Node | Fields that set the options for the ingress type. | ##### MetalLB -Field | Type | Description ---------------- | ---------- | ----------- -`ip_count` | int | Number of IP addresses to include in the available pool. -`manifest` | string | Path of the manifest yaml file to create MetalLB in the cluster. The validated manifest for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/metallb/manifest.yaml). -~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create MetalLB in the cluster. The directory is expected to contain a file with the name `metallb-native.yaml`.~~ +| Field | Type | Description | +| --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `ip_count` | int | Number of IP addresses to include in the available pool. | +| `manifest` | string | Path of the manifest yaml file to create MetalLB in the cluster. The validated manifest for use with KNE can be found in the [MetalLB manifest](https://github.com/openconfig/kne/tree/main/manifests/metallb/manifest.yaml). | +| ~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create MetalLB in the cluster. The directory is expected to contain a file with the name `metallb-native.yaml`.~~ | #### CNI -Field | Type | Description ------- | --------- | -------------------------------------------------- -`kind` | string | Name of the CNI type. The only option currently is `Meshnet`. -`spec` | yaml.Node | Fields that set the options for the CNI type. +| Field | Type | Description | +| ------ | --------- | ------------------------------------------------------------- | +| `kind` | string | Name of the CNI type. The only option currently is `Meshnet`. | +| `spec` | yaml.Node | Fields that set the options for the CNI type. | ##### Meshnet -Field | Type | Description ---------------- | ---------- | ----------- -`manifest` | string | Path of the manifest yaml file to create Meshnet in the cluster. The validated manifest for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/meshnet/grpc/manifest.yaml). -~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create Meshnet in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ +| Field | Type | Description | +| --------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `manifest` | string | Path of the manifest yaml file to create Meshnet in the cluster. The validated manifest for use with KNE can be found in the [Meshnet manifest](https://github.com/openconfig/kne/tree/main/manifests/meshnet/grpc/manifest.yaml). | +| ~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create Meshnet in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ | #### Controllers -Field | Type | Description ------- | --------- | ---------------------------------------------------- -`kind` | string | Name of the controller type. The current options currently are `IxiaTG`, `SRLinux`, `CEOSLab`, and `Lemming`. -`spec` | yaml.Node | Fields that set the options for the controller type. +| Field | Type | Description | +| ------ | --------- | ------------------------------------------------------------------------------------------------------------- | +| `kind` | string | Name of the controller type. The current options currently are `IxiaTG`, `SRLinux`, `CEOSLab`, and `Lemming`. | +| `spec` | yaml.Node | Fields that set the options for the controller type. | ##### IxiaTG -Field | Type | Description ---------------- | ---------- | ----------- -`operator` | string | Path of the yaml file to create an IxiaTG operator in the cluster. The validated operator for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/keysight/ixiatg-operator.yaml). -`configMap` | string | Path of the yaml file to create an IxiaTG config map in the cluster. The validated config map for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/keysight/ixiatg-configmap.yaml). -~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create an IxiaTG operator in the cluster. The directory is expected to contain a file with the name `ixiatg-operator.yaml`. Optionally the directory can contain a file with the name `ixiatg-configmap.yaml` to apply a config map of the desired container images used by the controller.~~ +| Field | Type | Description | +| --------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `operator` | string | Path of the yaml file to create an IxiaTG operator in the cluster. The validated operator for use with KNE can be found in the [IxiaTG operator manifest](https://github.com/openconfig/kne/tree/main/manifests/keysight/ixiatg-operator.yaml). | +| `configMap` | string | Path of the yaml file to create an IxiaTG config map in the cluster. The validated config map for use with KNE can be found in the [IxiaTG config map manifest](https://github.com/openconfig/kne/tree/main/manifests/keysight/ixiatg-configmap.yaml). | +| ~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create an IxiaTG operator in the cluster. The directory is expected to contain a file with the name `ixiatg-operator.yaml`. Optionally the directory can contain a file with the name `ixiatg-configmap.yaml` to apply a config map of the desired container images used by the controller.~~ | ##### SRLinux -Field | Type | Description ---------------- | ---------- | ----------- -`operator` | string | Path of the yaml file to create an SRLinux operator in the cluster. The validated operator for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/controllers/srlinux/manifest.yaml). -~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create an SRLinux operator in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ +| Field | Type | Description | +| --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `operator` | string | Path of the yaml file to create an SRLinux operator in the cluster. The validated operator for use with KNE can be found in the [SRLinux operator manifest](https://github.com/openconfig/kne/tree/main/manifests/controllers/srlinux/manifest.yaml). | +| ~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create an SRLinux operator in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ | ##### CEOSLab -Field | Type | Description ---------------- | ---------- | ----------- -`operator` | string | Path of the yaml file to create a CEOSLab operator in the cluster. The validated operator for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/controllers/ceoslab/manifest.yaml). -~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create a CEOSLab operator in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ +| Field | Type | Description | +| --------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `operator` | string | Path of the yaml file to create a CEOSLab operator in the cluster. The validated operator for use with KNE can be found in the [cEOS operator manifest](https://github.com/openconfig/kne/tree/main/manifests/controllers/ceoslab/manifest.yaml). | +| ~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create a CEOSLab operator in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ | ##### Lemming -Field | Type | Description ---------------- | ---------- | ----------- -`operator` | string | Path of the yaml file to create a Lemming operator in the cluster. The validated operator for use with KNE can be found [here](https://github.com/openconfig/kne/tree/main/manifests/controllers/lemming/manifest.yaml). -~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create a Lemming operator in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ +| Field | Type | Description | +| --------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `operator` | string | Path of the yaml file to create a Lemming operator in the cluster. The validated operator for use with KNE can be found in the [Lemming operator manifest](https://github.com/openconfig/kne/tree/main/manifests/controllers/lemming/manifest.yaml). | +| ~~`manifests`~~ | ~~string~~ | ~~Path of the directory holding the manifests to create a Lemming operator in the cluster. The directory is expected to contain a file with the name `manifest.yaml`.~~ | @@ -256,21 +256,21 @@ To load an image into a `kind` cluster there is a 3 step process: 1. Pull the desired image: - ```bash - docker pull src_image:src_tag - ``` + ```bash + docker pull src_image:src_tag + ``` 2. Tag the image with the desired in-cluster name: - ```bash - docker tag src_image:src_tag dst_image:dst_tag - ``` + ```bash + docker tag src_image:src_tag dst_image:dst_tag + ``` 3. Load the image into the `kind` cluster: - ```bash - kind load docker-image dst_image:dst_tag --name=kne - ``` + ```bash + kind load docker-image dst_image:dst_tag --name=kne + ``` Now the `dst_image:dst_tag` image will be present for use in the `kind` cluster. @@ -315,8 +315,8 @@ node definitions interfaces, services, and initial configs can be specified. An example topology containing 4 DUT nodes (Arista, Cisco, Nokia, and Juniper) and 1 ATE node (Keysight) can be found under the examples directory at [examples/multivendor/multivendor.pb.txt](https://github.com/openconfig/kne/blob/main/examples/multivendor/multivendor.pb.txt). -The initial vendor router configs referenced in the topology are found -[here](https://github.com/openconfig/kne/tree/main/examples/multivendor) +The initial vendor router configs referenced in the topology are found in the +[multivendor example directory](https://github.com/openconfig/kne/tree/main/examples/multivendor) See the [push config](interact_topology.md#push_config) section for details about pushing config after initial creation. diff --git a/docs/interact_topology.md b/docs/interact_topology.md index 90509c241..3c390bb93 100644 --- a/docs/interact_topology.md +++ b/docs/interact_topology.md @@ -66,32 +66,32 @@ $ ssh admin@192.168.11.50 1. Get the IP range used by KNE services: - ```bash - $ kubectl get services -n multivendor - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - service-gnmi-otg-controller LoadBalancer 10.96.179.48 192.168.11.55 50051:30901/TCP 4m9s - service-grpc-otg-controller LoadBalancer 10.96.33.245 192.168.11.56 40051:30449/TCP 4m9s - service-https-otg-controller LoadBalancer 10.96.215.225 192.168.11.54 443:32556/TCP 4m9s - service-otg-port-eth1 LoadBalancer 10.96.82.37 192.168.11.58 5555:30886/TCP,50071:30286/TCP 4m9s - service-otg-port-eth2 LoadBalancer 10.96.204.154 192.168.11.59 5555:31326/TCP,50071:31860/TCP 4m9s - service-otg-port-eth3 LoadBalancer 10.96.136.253 192.168.11.60 5555:30181/TCP,50071:31619/TCP 4m9s - service-otg-port-eth4 LoadBalancer 10.96.205.227 192.168.11.57 5555:32636/TCP,50071:31247/TCP 4m9s - service-r1 LoadBalancer 10.96.130.198 192.168.11.50 443:32101/TCP,22:32304/TCP,6030:32011/TCP 4m12s - service-r2 LoadBalancer 10.96.107.2 192.168.11.51 443:31942/TCP,22:30785/TCP,57400:30921/TCP 4m11s - service-r3 LoadBalancer 10.96.80.18 192.168.11.52 22:32410/TCP 4m11s - service-r4 LoadBalancer 10.96.138.204 192.168.11.53 22:31932/TCP,50051:32666/TCP 4m10s - ``` - - In this case the IP range would be `192.168.11.*`. + ```bash + $ kubectl get services -n multivendor + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + service-gnmi-otg-controller LoadBalancer 10.96.179.48 192.168.11.55 50051:30901/TCP 4m9s + service-grpc-otg-controller LoadBalancer 10.96.33.245 192.168.11.56 40051:30449/TCP 4m9s + service-https-otg-controller LoadBalancer 10.96.215.225 192.168.11.54 443:32556/TCP 4m9s + service-otg-port-eth1 LoadBalancer 10.96.82.37 192.168.11.58 5555:30886/TCP,50071:30286/TCP 4m9s + service-otg-port-eth2 LoadBalancer 10.96.204.154 192.168.11.59 5555:31326/TCP,50071:31860/TCP 4m9s + service-otg-port-eth3 LoadBalancer 10.96.136.253 192.168.11.60 5555:30181/TCP,50071:31619/TCP 4m9s + service-otg-port-eth4 LoadBalancer 10.96.205.227 192.168.11.57 5555:32636/TCP,50071:31247/TCP 4m9s + service-r1 LoadBalancer 10.96.130.198 192.168.11.50 443:32101/TCP,22:32304/TCP,6030:32011/TCP 4m12s + service-r2 LoadBalancer 10.96.107.2 192.168.11.51 443:31942/TCP,22:30785/TCP,57400:30921/TCP 4m11s + service-r3 LoadBalancer 10.96.80.18 192.168.11.52 22:32410/TCP 4m11s + service-r4 LoadBalancer 10.96.138.204 192.168.11.53 22:31932/TCP,50051:32666/TCP 4m10s + ``` + + In this case the IP range would be `192.168.11.*`. 1. Edit your SSH config found at `~/.ssh/config` to include: - ```bash - Host 192.168.11.* - UserKnownHostsFile /dev/null - StrictHostKeyChecking no - ProxyCommand none - ``` + ```bash + Host 192.168.11.* + UserKnownHostsFile /dev/null + StrictHostKeyChecking no + ProxyCommand none + ``` @@ -252,7 +252,7 @@ See the external cptx with services -### Using OpenConfig g* services +### Using OpenConfig g\* services #### Using the CLI diff --git a/docs/kubernetes_reference.md b/docs/kubernetes_reference.md index db36dc85d..d318883a5 100644 --- a/docs/kubernetes_reference.md +++ b/docs/kubernetes_reference.md @@ -74,12 +74,12 @@ cluster creation, but regardless of which is chosen a k8s cluster will be created ready for topology creation. Currently, the most used cluster tool in KNE is **kind**. This tool actually hosts a single node k8s cluster inside of a docker container. The details here are not important for the purpose of this -reference, but if you see the term *kind* then know it may be referring to a +reference, but if you see the term _kind_ then know it may be referring to a tool for creating a k8s cluster. You can also bring your own cluster for use with KNE, this is convenient for users with custom k8s setups. -NOTE: *kind* is also a field in kubeyaml used to specify resource type, you may -see this inside of k8s manifests. However when we refer to *kind*, it's likely +NOTE: _kind_ is also a field in kubeyaml used to specify resource type, you may +see this inside of k8s manifests. However when we refer to _kind_, it's likely the cluster tool. After the cluster is created, several k8s deployments are created to initialize diff --git a/docs/multinode.md b/docs/multinode.md index 7e56ac3f7..dfbf04e98 100644 --- a/docs/multinode.md +++ b/docs/multinode.md @@ -3,8 +3,7 @@ ## Background A k8s cluster is made up of 1 or more nodes. Each node can hold up to 110 pods. -See the official large cluster considerations -[here](https://kubernetes.io/docs/setup/best-practices/cluster-large/). An +See the [official large cluster considerations](https://kubernetes.io/docs/setup/best-practices/cluster-large/). An emulated DUT in KNE brings up 1 pod. An emulated ATE in KNE brings up 1 pod per port. Together with the controller pods and other dependency pods, this in turn restricts a KNE user using kind (a single node cluster) to less than ~100 DUTs + diff --git a/docs/setup.md b/docs/setup.md index 32ad2ad05..ccbe9bc6f 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -7,11 +7,11 @@ to work with your Linux distribution. The following dependencies and required to use KNE: -* Golang -* Docker -* Kubectl -* Kind -* Make +- Golang +- Docker +- Kubectl +- Kind +- Make ## Install Golang diff --git a/docs/vendor.md b/docs/vendor.md index 093a8fe3b..7fe07f2d3 100644 --- a/docs/vendor.md +++ b/docs/vendor.md @@ -1,18 +1,19 @@ # Vendor Image Requirements A Vendor Image is a docker container that can be used with KNE to emulate a -vendor's devices. A Vendor Image might also be a fully virtual device with -no physical version, such as openconfig/lemming. +vendor's devices. A Vendor Image might also be a fully virtual device with no +physical version, such as openconfig/lemming. Without vendor images KNE is just an empty virtual machine rack that does -nothing. Vendor supplied images are what the user of KNE sees and is interested -in. This document describes the requirements and expectations of vendor images +nothing. Vendor supplied images are what the user of KNE sees and is interested +in. This document describes the requirements and expectations of vendor images and the associated code that is included in the KNE repository A vendor image requires a corresponding node implementation in topo/node/vendor -and should have working examples in examples/vendor. A single node -implementation may support multiple vendor images (e.g., cisco-xrd and cisco-8000e). A maintainer is the person or organization that maintains the vendor -specific node implementation and examples. +and should have working examples in examples/vendor. A single node +implementation may support multiple vendor images (e.g., cisco-xrd and +cisco-8000e). A maintainer is the person or organization that maintains the +vendor specific node implementation and examples. In this document a vendor is considered the person or organization that makes image containers available for use by others. @@ -20,15 +21,15 @@ image containers available for use by others. ## KNE Uses KNE was built to enable testing the functionality of networks without physical -hardware. Due to the obvious limitations of emulation, KNE is not designed to -test bandwidth and latency of connections. KNE is designed to enable testing of -the control protocols and interaction between devices. There are several +hardware. Due to the obvious limitations of emulation, KNE is not designed to +test bandwidth and latency of connections. KNE is designed to enable testing of +the control protocols and interaction between devices. There are several different types of testing. ### Testing new Topologies -KNE is used to test changes in network topology. Changes in network topology -can impact various protocols use in the network (e.g. BGP). +KNE is used to test changes in network topology. Changes in network topology can +impact various protocols use in the network (e.g. BGP). ### Testing Changes in Protocol or Configuration @@ -36,7 +37,7 @@ KNE is used to test protocol changes or other configuration changes. ### Testing Device Functionality -KNE is used to test changes to a device's Network Operating System (NOS). This +KNE is used to test changes to a device's Network Operating System (NOS). This is a crucial step in validating a devices usability for a particular purpose when a new NOS is released. @@ -45,57 +46,57 @@ when a new NOS is released. A network device in KNE can be viewed as two main components, the control plane and the data plane (the ASIC). -KNE is used to test the control plane of the NOS. This requires the control -software in the virtual device behave the same as in the hardware. It is -expected that the control software used in an image is the same as the -software used on the physical device and that it is configured and reacts in the -same way as the hardware. +KNE is used to test the control plane of the NOS. This requires the control +software in the virtual device behave the same as in the hardware. It is +expected that the control software used in an image is the same as the software +used on the physical device and that it is configured and reacts in the same way +as the hardware. -KNE is not designed to test the data plane or ASIC. The emulated data plane -must support routing and packet forwarding. ASIC specific commands and features -do not need to be supported as long as the data plane provides basic -functionality. +KNE is not designed to test the data plane or ASIC. The emulated data plane must +support routing and packet forwarding. ASIC specific commands and features do +not need to be supported as long as the data plane provides basic functionality. All of these use cases require that the vendor images to behave functionally as -if it were the hardware. The image is expected to be built from the same source -code base as the NOS used in the hardware. Faithful emulation of the ASIC is -not a requirement. The emulated ASIC (data plane) must correctly handle routing +if it were the hardware. The image is expected to be built from the same source +codebase as the NOS used in the hardware. Faithful emulation of the ASIC is not +a requirement. The emulated ASIC (data plane) must correctly handle routing changes and packet forwarding. ### Deviations The vendor should supply a document that describes what series of devices the -image emulates as well as known limits and deviations. These include +image emulates as well as known limits and deviations. These include -* Protocols not supported -* Protocols that deviate from the hardware (and how) -* OpenConfig paths only supported by hardware -* OpenConfig paths that report different results compared to the hardware. -* Known limitations of the emulated device -* Supported port configurations (e.g, number of ports, line cards, etc). +- Protocols not supported +- Protocols that deviate from the hardware (and how) +- OpenConfig paths only supported by hardware +- OpenConfig paths that report different results compared to the hardware. +- Known limitations of the emulated device +- Supported port configurations (e.g, number of ports, line cards, etc). -The listed OpenConfig paths need not be leaf nodes. Wildcards may be used in -the path where applicable. +The listed OpenConfig paths need not be leaf nodes. Wildcards may be used in the +path where applicable. ## Testing -Vendor images must be tested prior to publication. A standard set of tests is -found at . At a minimum, a KNE node using that image should -start and not cause the KNE emulation to hang. It should work in both a single -Kubernetes Worker Node environment as well as a multi-worker node environment. +Vendor images must be tested prior to publication. A standard set of tests is +found at `under development`. At a minimum, a KNE node using that image should +start and not cause the KNE emulation to stop responding. It should work in both +a single Kubernetes Worker Node environment as well as a multi-worker node +environment. It is expected that released images undergo repeated testing to identify non-deterministic errors. ## Support -Vendors are responsible for support of their images. The maintainer (typically +Vendors are responsible for support of their images. The maintainer (typically the person or organization that provides the associated container images) is responsible for the support of the vendor image specific node implementation in [kne/topo/node](https://github.com/openconfig/kne/tree/main/topo/node), the vendor specific examples in [kne/examples](https://github.com/openconfig/kne/tree/main/examples), as well as -other vendor software reqiured by the node implementation (e.g., controller or -operator). The maintainer should be responsive to community contributions. In +other vendor software required by the node implementation (e.g., controller or +operator). The maintainer should be responsive to community contributions. In the event the maintainer of a particular node implementation is unresponsive a new maintainer may take over that implementation. diff --git a/examples/cisco/8000e/README.md b/examples/cisco/8000e/README.md index 7ea53bd90..656232b22 100644 --- a/examples/cisco/8000e/README.md +++ b/examples/cisco/8000e/README.md @@ -2,19 +2,30 @@ **Note:** The following instruction is validated on Ubuntu 20.04.1. -## Check perquisites and create a kne topology using topology [8000e-ixia.pb.txt](8000e-ixia.pb.txt) - -- Ensure you have a healthy kind cluster. Please refer [setup](../../../docs/setup.md) and [topology](../../../docs/create_topology.md) documents for the detailed instructions. -- Verify if nested virtualization is configured correctly by checking presence of /dev/kvm (`ls /dev/kvm`). -- Verify if Open vSwitch is installed by running `ovs-vswitchd --version` and install if it is missing by running `sudo apt-get install openvswitch-switch-dpdk`. -- Set pid_max <= 1048575 using `echo "kernel.pid_max=1048575" >> /etc/sysctl.conf` or `sysctl kernel.pid_max=1048575`. +## Check prerequisites and create a kne topology using topology [8000e-ixia.pb.txt](8000e-ixia.pb.txt) + +- Ensure you have a healthy kind cluster. Please refer + [setup](../../../docs/setup.md) and + [topology](../../../docs/create_topology.md) documents for the detailed + instructions. +- Verify if nested virtualization is configured correctly by checking presence + of /dev/kvm (`ls /dev/kvm`). +- Verify if Open vSwitch is installed by running `ovs-vswitchd --version` and + install if it is missing by running `sudo apt-get install +openvswitch-switch-dpdk`. +- Set pid_max <= 1048575 using `echo "kernel.pid_max=1048575" >> +/etc/sysctl.conf` or `sysctl kernel.pid_max=1048575`. - Create a KNE topology using `kne create path/to/8000e-ixia.pb.txt` ## Make sure the topology is healthy -- Make sure nodes are up and running by running command `kubectl get pods -A`. The output of the command should contain namespace `cisco-ixia` and 6 nodes with status `Running`. 4 otg ports (`otg-port-*`), one otg controller (`otg-controller`), and one cisco 8000e (`8000e`) are expected to be shown if the topology is created successfully. - -``` bash +- Make sure nodes are up and running by running command `kubectl get pods -A`. + The output of the command should contain namespace `cisco-ixia` and 6 nodes + with status `Running`. 4 otg ports (`otg-port-*`), one otg controller + (`otg-controller`), and one cisco 8000e (`8000e`) are expected to be shown + if the topology is created successfully. + +```bash kubectl get pods -A NAMESPACE NAME READY STATUS RESTARTS AGE cisco-ixia 8000e 1/1 Running 0 4m28s @@ -23,13 +34,17 @@ cisco-ixia otg-port-eth1 2/2 Run cisco-ixia otg-port-eth2 2/2 Running 0 4m28s cisco-ixia otg-port-eth3 2/2 Running 0 4m28s cisco-ixia otg-port-eth4 2/2 Running 0 4m27s --- omitted -- - +-- omitted -- + ``` -- Make sure external ip are mapped correctly by running command `kubectl get services -n cisco-ixia`. It is expected an external ip is assigned to each of the six nodes mentioned above. Also, the port mapping of the gnmi/gnoi/gribi/p4rt/ssh services for 8000e should match the port mapping in the topology file. - -``` bash +- Make sure external ip are mapped correctly by running command `kubectl get +services -n cisco-ixia`. It is expected an external ip is assigned to each + of the six nodes mentioned above. Also, the port mapping of the + gnmi/gnoi/gribi/p4rt/ssh services for 8000e should match the port mapping in + the topology file. + +```bash kubectl get services -n cisco-ixia NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service-8000e LoadBalancer 10.96.195.26 172.18.0.50 22:31633/TCP,9339:31543/TCP,9340:30751/TCP,9337:30331/TCP,9559:31439/TCP 7m45s @@ -40,23 +55,25 @@ service-otg-port-eth1 LoadBalancer 10.96.70.21 172.18.0.54 5555 service-otg-port-eth2 LoadBalancer 10.96.166.2 172.18.0.55 5555:31205/TCP,50071:32376/TCP 7m45s service-otg-port-eth3 LoadBalancer 10.96.108.38 172.18.0.56 5555:32396/TCP,50071:30361/TCP 7m45s service-otg-port-eth4 LoadBalancer 10.96.24.228 172.18.0.57 5555:31664/TCP,50071:30416/TCP 7m44s - ``` +``` ## Check 8000e status -- Based on the above output, you may use `ssh cisco@172.18.0.50` with user/pass (`cisco/cisco123`) to access cisco e8000 instance (`e8000`). +- Based on the above output, you may use `ssh cisco@172.18.0.50` with + user/pass (`cisco/cisco123`) to access cisco e8000 instance (`e8000`). -``` bash -ssh cisco@172.18.0.50 -Password: +```bash +ssh cisco@172.18.0.50 +Password: Last login: Thu Feb 23 05:03:48 2023 from 10.244.0.1 -RP/0/RP0/CPU0:ios# +RP/0/RP0/CPU0:ios# ``` -- You can also use `kubectl exec -it -n cisco-ixia 8000e -- telnet 0 60000` to get console access to the device. - -``` bash +- You can also use `kubectl exec -it -n cisco-ixia 8000e -- telnet 0 60000` to + get console access to the device. + +```bash kubectl exec -it -n cisco-ixia 8000e -- telnet 0 60000 Defaulted container "vxr" out of: vxr, init-vxr (init) Trying 0.0.0.0... @@ -64,23 +81,27 @@ Connected to 0. Escape character is '^]'. RP/0/RP0/CPU0:ios# - ``` +``` -**Note:** Depending on the model, it may takes around 6 minutes for the 8000e to be fully up. You may check `startup.log` and `startup.err` using the following steps if the telnet fails: +**Note:** Depending on the model, it may takes around 6 minutes for the 8000e to +be fully up. You may check `startup.log` and `startup.err` using the following +steps if the telnet fails: -``` bash -$ kubectl exec -it -n cisco-ixia 8000e -- bash +```bash +$ kubectl exec -it -n cisco-ixia 8000e -- bash Defaulted container "8000e" out of: 8000e, init-8000e (init) root@8000e:/# cd /nobackup/ root@8000e:/nobackup# ls -ltr -rw-r--r-- 1 root root 0 Feb 23 14:14 startup.err -rw-r--r-- 1 root root 4894 Feb 23 14:18 startup.log -root@8000e:/nobackup# +root@8000e:/nobackup# ``` -To check if the grpc is configured, you may use `show running-config grpc` after login to the router. By default grpc for 8000e is configured using tls without authentication (`insecure: false & skip_verify: true`). +To check if the grpc is configured, you may use `show running-config grpc` after +login to the router. By default grpc for 8000e is configured using tls without +authentication (`insecure: false & skip_verify: true`). -``` bash +```bash RP/0/RP0/CPU0:ios#show running-config grpc Thu Feb 23 06:04:04.562 UTC grpc @@ -97,7 +118,7 @@ RP/0/RP0/CPU0:ios# ## Test GNMI using external service ip and outside port -``` bash +```bash gnmic -a 172.18.0.50:9339 -u cisco -p cisco123 capabilities --skip-verify gNMI version: 0.8.0 supported encodings: @@ -130,12 +151,12 @@ supported models: ] } ] - + ``` ## Test gNOI service using external service ip and outside port -``` bash +```bash gnoic -a 172.18.0.50:9337 --skip-verify -u cisco -p cisco123 system ping --destination 44.44.44.44 100 bytes from 44.44.44.44: icmp_seq=1 ttl=255 time=3ns 100 bytes from 44.44.44.44: icmp_seq=2 ttl=255 time=1ns @@ -149,11 +170,11 @@ round-trip min/avg/max/stddev = 1.000/1.000/3.000/1.000 ms ## Test gRIBI service using external service ip and outside port -``` bash -gribic -a 172.18.0.50:9340 -u cisco -p cisco --skip-verify flush --ns DEFAULT -INFO[0000] got 1 results +```bash +gribic -a 172.18.0.50:9340 -u cisco -p cisco --skip-verify flush --ns DEFAULT +INFO[0000] got 1 results INFO[0000] "172.18.0.50:9340": timestamp: 1677161921484040943 -result: OK -$ +result: OK +$ ``` diff --git a/examples/gobgp/r1.yaml b/examples/gobgp/r1.yaml index 721e34299..8f77a5316 100644 --- a/examples/gobgp/r1.yaml +++ b/examples/gobgp/r1.yaml @@ -1,8 +1,9 @@ +--- global: - config: - as: 65001 - router-id: 10.1.0.1 + config: + as: 65001 + router-id: 10.1.0.1 neighbors: - - config: - neighbor-address: 10.0.0.2 - peer-as: 65002 \ No newline at end of file + - config: + neighbor-address: 10.0.0.2 + peer-as: 65002 diff --git a/examples/gobgp/r2.yaml b/examples/gobgp/r2.yaml index b770e9fa4..a35bc06a2 100644 --- a/examples/gobgp/r2.yaml +++ b/examples/gobgp/r2.yaml @@ -1,8 +1,9 @@ +--- global: - config: - as: 65002 - router-id: 10.1.0.2 + config: + as: 65002 + router-id: 10.1.0.2 neighbors: - - config: - neighbor-address: 10.0.0.1 - peer-as: 65001 \ No newline at end of file + - config: + neighbor-address: 10.0.0.1 + peer-as: 65001 diff --git a/examples/juniper/cptx-ixia/README.md b/examples/juniper/cptx-ixia/README.md index df981f7c5..f88719bed 100644 --- a/examples/juniper/cptx-ixia/README.md +++ b/examples/juniper/cptx-ixia/README.md @@ -167,35 +167,39 @@ entry: { - cPTX can be configured in a channelized or non-channelized mode. - cPTX will be started in channelized mode if any of the interfaces in the interface mapping of KNE config are channelized. - cPTX ethernet interfaces to software wire interface mapping (channelized). Follow the `juniper.config` for more info. Here is an example. - ```bash - et-0/0/0:0 (eth4) - et-0/0/0:1 (eth5) - -- snip -- - et-0/0/1:0 (eth12) - et-0/0/1:1 (eth13) - -- snip -- - et-0/0/2:0 (eth20) - -- snip -- - et-0/0/3:0 (eth28) - et-0/0/4:0 (eth36) - et-0/0/5:0 (unused) - et-0/0/6:0 (eth40) - -- snip -- - et-0/0/7:0 (unused) - -- snip -- - et-0/0/11:0 (eth68) - ``` + + ```bash + et-0/0/0:0 (eth4) + et-0/0/0:1 (eth5) + -- snip -- + et-0/0/1:0 (eth12) + et-0/0/1:1 (eth13) + -- snip -- + et-0/0/2:0 (eth20) + -- snip -- + et-0/0/3:0 (eth28) + et-0/0/4:0 (eth36) + et-0/0/5:0 (unused) + et-0/0/6:0 (eth40) + -- snip -- + et-0/0/7:0 (unused) + -- snip -- + et-0/0/11:0 (eth68) + ``` + - cPTX ethernet interfaces to software wire interface mapping (non-channelized). Here is an example. - ```bash - et-0/0/0 (eth4) - et-0/0/1 (eth5) - et-0/0/2 (eth6) - -- snip -- - et-0/0/5 (unused) - et-0/0/6 (eth10) - et-0/0/7 (unused) - et-0/0/8 (eth12) - -- snip -- - et-0/0/11 (eth15) - ``` + + ```bash + et-0/0/0 (eth4) + et-0/0/1 (eth5) + et-0/0/2 (eth6) + -- snip -- + et-0/0/5 (unused) + et-0/0/6 (eth10) + et-0/0/7 (unused) + et-0/0/8 (eth12) + -- snip -- + et-0/0/11 (eth15) + ``` + - Pass gRPC client option `-skip-verify` as only self-signed TLS certificates are configured as of today. diff --git a/load/testdata/deploy/kne/kind-bridge.yaml b/load/testdata/deploy/kne/kind-bridge.yaml index 0832c0c2f..00bcbf8b9 100644 --- a/load/testdata/deploy/kne/kind-bridge.yaml +++ b/load/testdata/deploy/kne/kind-bridge.yaml @@ -1,6 +1,7 @@ # kind-bridge.yaml cluster config file sets up a kind cluster where default PTP CNI plugin # is swapped with the Bridge CNI plugin. # Bridge CNI plugin is required by some Network OSes to operate. +--- cluster: kind: Kind spec: diff --git a/load/testdata/kind/kind-no-cni.yaml b/load/testdata/kind/kind-no-cni.yaml index 1494699dc..aa3bb8295 100644 --- a/load/testdata/kind/kind-no-cni.yaml +++ b/load/testdata/kind/kind-no-cni.yaml @@ -1,3 +1,4 @@ +--- kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 networking: diff --git a/load/testdata/manifests/controllers/ceoslab/manifest.yaml b/load/testdata/manifests/controllers/ceoslab/manifest.yaml index da7def69c..b21d6793f 100644 --- a/load/testdata/manifests/controllers/ceoslab/manifest.yaml +++ b/load/testdata/manifests/controllers/ceoslab/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,193 +22,193 @@ spec: singular: ceoslabdevice scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: CEosLabDevice is the Schema for the ceoslabdevices API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: CEosLabDeviceSpec defines the desired state of CEosLabDevice - properties: - args: - description: Additional arguments to pass to /sbin/init. Those necessary to boot properly are already present. - items: - type: string - type: array - certconfig: - description: X.509 certificate configuration. - properties: - selfsignedcerts: - description: Configuration for self-signed certificates. - items: - properties: - certname: - description: Certificate name on the node. - type: string - commonname: - description: Common name to set in the cert. - type: string - keyname: - description: Key name on the node. - type: string - keysize: - description: RSA keysize to use for key generation. - format: int32 - type: integer - type: object - type: array - type: object - envvars: - additionalProperties: - type: string - description: Additional environment variables. Those necessary to boot properly are already present. - type: object - image: - description: 'Image name. Default: ceos:latest' - type: string - initcontainerimage: - description: 'Init container image name. Default: networkop/init-wait:latest' - type: string - intfmapping: - additionalProperties: - type: string - description: Explicit interface mapping between kernel devices and interface names. If this is defined, any unmapped devices are ignored. - type: object - numinterfaces: - description: 'Number of data interfaces to create. An additional interface (eth0) is created for pod connectivity. Default: 0 interfaces' - format: int32 - type: integer - resourcerequirements: - additionalProperties: - type: string - description: 'Resource requests to configure on the pod. Default: none' - type: object - services: - additionalProperties: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: CEosLabDevice is the Schema for the ceoslabdevices API + properties: + apiVersion: + description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: CEosLabDeviceSpec defines the desired state of CEosLabDevice + properties: + args: + description: Additional arguments to pass to /sbin/init. Those necessary to boot properly are already present. + items: + type: string + type: array + certconfig: + description: X.509 certificate configuration. properties: - tcpports: - description: TCP ports to forward to the pod. + selfsignedcerts: + description: Configuration for self-signed certificates. items: properties: - in: - description: Port inside the container. - format: int32 - type: integer - out: - description: Port outside the container. Defaults to the same as in. + certname: + description: Certificate name on the node. + type: string + commonname: + description: Common name to set in the cert. + type: string + keyname: + description: Key name on the node. + type: string + keysize: + description: RSA keysize to use for key generation. format: int32 type: integer type: object type: array type: object - description: 'Port mappings for container services. Default: none' - type: object - sleep: - description: 'Time (in seconds) to wait before starting the device. Default: 0 seconds' - format: int32 - type: integer - toggleoverrides: - additionalProperties: - type: boolean - description: EOS feature toggle overrides - type: object - waitforagents: - description: EOS agents to for the startup probe to block on - items: + envvars: + additionalProperties: + type: string + description: Additional environment variables. Those necessary to boot properly are already present. + type: object + image: + description: "Image name. Default: ceos:latest" type: string - type: array - type: object - status: - description: CEosLabDeviceStatus defines the observed state of CEosLabDevice - properties: - configmapconfig: - description: ConfigMap state as configured in configmaps - properties: - intfmappingstatus: - additionalProperties: - type: string + initcontainerimage: + description: "Init container image name. Default: networkop/init-wait:latest" + type: string + intfmapping: + additionalProperties: + type: string + description: Explicit interface mapping between kernel devices and interface names. If this is defined, any unmapped devices are ignored. + type: object + numinterfaces: + description: "Number of data interfaces to create. An additional interface (eth0) is created for pod connectivity. Default: 0 interfaces" + format: int32 + type: integer + resourcerequirements: + additionalProperties: + type: string + description: "Resource requests to configure on the pod. Default: none" + type: object + services: + additionalProperties: + properties: + tcpports: + description: TCP ports to forward to the pod. + items: + properties: + in: + description: Port inside the container. + format: int32 + type: integer + out: + description: Port outside the container. Defaults to the same as in. + format: int32 + type: integer + type: object + type: array type: object - rceosstale: + description: "Port mappings for container services. Default: none" + type: object + sleep: + description: "Time (in seconds) to wait before starting the device. Default: 0 seconds" + format: int32 + type: integer + toggleoverrides: + additionalProperties: type: boolean - selfsignedcertstatus: - additionalProperties: - properties: - certname: - description: Certificate name on the node. - type: string - commonname: - description: Common name to set in the cert. - type: string - keyname: - description: Key name on the node. - type: string - keysize: - description: RSA keysize to use for key generation. - format: int32 - type: integer - type: object - type: object - startupconfigresourceversion: + description: EOS feature toggle overrides + type: object + waitforagents: + description: EOS agents to for the startup probe to block on + items: type: string - toggleoverridesstatus: - additionalProperties: + type: array + type: object + status: + description: CEosLabDeviceStatus defines the observed state of CEosLabDevice + properties: + configmapconfig: + description: ConfigMap state as configured in configmaps + properties: + intfmappingstatus: + additionalProperties: + type: string + type: object + rceosstale: type: boolean - type: object - type: object - podconfigmapconfig: - description: ConfigMap state as present in the pod. If these diverge, we need to restart the pod to update. Even if an in-place update is possible these are needed at boot time. - properties: - intfmappingstatus: - additionalProperties: + selfsignedcertstatus: + additionalProperties: + properties: + certname: + description: Certificate name on the node. + type: string + commonname: + description: Common name to set in the cert. + type: string + keyname: + description: Key name on the node. + type: string + keysize: + description: RSA keysize to use for key generation. + format: int32 + type: integer + type: object + type: object + startupconfigresourceversion: type: string - type: object - rceosstale: - type: boolean - selfsignedcertstatus: - additionalProperties: - properties: - certname: - description: Certificate name on the node. - type: string - commonname: - description: Common name to set in the cert. - type: string - keyname: - description: Key name on the node. - type: string - keysize: - description: RSA keysize to use for key generation. - format: int32 - type: integer + toggleoverridesstatus: + additionalProperties: + type: boolean type: object - type: object - startupconfigresourceversion: - type: string - toggleoverridesstatus: - additionalProperties: + type: object + podconfigmapconfig: + description: ConfigMap state as present in the pod. If these diverge, we need to restart the pod to update. Even if an in-place update is possible these are needed at boot time. + properties: + intfmappingstatus: + additionalProperties: + type: string + type: object + rceosstale: type: boolean - type: object - type: object - reason: - description: Reason for potential failure - type: string - status: - description: Device status - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + selfsignedcertstatus: + additionalProperties: + properties: + certname: + description: Certificate name on the node. + type: string + commonname: + description: Common name to set in the cert. + type: string + keyname: + description: Key name on the node. + type: string + keysize: + description: RSA keysize to use for key generation. + format: int32 + type: integer + type: object + type: object + startupconfigresourceversion: + type: string + toggleoverridesstatus: + additionalProperties: + type: boolean + type: object + type: object + reason: + description: Reason for potential failure + type: string + status: + description: Device status + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -227,37 +228,37 @@ metadata: name: arista-ceoslab-operator-leader-election-role namespace: arista-ceoslab-operator-system rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -265,108 +266,108 @@ metadata: creationTimestamp: null name: arista-ceoslab-operator-manager-role rules: -- apiGroups: - - ceoslab.arista.com - resources: - - ceoslabdevices - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - ceoslab.arista.com - resources: - - ceoslabdevices/finalizers - verbs: - - update -- apiGroups: - - ceoslab.arista.com - resources: - - ceoslabdevices/status - verbs: - - get - - patch - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch + - apiGroups: + - ceoslab.arista.com + resources: + - ceoslabdevices + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ceoslab.arista.com + resources: + - ceoslabdevices/finalizers + verbs: + - update + - apiGroups: + - ceoslab.arista.com + resources: + - ceoslabdevices/status + verbs: + - get + - patch + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: arista-ceoslab-operator-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: arista-ceoslab-operator-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -378,9 +379,9 @@ roleRef: kind: Role name: arista-ceoslab-operator-leader-election-role subjects: -- kind: ServiceAccount - name: arista-ceoslab-operator-controller-manager - namespace: arista-ceoslab-operator-system + - kind: ServiceAccount + name: arista-ceoslab-operator-controller-manager + namespace: arista-ceoslab-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -391,9 +392,9 @@ roleRef: kind: ClusterRole name: arista-ceoslab-operator-manager-role subjects: -- kind: ServiceAccount - name: arista-ceoslab-operator-controller-manager - namespace: arista-ceoslab-operator-system + - kind: ServiceAccount + name: arista-ceoslab-operator-controller-manager + namespace: arista-ceoslab-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -404,9 +405,9 @@ roleRef: kind: ClusterRole name: arista-ceoslab-operator-proxy-role subjects: -- kind: ServiceAccount - name: arista-ceoslab-operator-controller-manager - namespace: arista-ceoslab-operator-system + - kind: ServiceAccount + name: arista-ceoslab-operator-controller-manager + namespace: arista-ceoslab-operator-system --- apiVersion: v1 data: @@ -436,10 +437,10 @@ metadata: namespace: arista-ceoslab-operator-system spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -463,53 +464,53 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.11.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: ghcr.io/aristanetworks/arista-ceoslab-operator:v2.0.1 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.11.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: ghcr.io/aristanetworks/arista-ceoslab-operator:v2.0.1 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false securityContext: runAsNonRoot: true serviceAccountName: arista-ceoslab-operator-controller-manager diff --git a/load/testdata/manifests/controllers/lemming/manifest.yaml b/load/testdata/manifests/controllers/lemming/manifest.yaml index 273dc2d43..70931f9d3 100644 --- a/load/testdata/manifests/controllers/lemming/manifest.yaml +++ b/load/testdata/manifests/controllers/lemming/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,245 +22,268 @@ spec: singular: lemming scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Lemming is the Schema for the lemmings API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: LemmingSpec defines the desired state of Lemming. - properties: - args: - description: Args are the args to pass to the command. - items: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Lemming is the Schema for the lemmings API + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: LemmingSpec defines the desired state of Lemming. + properties: + args: + description: Args are the args to pass to the command. + items: + type: string + type: array + command: + description: Command is the name of the executable to run. type: string - type: array - command: - description: Command is the name of the executable to run. - type: string - configFile: - description: ConfigFile is the default configuration file name for - the pod. - type: string - configPath: - description: ConfigPath is the mount point for configuration inside - the pod. - type: string - env: - description: Env are the environment variables to set for the container. - items: - description: EnvVar represents an environment variable present in - a Container. - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported.' - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - image: - description: Image is the container image to run. - type: string - initImage: - description: InitImage is the docker image to use as an init container - for the pod. - type: string - initSleep: - description: InitSleep is the time sleep in the init container - type: integer - interfaceCount: - description: InterfaceCount is number of interfaces to be attached - to the pod. - type: integer - ports: - additionalProperties: - description: ServicePort describes an external L4 port on the device. - properties: - innerPort: - description: InnerPort is port on the container to expose. - format: int32 - type: integer - outerPort: - description: OuterPort is port on the container to expose. - format: int32 - type: integer - required: - - innerPort - - outerPort - type: object - description: Ports are ports to create on the service. - type: object - resources: - description: Resources are the K8s resources to allocate to lemming - container. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - tls: - description: TLS is the configuration the key/certs to use for management. - properties: - selfSigned: - description: SelfSigned generates a new self signed certificate. + configFile: + description: + ConfigFile is the default configuration file name for + the pod. + type: string + configPath: + description: + ConfigPath is the mount point for configuration inside + the pod. + type: string + env: + description: Env are the environment variables to set for the container. + items: + description: + EnvVar represents an environment variable present in + a Container. properties: - commonName: - description: / Common name to set in the cert. + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: + 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' type: string - keySize: - description: RSA keysize to use for key generation. + valueFrom: + description: + Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + fieldRef: + description: + "Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs." + properties: + apiVersion: + description: + Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: + Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + resourceFieldRef: + description: + "Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported." + properties: + containerName: + description: + "Container name: required for volumes, + optional for env vars" + type: string + divisor: + anyOf: + - type: integer + - type: string + description: + Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: "Required: resource to select" + type: string + required: + - resource + type: object + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: + The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + image: + description: Image is the container image to run. + type: string + initImage: + description: + InitImage is the docker image to use as an init container + for the pod. + type: string + initSleep: + description: InitSleep is the time sleep in the init container + type: integer + interfaceCount: + description: + InterfaceCount is number of interfaces to be attached + to the pod. + type: integer + ports: + additionalProperties: + description: ServicePort describes an external L4 port on the device. + properties: + innerPort: + description: InnerPort is port on the container to expose. + format: int32 + type: integer + outerPort: + description: OuterPort is port on the container to expose. + format: int32 type: integer required: - - commonName - - keySize + - innerPort + - outerPort type: object - type: object - type: object - status: - description: LemmingStatus defines the observed state of Lemming - properties: - message: - description: Message describes why the lemming is in the current phase. - type: string - phase: - description: Phase is the overall status of the Lemming. - type: string - required: - - message - - phase - type: object - type: object - served: true - storage: true - subresources: - status: {} + description: Ports are ports to create on the service. + type: object + resources: + description: + Resources are the K8s resources to allocate to lemming + container. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + type: object + tls: + description: TLS is the configuration the key/certs to use for management. + properties: + selfSigned: + description: SelfSigned generates a new self signed certificate. + properties: + commonName: + description: / Common name to set in the cert. + type: string + keySize: + description: RSA keysize to use for key generation. + type: integer + required: + - commonName + - keySize + type: object + type: object + type: object + status: + description: LemmingStatus defines the observed state of Lemming + properties: + message: + description: Message describes why the lemming is in the current phase. + type: string + phase: + description: Phase is the overall status of the Lemming. + type: string + required: + - message + - phase + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -273,37 +297,37 @@ metadata: name: lemming-leader-election-role namespace: lemming-operator rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -311,74 +335,74 @@ metadata: creationTimestamp: null name: lemming-manager-role rules: -- apiGroups: - - "" - resources: - - pods - - secrets - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/finalizers - verbs: - - update -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - pods + - secrets + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/finalizers + verbs: + - update + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -390,9 +414,9 @@ roleRef: kind: Role name: lemming-leader-election-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -403,9 +427,9 @@ roleRef: kind: ClusterRole name: lemming-manager-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -416,9 +440,9 @@ roleRef: kind: ClusterRole name: lemming-proxy-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: v1 data: @@ -458,10 +482,10 @@ metadata: namespace: lemming-operator spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -485,61 +509,61 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.3 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.3 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL securityContext: runAsNonRoot: true serviceAccountName: lemming-controller-manager diff --git a/load/testdata/manifests/controllers/srlinux/manifest.yaml b/load/testdata/manifests/controllers/srlinux/manifest.yaml index da3d2c48a..6ba42e3f3 100644 --- a/load/testdata/manifests/controllers/srlinux/manifest.yaml +++ b/load/testdata/manifests/controllers/srlinux/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,119 +22,127 @@ spec: singular: srlinux scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .status.image - name: Image - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - description: Srlinux is the Schema for the srlinuxes API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - license_key: - description: license key from license secret that contains a license file - for this Srlinux - type: string - metadata: - type: object - spec: - description: SrlinuxSpec defines the desired state of Srlinux. - properties: - config: - description: NodeConfig represents srlinux node configuration parameters. - properties: - args: - items: - type: string - type: array - cert: - description: CertificateCfg represents srlinux certificate configuration - parameters. - properties: - cert_name: - description: Certificate name on the node. - type: string - common_name: - description: Common name to set in the cert. + - additionalPrinterColumns: + - jsonPath: .status.image + name: Image + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: Srlinux is the Schema for the srlinuxes API + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + license_key: + description: + license key from license secret that contains a license file + for this Srlinux + type: string + metadata: + type: object + spec: + description: SrlinuxSpec defines the desired state of Srlinux. + properties: + config: + description: NodeConfig represents srlinux node configuration parameters. + properties: + args: + items: type: string - key_name: - description: Key name on the node. + type: array + cert: + description: + CertificateCfg represents srlinux certificate configuration + parameters. + properties: + cert_name: + description: Certificate name on the node. + type: string + common_name: + description: Common name to set in the cert. + type: string + key_name: + description: Key name on the node. + type: string + key_size: + description: RSA keysize to use for key generation. + format: int32 + type: integer + type: object + command: + items: type: string - key_size: - description: RSA keysize to use for key generation. - format: int32 - type: integer - type: object - command: - items: + type: array + config_data_present: + description: + When set to true by kne, srlinux controller will + attempt to mount the file with startup config to the pod + type: boolean + config_file: + description: + Startup configuration file name for the pod. Set + in the kne topo and created by kne as a config map type: string - type: array - config_data_present: - description: When set to true by kne, srlinux controller will - attempt to mount the file with startup config to the pod - type: boolean - config_file: - description: Startup configuration file name for the pod. Set - in the kne topo and created by kne as a config map - type: string - config_path: - description: Mount point for configuration inside the pod. Should - point to a dir that contains ConfigFile - type: string - entry_command: - description: Specific entry point command for accessing the pod. - type: string - env: - additionalProperties: + config_path: + description: + Mount point for configuration inside the pod. Should + point to a dir that contains ConfigFile + type: string + entry_command: + description: Specific entry point command for accessing the pod. + type: string + env: + additionalProperties: + type: string + description: Map of environment variables to pass into the pod. + type: object + image: type: string - description: Map of environment variables to pass into the pod. - type: object - image: + sleep: + format: int32 + type: integer + type: object + constraints: + additionalProperties: type: string - sleep: - format: int32 - type: integer - type: object - constraints: - additionalProperties: + type: object + model: + description: Model encodes SR Linux variant (ixr-d3, ixr-6e, etc) type: string - type: object - model: - description: Model encodes SR Linux variant (ixr-d3, ixr-6e, etc) - type: string - num-interfaces: - type: integer - version: - description: Version may be set in kne topology as a mean to explicitly - provide version information in case it is not encoded in the image - tag - type: string - type: object - status: - description: SrlinuxStatus defines the observed state of Srlinux. - properties: - image: - description: Image used to run srlinux pod - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + num-interfaces: + type: integer + version: + description: + Version may be set in kne topology as a mean to explicitly + provide version information in case it is not encoded in the image + tag + type: string + type: object + status: + description: SrlinuxStatus defines the observed state of Srlinux. + properties: + image: + description: Image used to run srlinux pod + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -153,37 +162,37 @@ metadata: name: srlinux-controller-leader-election-role namespace: srlinux-controller rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -191,96 +200,96 @@ metadata: creationTimestamp: null name: srlinux-controller-manager-role rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - kne.srlinux.dev - resources: - - srlinuxes - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - kne.srlinux.dev - resources: - - srlinuxes/finalizers - verbs: - - update -- apiGroups: - - kne.srlinux.dev - resources: - - srlinuxes/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - kne.srlinux.dev + resources: + - srlinuxes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - kne.srlinux.dev + resources: + - srlinuxes/finalizers + verbs: + - update + - apiGroups: + - kne.srlinux.dev + resources: + - srlinuxes/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: srlinux-controller-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: srlinux-controller-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -292,9 +301,9 @@ roleRef: kind: Role name: srlinux-controller-leader-election-role subjects: -- kind: ServiceAccount - name: srlinux-controller-controller-manager - namespace: srlinux-controller + - kind: ServiceAccount + name: srlinux-controller-controller-manager + namespace: srlinux-controller --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -305,9 +314,9 @@ roleRef: kind: ClusterRole name: srlinux-controller-manager-role subjects: -- kind: ServiceAccount - name: srlinux-controller-controller-manager - namespace: srlinux-controller + - kind: ServiceAccount + name: srlinux-controller-controller-manager + namespace: srlinux-controller --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -318,9 +327,9 @@ roleRef: kind: ClusterRole name: srlinux-controller-proxy-role subjects: -- kind: ServiceAccount - name: srlinux-controller-controller-manager - namespace: srlinux-controller + - kind: ServiceAccount + name: srlinux-controller-controller-manager + namespace: srlinux-controller --- apiVersion: v1 data: @@ -354,9 +363,9 @@ metadata: namespace: srlinux-controller spec: ports: - - name: https - port: 8443 - targetPort: https + - name: https + port: 8443 + targetPort: https selector: control-plane: controller-manager --- @@ -378,45 +387,45 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=10 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.8.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: ghcr.io/srl-labs/srl-controller:0.4.6 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 100m - memory: 30Mi - requests: - cpu: 100m - memory: 20Mi - securityContext: - allowPrivilegeEscalation: false + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=10 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.8.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: ghcr.io/srl-labs/srl-controller:0.4.6 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 100m + memory: 30Mi + requests: + cpu: 100m + memory: 20Mi + securityContext: + allowPrivilegeEscalation: false securityContext: runAsNonRoot: true serviceAccountName: srlinux-controller-controller-manager diff --git a/load/testdata/manifests/keysight/ixiatg-configmap.yaml b/load/testdata/manifests/keysight/ixiatg-configmap.yaml index d66becc56..48b03c804 100644 --- a/load/testdata/manifests/keysight/ixiatg-configmap.yaml +++ b/load/testdata/manifests/keysight/ixiatg-configmap.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: ConfigMap metadata: diff --git a/load/testdata/manifests/keysight/ixiatg-operator.yaml b/load/testdata/manifests/keysight/ixiatg-operator.yaml index 004e58503..94537d4e6 100644 --- a/load/testdata/manifests/keysight/ixiatg-operator.yaml +++ b/load/testdata/manifests/keysight/ixiatg-operator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,104 +22,104 @@ spec: singular: ixiatg scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: IxiaTG is the Schema for the ixiatg API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: IxiaTGSpec defines the desired state of IxiaTG - properties: - api_endpoint_map: - additionalProperties: - description: IxiaTGSvcPort defines the endpoint services for configuration and stats for the OTG node - properties: - in: - format: int32 - type: integer - out: - format: int32 - type: integer - required: - - in + - name: v1beta1 + schema: + openAPIV3Schema: + description: IxiaTG is the Schema for the ixiatg API + properties: + apiVersion: + description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: IxiaTGSpec defines the desired state of IxiaTG + properties: + api_endpoint_map: + additionalProperties: + description: IxiaTGSvcPort defines the endpoint services for configuration and stats for the OTG node + properties: + in: + format: int32 + type: integer + out: + format: int32 + type: integer + required: + - in + type: object + description: ApiEndPoint as define in OTG config type: object - description: ApiEndPoint as define in OTG config - type: object - desired_state: - description: Desired state by network emulation (KNE) - type: string - init_container: - description: Init container image of the node - properties: - image: - type: string - sleep: - format: int32 - type: integer - type: object - interfaces: - description: Interfaces with DUT - items: - description: IxiaTGSvcPort defines the endpoint ports for network traffic for the OTG node + desired_state: + description: Desired state by network emulation (KNE) + type: string + init_container: + description: Init container image of the node properties: - group: - type: string - name: + image: type: string - required: - - name + sleep: + format: int32 + type: integer type: object - type: array - release: - description: Version of the node - type: string - type: object - status: - description: IxiaTGStatus defines the observed state of IxiaTG - properties: - api_endpoint: - description: List of OTG service names - properties: - pod_name: - type: string - service_names: - items: - type: string - type: array - type: object - interfaces: - description: List of OTG port and pod mapping - items: - description: IxiaTGIntfStatus defines the mapping between endpoint ports and encasing pods + interfaces: + description: Interfaces with DUT + items: + description: IxiaTGSvcPort defines the endpoint ports for network traffic for the OTG node + properties: + group: + type: string + name: + type: string + required: + - name + type: object + type: array + release: + description: Version of the node + type: string + type: object + status: + description: IxiaTGStatus defines the observed state of IxiaTG + properties: + api_endpoint: + description: List of OTG service names properties: - interface: - type: string - name: - type: string pod_name: type: string + service_names: + items: + type: string + type: array type: object - type: array - reason: - description: Reason in case of failure - type: string - state: - description: Observed state - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + interfaces: + description: List of OTG port and pod mapping + items: + description: IxiaTGIntfStatus defines the mapping between endpoint ports and encasing pods + properties: + interface: + type: string + name: + type: string + pod_name: + type: string + type: object + type: array + reason: + description: Reason in case of failure + type: string + state: + description: Observed state + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -138,37 +139,37 @@ metadata: name: ixiatg-op-leader-election-role namespace: ixiatg-op-system rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -176,108 +177,108 @@ metadata: creationTimestamp: null name: ixiatg-op-manager-role rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - network.keysight.com - resources: - - ixiatgs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - network.keysight.com - resources: - - ixiatgs/finalizers - verbs: - - update -- apiGroups: - - network.keysight.com - resources: - - ixiatgs/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - network.keysight.com + resources: + - ixiatgs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - network.keysight.com + resources: + - ixiatgs/finalizers + verbs: + - update + - apiGroups: + - network.keysight.com + resources: + - ixiatgs/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ixiatg-op-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ixiatg-op-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -289,9 +290,9 @@ roleRef: kind: Role name: ixiatg-op-leader-election-role subjects: -- kind: ServiceAccount - name: ixiatg-op-controller-manager - namespace: ixiatg-op-system + - kind: ServiceAccount + name: ixiatg-op-controller-manager + namespace: ixiatg-op-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -302,9 +303,9 @@ roleRef: kind: ClusterRole name: ixiatg-op-manager-role subjects: -- kind: ServiceAccount - name: ixiatg-op-controller-manager - namespace: ixiatg-op-system + - kind: ServiceAccount + name: ixiatg-op-controller-manager + namespace: ixiatg-op-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -315,9 +316,9 @@ roleRef: kind: ClusterRole name: ixiatg-op-proxy-role subjects: -- kind: ServiceAccount - name: ixiatg-op-controller-manager - namespace: ixiatg-op-system + - kind: ServiceAccount + name: ixiatg-op-controller-manager + namespace: ixiatg-op-system --- apiVersion: v1 data: @@ -347,9 +348,9 @@ metadata: namespace: ixiatg-op-system spec: ports: - - name: https - port: 8443 - targetPort: https + - name: https + port: 8443 + targetPort: https selector: control-plane: controller-manager --- @@ -371,47 +372,47 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=10 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.8.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: ghcr.io/open-traffic-generator/keng-operator:0.3.13 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 100m - memory: 200Mi - requests: - cpu: 100m - memory: 20Mi - securityContext: - allowPrivilegeEscalation: false + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=10 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.8.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: ghcr.io/open-traffic-generator/keng-operator:0.3.13 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 100m + memory: 200Mi + requests: + cpu: 100m + memory: 20Mi + securityContext: + allowPrivilegeEscalation: false imagePullSecrets: - - name: ixia-pull-secret + - name: ixia-pull-secret securityContext: runAsNonRoot: true serviceAccountName: ixiatg-op-controller-manager diff --git a/load/testdata/manifests/kind/kind-bridge.yaml b/load/testdata/manifests/kind/kind-bridge.yaml index 83d9c92f9..2b9b7246a 100644 --- a/load/testdata/manifests/kind/kind-bridge.yaml +++ b/load/testdata/manifests/kind/kind-bridge.yaml @@ -13,7 +13,7 @@ rules: - watch - patch - apiGroups: - - "" + - "" resources: - configmaps verbs: @@ -28,9 +28,9 @@ roleRef: kind: ClusterRole name: kindnet subjects: -- kind: ServiceAccount - name: kindnet - namespace: kube-system + - kind: ServiceAccount + name: kindnet + namespace: kube-system --- apiVersion: v1 kind: ServiceAccount @@ -60,66 +60,71 @@ spec: spec: hostNetwork: true tolerations: - - operator: Exists - effect: NoSchedule + - operator: Exists + effect: NoSchedule serviceAccountName: kindnet initContainers: - - name: install-cni-bin - image: ghcr.io/aojea/kindnetd:v1.1.0 - command: ['sh', '-c', 'cd /opt/cni/bin; for i in * ; do cat $i > /cni/$i ; chmod +x /cni/$i ; done'] - volumeMounts: - - name: cni-bin - mountPath: /cni + - name: install-cni-bin + image: ghcr.io/aojea/kindnetd:v1.1.0 + command: + [ + "sh", + "-c", + "cd /opt/cni/bin; for i in * ; do cat $i > /cni/$i ; chmod +x /cni/$i ; done", + ] + volumeMounts: + - name: cni-bin + mountPath: /cni containers: - - name: kindnet-cni - image: ghcr.io/aojea/kindnetd:v1.1.0 - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: CNI_BRIDGE - value: "true" - - name: DISABLE_CNI_BRIDGE_OFFLOAD - value: "true" - volumeMounts: + - name: kindnet-cni + image: ghcr.io/aojea/kindnetd:v1.1.0 + env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: CNI_BRIDGE + value: "true" + - name: DISABLE_CNI_BRIDGE_OFFLOAD + value: "true" + volumeMounts: + - name: cni-cfg + mountPath: /etc/cni/net.d + - name: xtables-lock + mountPath: /run/xtables.lock + readOnly: false + - name: lib-modules + mountPath: /lib/modules + readOnly: true + resources: + requests: + cpu: "100m" + memory: "50Mi" + limits: + cpu: "100m" + memory: "50Mi" + securityContext: + privileged: false + capabilities: + add: ["NET_RAW", "NET_ADMIN"] + volumes: + - name: cni-bin + hostPath: + path: /opt/cni/bin + type: DirectoryOrCreate - name: cni-cfg - mountPath: /etc/cni/net.d + hostPath: + path: /etc/cni/net.d + type: DirectoryOrCreate - name: xtables-lock - mountPath: /run/xtables.lock - readOnly: false + hostPath: + path: /run/xtables.lock + type: FileOrCreate - name: lib-modules - mountPath: /lib/modules - readOnly: true - resources: - requests: - cpu: "100m" - memory: "50Mi" - limits: - cpu: "100m" - memory: "50Mi" - securityContext: - privileged: false - capabilities: - add: ["NET_RAW", "NET_ADMIN"] - volumes: - - name: cni-bin - hostPath: - path: /opt/cni/bin - type: DirectoryOrCreate - - name: cni-cfg - hostPath: - path: /etc/cni/net.d - type: DirectoryOrCreate - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - - name: lib-modules - hostPath: - path: /lib/modules + hostPath: + path: /lib/modules --- diff --git a/load/testdata/manifests/meshnet/grpc/manifest.yaml b/load/testdata/manifests/meshnet/grpc/manifest.yaml index c3a3e3f33..b2b75db48 100644 --- a/load/testdata/manifests/meshnet/grpc/manifest.yaml +++ b/load/testdata/manifests/meshnet/grpc/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -17,66 +18,66 @@ spec: kind: Topology plural: topologies shortNames: - - topo + - topo singular: topology scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - properties: - links: - items: - description: A complete definition of a p2p link - properties: - local_intf: - description: Local interface name - type: string - local_ip: - description: (Optional) Local IP address - type: string - peer_intf: - description: Peer interface name - type: string - peer_ip: - description: (Optional) Peer IP address - type: string - peer_pod: - description: Name of the peer pod - type: string - uid: - description: Unique identified of a p2p link - type: integer - required: - - uid - - peer_pod - - local_intf - - peer_intf - type: object - type: array - type: object - status: - properties: - net_ns: - description: Network namespace of the POD - type: string - skipped: - description: List of pods that are skipped by local pod - items: - description: peer pod name + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + links: + items: + description: A complete definition of a p2p link + properties: + local_intf: + description: Local interface name + type: string + local_ip: + description: (Optional) Local IP address + type: string + peer_intf: + description: Peer interface name + type: string + peer_ip: + description: (Optional) Peer IP address + type: string + peer_pod: + description: Name of the peer pod + type: string + uid: + description: Unique identified of a p2p link + type: integer + required: + - uid + - peer_pod + - local_intf + - peer_intf + type: object + type: array + type: object + status: + properties: + net_ns: + description: Network namespace of the POD + type: string + skipped: + description: List of pods that are skipped by local pod + items: + description: peer pod name + type: string + type: array + src_ip: + description: Source IP of the POD type: string - type: array - src_ip: - description: Source IP of the POD - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -99,18 +100,18 @@ metadata: app: meshnet name: meshnet-clusterrole rules: -- apiGroups: - - networkop.co.uk - resources: - - topologies - verbs: - - '*' -- apiGroups: - - networkop.co.uk - resources: - - topologies/status - verbs: - - '*' + - apiGroups: + - networkop.co.uk + resources: + - topologies + verbs: + - "*" + - apiGroups: + - networkop.co.uk + resources: + - topologies/status + verbs: + - "*" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -123,9 +124,9 @@ roleRef: kind: ClusterRole name: meshnet-clusterrole subjects: -- kind: ServiceAccount - name: meshnet - namespace: meshnet + - kind: ServiceAccount + name: meshnet + namespace: meshnet --- apiVersion: apps/v1 kind: DaemonSet @@ -147,32 +148,32 @@ spec: name: meshnet spec: containers: - - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: INTER_NODE_LINK_TYPE - value: GRPC - image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.1 - imagePullPolicy: IfNotPresent - name: meshnet - resources: - limits: - memory: 1000Mi - requests: - cpu: 100m - memory: 1000Mi - securityContext: - privileged: true - volumeMounts: - - mountPath: /etc/cni/net.d - name: cni-cfg - - mountPath: /opt/cni/bin - name: cni-bin - - mountPath: /var/run/netns - mountPropagation: Bidirectional - name: var-run-netns + - env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: INTER_NODE_LINK_TYPE + value: GRPC + image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.1 + imagePullPolicy: IfNotPresent + name: meshnet + resources: + limits: + memory: 1000Mi + requests: + cpu: 100m + memory: 1000Mi + securityContext: + privileged: true + volumeMounts: + - mountPath: /etc/cni/net.d + name: cni-cfg + - mountPath: /opt/cni/bin + name: cni-bin + - mountPath: /var/run/netns + mountPropagation: Bidirectional + name: var-run-netns hostIPC: true hostNetwork: true hostPID: true @@ -181,15 +182,15 @@ spec: serviceAccountName: meshnet terminationGracePeriodSeconds: 30 tolerations: - - effect: NoSchedule - operator: Exists + - effect: NoSchedule + operator: Exists volumes: - - hostPath: - path: /opt/cni/bin - name: cni-bin - - hostPath: - path: /etc/cni/net.d - name: cni-cfg - - hostPath: - path: /var/run/netns - name: var-run-netns + - hostPath: + path: /opt/cni/bin + name: cni-bin + - hostPath: + path: /etc/cni/net.d + name: cni-cfg + - hostPath: + path: /var/run/netns + name: var-run-netns diff --git a/load/testdata/manifests/meshnet/vxlan/manifest.yaml b/load/testdata/manifests/meshnet/vxlan/manifest.yaml index 47ae67f1c..5c05eb71c 100644 --- a/load/testdata/manifests/meshnet/vxlan/manifest.yaml +++ b/load/testdata/manifests/meshnet/vxlan/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -17,66 +18,66 @@ spec: kind: Topology plural: topologies shortNames: - - topo + - topo singular: topology scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - properties: - links: - items: - description: A complete definition of a p2p link - properties: - local_intf: - description: Local interface name - type: string - local_ip: - description: (Optional) Local IP address - type: string - peer_intf: - description: Peer interface name - type: string - peer_ip: - description: (Optional) Peer IP address - type: string - peer_pod: - description: Name of the peer pod - type: string - uid: - description: Unique identified of a p2p link - type: integer - required: - - uid - - peer_pod - - local_intf - - peer_intf - type: object - type: array - type: object - status: - properties: - net_ns: - description: Network namespace of the POD - type: string - skipped: - description: List of pods that are skipped by local pod - items: - description: peer pod name + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + links: + items: + description: A complete definition of a p2p link + properties: + local_intf: + description: Local interface name + type: string + local_ip: + description: (Optional) Local IP address + type: string + peer_intf: + description: Peer interface name + type: string + peer_ip: + description: (Optional) Peer IP address + type: string + peer_pod: + description: Name of the peer pod + type: string + uid: + description: Unique identified of a p2p link + type: integer + required: + - uid + - peer_pod + - local_intf + - peer_intf + type: object + type: array + type: object + status: + properties: + net_ns: + description: Network namespace of the POD + type: string + skipped: + description: List of pods that are skipped by local pod + items: + description: peer pod name + type: string + type: array + src_ip: + description: Source IP of the POD type: string - type: array - src_ip: - description: Source IP of the POD - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -99,18 +100,18 @@ metadata: app: meshnet name: meshnet-clusterrole rules: -- apiGroups: - - networkop.co.uk - resources: - - topologies - verbs: - - '*' -- apiGroups: - - networkop.co.uk - resources: - - topologies/status - verbs: - - '*' + - apiGroups: + - networkop.co.uk + resources: + - topologies + verbs: + - "*" + - apiGroups: + - networkop.co.uk + resources: + - topologies/status + verbs: + - "*" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -123,9 +124,9 @@ roleRef: kind: ClusterRole name: meshnet-clusterrole subjects: -- kind: ServiceAccount - name: meshnet - namespace: meshnet + - kind: ServiceAccount + name: meshnet + namespace: meshnet --- apiVersion: apps/v1 kind: DaemonSet @@ -147,32 +148,32 @@ spec: name: meshnet spec: containers: - - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: INTER_NODE_LINK_TYPE - value: VXLAN - image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.1 - imagePullPolicy: IfNotPresent - name: meshnet - resources: - limits: - memory: 200Mi - requests: - cpu: 100m - memory: 200Mi - securityContext: - privileged: true - volumeMounts: - - mountPath: /etc/cni/net.d - name: cni-cfg - - mountPath: /opt/cni/bin - name: cni-bin - - mountPath: /var/run/netns - mountPropagation: Bidirectional - name: var-run-netns + - env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: INTER_NODE_LINK_TYPE + value: VXLAN + image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.1 + imagePullPolicy: IfNotPresent + name: meshnet + resources: + limits: + memory: 200Mi + requests: + cpu: 100m + memory: 200Mi + securityContext: + privileged: true + volumeMounts: + - mountPath: /etc/cni/net.d + name: cni-cfg + - mountPath: /opt/cni/bin + name: cni-bin + - mountPath: /var/run/netns + mountPropagation: Bidirectional + name: var-run-netns hostIPC: true hostNetwork: true hostPID: true @@ -181,15 +182,15 @@ spec: serviceAccountName: meshnet terminationGracePeriodSeconds: 30 tolerations: - - effect: NoSchedule - operator: Exists + - effect: NoSchedule + operator: Exists volumes: - - hostPath: - path: /opt/cni/bin - name: cni-bin - - hostPath: - path: /etc/cni/net.d - name: cni-cfg - - hostPath: - path: /var/run/netns - name: var-run-netns + - hostPath: + path: /opt/cni/bin + name: cni-bin + - hostPath: + path: /etc/cni/net.d + name: cni-cfg + - hostPath: + path: /var/run/netns + name: var-run-netns diff --git a/load/testdata/manifests/metallb/manifest.yaml b/load/testdata/manifests/metallb/manifest.yaml index 0f41d0c11..138a9526d 100644 --- a/load/testdata/manifests/metallb/manifest.yaml +++ b/load/testdata/manifests/metallb/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -24,8 +25,8 @@ spec: namespace: metallb-system path: /convert conversionReviewVersions: - - v1alpha1 - - v1beta1 + - v1alpha1 + - v1beta1 group: metallb.io names: kind: AddressPool @@ -34,184 +35,205 @@ spec: singular: addresspool scope: Namespaced versions: - - deprecated: true - deprecationWarning: metallb.io v1alpha1 AddressPool is deprecated - name: v1alpha1 - schema: - openAPIV3Schema: - description: AddressPool is the Schema for the addresspools API. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: AddressPoolSpec defines the desired state of AddressPool. - properties: - addresses: - description: A list of IP address ranges over which MetalLB has authority. - You can list multiple ranges in a single pool, they will all share - the same settings. Each range can be either a CIDR prefix, or an - explicit start-end range of IPs. - items: + - deprecated: true + deprecationWarning: metallb.io v1alpha1 AddressPool is deprecated + name: v1alpha1 + schema: + openAPIV3Schema: + description: AddressPool is the Schema for the addresspools API. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: AddressPoolSpec defines the desired state of AddressPool. + properties: + addresses: + description: + A list of IP address ranges over which MetalLB has authority. + You can list multiple ranges in a single pool, they will all share + the same settings. Each range can be either a CIDR prefix, or an + explicit start-end range of IPs. + items: + type: string + type: array + autoAssign: + default: true + description: + AutoAssign flag used to prevent MetallB from automatic + allocation for a pool. + type: boolean + bgpAdvertisements: + description: + When an IP is allocated from this pool, how should it + be translated into BGP announcements? + items: + properties: + aggregationLength: + default: 32 + description: + The aggregation-length advertisement option lets + you “roll up” the /32s into a larger prefix. + format: int32 + minimum: 1 + type: integer + aggregationLengthV6: + default: 128 + description: + Optional, defaults to 128 (i.e. no aggregation) + if not specified. + format: int32 + type: integer + communities: + description: BGP communities + items: + type: string + type: array + localPref: + description: + BGP LOCAL_PREF attribute which is used by BGP best + path algorithm, Path with higher localpref is preferred over + one with lower localpref. + format: int32 + type: integer + type: object + type: array + protocol: + description: + Protocol can be used to select how the announcement is + done. + enum: + - layer2 + - bgp type: string - type: array - autoAssign: - default: true - description: AutoAssign flag used to prevent MetallB from automatic - allocation for a pool. - type: boolean - bgpAdvertisements: - description: When an IP is allocated from this pool, how should it - be translated into BGP announcements? - items: - properties: - aggregationLength: - default: 32 - description: The aggregation-length advertisement option lets - you “roll up” the /32s into a larger prefix. - format: int32 - minimum: 1 - type: integer - aggregationLengthV6: - default: 128 - description: Optional, defaults to 128 (i.e. no aggregation) - if not specified. - format: int32 - type: integer - communities: - description: BGP communities - items: - type: string - type: array - localPref: - description: BGP LOCAL_PREF attribute which is used by BGP best - path algorithm, Path with higher localpref is preferred over - one with lower localpref. - format: int32 - type: integer - type: object - type: array - protocol: - description: Protocol can be used to select how the announcement is - done. - enum: - - layer2 - - bgp - type: string - required: - - addresses - - protocol - type: object - status: - description: AddressPoolStatus defines the observed state of AddressPool. - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - deprecated: true - deprecationWarning: metallb.io v1beta1 AddressPool is deprecated, consider using - IPAddressPool - name: v1beta1 - schema: - openAPIV3Schema: - description: AddressPool represents a pool of IP addresses that can be allocated - to LoadBalancer services. AddressPool is deprecated and being replaced by - IPAddressPool. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: AddressPoolSpec defines the desired state of AddressPool. - properties: - addresses: - description: A list of IP address ranges over which MetalLB has authority. - You can list multiple ranges in a single pool, they will all share - the same settings. Each range can be either a CIDR prefix, or an - explicit start-end range of IPs. - items: + required: + - addresses + - protocol + type: object + status: + description: AddressPoolStatus defines the observed state of AddressPool. + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - deprecated: true + deprecationWarning: + metallb.io v1beta1 AddressPool is deprecated, consider using + IPAddressPool + name: v1beta1 + schema: + openAPIV3Schema: + description: + AddressPool represents a pool of IP addresses that can be allocated + to LoadBalancer services. AddressPool is deprecated and being replaced by + IPAddressPool. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: AddressPoolSpec defines the desired state of AddressPool. + properties: + addresses: + description: + A list of IP address ranges over which MetalLB has authority. + You can list multiple ranges in a single pool, they will all share + the same settings. Each range can be either a CIDR prefix, or an + explicit start-end range of IPs. + items: + type: string + type: array + autoAssign: + default: true + description: + AutoAssign flag used to prevent MetallB from automatic + allocation for a pool. + type: boolean + bgpAdvertisements: + description: + Drives how an IP allocated from this pool should translated + into BGP announcements. + items: + properties: + aggregationLength: + default: 32 + description: + The aggregation-length advertisement option lets + you “roll up” the /32s into a larger prefix. + format: int32 + minimum: 1 + type: integer + aggregationLengthV6: + default: 128 + description: + Optional, defaults to 128 (i.e. no aggregation) + if not specified. + format: int32 + type: integer + communities: + description: + BGP communities to be associated with the given + advertisement. + items: + type: string + type: array + localPref: + description: + BGP LOCAL_PREF attribute which is used by BGP best + path algorithm, Path with higher localpref is preferred over + one with lower localpref. + format: int32 + type: integer + type: object + type: array + protocol: + description: + Protocol can be used to select how the announcement is + done. + enum: + - layer2 + - bgp type: string - type: array - autoAssign: - default: true - description: AutoAssign flag used to prevent MetallB from automatic - allocation for a pool. - type: boolean - bgpAdvertisements: - description: Drives how an IP allocated from this pool should translated - into BGP announcements. - items: - properties: - aggregationLength: - default: 32 - description: The aggregation-length advertisement option lets - you “roll up” the /32s into a larger prefix. - format: int32 - minimum: 1 - type: integer - aggregationLengthV6: - default: 128 - description: Optional, defaults to 128 (i.e. no aggregation) - if not specified. - format: int32 - type: integer - communities: - description: BGP communities to be associated with the given - advertisement. - items: - type: string - type: array - localPref: - description: BGP LOCAL_PREF attribute which is used by BGP best - path algorithm, Path with higher localpref is preferred over - one with lower localpref. - format: int32 - type: integer - type: object - type: array - protocol: - description: Protocol can be used to select how the announcement is - done. - enum: - - layer2 - - bgp - type: string - required: - - addresses - - protocol - type: object - status: - description: AddressPoolStatus defines the observed state of AddressPool. - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} + required: + - addresses + - protocol + type: object + status: + description: AddressPoolStatus defines the observed state of AddressPool. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -235,83 +257,93 @@ spec: singular: bfdprofile scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: BFDProfile represents the settings of the bfd session that can - be optionally associated with a BGP session. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: BFDProfileSpec defines the desired state of BFDProfile. - properties: - detectMultiplier: - description: Configures the detection multiplier to determine packet - loss. The remote transmission interval will be multiplied by this - value to determine the connection loss detection timer. - format: int32 - maximum: 255 - minimum: 2 - type: integer - echoInterval: - description: Configures the minimal echo receive transmission interval - that this system is capable of handling in milliseconds. Defaults - to 50ms - format: int32 - maximum: 60000 - minimum: 10 - type: integer - echoMode: - description: Enables or disables the echo transmission mode. This - mode is disabled by default, and not supported on multi hops setups. - type: boolean - minimumTtl: - description: 'For multi hop sessions only: configure the minimum expected - TTL for an incoming BFD control packet.' - format: int32 - maximum: 254 - minimum: 1 - type: integer - passiveMode: - description: 'Mark session as passive: a passive session will not - attempt to start the connection and will wait for control packets - from peer before it begins replying.' - type: boolean - receiveInterval: - description: The minimum interval that this system is capable of receiving - control packets in milliseconds. Defaults to 300ms. - format: int32 - maximum: 60000 - minimum: 10 - type: integer - transmitInterval: - description: The minimum transmission interval (less jitter) that - this system wants to use to send BFD control packets in milliseconds. - Defaults to 300ms - format: int32 - maximum: 60000 - minimum: 10 - type: integer - type: object - status: - description: BFDProfileStatus defines the observed state of BFDProfile. - type: object - type: object - served: true - storage: true - subresources: - status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: + BFDProfile represents the settings of the bfd session that can + be optionally associated with a BGP session. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: BFDProfileSpec defines the desired state of BFDProfile. + properties: + detectMultiplier: + description: + Configures the detection multiplier to determine packet + loss. The remote transmission interval will be multiplied by this + value to determine the connection loss detection timer. + format: int32 + maximum: 255 + minimum: 2 + type: integer + echoInterval: + description: + Configures the minimal echo receive transmission interval + that this system is capable of handling in milliseconds. Defaults + to 50ms + format: int32 + maximum: 60000 + minimum: 10 + type: integer + echoMode: + description: + Enables or disables the echo transmission mode. This + mode is disabled by default, and not supported on multi hops setups. + type: boolean + minimumTtl: + description: + "For multi hop sessions only: configure the minimum expected + TTL for an incoming BFD control packet." + format: int32 + maximum: 254 + minimum: 1 + type: integer + passiveMode: + description: + "Mark session as passive: a passive session will not + attempt to start the connection and will wait for control packets + from peer before it begins replying." + type: boolean + receiveInterval: + description: + The minimum interval that this system is capable of receiving + control packets in milliseconds. Defaults to 300ms. + format: int32 + maximum: 60000 + minimum: 10 + type: integer + transmitInterval: + description: + The minimum transmission interval (less jitter) that + this system wants to use to send BFD control packets in milliseconds. + Defaults to 300ms + format: int32 + maximum: 60000 + minimum: 10 + type: integer + type: object + status: + description: BFDProfileStatus defines the observed state of BFDProfile. + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -335,181 +367,206 @@ spec: singular: bgpadvertisement scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: BGPAdvertisement allows to advertise the IPs coming from the - selected IPAddressPools via BGP, setting the parameters of the BGP Advertisement. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: BGPAdvertisementSpec defines the desired state of BGPAdvertisement. - properties: - aggregationLength: - default: 32 - description: The aggregation-length advertisement option lets you - “roll up” the /32s into a larger prefix. Defaults to 32. Works for - IPv4 addresses. - format: int32 - minimum: 1 - type: integer - aggregationLengthV6: - default: 128 - description: The aggregation-length advertisement option lets you - “roll up” the /128s into a larger prefix. Defaults to 128. Works - for IPv6 addresses. - format: int32 - type: integer - communities: - description: The BGP communities to be associated with the announcement. - Each item can be a community of the form 1234:1234 or the name of - an alias defined in the Community CRD. - items: - type: string - type: array - ipAddressPoolSelectors: - description: A selector for the IPAddressPools which would get advertised - via this advertisement. If no IPAddressPool is selected by this - or by the list, the advertisement is applied to all the IPAddressPools. - items: - description: A label selector is a label query over a set of resources. - The result of matchLabels and matchExpressions are ANDed. An empty - label selector matches all objects. A null label selector matches - no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the - key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a - strategic merge patch. - items: + - name: v1beta1 + schema: + openAPIV3Schema: + description: + BGPAdvertisement allows to advertise the IPs coming from the + selected IPAddressPools via BGP, setting the parameters of the BGP Advertisement. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: BGPAdvertisementSpec defines the desired state of BGPAdvertisement. + properties: + aggregationLength: + default: 32 + description: + The aggregation-length advertisement option lets you + “roll up” the /32s into a larger prefix. Defaults to 32. Works for + IPv4 addresses. + format: int32 + minimum: 1 + type: integer + aggregationLengthV6: + default: 128 + description: + The aggregation-length advertisement option lets you + “roll up” the /128s into a larger prefix. Defaults to 128. Works + for IPv6 addresses. + format: int32 + type: integer + communities: + description: + The BGP communities to be associated with the announcement. + Each item can be a community of the form 1234:1234 or the name of + an alias defined in the Community CRD. + items: + type: string + type: array + ipAddressPoolSelectors: + description: + A selector for the IPAddressPools which would get advertised + via this advertisement. If no IPAddressPool is selected by this + or by the list, the advertisement is applied to all the IPAddressPools. + items: + description: + A label selector is a label query over a set of resources. + The result of matchLabels and matchExpressions are ANDed. An empty + label selector matches all objects. A null label selector matches + no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: + A label selector requirement is a selector that + contains values, a key, and an operator that relates the + key and values. + properties: + key: + description: + key is the label key that the selector applies + to. + type: string + operator: + description: + operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. type: string - type: array - required: - - key - - operator + values: + description: + values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: + matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object - type: object - type: array - ipAddressPools: - description: The list of IPAddressPools to advertise via this advertisement, - selected by name. - items: - type: string - type: array - localPref: - description: The BGP LOCAL_PREF attribute which is used by BGP best - path algorithm, Path with higher localpref is preferred over one - with lower localpref. - format: int32 - type: integer - nodeSelectors: - description: NodeSelectors allows to limit the nodes to announce as - next hops for the LoadBalancer IP. When empty, all the nodes having are - announced as next hops. - items: - description: A label selector is a label query over a set of resources. - The result of matchLabels and matchExpressions are ANDed. An empty - label selector matches all objects. A null label selector matches - no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the - key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a - strategic merge patch. - items: + type: object + type: array + ipAddressPools: + description: + The list of IPAddressPools to advertise via this advertisement, + selected by name. + items: + type: string + type: array + localPref: + description: + The BGP LOCAL_PREF attribute which is used by BGP best + path algorithm, Path with higher localpref is preferred over one + with lower localpref. + format: int32 + type: integer + nodeSelectors: + description: + NodeSelectors allows to limit the nodes to announce as + next hops for the LoadBalancer IP. When empty, all the nodes having are + announced as next hops. + items: + description: + A label selector is a label query over a set of resources. + The result of matchLabels and matchExpressions are ANDed. An empty + label selector matches all objects. A null label selector matches + no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: + A label selector requirement is a selector that + contains values, a key, and an operator that relates the + key and values. + properties: + key: + description: + key is the label key that the selector applies + to. + type: string + operator: + description: + operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. type: string - type: array - required: - - key - - operator + values: + description: + values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: + matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object - type: object - type: array - peers: - description: Peers limits the bgppeer to advertise the ips of the - selected pools to. When empty, the loadbalancer IP is announced - to all the BGPPeers configured. - items: - type: string - type: array - type: object - status: - description: BGPAdvertisementStatus defines the observed state of BGPAdvertisement. - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: array + peers: + description: + Peers limits the bgppeer to advertise the ips of the + selected pools to. When empty, the loadbalancer IP is announced + to all the BGPPeers configured. + items: + type: string + type: array + type: object + status: + description: BGPAdvertisementStatus defines the observed state of BGPAdvertisement. + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -534,8 +591,8 @@ spec: namespace: metallb-system path: /convert conversionReviewVersions: - - v1beta1 - - v1beta2 + - v1beta1 + - v1beta2 group: metallb.io names: kind: BGPPeer @@ -544,254 +601,274 @@ spec: singular: bgppeer scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: BGPPeer is the Schema for the peers API. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: BGPPeerSpec defines the desired state of Peer. - properties: - bfdProfile: - type: string - ebgpMultiHop: - description: EBGP peer is multi-hops away - type: boolean - holdTime: - description: Requested BGP hold time, per RFC4271. - type: string - keepaliveTime: - description: Requested BGP keepalive time, per RFC4271. - type: string - myASN: - description: AS number to use for the local end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - nodeSelectors: - description: Only connect to this peer on nodes that match one of - these selectors. - items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: + - name: v1beta1 + schema: + openAPIV3Schema: + description: BGPPeer is the Schema for the peers API. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: BGPPeerSpec defines the desired state of Peer. + properties: + bfdProfile: + type: string + ebgpMultiHop: + description: EBGP peer is multi-hops away + type: boolean + holdTime: + description: Requested BGP hold time, per RFC4271. + type: string + keepaliveTime: + description: Requested BGP keepalive time, per RFC4271. + type: string + myASN: + description: AS number to use for the local end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + nodeSelectors: + description: + Only connect to this peer on nodes that match one of + these selectors. + items: + properties: + matchExpressions: + items: + properties: + key: type: string - minItems: 1 - type: array - required: - - key - - operator - - values + operator: + type: string + values: + items: + type: string + minItems: 1 + type: array + required: + - key + - operator + - values + type: object + type: array + matchLabels: + additionalProperties: + type: string type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - type: array - password: - description: Authentication password for routers enforcing TCP MD5 - authenticated sessions - type: string - peerASN: - description: AS number to expect from the remote end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - peerAddress: - description: Address to dial when establishing the session. - type: string - peerPort: - description: Port to dial when establishing the session. - maximum: 16384 - minimum: 0 - type: integer - routerID: - description: BGP router ID to advertise to the peer - type: string - sourceAddress: - description: Source address to use when establishing the session. - type: string - required: - - myASN - - peerASN - - peerAddress - type: object - status: - description: BGPPeerStatus defines the observed state of Peer. - type: object - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta2 - schema: - openAPIV3Schema: - description: BGPPeer is the Schema for the peers API. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: BGPPeerSpec defines the desired state of Peer. - properties: - bfdProfile: - description: The name of the BFD Profile to be used for the BFD session - associated to the BGP session. If not set, the BFD session won't - be set up. - type: string - ebgpMultiHop: - description: To set if the BGPPeer is multi-hops away. Needed for - FRR mode only. - type: boolean - holdTime: - description: Requested BGP hold time, per RFC4271. - type: string - keepaliveTime: - description: Requested BGP keepalive time, per RFC4271. - type: string - myASN: - description: AS number to use for the local end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - nodeSelectors: - description: Only connect to this peer on nodes that match one of - these selectors. - items: - description: A label selector is a label query over a set of resources. - The result of matchLabels and matchExpressions are ANDed. An empty - label selector matches all objects. A null label selector matches - no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the - key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a - strategic merge patch. - items: + type: object + type: array + password: + description: + Authentication password for routers enforcing TCP MD5 + authenticated sessions + type: string + peerASN: + description: AS number to expect from the remote end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + peerAddress: + description: Address to dial when establishing the session. + type: string + peerPort: + description: Port to dial when establishing the session. + maximum: 16384 + minimum: 0 + type: integer + routerID: + description: BGP router ID to advertise to the peer + type: string + sourceAddress: + description: Source address to use when establishing the session. + type: string + required: + - myASN + - peerASN + - peerAddress + type: object + status: + description: BGPPeerStatus defines the observed state of Peer. + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta2 + schema: + openAPIV3Schema: + description: BGPPeer is the Schema for the peers API. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: BGPPeerSpec defines the desired state of Peer. + properties: + bfdProfile: + description: + The name of the BFD Profile to be used for the BFD session + associated to the BGP session. If not set, the BFD session won't + be set up. + type: string + ebgpMultiHop: + description: + To set if the BGPPeer is multi-hops away. Needed for + FRR mode only. + type: boolean + holdTime: + description: Requested BGP hold time, per RFC4271. + type: string + keepaliveTime: + description: Requested BGP keepalive time, per RFC4271. + type: string + myASN: + description: AS number to use for the local end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + nodeSelectors: + description: + Only connect to this peer on nodes that match one of + these selectors. + items: + description: + A label selector is a label query over a set of resources. + The result of matchLabels and matchExpressions are ANDed. An empty + label selector matches all objects. A null label selector matches + no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: + A label selector requirement is a selector that + contains values, a key, and an operator that relates the + key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - required: - - key - - operator + operator: + description: + operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: + values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: + matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object + type: object + type: array + password: + description: + Authentication password for routers enforcing TCP MD5 + authenticated sessions + type: string + passwordSecret: + description: + passwordSecret is name of the authentication secret for + BGP Peer. the secret must be of type "kubernetes.io/basic-auth", + and created in the same namespace as the MetalLB deployment. The + password is stored in the secret as the key "password". + properties: + name: + description: + name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: + namespace defines the space within which the secret + name must be unique. + type: string type: object - type: array - password: - description: Authentication password for routers enforcing TCP MD5 - authenticated sessions - type: string - passwordSecret: - description: passwordSecret is name of the authentication secret for - BGP Peer. the secret must be of type "kubernetes.io/basic-auth", - and created in the same namespace as the MetalLB deployment. The - password is stored in the secret as the key "password". - properties: - name: - description: name is unique within a namespace to reference a - secret resource. - type: string - namespace: - description: namespace defines the space within which the secret - name must be unique. - type: string - type: object - peerASN: - description: AS number to expect from the remote end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - peerAddress: - description: Address to dial when establishing the session. - type: string - peerPort: - default: 179 - description: Port to dial when establishing the session. - maximum: 16384 - minimum: 0 - type: integer - routerID: - description: BGP router ID to advertise to the peer - type: string - sourceAddress: - description: Source address to use when establishing the session. - type: string - required: - - myASN - - peerASN - - peerAddress - type: object - status: - description: BGPPeerStatus defines the observed state of Peer. - type: object - type: object - served: true - storage: true - subresources: - status: {} + peerASN: + description: AS number to expect from the remote end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + peerAddress: + description: Address to dial when establishing the session. + type: string + peerPort: + default: 179 + description: Port to dial when establishing the session. + maximum: 16384 + minimum: 0 + type: integer + routerID: + description: BGP router ID to advertise to the peer + type: string + sourceAddress: + description: Source address to use when establishing the session. + type: string + required: + - myASN + - peerASN + - peerAddress + type: object + status: + description: BGPPeerStatus defines the observed state of Peer. + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -815,48 +892,52 @@ spec: singular: community scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: Community is a collection of aliases for communities. Users can - define named aliases to be used in the BGPPeer CRD. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: CommunitySpec defines the desired state of Community. - properties: - communities: - items: - properties: - name: - description: The name of the alias for the community. - type: string - value: - description: The BGP community value corresponding to the given - name. - type: string - type: object - type: array - type: object - status: - description: CommunityStatus defines the observed state of Community. - type: object - type: object - served: true - storage: true - subresources: - status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: + Community is a collection of aliases for communities. Users can + define named aliases to be used in the BGPPeer CRD. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: CommunitySpec defines the desired state of Community. + properties: + communities: + items: + properties: + name: + description: The name of the alias for the community. + type: string + value: + description: + The BGP community value corresponding to the given + name. + type: string + type: object + type: array + type: object + status: + description: CommunityStatus defines the observed state of Community. + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -880,58 +961,64 @@ spec: singular: ipaddresspool scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: IPAddressPool represents a pool of IP addresses that can be allocated - to LoadBalancer services. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: IPAddressPoolSpec defines the desired state of IPAddressPool. - properties: - addresses: - description: A list of IP address ranges over which MetalLB has authority. - You can list multiple ranges in a single pool, they will all share - the same settings. Each range can be either a CIDR prefix, or an - explicit start-end range of IPs. - items: - type: string - type: array - autoAssign: - default: true - description: AutoAssign flag used to prevent MetallB from automatic - allocation for a pool. - type: boolean - avoidBuggyIPs: - default: false - description: AvoidBuggyIPs prevents addresses ending with .0 and .255 - to be used by a pool. - type: boolean - required: - - addresses - type: object - status: - description: IPAddressPoolStatus defines the observed state of IPAddressPool. - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: + IPAddressPool represents a pool of IP addresses that can be allocated + to LoadBalancer services. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: IPAddressPoolSpec defines the desired state of IPAddressPool. + properties: + addresses: + description: + A list of IP address ranges over which MetalLB has authority. + You can list multiple ranges in a single pool, they will all share + the same settings. Each range can be either a CIDR prefix, or an + explicit start-end range of IPs. + items: + type: string + type: array + autoAssign: + default: true + description: + AutoAssign flag used to prevent MetallB from automatic + allocation for a pool. + type: boolean + avoidBuggyIPs: + default: false + description: + AvoidBuggyIPs prevents addresses ending with .0 and .255 + to be used by a pool. + type: boolean + required: + - addresses + type: object + status: + description: IPAddressPoolStatus defines the observed state of IPAddressPool. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -955,146 +1042,166 @@ spec: singular: l2advertisement scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: L2Advertisement allows to advertise the LoadBalancer IPs provided - by the selected pools via L2. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: L2AdvertisementSpec defines the desired state of L2Advertisement. - properties: - ipAddressPoolSelectors: - description: A selector for the IPAddressPools which would get advertised - via this advertisement. If no IPAddressPool is selected by this - or by the list, the advertisement is applied to all the IPAddressPools. - items: - description: A label selector is a label query over a set of resources. - The result of matchLabels and matchExpressions are ANDed. An empty - label selector matches all objects. A null label selector matches - no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the - key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a - strategic merge patch. - items: + - name: v1beta1 + schema: + openAPIV3Schema: + description: + L2Advertisement allows to advertise the LoadBalancer IPs provided + by the selected pools via L2. + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: L2AdvertisementSpec defines the desired state of L2Advertisement. + properties: + ipAddressPoolSelectors: + description: + A selector for the IPAddressPools which would get advertised + via this advertisement. If no IPAddressPool is selected by this + or by the list, the advertisement is applied to all the IPAddressPools. + items: + description: + A label selector is a label query over a set of resources. + The result of matchLabels and matchExpressions are ANDed. An empty + label selector matches all objects. A null label selector matches + no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: + A label selector requirement is a selector that + contains values, a key, and an operator that relates the + key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - required: - - key - - operator + operator: + description: + operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: + values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: + matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object - type: object - type: array - ipAddressPools: - description: The list of IPAddressPools to advertise via this advertisement, - selected by name. - items: - type: string - type: array - nodeSelectors: - description: NodeSelectors allows to limit the nodes to announce as - next hops for the LoadBalancer IP. When empty, all the nodes having are - announced as next hops. - items: - description: A label selector is a label query over a set of resources. - The result of matchLabels and matchExpressions are ANDed. An empty - label selector matches all objects. A null label selector matches - no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the - key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a - strategic merge patch. - items: + type: object + type: array + ipAddressPools: + description: + The list of IPAddressPools to advertise via this advertisement, + selected by name. + items: + type: string + type: array + nodeSelectors: + description: + NodeSelectors allows to limit the nodes to announce as + next hops for the LoadBalancer IP. When empty, all the nodes having are + announced as next hops. + items: + description: + A label selector is a label query over a set of resources. + The result of matchLabels and matchExpressions are ANDed. An empty + label selector matches all objects. A null label selector matches + no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: + A label selector requirement is a selector that + contains values, a key, and an operator that relates the + key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - required: - - key - - operator + operator: + description: + operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: + values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: + matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object - type: object - type: array - type: object - status: - description: L2AdvertisementStatus defines the observed state of L2Advertisement. - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: array + type: object + status: + description: L2AdvertisementStatus defines the observed state of L2Advertisement. + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -1126,89 +1233,89 @@ metadata: name: controller namespace: metallb-system rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resourceNames: - - memberlist - resources: - - secrets - verbs: - - list -- apiGroups: - - apps - resourceNames: - - controller - resources: - - deployments - verbs: - - get -- apiGroups: - - metallb.io - resources: - - bgppeers - verbs: - - get - - list -- apiGroups: - - metallb.io - resources: - - addresspools - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bfdprofiles - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - ipaddresspools - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bgpadvertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - l2advertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - communities - verbs: - - get - - list - - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - memberlist + resources: + - secrets + verbs: + - list + - apiGroups: + - apps + resourceNames: + - controller + resources: + - deployments + verbs: + - get + - apiGroups: + - metallb.io + resources: + - bgppeers + verbs: + - get + - list + - apiGroups: + - metallb.io + resources: + - addresspools + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bfdprofiles + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - ipaddresspools + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bgpadvertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - l2advertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - communities + verbs: + - get + - list + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -1218,76 +1325,76 @@ metadata: name: pod-lister namespace: metallb-system rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - list -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - addresspools - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bfdprofiles - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bgppeers - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - l2advertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bgpadvertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - ipaddresspools - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - communities - verbs: - - get - - list - - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - addresspools + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bfdprofiles + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bgppeers + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - l2advertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bgpadvertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - ipaddresspools + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - communities + verbs: + - get + - list + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -1296,60 +1403,60 @@ metadata: app: metallb name: metallb-system:controller rules: -- apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - services/status - verbs: - - update -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - policy - resourceNames: - - controller - resources: - - podsecuritypolicies - verbs: - - use -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - - mutatingwebhookconfigurations - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - create - - delete - - get - - list - - patch - - update - - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services/status + verbs: + - update + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - policy + resourceNames: + - controller + resources: + - podsecuritypolicies + verbs: + - use + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -1358,39 +1465,39 @@ metadata: app: metallb name: metallb-system:speaker rules: -- apiGroups: - - "" - resources: - - services - - endpoints - - nodes - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - policy - resourceNames: - - speaker - resources: - - podsecuritypolicies - verbs: - - use + - apiGroups: + - "" + resources: + - services + - endpoints + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - policy + resourceNames: + - speaker + resources: + - podsecuritypolicies + verbs: + - use --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -1404,9 +1511,9 @@ roleRef: kind: Role name: controller subjects: -- kind: ServiceAccount - name: controller - namespace: metallb-system + - kind: ServiceAccount + name: controller + namespace: metallb-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -1420,9 +1527,9 @@ roleRef: kind: Role name: pod-lister subjects: -- kind: ServiceAccount - name: speaker - namespace: metallb-system + - kind: ServiceAccount + name: speaker + namespace: metallb-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -1435,9 +1542,9 @@ roleRef: kind: ClusterRole name: metallb-system:controller subjects: -- kind: ServiceAccount - name: controller - namespace: metallb-system + - kind: ServiceAccount + name: controller + namespace: metallb-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -1450,9 +1557,9 @@ roleRef: kind: ClusterRole name: metallb-system:speaker subjects: -- kind: ServiceAccount - name: speaker - namespace: metallb-system + - kind: ServiceAccount + name: speaker + namespace: metallb-system --- apiVersion: v1 kind: Secret @@ -1467,8 +1574,8 @@ metadata: namespace: metallb-system spec: ports: - - port: 443 - targetPort: 9443 + - port: 443 + targetPort: 9443 selector: component: controller --- @@ -1496,50 +1603,50 @@ spec: component: controller spec: containers: - - args: - - --port=7472 - - --log-level=info - env: - - name: METALLB_ML_SECRET_NAME - value: memberlist - - name: METALLB_DEPLOYMENT - value: controller - image: us-west1-docker.pkg.dev/kne-external/kne/metallb/controller:v0.13.5 - livenessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - name: controller - ports: - - containerPort: 7472 - name: monitoring - - containerPort: 9443 - name: webhook-server - protocol: TCP - readinessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - all - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: cert - readOnly: true + - args: + - --port=7472 + - --log-level=info + env: + - name: METALLB_ML_SECRET_NAME + value: memberlist + - name: METALLB_DEPLOYMENT + value: controller + image: us-west1-docker.pkg.dev/kne-external/kne/metallb/controller:v0.13.5 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: controller + ports: + - containerPort: 7472 + name: monitoring + - containerPort: 9443 + name: webhook-server + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - all + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true nodeSelector: kubernetes.io/os: linux securityContext: @@ -1549,10 +1656,10 @@ spec: serviceAccountName: controller terminationGracePeriodSeconds: 0 volumes: - - name: cert - secret: - defaultMode: 420 - secretName: webhook-server-cert + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert --- apiVersion: apps/v1 kind: DaemonSet @@ -1577,77 +1684,77 @@ spec: component: speaker spec: containers: - - args: - - --port=7472 - - --log-level=info - env: - - name: METALLB_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: METALLB_HOST - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: METALLB_ML_BIND_ADDR - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: METALLB_ML_LABELS - value: app=metallb,component=speaker - - name: METALLB_ML_SECRET_KEY - valueFrom: - secretKeyRef: - key: secretkey - name: memberlist - image: us-west1-docker.pkg.dev/kne-external/kne/metallb/speaker:v0.13.5 - livenessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - name: speaker - ports: - - containerPort: 7472 - name: monitoring - - containerPort: 7946 - name: memberlist-tcp - - containerPort: 7946 - name: memberlist-udp - protocol: UDP - readinessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - securityContext: - allowPrivilegeEscalation: false - capabilities: - add: - - NET_RAW - drop: - - ALL - readOnlyRootFilesystem: true + - args: + - --port=7472 + - --log-level=info + env: + - name: METALLB_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: METALLB_HOST + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: METALLB_ML_BIND_ADDR + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: METALLB_ML_LABELS + value: app=metallb,component=speaker + - name: METALLB_ML_SECRET_KEY + valueFrom: + secretKeyRef: + key: secretkey + name: memberlist + image: us-west1-docker.pkg.dev/kne-external/kne/metallb/speaker:v0.13.5 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: speaker + ports: + - containerPort: 7472 + name: monitoring + - containerPort: 7946 + name: memberlist-tcp + - containerPort: 7946 + name: memberlist-udp + protocol: UDP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - NET_RAW + drop: + - ALL + readOnlyRootFilesystem: true hostNetwork: true nodeSelector: kubernetes.io/os: linux serviceAccountName: speaker terminationGracePeriodSeconds: 2 tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/master - operator: Exists - - effect: NoSchedule - key: node-role.kubernetes.io/control-plane - operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + operator: Exists --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -1655,143 +1762,143 @@ metadata: creationTimestamp: null name: metallb-webhook-configuration webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta2-bgppeer - failurePolicy: Fail - name: bgppeersvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta2 - operations: - - CREATE - - UPDATE - resources: - - bgppeers - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-addresspool - failurePolicy: Fail - name: addresspoolvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - addresspools - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-bfdprofile - failurePolicy: Fail - name: bfdprofilevalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - DELETE - resources: - - bfdprofiles - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-bgpadvertisement - failurePolicy: Fail - name: bgpadvertisementvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - bgpadvertisements - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-community - failurePolicy: Fail - name: communityvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - communities - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-ipaddresspool - failurePolicy: Fail - name: ipaddresspoolvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - ipaddresspools - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-l2advertisement - failurePolicy: Fail - name: l2advertisementvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - l2advertisements - sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta2-bgppeer + failurePolicy: Fail + name: bgppeersvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta2 + operations: + - CREATE + - UPDATE + resources: + - bgppeers + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-addresspool + failurePolicy: Fail + name: addresspoolvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - addresspools + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-bfdprofile + failurePolicy: Fail + name: bfdprofilevalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - DELETE + resources: + - bfdprofiles + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-bgpadvertisement + failurePolicy: Fail + name: bgpadvertisementvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - bgpadvertisements + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-community + failurePolicy: Fail + name: communityvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - communities + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-ipaddresspool + failurePolicy: Fail + name: ipaddresspoolvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - ipaddresspools + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-l2advertisement + failurePolicy: Fail + name: l2advertisementvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - l2advertisements + sideEffects: None diff --git a/manifests/base/kustomization.yaml b/manifests/base/kustomization.yaml index 10db6cfa8..aef5c5f36 100644 --- a/manifests/base/kustomization.yaml +++ b/manifests/base/kustomization.yaml @@ -1,10 +1,10 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: neo4j commonLabels: app: neo4j resources: -- namespace.yaml -- serviceaccount.yaml -- neo4j.yaml - + - namespace.yaml + - serviceaccount.yaml + - neo4j.yaml diff --git a/manifests/base/namespace.yaml b/manifests/base/namespace.yaml index 087d8b0d3..f78e7bb80 100644 --- a/manifests/base/namespace.yaml +++ b/manifests/base/namespace.yaml @@ -1,4 +1,5 @@ +--- apiVersion: v1 kind: Namespace metadata: - name: neo4j \ No newline at end of file + name: neo4j diff --git a/manifests/base/neo4j.yaml b/manifests/base/neo4j.yaml index c5aef9dc3..9bf61586f 100644 --- a/manifests/base/neo4j.yaml +++ b/manifests/base/neo4j.yaml @@ -132,48 +132,48 @@ spec: app: neo4j spec: containers: - - name: neo4j - resources: - requests: - memory: "512Mi" - cpu: "250m" - limits: - memory: "1024Mi" - cpu: "500m" - image: neo4j:latest - ports: - - containerPort: 7474 - - containerPort: 7687 - env: - - name: SIMPLE_SERVICE_VERSION - value: "0.9" - - name: NEO4J_AUTH - value: neo4j/test - - name: NEO4J_dbms_connector_https_advertised__address - value: "localhost:7473" - - name: NEO4J_dbms_connector_http_advertised__address - value: "localhost:7474" - - name: NEO4J_dbms_connector_bolt_advertised__address - value: "localhost:7687" - volumeMounts: + - name: neo4j + resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "1024Mi" + cpu: "500m" + image: neo4j:latest + ports: + - containerPort: 7474 + - containerPort: 7687 + env: + - name: SIMPLE_SERVICE_VERSION + value: "0.9" + - name: NEO4J_AUTH + value: neo4j/test + - name: NEO4J_dbms_connector_https_advertised__address + value: "localhost:7473" + - name: NEO4J_dbms_connector_http_advertised__address + value: "localhost:7474" + - name: NEO4J_dbms_connector_bolt_advertised__address + value: "localhost:7687" + volumeMounts: + - name: neo4j-data + mountPath: /data + - name: neo4j-logs + mountPath: /logs + - name: neo4j-plugins + mountPath: /plugins + - name: neo4j-import + mountPath: /var/lib/neo4j/import + volumes: - name: neo4j-data - mountPath: /data + persistentVolumeClaim: + claimName: neo4j-data - name: neo4j-logs - mountPath: /logs + persistentVolumeClaim: + claimName: neo4j-logs - name: neo4j-plugins - mountPath: /plugins + persistentVolumeClaim: + claimName: neo4j-plugins - name: neo4j-import - mountPath: /var/lib/neo4j/import - volumes: - - name: neo4j-data - persistentVolumeClaim: - claimName: neo4j-data - - name: neo4j-logs - persistentVolumeClaim: - claimName: neo4j-logs - - name: neo4j-plugins - persistentVolumeClaim: - claimName: neo4j-plugins - - name: neo4j-import - persistentVolumeClaim: - claimName: neo4j-import \ No newline at end of file + persistentVolumeClaim: + claimName: neo4j-import diff --git a/manifests/base/serviceaccount.yaml b/manifests/base/serviceaccount.yaml index aac1834e3..9ec267ed7 100644 --- a/manifests/base/serviceaccount.yaml +++ b/manifests/base/serviceaccount.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: ServiceAccount metadata: diff --git a/manifests/controllers/cdnos/manifest.yaml b/manifests/controllers/cdnos/manifest.yaml index 0815bf137..2c9113ecf 100644 --- a/manifests/controllers/cdnos/manifest.yaml +++ b/manifests/controllers/cdnos/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -26,271 +27,296 @@ spec: singular: cdnos scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - description: Cdnos is the Schema for the cdnoss API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: CdnosSpec defines the desired state of Cdnos - properties: - args: - description: Args are the args to pass to the command. - items: + - name: v1 + schema: + openAPIV3Schema: + description: Cdnos is the Schema for the cdnoss API + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: CdnosSpec defines the desired state of Cdnos + properties: + args: + description: Args are the args to pass to the command. + items: + type: string + type: array + command: + description: Command is the name of the executable to run. + type: string + configFile: + description: + ConfigFile is the default configuration file name for + the pod. + type: string + configPath: + description: + ConfigPath is the mount point for configuration inside + the pod. + type: string + env: + description: Env are the environment variables to set for the container. + items: + description: + EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: + 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' + type: string + valueFrom: + description: + Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: + "Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs." + properties: + apiVersion: + description: + Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: + Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: + "Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported." + properties: + containerName: + description: + "Container name: required for volumes, + optional for env vars" + type: string + divisor: + anyOf: + - type: integer + - type: string + description: + Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: "Required: resource to select" + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: + The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + image: + description: Image to use for the CDNOS container + type: string + initImage: + description: + InitImage is the docker image to use as an init container + for the pod. type: string - type: array - command: - description: Command is the name of the executable to run. - type: string - configFile: - description: ConfigFile is the default configuration file name for - the pod. - type: string - configPath: - description: ConfigPath is the mount point for configuration inside - the pod. - type: string - env: - description: Env are the environment variables to set for the container. - items: - description: EnvVar represents an environment variable present in - a Container. + initSleep: + description: InitSleep is the time sleep in the init container + type: integer + interfaceCount: + description: + InterfaceCount is number of interfaces to be attached + to the pod. + type: integer + ports: + additionalProperties: + description: ServicePort describes an external L4 port on the device. + properties: + innerPort: + description: InnerPort is port on the container to expose. + format: int32 + type: integer + outerPort: + description: OuterPort is port on the container to expose. + format: int32 + type: integer + required: + - innerPort + - outerPort + type: object + description: Ports are ports to create on the service. + type: object + resources: + description: + Resources are the K8s resources to allocate to cdnos + container. properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - description: 'Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - description: 'Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported.' - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic + claims: + description: + "Claims lists the names of resources, defined in + spec.resourceClaims, that are used by this container. \n This + is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable. It can only be set + for containers." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: + Name must match the name of one entry in pod.spec.resourceClaims + of the Pod where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" type: object - required: - - name type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - image: - description: Image to use for the CDNOS container - type: string - initImage: - description: InitImage is the docker image to use as an init container - for the pod. - type: string - initSleep: - description: InitSleep is the time sleep in the init container - type: integer - interfaceCount: - description: InterfaceCount is number of interfaces to be attached - to the pod. - type: integer - ports: - additionalProperties: - description: ServicePort describes an external L4 port on the device. + tls: + description: TLS is the configuration the key/certs to use for management. properties: - innerPort: - description: InnerPort is port on the container to expose. - format: int32 - type: integer - outerPort: - description: OuterPort is port on the container to expose. - format: int32 - type: integer - required: - - innerPort - - outerPort - type: object - description: Ports are ports to create on the service. - type: object - resources: - description: Resources are the K8s resources to allocate to cdnos - container. - properties: - claims: - description: "Claims lists the names of resources, defined in - spec.resourceClaims, that are used by this container. \n This - is an alpha field and requires enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. It can only be set - for containers." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. + selfSigned: + description: SelfSigned generates a new self signed certificate. properties: - name: - description: Name must match the name of one entry in pod.spec.resourceClaims - of the Pod where this field is used. It makes that resource - available inside a container. + commonName: + description: / Common name to set in the cert. type: string + keySize: + description: RSA keysize to use for key generation. + type: integer required: - - name + - commonName + - keySize type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - tls: - description: TLS is the configuration the key/certs to use for management. - properties: - selfSigned: - description: SelfSigned generates a new self signed certificate. - properties: - commonName: - description: / Common name to set in the cert. - type: string - keySize: - description: RSA keysize to use for key generation. - type: integer - required: - - commonName - - keySize - type: object - type: object - type: object - status: - description: CdnosStatus defines the observed state of Cdnos - properties: - message: - description: Message describes why the Cdnos is in the current phase. - type: string - phase: - description: Phase is the overall status of the Cdnos. - type: string - required: - - message - - phase - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: object + status: + description: CdnosStatus defines the observed state of Cdnos + properties: + message: + description: Message describes why the Cdnos is in the current phase. + type: string + phase: + description: Phase is the overall status of the Cdnos. + type: string + required: + - message + - phase + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -318,83 +344,83 @@ metadata: name: cdnos-controller-leader-election-role namespace: cdnos-controller-system rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cdnos-controller-manager-role rules: -- apiGroups: - - cdnos.dev.drivenets.net - resources: - - cdnoss - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - cdnos.dev.drivenets.net - resources: - - cdnoss/finalizers - verbs: - - update -- apiGroups: - - cdnos.dev.drivenets.net - resources: - - cdnoss/status - verbs: - - get - - patch - - update -- apiGroups: - - "" - resources: - - pods - - secrets - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch + - apiGroups: + - cdnos.dev.drivenets.net + resources: + - cdnoss + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cdnos.dev.drivenets.net + resources: + - cdnoss/finalizers + verbs: + - update + - apiGroups: + - cdnos.dev.drivenets.net + resources: + - cdnoss/status + verbs: + - get + - patch + - update + - apiGroups: + - "" + resources: + - pods + - secrets + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -408,10 +434,10 @@ metadata: app.kubernetes.io/part-of: cdnos-controller name: cdnos-controller-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -425,18 +451,18 @@ metadata: app.kubernetes.io/part-of: cdnos-controller name: cdnos-controller-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -455,9 +481,9 @@ roleRef: kind: Role name: cdnos-controller-leader-election-role subjects: -- kind: ServiceAccount - name: cdnos-controller-controller-manager - namespace: cdnos-controller-system + - kind: ServiceAccount + name: cdnos-controller-controller-manager + namespace: cdnos-controller-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -475,9 +501,9 @@ roleRef: kind: ClusterRole name: cdnos-controller-manager-role subjects: -- kind: ServiceAccount - name: cdnos-controller-controller-manager - namespace: cdnos-controller-system + - kind: ServiceAccount + name: cdnos-controller-controller-manager + namespace: cdnos-controller-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -495,9 +521,9 @@ roleRef: kind: ClusterRole name: cdnos-controller-proxy-role subjects: -- kind: ServiceAccount - name: cdnos-controller-controller-manager - namespace: cdnos-controller-system + - kind: ServiceAccount + name: cdnos-controller-controller-manager + namespace: cdnos-controller-system --- apiVersion: v1 kind: Service @@ -514,10 +540,10 @@ metadata: namespace: cdnos-controller-system spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -547,61 +573,61 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.15.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: public.ecr.aws/dn/cdnos-controller:1.7.5 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.15.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: public.ecr.aws/dn/cdnos-controller:1.7.5 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL securityContext: runAsNonRoot: true serviceAccountName: cdnos-controller-controller-manager diff --git a/manifests/controllers/ceoslab/manifest.yaml b/manifests/controllers/ceoslab/manifest.yaml index f9d2be424..2f085db4c 100644 --- a/manifests/controllers/ceoslab/manifest.yaml +++ b/manifests/controllers/ceoslab/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,193 +22,193 @@ spec: singular: ceoslabdevice scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: CEosLabDevice is the Schema for the ceoslabdevices API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: CEosLabDeviceSpec defines the desired state of CEosLabDevice - properties: - args: - description: Additional arguments to pass to /sbin/init. Those necessary to boot properly are already present. - items: - type: string - type: array - certconfig: - description: X.509 certificate configuration. - properties: - selfsignedcerts: - description: Configuration for self-signed certificates. - items: - properties: - certname: - description: Certificate name on the node. - type: string - commonname: - description: Common name to set in the cert. - type: string - keyname: - description: Key name on the node. - type: string - keysize: - description: RSA keysize to use for key generation. - format: int32 - type: integer - type: object - type: array - type: object - envvars: - additionalProperties: - type: string - description: Additional environment variables. Those necessary to boot properly are already present. - type: object - image: - description: 'Image name. Default: ceos:latest' - type: string - initcontainerimage: - description: 'Init container image name. Default: networkop/init-wait:latest' - type: string - intfmapping: - additionalProperties: - type: string - description: Explicit interface mapping between kernel devices and interface names. If this is defined, any unmapped devices are ignored. - type: object - numinterfaces: - description: 'Number of data interfaces to create. An additional interface (eth0) is created for pod connectivity. Default: 0 interfaces' - format: int32 - type: integer - resourcerequirements: - additionalProperties: - type: string - description: 'Resource requests to configure on the pod. Default: none' - type: object - services: - additionalProperties: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: CEosLabDevice is the Schema for the ceoslabdevices API + properties: + apiVersion: + description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: CEosLabDeviceSpec defines the desired state of CEosLabDevice + properties: + args: + description: Additional arguments to pass to /sbin/init. Those necessary to boot properly are already present. + items: + type: string + type: array + certconfig: + description: X.509 certificate configuration. properties: - tcpports: - description: TCP ports to forward to the pod. + selfsignedcerts: + description: Configuration for self-signed certificates. items: properties: - in: - description: Port inside the container. - format: int32 - type: integer - out: - description: Port outside the container. Defaults to the same as in. + certname: + description: Certificate name on the node. + type: string + commonname: + description: Common name to set in the cert. + type: string + keyname: + description: Key name on the node. + type: string + keysize: + description: RSA keysize to use for key generation. format: int32 type: integer type: object type: array type: object - description: 'Port mappings for container services. Default: none' - type: object - sleep: - description: 'Time (in seconds) to wait before starting the device. Default: 0 seconds' - format: int32 - type: integer - toggleoverrides: - additionalProperties: - type: boolean - description: EOS feature toggle overrides - type: object - waitforagents: - description: EOS agents to for the startup probe to block on - items: + envvars: + additionalProperties: + type: string + description: Additional environment variables. Those necessary to boot properly are already present. + type: object + image: + description: "Image name. Default: ceos:latest" type: string - type: array - type: object - status: - description: CEosLabDeviceStatus defines the observed state of CEosLabDevice - properties: - configmapconfig: - description: ConfigMap state as configured in configmaps - properties: - intfmappingstatus: - additionalProperties: - type: string + initcontainerimage: + description: "Init container image name. Default: networkop/init-wait:latest" + type: string + intfmapping: + additionalProperties: + type: string + description: Explicit interface mapping between kernel devices and interface names. If this is defined, any unmapped devices are ignored. + type: object + numinterfaces: + description: "Number of data interfaces to create. An additional interface (eth0) is created for pod connectivity. Default: 0 interfaces" + format: int32 + type: integer + resourcerequirements: + additionalProperties: + type: string + description: "Resource requests to configure on the pod. Default: none" + type: object + services: + additionalProperties: + properties: + tcpports: + description: TCP ports to forward to the pod. + items: + properties: + in: + description: Port inside the container. + format: int32 + type: integer + out: + description: Port outside the container. Defaults to the same as in. + format: int32 + type: integer + type: object + type: array type: object - rceosstale: + description: "Port mappings for container services. Default: none" + type: object + sleep: + description: "Time (in seconds) to wait before starting the device. Default: 0 seconds" + format: int32 + type: integer + toggleoverrides: + additionalProperties: type: boolean - selfsignedcertstatus: - additionalProperties: - properties: - certname: - description: Certificate name on the node. - type: string - commonname: - description: Common name to set in the cert. - type: string - keyname: - description: Key name on the node. - type: string - keysize: - description: RSA keysize to use for key generation. - format: int32 - type: integer - type: object - type: object - startupconfigresourceversion: + description: EOS feature toggle overrides + type: object + waitforagents: + description: EOS agents to for the startup probe to block on + items: type: string - toggleoverridesstatus: - additionalProperties: + type: array + type: object + status: + description: CEosLabDeviceStatus defines the observed state of CEosLabDevice + properties: + configmapconfig: + description: ConfigMap state as configured in configmaps + properties: + intfmappingstatus: + additionalProperties: + type: string + type: object + rceosstale: type: boolean - type: object - type: object - podconfigmapconfig: - description: ConfigMap state as present in the pod. If these diverge, we need to restart the pod to update. Even if an in-place update is possible these are needed at boot time. - properties: - intfmappingstatus: - additionalProperties: + selfsignedcertstatus: + additionalProperties: + properties: + certname: + description: Certificate name on the node. + type: string + commonname: + description: Common name to set in the cert. + type: string + keyname: + description: Key name on the node. + type: string + keysize: + description: RSA keysize to use for key generation. + format: int32 + type: integer + type: object + type: object + startupconfigresourceversion: type: string - type: object - rceosstale: - type: boolean - selfsignedcertstatus: - additionalProperties: - properties: - certname: - description: Certificate name on the node. - type: string - commonname: - description: Common name to set in the cert. - type: string - keyname: - description: Key name on the node. - type: string - keysize: - description: RSA keysize to use for key generation. - format: int32 - type: integer + toggleoverridesstatus: + additionalProperties: + type: boolean type: object - type: object - startupconfigresourceversion: - type: string - toggleoverridesstatus: - additionalProperties: + type: object + podconfigmapconfig: + description: ConfigMap state as present in the pod. If these diverge, we need to restart the pod to update. Even if an in-place update is possible these are needed at boot time. + properties: + intfmappingstatus: + additionalProperties: + type: string + type: object + rceosstale: type: boolean - type: object - type: object - reason: - description: Reason for potential failure - type: string - status: - description: Device status - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + selfsignedcertstatus: + additionalProperties: + properties: + certname: + description: Certificate name on the node. + type: string + commonname: + description: Common name to set in the cert. + type: string + keyname: + description: Key name on the node. + type: string + keysize: + description: RSA keysize to use for key generation. + format: int32 + type: integer + type: object + type: object + startupconfigresourceversion: + type: string + toggleoverridesstatus: + additionalProperties: + type: boolean + type: object + type: object + reason: + description: Reason for potential failure + type: string + status: + description: Device status + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -227,37 +228,37 @@ metadata: name: arista-ceoslab-operator-leader-election-role namespace: arista-ceoslab-operator-system rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -265,108 +266,108 @@ metadata: creationTimestamp: null name: arista-ceoslab-operator-manager-role rules: -- apiGroups: - - ceoslab.arista.com - resources: - - ceoslabdevices - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - ceoslab.arista.com - resources: - - ceoslabdevices/finalizers - verbs: - - update -- apiGroups: - - ceoslab.arista.com - resources: - - ceoslabdevices/status - verbs: - - get - - patch - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch + - apiGroups: + - ceoslab.arista.com + resources: + - ceoslabdevices + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ceoslab.arista.com + resources: + - ceoslabdevices/finalizers + verbs: + - update + - apiGroups: + - ceoslab.arista.com + resources: + - ceoslabdevices/status + verbs: + - get + - patch + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: arista-ceoslab-operator-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: arista-ceoslab-operator-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -378,9 +379,9 @@ roleRef: kind: Role name: arista-ceoslab-operator-leader-election-role subjects: -- kind: ServiceAccount - name: arista-ceoslab-operator-controller-manager - namespace: arista-ceoslab-operator-system + - kind: ServiceAccount + name: arista-ceoslab-operator-controller-manager + namespace: arista-ceoslab-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -391,9 +392,9 @@ roleRef: kind: ClusterRole name: arista-ceoslab-operator-manager-role subjects: -- kind: ServiceAccount - name: arista-ceoslab-operator-controller-manager - namespace: arista-ceoslab-operator-system + - kind: ServiceAccount + name: arista-ceoslab-operator-controller-manager + namespace: arista-ceoslab-operator-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -404,9 +405,9 @@ roleRef: kind: ClusterRole name: arista-ceoslab-operator-proxy-role subjects: -- kind: ServiceAccount - name: arista-ceoslab-operator-controller-manager - namespace: arista-ceoslab-operator-system + - kind: ServiceAccount + name: arista-ceoslab-operator-controller-manager + namespace: arista-ceoslab-operator-system --- apiVersion: v1 data: @@ -436,10 +437,10 @@ metadata: namespace: arista-ceoslab-operator-system spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -463,53 +464,53 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.11.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: ghcr.io/aristanetworks/arista-ceoslab-operator:v2.1.2 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.11.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: ghcr.io/aristanetworks/arista-ceoslab-operator:v2.1.2 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false securityContext: runAsNonRoot: true serviceAccountName: arista-ceoslab-operator-controller-manager diff --git a/manifests/controllers/lemming/manifest.yaml b/manifests/controllers/lemming/manifest.yaml index 3f3b60158..eb5ad8118 100644 --- a/manifests/controllers/lemming/manifest.yaml +++ b/manifests/controllers/lemming/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,265 +22,290 @@ spec: singular: lemming scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Lemming is the Schema for the lemmings API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: LemmingSpec defines the desired state of Lemming. - properties: - args: - description: Args are the args to pass to the command. - items: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Lemming is the Schema for the lemmings API + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: LemmingSpec defines the desired state of Lemming. + properties: + args: + description: Args are the args to pass to the command. + items: + type: string + type: array + command: + description: Command is the name of the executable to run. + type: string + configFile: + description: + ConfigFile is the default configuration file name for + the pod. + type: string + configPath: + description: + ConfigPath is the mount point for configuration inside + the pod. + type: string + env: + description: Env are the environment variables to set for the container. + items: + description: + EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: + 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' + type: string + valueFrom: + description: + Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + fieldRef: + description: + "Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs." + properties: + apiVersion: + description: + Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: + Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + resourceFieldRef: + description: + "Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported." + properties: + containerName: + description: + "Container name: required for volumes, + optional for env vars" + type: string + divisor: + anyOf: + - type: integer + - type: string + description: + Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: "Required: resource to select" + type: string + required: + - resource + type: object + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: + The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + image: + description: Image is the container image to run. + type: string + initImage: + description: + InitImage is the docker image to use as an init container + for the pod. type: string - type: array - command: - description: Command is the name of the executable to run. - type: string - configFile: - description: ConfigFile is the default configuration file name for - the pod. - type: string - configPath: - description: ConfigPath is the mount point for configuration inside - the pod. - type: string - env: - description: Env are the environment variables to set for the container. - items: - description: EnvVar represents an environment variable present in - a Container. + initSleep: + description: InitSleep is the time sleep in the init container + type: integer + interfaceCount: + description: + InterfaceCount is number of interfaces to be attached + to the pod. + type: integer + ports: + additionalProperties: + description: ServicePort describes an external L4 port on the device. + properties: + innerPort: + description: InnerPort is port on the container to expose. + format: int32 + type: integer + outerPort: + description: OuterPort is port on the container to expose. + format: int32 + type: integer + required: + - innerPort + - outerPort + type: object + description: Ports are ports to create on the service. + type: object + resources: + description: + Resources are the K8s resources to allocate to lemming + container. properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported.' - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object + claims: + description: + "Claims lists the names of resources, defined in + spec.resourceClaims, that are used by this container. \n This + is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: + Name must match the name of one entry in pod.spec.resourceClaims + of the Pod where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" type: object - required: - - name type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - image: - description: Image is the container image to run. - type: string - initImage: - description: InitImage is the docker image to use as an init container - for the pod. - type: string - initSleep: - description: InitSleep is the time sleep in the init container - type: integer - interfaceCount: - description: InterfaceCount is number of interfaces to be attached - to the pod. - type: integer - ports: - additionalProperties: - description: ServicePort describes an external L4 port on the device. + tls: + description: TLS is the configuration the key/certs to use for management. properties: - innerPort: - description: InnerPort is port on the container to expose. - format: int32 - type: integer - outerPort: - description: OuterPort is port on the container to expose. - format: int32 - type: integer - required: - - innerPort - - outerPort - type: object - description: Ports are ports to create on the service. - type: object - resources: - description: Resources are the K8s resources to allocate to lemming - container. - properties: - claims: - description: "Claims lists the names of resources, defined in - spec.resourceClaims, that are used by this container. \n This - is an alpha field and requires enabling the DynamicResourceAllocation - feature gate. \n This field is immutable." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. + selfSigned: + description: SelfSigned generates a new self signed certificate. properties: - name: - description: Name must match the name of one entry in pod.spec.resourceClaims - of the Pod where this field is used. It makes that resource - available inside a container. + commonName: + description: / Common name to set in the cert. type: string + keySize: + description: RSA keysize to use for key generation. + type: integer required: - - name + - commonName + - keySize type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - tls: - description: TLS is the configuration the key/certs to use for management. - properties: - selfSigned: - description: SelfSigned generates a new self signed certificate. - properties: - commonName: - description: / Common name to set in the cert. - type: string - keySize: - description: RSA keysize to use for key generation. - type: integer - required: - - commonName - - keySize - type: object - type: object - type: object - status: - description: LemmingStatus defines the observed state of Lemming - properties: - message: - description: Message describes why the lemming is in the current phase. - type: string - phase: - description: Phase is the overall status of the Lemming. - type: string - required: - - message - - phase - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: object + status: + description: LemmingStatus defines the observed state of Lemming + properties: + message: + description: Message describes why the lemming is in the current phase. + type: string + phase: + description: Phase is the overall status of the Lemming. + type: string + required: + - message + - phase + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -293,37 +319,37 @@ metadata: name: lemming-leader-election-role namespace: lemming-operator rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -331,74 +357,74 @@ metadata: creationTimestamp: null name: lemming-manager-role rules: -- apiGroups: - - "" - resources: - - pods - - secrets - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/finalizers - verbs: - - update -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - pods + - secrets + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/finalizers + verbs: + - update + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -410,9 +436,9 @@ roleRef: kind: Role name: lemming-leader-election-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -423,9 +449,9 @@ roleRef: kind: ClusterRole name: lemming-manager-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -436,9 +462,9 @@ roleRef: kind: ClusterRole name: lemming-proxy-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: v1 data: @@ -478,10 +504,10 @@ metadata: namespace: lemming-operator spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -505,61 +531,61 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.4 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.4 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL securityContext: runAsNonRoot: true serviceAccountName: lemming-controller-manager diff --git a/manifests/controllers/srlinux/manifest.yaml b/manifests/controllers/srlinux/manifest.yaml index ba211a4b2..6936bb2f2 100644 --- a/manifests/controllers/srlinux/manifest.yaml +++ b/manifests/controllers/srlinux/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -26,159 +27,166 @@ spec: singular: srlinux scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.image - name: Image - type: string - - jsonPath: .status.status - name: Status - type: string - - jsonPath: .status.ready - name: Ready - type: boolean - - jsonPath: .status.startup-config.phase - name: Config - type: string - name: v1 - schema: - openAPIV3Schema: - description: Srlinux is the Schema for the srlinuxes API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - license_key: - description: license key from license secret that contains a license file - for this Srlinux - type: string - metadata: - type: object - spec: - description: SrlinuxSpec defines the desired state of Srlinux. - properties: - config: - description: NodeConfig represents srlinux node configuration parameters. - properties: - args: - description: Command args to pass into the pod. - items: - type: string - type: array - cert: - description: CertificateCfg represents srlinux certificate configuration - parameters. - properties: - cert_name: - description: Certificate name on the node. + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.image + name: Image + type: string + - jsonPath: .status.status + name: Status + type: string + - jsonPath: .status.ready + name: Ready + type: boolean + - jsonPath: .status.startup-config.phase + name: Config + type: string + name: v1 + schema: + openAPIV3Schema: + description: Srlinux is the Schema for the srlinuxes API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + license_key: + description: + license key from license secret that contains a license file + for this Srlinux + type: string + metadata: + type: object + spec: + description: SrlinuxSpec defines the desired state of Srlinux. + properties: + config: + description: NodeConfig represents srlinux node configuration parameters. + properties: + args: + description: Command args to pass into the pod. + items: type: string - common_name: - description: Common name to set in the cert. + type: array + cert: + description: + CertificateCfg represents srlinux certificate configuration + parameters. + properties: + cert_name: + description: Certificate name on the node. + type: string + common_name: + description: Common name to set in the cert. + type: string + key_name: + description: Key name on the node. + type: string + key_size: + description: RSA keysize to use for key generation. + format: int32 + type: integer + type: object + command: + description: Command to pass into pod. + items: type: string - key_name: - description: Key name on the node. + type: array + config_data_present: + description: + When set to true by kne, srlinux controller will + attempt to mount the file with startup config to the pod + type: boolean + config_file: + description: + Startup configuration file name for the pod. Set + in the kne topo and created by kne as a config map + type: string + config_path: + description: + Mount point for configuration inside the pod. Should + point to a dir that contains ConfigFile + type: string + entry_command: + description: Specific entry point command for accessing the pod. + type: string + env: + additionalProperties: type: string - key_size: - description: RSA keysize to use for key generation. - format: int32 - type: integer - type: object - command: - description: Command to pass into pod. - items: + description: Map of environment variables to pass into the pod. + type: object + image: + description: Container image to use with for the SR Linux container. type: string - type: array - config_data_present: - description: When set to true by kne, srlinux controller will - attempt to mount the file with startup config to the pod - type: boolean - config_file: - description: Startup configuration file name for the pod. Set - in the kne topo and created by kne as a config map - type: string - config_path: - description: Mount point for configuration inside the pod. Should - point to a dir that contains ConfigFile - type: string - entry_command: - description: Specific entry point command for accessing the pod. - type: string - env: - additionalProperties: + init-image: + description: + Init container image to use with for the SR Linux + container. type: string - description: Map of environment variables to pass into the pod. - type: object - image: - description: Container image to use with for the SR Linux container. + sleep: + description: Sleep time before starting the pod. + format: int32 + type: integer + type: object + constraints: + additionalProperties: type: string - init-image: - description: Init container image to use with for the SR Linux - container. - type: string - sleep: - description: Sleep time before starting the pod. - format: int32 - type: integer - type: object - constraints: - additionalProperties: + type: object + model: + description: Model encodes SR Linux variant (ixr-d3, ixr-6e, etc) type: string - type: object - model: - description: Model encodes SR Linux variant (ixr-d3, ixr-6e, etc) - type: string - num-interfaces: - type: integer - version: - description: |- - Version may be set in kne topology as a mean to explicitly provide version information - in case it is not encoded in the image tag - type: string - type: object - status: - description: SrlinuxStatus defines the observed state of Srlinux. - properties: - image: - description: Image used to run srlinux pod - type: string - ready: - description: |- - Ready is true if the srlinux NOS is ready to receive config. - This is when management server is running and initial commit is processed. - type: boolean - startup-config: - description: StartupConfig contains the status of the startup-config. - properties: - phase: - description: 'Phase is the phase startup-config is in. Can be - one of: "pending", "loaded", "not-provided", "failed".' - type: string - type: object - status: - description: |- - Status is the status of the srlinux custom resource. - Can be one of: "created", "running", "error". - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + num-interfaces: + type: integer + version: + description: |- + Version may be set in kne topology as a mean to explicitly provide version information + in case it is not encoded in the image tag + type: string + type: object + status: + description: SrlinuxStatus defines the observed state of Srlinux. + properties: + image: + description: Image used to run srlinux pod + type: string + ready: + description: |- + Ready is true if the srlinux NOS is ready to receive config. + This is when management server is running and initial commit is processed. + type: boolean + startup-config: + description: StartupConfig contains the status of the startup-config. + properties: + phase: + description: + 'Phase is the phase startup-config is in. Can be + one of: "pending", "loaded", "not-provided", "failed".' + type: string + type: object + status: + description: |- + Status is the status of the srlinux custom resource. + Can be one of: "created", "running", "error". + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -206,83 +214,83 @@ metadata: name: srlinux-controller-leader-election-role namespace: srlinux-controller rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: srlinux-controller-manager-role rules: -- apiGroups: - - "" - resources: - - configmaps - - pods - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - kne.srlinux.dev - resources: - - srlinuxes - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - kne.srlinux.dev - resources: - - srlinuxes/finalizers - verbs: - - update -- apiGroups: - - kne.srlinux.dev - resources: - - srlinuxes/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - kne.srlinux.dev + resources: + - srlinuxes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - kne.srlinux.dev + resources: + - srlinuxes/finalizers + verbs: + - update + - apiGroups: + - kne.srlinux.dev + resources: + - srlinuxes/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -296,10 +304,10 @@ metadata: app.kubernetes.io/part-of: srlinux-controller name: srlinux-controller-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -313,18 +321,18 @@ metadata: app.kubernetes.io/part-of: srlinux-controller name: srlinux-controller-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -343,9 +351,9 @@ roleRef: kind: Role name: srlinux-controller-leader-election-role subjects: -- kind: ServiceAccount - name: srlinux-controller-controller-manager - namespace: srlinux-controller + - kind: ServiceAccount + name: srlinux-controller-controller-manager + namespace: srlinux-controller --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -363,9 +371,9 @@ roleRef: kind: ClusterRole name: srlinux-controller-manager-role subjects: -- kind: ServiceAccount - name: srlinux-controller-controller-manager - namespace: srlinux-controller + - kind: ServiceAccount + name: srlinux-controller-controller-manager + namespace: srlinux-controller --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -383,9 +391,9 @@ roleRef: kind: ClusterRole name: srlinux-controller-proxy-role subjects: -- kind: ServiceAccount - name: srlinux-controller-controller-manager - namespace: srlinux-controller + - kind: ServiceAccount + name: srlinux-controller-controller-manager + namespace: srlinux-controller --- apiVersion: v1 kind: Service @@ -402,10 +410,10 @@ metadata: namespace: srlinux-controller spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -438,74 +446,74 @@ spec: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/arch - operator: In - values: - - amd64 - - arm64 - - ppc64le - - s390x - - key: kubernetes.io/os - operator: In - values: - - linux + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - s390x + - key: kubernetes.io/os + operator: In + values: + - linux containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.13.1 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: ghcr.io/srl-labs/srl-controller:v0.7.1 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.13.1 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: ghcr.io/srl-labs/srl-controller:v0.7.1 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL securityContext: runAsNonRoot: true serviceAccountName: srlinux-controller-controller-manager diff --git a/manifests/flannel/manifest.yaml b/manifests/flannel/manifest.yaml index 9f7b2eb53..e846108ab 100644 --- a/manifests/flannel/manifest.yaml +++ b/manifests/flannel/manifest.yaml @@ -14,33 +14,33 @@ metadata: k8s-app: flannel name: flannel rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - get -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - nodes/status - verbs: - - patch -- apiGroups: - - networking.k8s.io - resources: - - clustercidrs - verbs: - - list - - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes/status + verbs: + - patch + - apiGroups: + - networking.k8s.io + resources: + - clustercidrs + verbs: + - list + - watch --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 @@ -53,9 +53,9 @@ roleRef: kind: ClusterRole name: flannel subjects: -- kind: ServiceAccount - name: flannel - namespace: kube-flannel + - kind: ServiceAccount + name: flannel + namespace: kube-flannel --- apiVersion: v1 kind: ServiceAccount @@ -126,90 +126,90 @@ spec: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/os - operator: In - values: - - linux + - matchExpressions: + - key: kubernetes.io/os + operator: In + values: + - linux hostNetwork: true priorityClassName: system-node-critical tolerations: - - operator: Exists - effect: NoSchedule + - operator: Exists + effect: NoSchedule serviceAccountName: flannel initContainers: - - name: install-cni-plugin - image: docker.io/flannel/flannel-cni-plugin:v1.4.0-flannel1 - command: - - cp - args: - - -f - - /flannel - - /opt/cni/bin/flannel - volumeMounts: - - name: cni-plugin - mountPath: /opt/cni/bin - - name: install-cni - image: docker.io/flannel/flannel:v0.24.3 - command: - - cp - args: - - -f - - /etc/kube-flannel/cni-conf.json - - /etc/cni/net.d/10-flannel.conflist - volumeMounts: - - name: cni - mountPath: /etc/cni/net.d - - name: flannel-cfg - mountPath: /etc/kube-flannel/ + - name: install-cni-plugin + image: docker.io/flannel/flannel-cni-plugin:v1.4.0-flannel1 + command: + - cp + args: + - -f + - /flannel + - /opt/cni/bin/flannel + volumeMounts: + - name: cni-plugin + mountPath: /opt/cni/bin + - name: install-cni + image: docker.io/flannel/flannel:v0.24.3 + command: + - cp + args: + - -f + - /etc/kube-flannel/cni-conf.json + - /etc/cni/net.d/10-flannel.conflist + volumeMounts: + - name: cni + mountPath: /etc/cni/net.d + - name: flannel-cfg + mountPath: /etc/kube-flannel/ containers: - - name: kube-flannel - image: docker.io/flannel/flannel:v0.24.3 - command: - - /opt/bin/flanneld - args: - - --ip-masq - - --kube-subnet-mgr - resources: - requests: - cpu: "100m" - memory: "50Mi" - securityContext: - privileged: false - capabilities: - add: ["NET_ADMIN", "NET_RAW"] - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: EVENT_QUEUE_DEPTH - value: "5000" - volumeMounts: + - name: kube-flannel + image: docker.io/flannel/flannel:v0.24.3 + command: + - /opt/bin/flanneld + args: + - --ip-masq + - --kube-subnet-mgr + resources: + requests: + cpu: "100m" + memory: "50Mi" + securityContext: + privileged: false + capabilities: + add: ["NET_ADMIN", "NET_RAW"] + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: EVENT_QUEUE_DEPTH + value: "5000" + volumeMounts: + - name: run + mountPath: /run/flannel + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + - name: xtables-lock + mountPath: /run/xtables.lock + volumes: - name: run - mountPath: /run/flannel + hostPath: + path: /run/flannel + - name: cni-plugin + hostPath: + path: /opt/cni/bin + - name: cni + hostPath: + path: /etc/cni/net.d - name: flannel-cfg - mountPath: /etc/kube-flannel/ + configMap: + name: kube-flannel-cfg - name: xtables-lock - mountPath: /run/xtables.lock - volumes: - - name: run - hostPath: - path: /run/flannel - - name: cni-plugin - hostPath: - path: /opt/cni/bin - - name: cni - hostPath: - path: /etc/cni/net.d - - name: flannel-cfg - configMap: - name: kube-flannel-cfg - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate + hostPath: + path: /run/xtables.lock + type: FileOrCreate diff --git a/manifests/keysight/ixiatg-configmap.yaml b/manifests/keysight/ixiatg-configmap.yaml index 2028969b0..f3fe166b2 100644 --- a/manifests/keysight/ixiatg-configmap.yaml +++ b/manifests/keysight/ixiatg-configmap.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: ConfigMap metadata: diff --git a/manifests/keysight/ixiatg-operator.yaml b/manifests/keysight/ixiatg-operator.yaml index 7905959fe..4d24e137c 100644 --- a/manifests/keysight/ixiatg-operator.yaml +++ b/manifests/keysight/ixiatg-operator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,104 +22,104 @@ spec: singular: ixiatg scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: IxiaTG is the Schema for the ixiatg API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: IxiaTGSpec defines the desired state of IxiaTG - properties: - api_endpoint_map: - additionalProperties: - description: IxiaTGSvcPort defines the endpoint services for configuration and stats for the OTG node - properties: - in: - format: int32 - type: integer - out: - format: int32 - type: integer - required: - - in + - name: v1beta1 + schema: + openAPIV3Schema: + description: IxiaTG is the Schema for the ixiatg API + properties: + apiVersion: + description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: IxiaTGSpec defines the desired state of IxiaTG + properties: + api_endpoint_map: + additionalProperties: + description: IxiaTGSvcPort defines the endpoint services for configuration and stats for the OTG node + properties: + in: + format: int32 + type: integer + out: + format: int32 + type: integer + required: + - in + type: object + description: ApiEndPoint as define in OTG config type: object - description: ApiEndPoint as define in OTG config - type: object - desired_state: - description: Desired state by network emulation (KNE) - type: string - init_container: - description: Init container image of the node - properties: - image: - type: string - sleep: - format: int32 - type: integer - type: object - interfaces: - description: Interfaces with DUT - items: - description: IxiaTGSvcPort defines the endpoint ports for network traffic for the OTG node + desired_state: + description: Desired state by network emulation (KNE) + type: string + init_container: + description: Init container image of the node properties: - group: - type: string - name: + image: type: string - required: - - name + sleep: + format: int32 + type: integer type: object - type: array - release: - description: Version of the node - type: string - type: object - status: - description: IxiaTGStatus defines the observed state of IxiaTG - properties: - api_endpoint: - description: List of OTG service names - properties: - pod_name: - type: string - service_names: - items: - type: string - type: array - type: object - interfaces: - description: List of OTG port and pod mapping - items: - description: IxiaTGIntfStatus defines the mapping between endpoint ports and encasing pods + interfaces: + description: Interfaces with DUT + items: + description: IxiaTGSvcPort defines the endpoint ports for network traffic for the OTG node + properties: + group: + type: string + name: + type: string + required: + - name + type: object + type: array + release: + description: Version of the node + type: string + type: object + status: + description: IxiaTGStatus defines the observed state of IxiaTG + properties: + api_endpoint: + description: List of OTG service names properties: - interface: - type: string - name: - type: string pod_name: type: string + service_names: + items: + type: string + type: array type: object - type: array - reason: - description: Reason in case of failure - type: string - state: - description: Observed state - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + interfaces: + description: List of OTG port and pod mapping + items: + description: IxiaTGIntfStatus defines the mapping between endpoint ports and encasing pods + properties: + interface: + type: string + name: + type: string + pod_name: + type: string + type: object + type: array + reason: + description: Reason in case of failure + type: string + state: + description: Observed state + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -138,37 +139,37 @@ metadata: name: ixiatg-op-leader-election-role namespace: ixiatg-op-system rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -176,108 +177,108 @@ metadata: creationTimestamp: null name: ixiatg-op-manager-role rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - network.keysight.com - resources: - - ixiatgs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - network.keysight.com - resources: - - ixiatgs/finalizers - verbs: - - update -- apiGroups: - - network.keysight.com - resources: - - ixiatgs/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - network.keysight.com + resources: + - ixiatgs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - network.keysight.com + resources: + - ixiatgs/finalizers + verbs: + - update + - apiGroups: + - network.keysight.com + resources: + - ixiatgs/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ixiatg-op-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ixiatg-op-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -289,9 +290,9 @@ roleRef: kind: Role name: ixiatg-op-leader-election-role subjects: -- kind: ServiceAccount - name: ixiatg-op-controller-manager - namespace: ixiatg-op-system + - kind: ServiceAccount + name: ixiatg-op-controller-manager + namespace: ixiatg-op-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -302,9 +303,9 @@ roleRef: kind: ClusterRole name: ixiatg-op-manager-role subjects: -- kind: ServiceAccount - name: ixiatg-op-controller-manager - namespace: ixiatg-op-system + - kind: ServiceAccount + name: ixiatg-op-controller-manager + namespace: ixiatg-op-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -315,9 +316,9 @@ roleRef: kind: ClusterRole name: ixiatg-op-proxy-role subjects: -- kind: ServiceAccount - name: ixiatg-op-controller-manager - namespace: ixiatg-op-system + - kind: ServiceAccount + name: ixiatg-op-controller-manager + namespace: ixiatg-op-system --- apiVersion: v1 data: @@ -347,9 +348,9 @@ metadata: namespace: ixiatg-op-system spec: ports: - - name: https - port: 8443 - targetPort: https + - name: https + port: 8443 + targetPort: https selector: control-plane: controller-manager --- @@ -371,47 +372,47 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=10 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.8.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: ghcr.io/open-traffic-generator/keng-operator:0.3.34 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 100m - memory: 200Mi - requests: - cpu: 100m - memory: 20Mi - securityContext: - allowPrivilegeEscalation: false + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=10 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.8.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: ghcr.io/open-traffic-generator/keng-operator:0.3.34 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 100m + memory: 200Mi + requests: + cpu: 100m + memory: 20Mi + securityContext: + allowPrivilegeEscalation: false imagePullSecrets: - - name: ixia-pull-secret + - name: ixia-pull-secret securityContext: runAsNonRoot: true serviceAccountName: ixiatg-op-controller-manager diff --git a/manifests/kind/bridge.yaml b/manifests/kind/bridge.yaml index 84915de60..2f7d6991d 100644 --- a/manifests/kind/bridge.yaml +++ b/manifests/kind/bridge.yaml @@ -13,7 +13,7 @@ rules: - watch - patch - apiGroups: - - "" + - "" resources: - configmaps verbs: @@ -28,9 +28,9 @@ roleRef: kind: ClusterRole name: kindnet subjects: -- kind: ServiceAccount - name: kindnet - namespace: kube-system + - kind: ServiceAccount + name: kindnet + namespace: kube-system --- apiVersion: v1 kind: ServiceAccount @@ -60,66 +60,71 @@ spec: spec: hostNetwork: true tolerations: - - operator: Exists - effect: NoSchedule + - operator: Exists + effect: NoSchedule serviceAccountName: kindnet initContainers: - - name: install-cni-bin - image: ghcr.io/aojea/kindnetd:v1.7.0 - command: ['sh', '-c', 'cd /opt/cni/bin; for i in * ; do cat $i > /cni/$i ; chmod +x /cni/$i ; done'] - volumeMounts: - - name: cni-bin - mountPath: /cni + - name: install-cni-bin + image: ghcr.io/aojea/kindnetd:v1.7.0 + command: + [ + "sh", + "-c", + "cd /opt/cni/bin; for i in * ; do cat $i > /cni/$i ; chmod +x /cni/$i ; done", + ] + volumeMounts: + - name: cni-bin + mountPath: /cni containers: - - name: kindnet-cni - image: ghcr.io/aojea/kindnetd:v1.7.0 - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: CNI_BRIDGE - value: "true" - - name: DISABLE_CNI_BRIDGE_OFFLOAD - value: "true" - volumeMounts: + - name: kindnet-cni + image: ghcr.io/aojea/kindnetd:v1.7.0 + env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: CNI_BRIDGE + value: "true" + - name: DISABLE_CNI_BRIDGE_OFFLOAD + value: "true" + volumeMounts: + - name: cni-cfg + mountPath: /etc/cni/net.d + - name: xtables-lock + mountPath: /run/xtables.lock + readOnly: false + - name: lib-modules + mountPath: /lib/modules + readOnly: true + resources: + requests: + cpu: "100m" + memory: "50Mi" + limits: + cpu: "100m" + memory: "50Mi" + securityContext: + privileged: false + capabilities: + add: ["NET_RAW", "NET_ADMIN"] + volumes: + - name: cni-bin + hostPath: + path: /opt/cni/bin + type: DirectoryOrCreate - name: cni-cfg - mountPath: /etc/cni/net.d + hostPath: + path: /etc/cni/net.d + type: DirectoryOrCreate - name: xtables-lock - mountPath: /run/xtables.lock - readOnly: false + hostPath: + path: /run/xtables.lock + type: FileOrCreate - name: lib-modules - mountPath: /lib/modules - readOnly: true - resources: - requests: - cpu: "100m" - memory: "50Mi" - limits: - cpu: "100m" - memory: "50Mi" - securityContext: - privileged: false - capabilities: - add: ["NET_RAW", "NET_ADMIN"] - volumes: - - name: cni-bin - hostPath: - path: /opt/cni/bin - type: DirectoryOrCreate - - name: cni-cfg - hostPath: - path: /etc/cni/net.d - type: DirectoryOrCreate - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - - name: lib-modules - hostPath: - path: /lib/modules + hostPath: + path: /lib/modules --- diff --git a/manifests/kind/config.yaml b/manifests/kind/config.yaml index 332ed08cb..5181a8603 100644 --- a/manifests/kind/config.yaml +++ b/manifests/kind/config.yaml @@ -1,11 +1,12 @@ +--- kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 networking: # the default CNI will not be installed disableDefaultCNI: true nodes: -- role: control-plane - # add a mount from /tmp/kne on the host to /tmp/kne on the node - extraMounts: - - hostPath: /tmp/kne - containerPath: /tmp/kne + - role: control-plane + # add a mount from /tmp/kne on the host to /tmp/kne on the node + extraMounts: + - hostPath: /tmp/kne + containerPath: /tmp/kne diff --git a/manifests/kind/kind-bridge.yaml b/manifests/kind/kind-bridge.yaml index 84915de60..2f7d6991d 100644 --- a/manifests/kind/kind-bridge.yaml +++ b/manifests/kind/kind-bridge.yaml @@ -13,7 +13,7 @@ rules: - watch - patch - apiGroups: - - "" + - "" resources: - configmaps verbs: @@ -28,9 +28,9 @@ roleRef: kind: ClusterRole name: kindnet subjects: -- kind: ServiceAccount - name: kindnet - namespace: kube-system + - kind: ServiceAccount + name: kindnet + namespace: kube-system --- apiVersion: v1 kind: ServiceAccount @@ -60,66 +60,71 @@ spec: spec: hostNetwork: true tolerations: - - operator: Exists - effect: NoSchedule + - operator: Exists + effect: NoSchedule serviceAccountName: kindnet initContainers: - - name: install-cni-bin - image: ghcr.io/aojea/kindnetd:v1.7.0 - command: ['sh', '-c', 'cd /opt/cni/bin; for i in * ; do cat $i > /cni/$i ; chmod +x /cni/$i ; done'] - volumeMounts: - - name: cni-bin - mountPath: /cni + - name: install-cni-bin + image: ghcr.io/aojea/kindnetd:v1.7.0 + command: + [ + "sh", + "-c", + "cd /opt/cni/bin; for i in * ; do cat $i > /cni/$i ; chmod +x /cni/$i ; done", + ] + volumeMounts: + - name: cni-bin + mountPath: /cni containers: - - name: kindnet-cni - image: ghcr.io/aojea/kindnetd:v1.7.0 - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: CNI_BRIDGE - value: "true" - - name: DISABLE_CNI_BRIDGE_OFFLOAD - value: "true" - volumeMounts: + - name: kindnet-cni + image: ghcr.io/aojea/kindnetd:v1.7.0 + env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: CNI_BRIDGE + value: "true" + - name: DISABLE_CNI_BRIDGE_OFFLOAD + value: "true" + volumeMounts: + - name: cni-cfg + mountPath: /etc/cni/net.d + - name: xtables-lock + mountPath: /run/xtables.lock + readOnly: false + - name: lib-modules + mountPath: /lib/modules + readOnly: true + resources: + requests: + cpu: "100m" + memory: "50Mi" + limits: + cpu: "100m" + memory: "50Mi" + securityContext: + privileged: false + capabilities: + add: ["NET_RAW", "NET_ADMIN"] + volumes: + - name: cni-bin + hostPath: + path: /opt/cni/bin + type: DirectoryOrCreate - name: cni-cfg - mountPath: /etc/cni/net.d + hostPath: + path: /etc/cni/net.d + type: DirectoryOrCreate - name: xtables-lock - mountPath: /run/xtables.lock - readOnly: false + hostPath: + path: /run/xtables.lock + type: FileOrCreate - name: lib-modules - mountPath: /lib/modules - readOnly: true - resources: - requests: - cpu: "100m" - memory: "50Mi" - limits: - cpu: "100m" - memory: "50Mi" - securityContext: - privileged: false - capabilities: - add: ["NET_RAW", "NET_ADMIN"] - volumes: - - name: cni-bin - hostPath: - path: /opt/cni/bin - type: DirectoryOrCreate - - name: cni-cfg - hostPath: - path: /etc/cni/net.d - type: DirectoryOrCreate - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - - name: lib-modules - hostPath: - path: /lib/modules + hostPath: + path: /lib/modules --- diff --git a/manifests/kube/credential-provider-config.yaml b/manifests/kube/credential-provider-config.yaml index bd5cdd310..074161856 100644 --- a/manifests/kube/credential-provider-config.yaml +++ b/manifests/kube/credential-provider-config.yaml @@ -1,15 +1,16 @@ +--- kind: CredentialProviderConfig apiVersion: kubelet.config.k8s.io/v1 providers: -- name: auth-provider-gcp - apiVersion: credentialprovider.kubelet.k8s.io/v1 - matchImages: - - "container.cloud.google.com" - - "gcr.io" - - "*.gcr.io" - - "*.pkg.dev" - - "registry.k8s.io" - args: - - get-credentials - - --v=3 - defaultCacheDuration: 1m + - name: auth-provider-gcp + apiVersion: credentialprovider.kubelet.k8s.io/v1 + matchImages: + - "container.cloud.google.com" + - "gcr.io" + - "*.gcr.io" + - "*.pkg.dev" + - "registry.k8s.io" + args: + - get-credentials + - --v=3 + defaultCacheDuration: 1m diff --git a/manifests/meshnet/grpc/manifest.yaml b/manifests/meshnet/grpc/manifest.yaml index bcda4c210..76bb464b3 100644 --- a/manifests/meshnet/grpc/manifest.yaml +++ b/manifests/meshnet/grpc/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -23,100 +24,110 @@ spec: singular: gwirekobj scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource - this object represents. Servers may infer this from the endpoint - the client submits requests to. Cannot be updated. In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - uids: - description: unique link id - items: - type: integer - type: array - type: object - status: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - grpcWireItems: - items: - properties: - gwire_peer_node_ip: - description: peer node IP address - type: string - link_id: - description: Unique link id as assigned by meshnet - format: int64 - type: integer - local_pod_iface_name: - description: Local pod interface name that is specified in topology - CR and is created by meshnet - type: string - local_pod_ip: - description: Local pod ip as specified in topology CR - type: string - local_pod_name: - description: Local pod name as specified in topology CR - type: string - local_pod_net_ns: - description: Netwokr namespace of the local pod holding the - wire end - type: string - node_name: - description: Name of the node holding the wire end - type: string - topo_namespace: - description: The topology namespace. - type: string - wire_iface_id_on_peer_node: - description: The interface id, in the peer node adn is connected - with remote pod. This is used for de-multiplexing received - packet from grpcwire - format: int64 - type: integer - wire_iface_name_on_local_node: - description: The interface(name) in the local node and is connected - with local pod - type: string - type: object - type: array - kind: - description: 'Kind is a string value representing the REST resource - this object represents. Servers may infer this from the endpoint - the client submits requests to. Cannot be updated. In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - type: object - type: object - served: true - storage: true + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource + this object represents. Servers may infer this from the endpoint + the client submits requests to. Cannot be updated. In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + uids: + description: unique link id + items: + type: integer + type: array + type: object + status: + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + grpcWireItems: + items: + properties: + gwire_peer_node_ip: + description: peer node IP address + type: string + link_id: + description: Unique link id as assigned by meshnet + format: int64 + type: integer + local_pod_iface_name: + description: + Local pod interface name that is specified in topology + CR and is created by meshnet + type: string + local_pod_ip: + description: Local pod ip as specified in topology CR + type: string + local_pod_name: + description: Local pod name as specified in topology CR + type: string + local_pod_net_ns: + description: + Netwokr namespace of the local pod holding the + wire end + type: string + node_name: + description: Name of the node holding the wire end + type: string + topo_namespace: + description: The topology namespace. + type: string + wire_iface_id_on_peer_node: + description: + The interface id, in the peer node and is connected + with remote pod. This is used for de-multiplexing received + packet from grpcwire + format: int64 + type: integer + wire_iface_name_on_local_node: + description: + The interface(name) in the local node and is connected + with local pod + type: string + type: object + type: array + kind: + description: + "Kind is a string value representing the REST resource + this object represents. Servers may infer this from the endpoint + the client submits requests to. Cannot be updated. In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + type: object + type: object + served: true + storage: true --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -130,75 +141,75 @@ spec: kind: Topology plural: topologies shortNames: - - topo + - topo singular: topology scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - properties: - links: - items: - description: A complete definition of a p2p link - properties: - local_intf: - description: Local interface name - type: string - local_ip: - description: (Optional) Peer IP address - type: string - peer_intf: - description: Peer interface name - type: string - peer_ip: - description: (Optional) Local IP address - type: string - peer_pod: - description: Name of the peer pod - type: string - uid: - description: Unique identified of a p2p link - type: integer - required: - - uid - - peer_pod - - local_intf - - peer_intf - type: object - type: array - type: object - status: - properties: - container_id: - description: Sandbox ID of the POD - type: string - net_ns: - description: Network namespace of the POD - type: string - skipped: - description: List of pods/interfaces that are skipped by local pod - items: - properties: - link_id: - format: int64 - type: integer - pod_name: - description: peer pod name - type: string - type: object - type: array - src_ip: - description: Source IP of the POD - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + links: + items: + description: A complete definition of a p2p link + properties: + local_intf: + description: Local interface name + type: string + local_ip: + description: (Optional) Peer IP address + type: string + peer_intf: + description: Peer interface name + type: string + peer_ip: + description: (Optional) Local IP address + type: string + peer_pod: + description: Name of the peer pod + type: string + uid: + description: Unique identified of a p2p link + type: integer + required: + - uid + - peer_pod + - local_intf + - peer_intf + type: object + type: array + type: object + status: + properties: + container_id: + description: Sandbox ID of the POD + type: string + net_ns: + description: Network namespace of the POD + type: string + skipped: + description: List of pods/interfaces that are skipped by local pod + items: + properties: + link_id: + format: int64 + type: integer + pod_name: + description: peer pod name + type: string + type: object + type: array + src_ip: + description: Source IP of the POD + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -221,21 +232,21 @@ metadata: app: meshnet name: meshnet-clusterrole rules: -- apiGroups: - - networkop.co.uk - resources: - - topologies - - gwirekobjs - verbs: - - '*' -- apiGroups: - - networkop.co.uk - resources: - - topologies/status - - gwirekobjs/spec - - gwirekobjs/status - verbs: - - '*' + - apiGroups: + - networkop.co.uk + resources: + - topologies + - gwirekobjs + verbs: + - "*" + - apiGroups: + - networkop.co.uk + resources: + - topologies/status + - gwirekobjs/spec + - gwirekobjs/status + verbs: + - "*" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -248,9 +259,9 @@ roleRef: kind: ClusterRole name: meshnet-clusterrole subjects: -- kind: ServiceAccount - name: meshnet - namespace: meshnet + - kind: ServiceAccount + name: meshnet + namespace: meshnet --- apiVersion: apps/v1 kind: DaemonSet @@ -272,46 +283,46 @@ spec: name: meshnet spec: containers: - - command: - - ./entrypoint.sh - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: INTER_NODE_LINK_TYPE - value: GRPC - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2 - imagePullPolicy: IfNotPresent - name: meshnet - resources: - limits: - memory: 10G - requests: - cpu: 200m - memory: 1G - securityContext: - privileged: true - volumeMounts: - - mountPath: /etc/cni/net.d - name: cni-cfg - - mountPath: /opt/cni/bin - name: cni-bin - - mountPath: /var/run/netns - mountPropagation: Bidirectional - name: var-run-netns + - command: + - ./entrypoint.sh + env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: INTER_NODE_LINK_TYPE + value: GRPC + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2 + imagePullPolicy: IfNotPresent + name: meshnet + resources: + limits: + memory: 10G + requests: + cpu: 200m + memory: 1G + securityContext: + privileged: true + volumeMounts: + - mountPath: /etc/cni/net.d + name: cni-cfg + - mountPath: /opt/cni/bin + name: cni-bin + - mountPath: /var/run/netns + mountPropagation: Bidirectional + name: var-run-netns hostIPC: true hostNetwork: true hostPID: true @@ -320,15 +331,15 @@ spec: serviceAccountName: meshnet terminationGracePeriodSeconds: 30 tolerations: - - effect: NoSchedule - operator: Exists + - effect: NoSchedule + operator: Exists volumes: - - hostPath: - path: /opt/cni/bin - name: cni-bin - - hostPath: - path: /etc/cni/net.d - name: cni-cfg - - hostPath: - path: /var/run/netns - name: var-run-netns + - hostPath: + path: /opt/cni/bin + name: cni-bin + - hostPath: + path: /etc/cni/net.d + name: cni-cfg + - hostPath: + path: /var/run/netns + name: var-run-netns diff --git a/manifests/meshnet/vxlan/manifest.yaml b/manifests/meshnet/vxlan/manifest.yaml index e9e99e9f5..5a6824b93 100644 --- a/manifests/meshnet/vxlan/manifest.yaml +++ b/manifests/meshnet/vxlan/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -23,100 +24,110 @@ spec: singular: gwirekobj scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource - this object represents. Servers may infer this from the endpoint - the client submits requests to. Cannot be updated. In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - uids: - description: unique link id - items: - type: integer - type: array - type: object - status: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - grpcWireItems: - items: - properties: - gwire_peer_node_ip: - description: peer node IP address - type: string - link_id: - description: Unique link id as assigned by meshnet - format: int64 - type: integer - local_pod_iface_name: - description: Local pod interface name that is specified in topology - CR and is created by meshnet - type: string - local_pod_ip: - description: Local pod ip as specified in topology CR - type: string - local_pod_name: - description: Local pod name as specified in topology CR - type: string - local_pod_net_ns: - description: Netwokr namespace of the local pod holding the - wire end - type: string - node_name: - description: Name of the node holding the wire end - type: string - topo_namespace: - description: The topology namespace. - type: string - wire_iface_id_on_peer_node: - description: The interface id, in the peer node adn is connected - with remote pod. This is used for de-multiplexing received - packet from grpcwire - format: int64 - type: integer - wire_iface_name_on_local_node: - description: The interface(name) in the local node and is connected - with local pod - type: string - type: object - type: array - kind: - description: 'Kind is a string value representing the REST resource - this object represents. Servers may infer this from the endpoint - the client submits requests to. Cannot be updated. In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - type: object - type: object - served: true - storage: true + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource + this object represents. Servers may infer this from the endpoint + the client submits requests to. Cannot be updated. In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + uids: + description: unique link id + items: + type: integer + type: array + type: object + status: + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + grpcWireItems: + items: + properties: + gwire_peer_node_ip: + description: peer node IP address + type: string + link_id: + description: Unique link id as assigned by meshnet + format: int64 + type: integer + local_pod_iface_name: + description: + Local pod interface name that is specified in topology + CR and is created by meshnet + type: string + local_pod_ip: + description: Local pod ip as specified in topology CR + type: string + local_pod_name: + description: Local pod name as specified in topology CR + type: string + local_pod_net_ns: + description: + Netwokr namespace of the local pod holding the + wire end + type: string + node_name: + description: Name of the node holding the wire end + type: string + topo_namespace: + description: The topology namespace. + type: string + wire_iface_id_on_peer_node: + description: + The interface id, in the peer node and is connected + with remote pod. This is used for de-multiplexing received + packet from grpcwire + format: int64 + type: integer + wire_iface_name_on_local_node: + description: + The interface(name) in the local node and is connected + with local pod + type: string + type: object + type: array + kind: + description: + "Kind is a string value representing the REST resource + this object represents. Servers may infer this from the endpoint + the client submits requests to. Cannot be updated. In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + type: object + type: object + served: true + storage: true --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -130,75 +141,75 @@ spec: kind: Topology plural: topologies shortNames: - - topo + - topo singular: topology scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - properties: - links: - items: - description: A complete definition of a p2p link - properties: - local_intf: - description: Local interface name - type: string - local_ip: - description: (Optional) Peer IP address - type: string - peer_intf: - description: Peer interface name - type: string - peer_ip: - description: (Optional) Local IP address - type: string - peer_pod: - description: Name of the peer pod - type: string - uid: - description: Unique identified of a p2p link - type: integer - required: - - uid - - peer_pod - - local_intf - - peer_intf - type: object - type: array - type: object - status: - properties: - container_id: - description: Sandbox ID of the POD - type: string - net_ns: - description: Network namespace of the POD - type: string - skipped: - description: List of pods/interfaces that are skipped by local pod - items: - properties: - link_id: - format: int64 - type: integer - pod_name: - description: peer pod name - type: string - type: object - type: array - src_ip: - description: Source IP of the POD - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + links: + items: + description: A complete definition of a p2p link + properties: + local_intf: + description: Local interface name + type: string + local_ip: + description: (Optional) Peer IP address + type: string + peer_intf: + description: Peer interface name + type: string + peer_ip: + description: (Optional) Local IP address + type: string + peer_pod: + description: Name of the peer pod + type: string + uid: + description: Unique identified of a p2p link + type: integer + required: + - uid + - peer_pod + - local_intf + - peer_intf + type: object + type: array + type: object + status: + properties: + container_id: + description: Sandbox ID of the POD + type: string + net_ns: + description: Network namespace of the POD + type: string + skipped: + description: List of pods/interfaces that are skipped by local pod + items: + properties: + link_id: + format: int64 + type: integer + pod_name: + description: peer pod name + type: string + type: object + type: array + src_ip: + description: Source IP of the POD + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -221,21 +232,21 @@ metadata: app: meshnet name: meshnet-clusterrole rules: -- apiGroups: - - networkop.co.uk - resources: - - topologies - - gwirekobjs - verbs: - - '*' -- apiGroups: - - networkop.co.uk - resources: - - topologies/status - - gwirekobjs/spec - - gwirekobjs/status - verbs: - - '*' + - apiGroups: + - networkop.co.uk + resources: + - topologies + - gwirekobjs + verbs: + - "*" + - apiGroups: + - networkop.co.uk + resources: + - topologies/status + - gwirekobjs/spec + - gwirekobjs/status + verbs: + - "*" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -248,9 +259,9 @@ roleRef: kind: ClusterRole name: meshnet-clusterrole subjects: -- kind: ServiceAccount - name: meshnet - namespace: meshnet + - kind: ServiceAccount + name: meshnet + namespace: meshnet --- apiVersion: apps/v1 kind: DaemonSet @@ -272,46 +283,46 @@ spec: name: meshnet spec: containers: - - command: - - ./entrypoint.sh - env: - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: INTER_NODE_LINK_TYPE - value: VXLAN - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2 - imagePullPolicy: IfNotPresent - name: meshnet - resources: - limits: - memory: 10G - requests: - cpu: 200m - memory: 1G - securityContext: - privileged: true - volumeMounts: - - mountPath: /etc/cni/net.d - name: cni-cfg - - mountPath: /opt/cni/bin - name: cni-bin - - mountPath: /var/run/netns - mountPropagation: Bidirectional - name: var-run-netns + - command: + - ./entrypoint.sh + env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: INTER_NODE_LINK_TYPE + value: VXLAN + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2 + imagePullPolicy: IfNotPresent + name: meshnet + resources: + limits: + memory: 10G + requests: + cpu: 200m + memory: 1G + securityContext: + privileged: true + volumeMounts: + - mountPath: /etc/cni/net.d + name: cni-cfg + - mountPath: /opt/cni/bin + name: cni-bin + - mountPath: /var/run/netns + mountPropagation: Bidirectional + name: var-run-netns hostIPC: true hostNetwork: true hostPID: true @@ -320,15 +331,15 @@ spec: serviceAccountName: meshnet terminationGracePeriodSeconds: 30 tolerations: - - effect: NoSchedule - operator: Exists + - effect: NoSchedule + operator: Exists volumes: - - hostPath: - path: /opt/cni/bin - name: cni-bin - - hostPath: - path: /etc/cni/net.d - name: cni-cfg - - hostPath: - path: /var/run/netns - name: var-run-netns + - hostPath: + path: /opt/cni/bin + name: cni-bin + - hostPath: + path: /etc/cni/net.d + name: cni-cfg + - hostPath: + path: /var/run/netns + name: var-run-netns diff --git a/manifests/metallb/manifest.yaml b/manifests/metallb/manifest.yaml index 48454a684..e005898a2 100644 --- a/manifests/metallb/manifest.yaml +++ b/manifests/metallb/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -22,111 +23,111 @@ spec: singular: bfdprofile scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .spec.passiveMode - name: Passive Mode - type: boolean - - jsonPath: .spec.transmitInterval - name: Transmit Interval - type: integer - - jsonPath: .spec.receiveInterval - name: Receive Interval - type: integer - - jsonPath: .spec.detectMultiplier - name: Multiplier - type: integer - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - BFDProfile represents the settings of the bfd session that can be - optionally associated with a BGP session. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: BFDProfileSpec defines the desired state of BFDProfile. - properties: - detectMultiplier: - description: |- - Configures the detection multiplier to determine - packet loss. The remote transmission interval will be multiplied - by this value to determine the connection loss detection timer. - format: int32 - maximum: 255 - minimum: 2 - type: integer - echoInterval: - description: |- - Configures the minimal echo receive transmission - interval that this system is capable of handling in milliseconds. - Defaults to 50ms - format: int32 - maximum: 60000 - minimum: 10 - type: integer - echoMode: - description: |- - Enables or disables the echo transmission mode. - This mode is disabled by default, and not supported on multi - hops setups. - type: boolean - minimumTtl: - description: |- - For multi hop sessions only: configure the minimum - expected TTL for an incoming BFD control packet. - format: int32 - maximum: 254 - minimum: 1 - type: integer - passiveMode: - description: |- - Mark session as passive: a passive session will not - attempt to start the connection and will wait for control packets - from peer before it begins replying. - type: boolean - receiveInterval: - description: |- - The minimum interval that this system is capable of - receiving control packets in milliseconds. - Defaults to 300ms. - format: int32 - maximum: 60000 - minimum: 10 - type: integer - transmitInterval: - description: |- - The minimum transmission interval (less jitter) - that this system wants to use to send BFD control packets in - milliseconds. Defaults to 300ms - format: int32 - maximum: 60000 - minimum: 10 - type: integer - type: object - status: - description: BFDProfileStatus defines the observed state of BFDProfile. - type: object - type: object - served: true - storage: true - subresources: - status: {} + - additionalPrinterColumns: + - jsonPath: .spec.passiveMode + name: Passive Mode + type: boolean + - jsonPath: .spec.transmitInterval + name: Transmit Interval + type: integer + - jsonPath: .spec.receiveInterval + name: Receive Interval + type: integer + - jsonPath: .spec.detectMultiplier + name: Multiplier + type: integer + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + BFDProfile represents the settings of the bfd session that can be + optionally associated with a BGP session. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BFDProfileSpec defines the desired state of BFDProfile. + properties: + detectMultiplier: + description: |- + Configures the detection multiplier to determine + packet loss. The remote transmission interval will be multiplied + by this value to determine the connection loss detection timer. + format: int32 + maximum: 255 + minimum: 2 + type: integer + echoInterval: + description: |- + Configures the minimal echo receive transmission + interval that this system is capable of handling in milliseconds. + Defaults to 50ms + format: int32 + maximum: 60000 + minimum: 10 + type: integer + echoMode: + description: |- + Enables or disables the echo transmission mode. + This mode is disabled by default, and not supported on multi + hops setups. + type: boolean + minimumTtl: + description: |- + For multi hop sessions only: configure the minimum + expected TTL for an incoming BFD control packet. + format: int32 + maximum: 254 + minimum: 1 + type: integer + passiveMode: + description: |- + Mark session as passive: a passive session will not + attempt to start the connection and will wait for control packets + from peer before it begins replying. + type: boolean + receiveInterval: + description: |- + The minimum interval that this system is capable of + receiving control packets in milliseconds. + Defaults to 300ms. + format: int32 + maximum: 60000 + minimum: 10 + type: integer + transmitInterval: + description: |- + The minimum transmission interval (less jitter) + that this system wants to use to send BFD control packets in + milliseconds. Defaults to 300ms + format: int32 + maximum: 60000 + minimum: 10 + type: integer + type: object + status: + description: BFDProfileStatus defines the observed state of BFDProfile. + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -143,207 +144,215 @@ spec: singular: bgpadvertisement scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .spec.ipAddressPools - name: IPAddressPools - type: string - - jsonPath: .spec.ipAddressPoolSelectors - name: IPAddressPool Selectors - type: string - - jsonPath: .spec.peers - name: Peers - type: string - - jsonPath: .spec.nodeSelectors - name: Node Selectors - priority: 10 - type: string - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - BGPAdvertisement allows to advertise the IPs coming - from the selected IPAddressPools via BGP, setting the parameters of the - BGP Advertisement. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: BGPAdvertisementSpec defines the desired state of BGPAdvertisement. - properties: - aggregationLength: - default: 32 - description: The aggregation-length advertisement option lets you - “roll up” the /32s into a larger prefix. Defaults to 32. Works for - IPv4 addresses. - format: int32 - minimum: 1 - type: integer - aggregationLengthV6: - default: 128 - description: The aggregation-length advertisement option lets you - “roll up” the /128s into a larger prefix. Defaults to 128. Works - for IPv6 addresses. - format: int32 - type: integer - communities: - description: |- - The BGP communities to be associated with the announcement. Each item can be a standard community of the - form 1234:1234, a large community of the form large:1234:1234:1234 or the name of an alias defined in the - Community CRD. - items: - type: string - type: array - ipAddressPoolSelectors: - description: |- - A selector for the IPAddressPools which would get advertised via this advertisement. - If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools. - items: + - additionalPrinterColumns: + - jsonPath: .spec.ipAddressPools + name: IPAddressPools + type: string + - jsonPath: .spec.ipAddressPoolSelectors + name: IPAddressPool Selectors + type: string + - jsonPath: .spec.peers + name: Peers + type: string + - jsonPath: .spec.nodeSelectors + name: Node Selectors + priority: 10 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + BGPAdvertisement allows to advertise the IPs coming + from the selected IPAddressPools via BGP, setting the parameters of the + BGP Advertisement. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BGPAdvertisementSpec defines the desired state of BGPAdvertisement. + properties: + aggregationLength: + default: 32 + description: + The aggregation-length advertisement option lets you + “roll up” the /32s into a larger prefix. Defaults to 32. Works for + IPv4 addresses. + format: int32 + minimum: 1 + type: integer + aggregationLengthV6: + default: 128 + description: + The aggregation-length advertisement option lets you + “roll up” the /128s into a larger prefix. Defaults to 128. Works + for IPv6 addresses. + format: int32 + type: integer + communities: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: + The BGP communities to be associated with the announcement. Each item can be a standard community of the + form 1234:1234, a large community of the form large:1234:1234:1234 or the name of an alias defined in the + Community CRD. + items: + type: string + type: array + ipAddressPoolSelectors: + description: |- + A selector for the IPAddressPools which would get advertised via this advertisement. + If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: array - ipAddressPools: - description: The list of IPAddressPools to advertise via this advertisement, - selected by name. - items: - type: string - type: array - localPref: - description: |- - The BGP LOCAL_PREF attribute which is used by BGP best path algorithm, - Path with higher localpref is preferred over one with lower localpref. - format: int32 - type: integer - nodeSelectors: - description: NodeSelectors allows to limit the nodes to announce as - next hops for the LoadBalancer IP. When empty, all the nodes having are - announced as next hops. - items: + type: object + x-kubernetes-map-type: atomic + type: array + ipAddressPools: + description: + The list of IPAddressPools to advertise via this advertisement, + selected by name. + items: + type: string + type: array + localPref: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: + The BGP LOCAL_PREF attribute which is used by BGP best path algorithm, + Path with higher localpref is preferred over one with lower localpref. + format: int32 + type: integer + nodeSelectors: + description: + NodeSelectors allows to limit the nodes to announce as + next hops for the LoadBalancer IP. When empty, all the nodes having are + announced as next hops. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: array - peers: - description: |- - Peers limits the bgppeer to advertise the ips of the selected pools to. - When empty, the loadbalancer IP is announced to all the BGPPeers configured. - items: - type: string - type: array - type: object - status: - description: BGPAdvertisementStatus defines the observed state of BGPAdvertisement. - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + x-kubernetes-map-type: atomic + type: array + peers: + description: |- + Peers limits the bgppeer to advertise the ips of the selected pools to. + When empty, the loadbalancer IP is announced to all the BGPPeers configured. + items: + type: string + type: array + type: object + status: + description: BGPAdvertisementStatus defines the observed state of BGPAdvertisement. + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -362,8 +371,8 @@ spec: namespace: metallb-system path: /convert conversionReviewVersions: - - v1beta1 - - v1beta2 + - v1beta1 + - v1beta2 group: metallb.io names: kind: BGPPeer @@ -372,340 +381,351 @@ spec: singular: bgppeer scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .spec.peerAddress - name: Address - type: string - - jsonPath: .spec.peerASN - name: ASN - type: string - - jsonPath: .spec.bfdProfile - name: BFD Profile - type: string - - jsonPath: .spec.ebgpMultiHop - name: Multi Hops - type: string - deprecated: true - deprecationWarning: v1beta1 is deprecated, please use v1beta2 - name: v1beta1 - schema: - openAPIV3Schema: - description: BGPPeer is the Schema for the peers API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: BGPPeerSpec defines the desired state of Peer. - properties: - bfdProfile: - type: string - ebgpMultiHop: - description: EBGP peer is multi-hops away - type: boolean - holdTime: - description: Requested BGP hold time, per RFC4271. - type: string - keepaliveTime: - description: Requested BGP keepalive time, per RFC4271. - type: string - myASN: - description: AS number to use for the local end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - nodeSelectors: - description: |- - Only connect to this peer on nodes that match one of these - selectors. - items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: + - additionalPrinterColumns: + - jsonPath: .spec.peerAddress + name: Address + type: string + - jsonPath: .spec.peerASN + name: ASN + type: string + - jsonPath: .spec.bfdProfile + name: BFD Profile + type: string + - jsonPath: .spec.ebgpMultiHop + name: Multi Hops + type: string + deprecated: true + deprecationWarning: v1beta1 is deprecated, please use v1beta2 + name: v1beta1 + schema: + openAPIV3Schema: + description: BGPPeer is the Schema for the peers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BGPPeerSpec defines the desired state of Peer. + properties: + bfdProfile: + type: string + ebgpMultiHop: + description: EBGP peer is multi-hops away + type: boolean + holdTime: + description: Requested BGP hold time, per RFC4271. + type: string + keepaliveTime: + description: Requested BGP keepalive time, per RFC4271. + type: string + myASN: + description: AS number to use for the local end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + nodeSelectors: + description: |- + Only connect to this peer on nodes that match one of these + selectors. + items: + properties: + matchExpressions: + items: + properties: + key: type: string - minItems: 1 - type: array - required: - - key - - operator - - values + operator: + type: string + values: + items: + type: string + minItems: 1 + type: array + required: + - key + - operator + - values + type: object + type: array + matchLabels: + additionalProperties: + type: string type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - type: array - password: - description: Authentication password for routers enforcing TCP MD5 - authenticated sessions - type: string - peerASN: - description: AS number to expect from the remote end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - peerAddress: - description: Address to dial when establishing the session. - type: string - peerPort: - description: Port to dial when establishing the session. - maximum: 16384 - minimum: 0 - type: integer - routerID: - description: BGP router ID to advertise to the peer - type: string - sourceAddress: - description: Source address to use when establishing the session. - type: string - required: - - myASN - - peerASN - - peerAddress - type: object - status: - description: BGPPeerStatus defines the observed state of Peer. - type: object - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.peerAddress - name: Address - type: string - - jsonPath: .spec.peerASN - name: ASN - type: string - - jsonPath: .spec.bfdProfile - name: BFD Profile - type: string - - jsonPath: .spec.ebgpMultiHop - name: Multi Hops - type: string - name: v1beta2 - schema: - openAPIV3Schema: - description: BGPPeer is the Schema for the peers API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: BGPPeerSpec defines the desired state of Peer. - properties: - bfdProfile: - description: The name of the BFD Profile to be used for the BFD session - associated to the BGP session. If not set, the BFD session won't - be set up. - type: string - connectTime: - description: Requested BGP connect time, controls how long BGP waits - between connection attempts to a neighbor. - type: string - x-kubernetes-validations: - - message: connect time should be between 1 seconds to 65535 - rule: duration(self).getSeconds() >= 1 && duration(self).getSeconds() - <= 65535 - - message: connect time should contain a whole number of seconds - rule: duration(self).getMilliseconds() % 1000 == 0 - disableMP: - default: false - description: To set if we want to disable MP BGP that will separate - IPv4 and IPv6 route exchanges into distinct BGP sessions. - type: boolean - dynamicASN: - description: |- - DynamicASN detects the AS number to use for the remote end of the session - without explicitly setting it via the ASN field. Limited to: - internal - if the neighbor's ASN is different than MyASN connection is denied. - external - if the neighbor's ASN is the same as MyASN the connection is denied. - ASN and DynamicASN are mutually exclusive and one of them must be specified. - enum: - - internal - - external - type: string - ebgpMultiHop: - description: To set if the BGPPeer is multi-hops away. Needed for - FRR mode only. - type: boolean - enableGracefulRestart: - description: |- - EnableGracefulRestart allows BGP peer to continue to forward data packets - along known routes while the routing protocol information is being - restored. This field is immutable because it requires restart of the BGP - session. Supported for FRR mode only. - type: boolean - x-kubernetes-validations: - - message: EnableGracefulRestart cannot be changed after creation - rule: self == oldSelf - holdTime: - description: Requested BGP hold time, per RFC4271. - type: string - keepaliveTime: - description: Requested BGP keepalive time, per RFC4271. - type: string - myASN: - description: AS number to use for the local end of the session. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - nodeSelectors: - description: |- - Only connect to this peer on nodes that match one of these - selectors. - items: + type: object + type: array + password: + description: + Authentication password for routers enforcing TCP MD5 + authenticated sessions + type: string + peerASN: + description: AS number to expect from the remote end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + peerAddress: + description: Address to dial when establishing the session. + type: string + peerPort: + description: Port to dial when establishing the session. + maximum: 16384 + minimum: 0 + type: integer + routerID: + description: BGP router ID to advertise to the peer + type: string + sourceAddress: + description: Source address to use when establishing the session. + type: string + required: + - myASN + - peerASN + - peerAddress + type: object + status: + description: BGPPeerStatus defines the observed state of Peer. + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.peerAddress + name: Address + type: string + - jsonPath: .spec.peerASN + name: ASN + type: string + - jsonPath: .spec.bfdProfile + name: BFD Profile + type: string + - jsonPath: .spec.ebgpMultiHop + name: Multi Hops + type: string + name: v1beta2 + schema: + openAPIV3Schema: + description: BGPPeer is the Schema for the peers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BGPPeerSpec defines the desired state of Peer. + properties: + bfdProfile: + description: + The name of the BFD Profile to be used for the BFD session + associated to the BGP session. If not set, the BFD session won't + be set up. + type: string + connectTime: + description: + Requested BGP connect time, controls how long BGP waits + between connection attempts to a neighbor. + type: string + x-kubernetes-validations: + - message: connect time should be between 1 seconds to 65535 + rule: + duration(self).getSeconds() >= 1 && duration(self).getSeconds() + <= 65535 + - message: connect time should contain a whole number of seconds + rule: duration(self).getMilliseconds() % 1000 == 0 + disableMP: + default: false + description: + To set if we want to disable MP BGP that will separate + IPv4 and IPv6 route exchanges into distinct BGP sessions. + type: boolean + dynamicASN: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: + DynamicASN detects the AS number to use for the remote end of the session + without explicitly setting it via the ASN field. Limited to: + internal - if the neighbor's ASN is different than MyASN connection is denied. + external - if the neighbor's ASN is the same as MyASN the connection is denied. + ASN and DynamicASN are mutually exclusive and one of them must be specified. + enum: + - internal + - external + type: string + ebgpMultiHop: + description: + To set if the BGPPeer is multi-hops away. Needed for + FRR mode only. + type: boolean + enableGracefulRestart: + description: |- + EnableGracefulRestart allows BGP peer to continue to forward data packets + along known routes while the routing protocol information is being + restored. This field is immutable because it requires restart of the BGP + session. Supported for FRR mode only. + type: boolean + x-kubernetes-validations: + - message: EnableGracefulRestart cannot be changed after creation + rule: self == oldSelf + holdTime: + description: Requested BGP hold time, per RFC4271. + type: string + keepaliveTime: + description: Requested BGP keepalive time, per RFC4271. + type: string + myASN: + description: AS number to use for the local end of the session. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + nodeSelectors: + description: |- + Only connect to this peer on nodes that match one of these + selectors. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object + type: object + x-kubernetes-map-type: atomic + type: array + password: + description: + Authentication password for routers enforcing TCP MD5 + authenticated sessions + type: string + passwordSecret: + description: |- + passwordSecret is name of the authentication secret for BGP Peer. + the secret must be of type "kubernetes.io/basic-auth", and created in the + same namespace as the MetalLB deployment. The password is stored in the + secret as the key "password". + properties: + name: + description: + name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: + namespace defines the space within which the secret + name must be unique. + type: string type: object x-kubernetes-map-type: atomic - type: array - password: - description: Authentication password for routers enforcing TCP MD5 - authenticated sessions - type: string - passwordSecret: - description: |- - passwordSecret is name of the authentication secret for BGP Peer. - the secret must be of type "kubernetes.io/basic-auth", and created in the - same namespace as the MetalLB deployment. The password is stored in the - secret as the key "password". - properties: - name: - description: name is unique within a namespace to reference a - secret resource. - type: string - namespace: - description: namespace defines the space within which the secret - name must be unique. - type: string - type: object - x-kubernetes-map-type: atomic - peerASN: - description: |- - AS number to expect from the remote end of the session. - ASN and DynamicASN are mutually exclusive and one of them must be specified. - format: int32 - maximum: 4294967295 - minimum: 0 - type: integer - peerAddress: - description: Address to dial when establishing the session. - type: string - peerPort: - default: 179 - description: Port to dial when establishing the session. - maximum: 16384 - minimum: 0 - type: integer - routerID: - description: BGP router ID to advertise to the peer - type: string - sourceAddress: - description: Source address to use when establishing the session. - type: string - vrf: - description: |- - To set if we want to peer with the BGPPeer using an interface belonging to - a host vrf - type: string - required: - - myASN - - peerAddress - type: object - status: - description: BGPPeerStatus defines the observed state of Peer. - type: object - type: object - served: true - storage: true - subresources: - status: {} + peerASN: + description: |- + AS number to expect from the remote end of the session. + ASN and DynamicASN are mutually exclusive and one of them must be specified. + format: int32 + maximum: 4294967295 + minimum: 0 + type: integer + peerAddress: + description: Address to dial when establishing the session. + type: string + peerPort: + default: 179 + description: Port to dial when establishing the session. + maximum: 16384 + minimum: 0 + type: integer + routerID: + description: BGP router ID to advertise to the peer + type: string + sourceAddress: + description: Source address to use when establishing the session. + type: string + vrf: + description: |- + To set if we want to peer with the BGPPeer using an interface belonging to + a host vrf + type: string + required: + - myASN + - peerAddress + type: object + status: + description: BGPPeerStatus defines the observed state of Peer. + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -722,55 +742,55 @@ spec: singular: community scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - Community is a collection of aliases for communities. - Users can define named aliases to be used in the BGPPeer CRD. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: CommunitySpec defines the desired state of Community. - properties: - communities: - items: - properties: - name: - description: The name of the alias for the community. - type: string - value: - description: |- - The BGP community value corresponding to the given name. Can be a standard community of the form 1234:1234 - or a large community of the form large:1234:1234:1234. - type: string - type: object - type: array - type: object - status: - description: CommunityStatus defines the observed state of Community. - type: object - type: object - served: true - storage: true - subresources: - status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: |- + Community is a collection of aliases for communities. + Users can define named aliases to be used in the BGPPeer CRD. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: CommunitySpec defines the desired state of Community. + properties: + communities: + items: + properties: + name: + description: The name of the alias for the community. + type: string + value: + description: |- + The BGP community value corresponding to the given name. Can be a standard community of the form 1234:1234 + or a large community of the form large:1234:1234:1234. + type: string + type: object + type: array + type: object + status: + description: CommunityStatus defines the observed state of Community. + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -787,206 +807,212 @@ spec: singular: ipaddresspool scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .spec.autoAssign - name: Auto Assign - type: boolean - - jsonPath: .spec.avoidBuggyIPs - name: Avoid Buggy IPs - type: boolean - - jsonPath: .spec.addresses - name: Addresses - type: string - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - IPAddressPool represents a pool of IP addresses that can be allocated - to LoadBalancer services. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: IPAddressPoolSpec defines the desired state of IPAddressPool. - properties: - addresses: - description: |- - A list of IP address ranges over which MetalLB has authority. - You can list multiple ranges in a single pool, they will all share the - same settings. Each range can be either a CIDR prefix, or an explicit - start-end range of IPs. - items: - type: string - type: array - autoAssign: - default: true - description: |- - AutoAssign flag used to prevent MetallB from automatic allocation - for a pool. - type: boolean - avoidBuggyIPs: - default: false - description: |- - AvoidBuggyIPs prevents addresses ending with .0 and .255 - to be used by a pool. - type: boolean - serviceAllocation: - description: |- - AllocateTo makes ip pool allocation to specific namespace and/or service. - The controller will use the pool with lowest value of priority in case of - multiple matches. A pool with no priority set will be used only if the - pools with priority can't be used. If multiple matching IPAddressPools are - available it will check for the availability of IPs sorting the matching - IPAddressPools by priority, starting from the highest to the lowest. If - multiple IPAddressPools have the same priority, choice will be random. - properties: - namespaceSelectors: - description: |- - NamespaceSelectors list of label selectors to select namespace(s) for ip pool, - an alternative to using namespace list. - items: + - additionalPrinterColumns: + - jsonPath: .spec.autoAssign + name: Auto Assign + type: boolean + - jsonPath: .spec.avoidBuggyIPs + name: Avoid Buggy IPs + type: boolean + - jsonPath: .spec.addresses + name: Addresses + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + IPAddressPool represents a pool of IP addresses that can be allocated + to LoadBalancer services. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IPAddressPoolSpec defines the desired state of IPAddressPool. + properties: + addresses: + description: |- + A list of IP address ranges over which MetalLB has authority. + You can list multiple ranges in a single pool, they will all share the + same settings. Each range can be either a CIDR prefix, or an explicit + start-end range of IPs. + items: + type: string + type: array + autoAssign: + default: true + description: |- + AutoAssign flag used to prevent MetallB from automatic allocation + for a pool. + type: boolean + avoidBuggyIPs: + default: false + description: |- + AvoidBuggyIPs prevents addresses ending with .0 and .255 + to be used by a pool. + type: boolean + serviceAllocation: + description: |- + AllocateTo makes ip pool allocation to specific namespace and/or service. + The controller will use the pool with lowest value of priority in case of + multiple matches. A pool with no priority set will be used only if the + pools with priority can't be used. If multiple matching IPAddressPools are + available it will check for the availability of IPs sorting the matching + IPAddressPools by priority, starting from the highest to the lowest. If + multiple IPAddressPools have the same priority, choice will be random. + properties: + namespaceSelectors: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: + NamespaceSelectors list of label selectors to select namespace(s) for ip pool, + an alternative to using namespace list. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector + applies to. type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: array - namespaces: - description: Namespaces list of namespace(s) on which ip pool - can be attached. - items: - type: string - type: array - priority: - description: Priority priority given for ip pool while ip allocation - on a service. - type: integer - serviceSelectors: - description: |- - ServiceSelectors list of label selector to select service(s) for which ip pool - can be used for ip allocation. - items: + type: object + x-kubernetes-map-type: atomic + type: array + namespaces: + description: + Namespaces list of namespace(s) on which ip pool + can be attached. + items: + type: string + type: array + priority: + description: + Priority priority given for ip pool while ip allocation + on a service. + type: integer + serviceSelectors: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: + ServiceSelectors list of label selector to select service(s) for which ip pool + can be used for ip allocation. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector + applies to. type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: array - type: object - required: - - addresses - type: object - status: - description: IPAddressPoolStatus defines the observed state of IPAddressPool. - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} + type: object + x-kubernetes-map-type: atomic + type: array + type: object + required: + - addresses + type: object + status: + description: IPAddressPoolStatus defines the observed state of IPAddressPool. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1003,177 +1029,183 @@ spec: singular: l2advertisement scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .spec.ipAddressPools - name: IPAddressPools - type: string - - jsonPath: .spec.ipAddressPoolSelectors - name: IPAddressPool Selectors - type: string - - jsonPath: .spec.interfaces - name: Interfaces - type: string - - jsonPath: .spec.nodeSelectors - name: Node Selectors - priority: 10 - type: string - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - L2Advertisement allows to advertise the LoadBalancer IPs provided - by the selected pools via L2. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: L2AdvertisementSpec defines the desired state of L2Advertisement. - properties: - interfaces: - description: |- - A list of interfaces to announce from. The LB IP will be announced only from these interfaces. - If the field is not set, we advertise from all the interfaces on the host. - items: - type: string - type: array - ipAddressPoolSelectors: - description: |- - A selector for the IPAddressPools which would get advertised via this advertisement. - If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools. - items: + - additionalPrinterColumns: + - jsonPath: .spec.ipAddressPools + name: IPAddressPools + type: string + - jsonPath: .spec.ipAddressPoolSelectors + name: IPAddressPool Selectors + type: string + - jsonPath: .spec.interfaces + name: Interfaces + type: string + - jsonPath: .spec.nodeSelectors + name: Node Selectors + priority: 10 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + L2Advertisement allows to advertise the LoadBalancer IPs provided + by the selected pools via L2. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: L2AdvertisementSpec defines the desired state of L2Advertisement. + properties: + interfaces: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: array - ipAddressPools: - description: The list of IPAddressPools to advertise via this advertisement, - selected by name. - items: - type: string - type: array - nodeSelectors: - description: NodeSelectors allows to limit the nodes to announce as - next hops for the LoadBalancer IP. When empty, all the nodes having are - announced as next hops. - items: + A list of interfaces to announce from. The LB IP will be announced only from these interfaces. + If the field is not set, we advertise from all the interfaces on the host. + items: + type: string + type: array + ipAddressPoolSelectors: description: |- - A label selector is a label query over a set of resources. The result of matchLabels and - matchExpressions are ANDed. An empty label selector matches all objects. A null - label selector matches no objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: + A selector for the IPAddressPools which would get advertised via this advertisement. + If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + ipAddressPools: + description: + The list of IPAddressPools to advertise via this advertisement, + selected by name. + items: + type: string + type: array + nodeSelectors: + description: + NodeSelectors allows to limit the nodes to announce as + next hops for the LoadBalancer IP. When empty, all the nodes having are + announced as next hops. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: + matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: + key is the label key that the selector applies + to. type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: array - type: object - status: - description: L2AdvertisementStatus defines the observed state of L2Advertisement. - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + x-kubernetes-map-type: atomic + type: array + type: object + status: + description: L2AdvertisementStatus defines the observed state of L2Advertisement. + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1190,80 +1222,82 @@ spec: singular: servicel2status scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .status.node - name: Allocated Node - type: string - - jsonPath: .status.serviceName - name: Service Name - type: string - - jsonPath: .status.serviceNamespace - name: Service Namespace - type: string - name: v1beta1 - schema: - openAPIV3Schema: - description: ServiceL2Status reveals the actual traffic status of loadbalancer - services in layer2 mode. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ServiceL2StatusSpec defines the desired state of ServiceL2Status. - type: object - status: - description: MetalLBServiceL2Status defines the observed state of ServiceL2Status. - properties: - interfaces: - description: Interfaces indicates the interfaces that receive the - directed traffic - items: - description: InterfaceInfo defines interface info of layer2 announcement. - properties: - name: - description: Name the name of network interface card - type: string - type: object - type: array - node: - description: Node indicates the node that receives the directed traffic - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - serviceName: - description: ServiceName indicates the service this status represents - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - serviceNamespace: - description: ServiceNamespace indicates the namespace of the service - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - type: object - type: object - served: true - storage: true - subresources: - status: {} + - additionalPrinterColumns: + - jsonPath: .status.node + name: Allocated Node + type: string + - jsonPath: .status.serviceName + name: Service Name + type: string + - jsonPath: .status.serviceNamespace + name: Service Namespace + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: + ServiceL2Status reveals the actual traffic status of loadbalancer + services in layer2 mode. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ServiceL2StatusSpec defines the desired state of ServiceL2Status. + type: object + status: + description: MetalLBServiceL2Status defines the observed state of ServiceL2Status. + properties: + interfaces: + description: + Interfaces indicates the interfaces that receive the + directed traffic + items: + description: InterfaceInfo defines interface info of layer2 announcement. + properties: + name: + description: Name the name of network interface card + type: string + type: object + type: array + node: + description: Node indicates the node that receives the directed traffic + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + serviceName: + description: ServiceName indicates the service this status represents + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + serviceNamespace: + description: ServiceNamespace indicates the namespace of the service + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -1289,81 +1323,81 @@ metadata: name: controller namespace: metallb-system rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resourceNames: - - memberlist - resources: - - secrets - verbs: - - list -- apiGroups: - - apps - resourceNames: - - controller - resources: - - deployments - verbs: - - get -- apiGroups: - - metallb.io - resources: - - bgppeers - verbs: - - get - - list -- apiGroups: - - metallb.io - resources: - - bfdprofiles - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - ipaddresspools - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bgpadvertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - l2advertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - communities - verbs: - - get - - list - - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - memberlist + resources: + - secrets + verbs: + - list + - apiGroups: + - apps + resourceNames: + - controller + resources: + - deployments + verbs: + - get + - apiGroups: + - metallb.io + resources: + - bgppeers + verbs: + - get + - list + - apiGroups: + - metallb.io + resources: + - bfdprofiles + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - ipaddresspools + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bgpadvertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - l2advertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - communities + verbs: + - get + - list + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -1373,77 +1407,77 @@ metadata: name: pod-lister namespace: metallb-system rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - list - - get -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bfdprofiles - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bgppeers - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - l2advertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - bgpadvertisements - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - ipaddresspools - verbs: - - get - - list - - watch -- apiGroups: - - metallb.io - resources: - - communities - verbs: - - get - - list - - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - get + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bfdprofiles + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bgppeers + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - l2advertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - bgpadvertisements + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - ipaddresspools + verbs: + - get + - list + - watch + - apiGroups: + - metallb.io + resources: + - communities + verbs: + - get + - list + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -1452,89 +1486,89 @@ metadata: app: metallb name: metallb-system:controller rules: -- apiGroups: - - "" - resources: - - services - - namespaces - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - nodes - verbs: - - list -- apiGroups: - - "" - resources: - - services/status - verbs: - - update -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - policy - resourceNames: - - controller - resources: - - podsecuritypolicies - verbs: - - use -- apiGroups: - - admissionregistration.k8s.io - resourceNames: - - metallb-webhook-configuration - resources: - - validatingwebhookconfigurations - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resourceNames: - - bfdprofiles.metallb.io - - bgpadvertisements.metallb.io - - bgppeers.metallb.io - - ipaddresspools.metallb.io - - l2advertisements.metallb.io - - communities.metallb.io - resources: - - customresourcedefinitions - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - list - - watch + - apiGroups: + - "" + resources: + - services + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - "" + resources: + - services/status + verbs: + - update + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - policy + resourceNames: + - controller + resources: + - podsecuritypolicies + verbs: + - use + - apiGroups: + - admissionregistration.k8s.io + resourceNames: + - metallb-webhook-configuration + resources: + - validatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - list + - watch + - apiGroups: + - apiextensions.k8s.io + resourceNames: + - bfdprofiles.metallb.io + - bgpadvertisements.metallb.io + - bgppeers.metallb.io + - ipaddresspools.metallb.io + - l2advertisements.metallb.io + - communities.metallb.io + resources: + - customresourcedefinitions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - list + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -1543,47 +1577,47 @@ metadata: app: metallb name: metallb-system:speaker rules: -- apiGroups: - - metallb.io - resources: - - servicel2statuses - - servicel2statuses/status - verbs: - - '*' -- apiGroups: - - "" - resources: - - services - - endpoints - - nodes - - namespaces - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - policy - resourceNames: - - speaker - resources: - - podsecuritypolicies - verbs: - - use + - apiGroups: + - metallb.io + resources: + - servicel2statuses + - servicel2statuses/status + verbs: + - "*" + - apiGroups: + - "" + resources: + - services + - endpoints + - nodes + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - policy + resourceNames: + - speaker + resources: + - podsecuritypolicies + verbs: + - use --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -1597,9 +1631,9 @@ roleRef: kind: Role name: controller subjects: -- kind: ServiceAccount - name: controller - namespace: metallb-system + - kind: ServiceAccount + name: controller + namespace: metallb-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -1613,9 +1647,9 @@ roleRef: kind: Role name: pod-lister subjects: -- kind: ServiceAccount - name: speaker - namespace: metallb-system + - kind: ServiceAccount + name: speaker + namespace: metallb-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -1628,9 +1662,9 @@ roleRef: kind: ClusterRole name: metallb-system:controller subjects: -- kind: ServiceAccount - name: controller - namespace: metallb-system + - kind: ServiceAccount + name: controller + namespace: metallb-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -1643,9 +1677,9 @@ roleRef: kind: ClusterRole name: metallb-system:speaker subjects: -- kind: ServiceAccount - name: speaker - namespace: metallb-system + - kind: ServiceAccount + name: speaker + namespace: metallb-system --- apiVersion: v1 data: @@ -1669,8 +1703,8 @@ metadata: namespace: metallb-system spec: ports: - - port: 443 - targetPort: 9443 + - port: 443 + targetPort: 9443 selector: component: controller --- @@ -1698,51 +1732,51 @@ spec: component: controller spec: containers: - - args: - - --port=7472 - - --log-level=info - - --tls-min-version=VersionTLS12 - env: - - name: METALLB_ML_SECRET_NAME - value: memberlist - - name: METALLB_DEPLOYMENT - value: controller - image: quay.io/metallb/controller:v0.14.9 - livenessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - name: controller - ports: - - containerPort: 7472 - name: monitoring - - containerPort: 9443 - name: webhook-server - protocol: TCP - readinessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - all - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: cert - readOnly: true + - args: + - --port=7472 + - --log-level=info + - --tls-min-version=VersionTLS12 + env: + - name: METALLB_ML_SECRET_NAME + value: memberlist + - name: METALLB_DEPLOYMENT + value: controller + image: quay.io/metallb/controller:v0.14.9 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: controller + ports: + - containerPort: 7472 + name: monitoring + - containerPort: 9443 + name: webhook-server + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - all + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true nodeSelector: kubernetes.io/os: linux securityContext: @@ -1752,10 +1786,10 @@ spec: serviceAccountName: controller terminationGracePeriodSeconds: 0 volumes: - - name: cert - secret: - defaultMode: 420 - secretName: metallb-webhook-cert + - name: cert + secret: + defaultMode: 420 + secretName: metallb-webhook-cert --- apiVersion: apps/v1 kind: DaemonSet @@ -1780,94 +1814,94 @@ spec: component: speaker spec: containers: - - args: - - --port=7472 - - --log-level=info - env: - - name: METALLB_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: METALLB_POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: METALLB_HOST - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: METALLB_ML_BIND_ADDR - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: METALLB_ML_LABELS - value: app=metallb,component=speaker - - name: METALLB_ML_SECRET_KEY_PATH - value: /etc/ml_secret_key - image: quay.io/metallb/speaker:v0.14.9 - livenessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - name: speaker - ports: - - containerPort: 7472 - name: monitoring - - containerPort: 7946 - name: memberlist-tcp - - containerPort: 7946 - name: memberlist-udp - protocol: UDP - readinessProbe: - failureThreshold: 3 - httpGet: - path: /metrics - port: monitoring - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - securityContext: - allowPrivilegeEscalation: false - capabilities: - add: - - NET_RAW - drop: - - ALL - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /etc/ml_secret_key - name: memberlist - readOnly: true - - mountPath: /etc/metallb - name: metallb-excludel2 - readOnly: true + - args: + - --port=7472 + - --log-level=info + env: + - name: METALLB_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: METALLB_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: METALLB_HOST + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: METALLB_ML_BIND_ADDR + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: METALLB_ML_LABELS + value: app=metallb,component=speaker + - name: METALLB_ML_SECRET_KEY_PATH + value: /etc/ml_secret_key + image: quay.io/metallb/speaker:v0.14.9 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: speaker + ports: + - containerPort: 7472 + name: monitoring + - containerPort: 7946 + name: memberlist-tcp + - containerPort: 7946 + name: memberlist-udp + protocol: UDP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /metrics + port: monitoring + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - NET_RAW + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /etc/ml_secret_key + name: memberlist + readOnly: true + - mountPath: /etc/metallb + name: metallb-excludel2 + readOnly: true hostNetwork: true nodeSelector: kubernetes.io/os: linux serviceAccountName: speaker terminationGracePeriodSeconds: 2 tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/master - operator: Exists - - effect: NoSchedule - key: node-role.kubernetes.io/control-plane - operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + operator: Exists volumes: - - name: memberlist - secret: - defaultMode: 420 - secretName: memberlist - - configMap: - defaultMode: 256 + - name: memberlist + secret: + defaultMode: 420 + secretName: memberlist + - configMap: + defaultMode: 256 + name: metallb-excludel2 name: metallb-excludel2 - name: metallb-excludel2 --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -1875,123 +1909,123 @@ metadata: creationTimestamp: null name: metallb-webhook-configuration webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: metallb-webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta2-bgppeer - failurePolicy: Fail - name: bgppeersvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta2 - operations: - - CREATE - - UPDATE - resources: - - bgppeers - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: metallb-webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-bfdprofile - failurePolicy: Fail - name: bfdprofilevalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - DELETE - resources: - - bfdprofiles - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: metallb-webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-bgpadvertisement - failurePolicy: Fail - name: bgpadvertisementvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - bgpadvertisements - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: metallb-webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-community - failurePolicy: Fail - name: communityvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - communities - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: metallb-webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-ipaddresspool - failurePolicy: Fail - name: ipaddresspoolvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - ipaddresspools - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: metallb-webhook-service - namespace: metallb-system - path: /validate-metallb-io-v1beta1-l2advertisement - failurePolicy: Fail - name: l2advertisementvalidationwebhook.metallb.io - rules: - - apiGroups: - - metallb.io - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - l2advertisements - sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: metallb-webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta2-bgppeer + failurePolicy: Fail + name: bgppeersvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta2 + operations: + - CREATE + - UPDATE + resources: + - bgppeers + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: metallb-webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-bfdprofile + failurePolicy: Fail + name: bfdprofilevalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - DELETE + resources: + - bfdprofiles + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: metallb-webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-bgpadvertisement + failurePolicy: Fail + name: bgpadvertisementvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - bgpadvertisements + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: metallb-webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-community + failurePolicy: Fail + name: communityvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - communities + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: metallb-webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-ipaddresspool + failurePolicy: Fail + name: ipaddresspoolvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - ipaddresspools + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: metallb-webhook-service + namespace: metallb-system + path: /validate-metallb-io-v1beta1-l2advertisement + failurePolicy: Fail + name: l2advertisementvalidationwebhook.metallb.io + rules: + - apiGroups: + - metallb.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - l2advertisements + sideEffects: None diff --git a/third_party/meshnet/README.md b/third_party/meshnet/README.md index e1b3d394a..ee00f14ba 100644 --- a/third_party/meshnet/README.md +++ b/third_party/meshnet/README.md @@ -1,11 +1,19 @@ # meshnet CNI (KNE Fork) -> [!NOTE] -> This directory contains a fork of the archived [networkop/meshnet-cni](https://github.com/networkop/meshnet-cni) project, now integrated and maintained directly within the OpenConfig KNE repository. +> [!NOTE] This directory contains a fork of the archived +> [networkop/meshnet-cni](https://github.com/networkop/meshnet-cni) project, now +> integrated and maintained directly within the OpenConfig KNE repository. > -> Future development, bug fixes, and CI/CD testing are managed as part of the parent [KNE project](https://github.com/openconfig/kne). Please file any issues or pull requests in the main KNE repository. +> Future development, bug fixes, and CI/CD testing are managed as part of the +> parent [KNE project](https://github.com/openconfig/kne). Please file any +> issues or pull requests in the main KNE repository. -**meshnet** is a (K8s) CNI plugin to create arbitrary network topologies out of point-to-point links with the help of [koko](https://github.com/redhat-nfvpe/koko). Heavily inspired by [Ratchet-CNI](https://github.com/dougbtv/ratchet-cni), [kokonet](https://github.com/s1061123/kokonet) and [Multus](https://github.com/intel/multus-cni). +**meshnet** is a (K8s) CNI plugin to create arbitrary network topologies out of +point-to-point links with the help of +[koko](https://github.com/redhat-nfvpe/koko). Heavily inspired by +[Ratchet-CNI](https://github.com/dougbtv/ratchet-cni), +[kokonet](https://github.com/s1061123/kokonet) and +[Multus](https://github.com/intel/multus-cni). ## New in version 0.2.0 @@ -15,14 +23,19 @@ ## Architecture -The goal of this plugin is to interconnect pods via direct point-to-point links according to a pre-define topology. To do that, the plugin uses three types of links: +The goal of this plugin is to interconnect pods via direct point-to-point links +according to a pre-define topology. To do that, the plugin uses three types of +links: - **veth** - used to connect two pods running on the same host - **vxlan** - used to connected two pods running on different hosts - - Optionally users can opt in to use **gRPC** instead, for this use case. Check [Installation](#installation). -- **macvlan** - used to connect to external resources, i.e. any physical or virtual device outside of the Kubernetes cluster + - Optionally users can opt in to use **gRPC** instead, for this use case. + Check [Installation](#installation). +- **macvlan** - used to connect to external resources, i.e. any physical or + virtual device outside of the Kubernetes cluster -Topology information, represented as a list of links per pod, is stored in k8s's etcd datastore as custom resources: +Topology information, represented as a list of links per pod, is stored in k8s's +etcd datastore as custom resources: ```yaml apiVersion: networkop.co.uk/v1beta1 @@ -39,7 +52,8 @@ spec: peer_ip: 12.12.12.2/24 ``` -The plugin configuration file contains a "chained" `meshnet` in the list of plugins: +The plugin configuration file contains a "chained" `meshnet` in the list of +plugins: ```yaml { @@ -67,27 +81,46 @@ The plugin configuration file contains a "chained" `meshnet` in the list of plug The plugin consists of three main components: -- **datastore** - a k8s native etcd backend cluster storing topology information and runtime pod metadata (e.g. pod IP address and NetNS) +- **datastore** - a k8s native etcd backend cluster storing topology + information and runtime pod metadata (e.g. pod IP address and NetNS) - **meshnet** - a CNI binary responsible for pod's network configuration -- **meshnetd** - a daemon responsible for communication with k8s and vxlan (or grpc) link configuration updates +- **meshnetd** - a daemon responsible for communication with k8s and vxlan (or + grpc) link configuration updates ![architecture](arch_v0_2_0.png) -Below is the order of operation of the plugin from the perspective of kube-node-1: +Below is the order of operation of the plugin from the perspective of +kube-node-1: -1. Kubernetes cluster gets populated with the topology information via custom resources -2. pod-1/pod-2 come up, local kubelet calls the `meshnet` binary for each pod to setup their networking. -3. Based on the CNI configuration file, Kubelet calls meshnet to set up additional interfaces. +1. Kubernetes cluster gets populated with the topology information via custom + resources +2. pod-1/pod-2 come up, local kubelet calls the `meshnet` binary for each pod + to setup their networking. +3. Based on the CNI configuration file, Kubelet calls meshnet to set up + additional interfaces. - > Note that `eth0` is **always** setup by one of the existing CNI plugins. It is used to provide external connectivity to and from the pod + > Note that `eth0` is **always** setup by one of the existing CNI plugins. + > It is used to provide external connectivity to and from the pod -4. meshnet binary updates the topology data with pod's runtime metadata (namespace filepath and primary IP address). -5. meshnet binary (via a local meshnet daemon) retrieves the list of `links` and looks up peer pod's metadata to identify what kind of link to setup - veth, vxlan or macvlan. -6. If the peer is on the same node, it calls koko to setup a `veth` link between the two pods. -7. If the peer is on the remote node, it does two things: - - 7.1 It calls koko to setup a local `vxlan` link. - - 7.2 It makes a gRPC `Update` call to the remote node's meshnet daemon, specifying this link's metadata (e.g. VTEP IP and VNI). -8. Upon receipt of this information, remote node's `meshnetd` idepmotently updates the local vxlan link, i.e. it creates a new link, updates the existing link if there's a change or does nothing if the link attributes are the same. +4. meshnet binary updates the topology data with pod's runtime metadata + (namespace filepath and primary IP address). + +5. meshnet binary (via a local meshnet daemon) retrieves the list of `links` + and looks up peer pod's metadata to identify what kind of link to setup - + veth, vxlan or macvlan. + +6. If the peer is on the same node, it calls koko to setup a `veth` link + between the two pods. + +7. If the peer is on the remote node, it does two things: + - 7.1 It calls koko to setup a local `vxlan` link. + - 7.2 It makes a gRPC `Update` call to the remote node's meshnet daemon, + specifying this link's metadata (e.g. VTEP IP and VNI). + +8. Upon receipt of this information, remote node's `meshnetd` idepmotently + updates the local vxlan link, i.e. it creates a new link, updates the + existing link if there's a change or does nothing if the link attributes are + the same. ## Local Demo @@ -156,7 +189,8 @@ make down ## Installation -The following manifest will create all that's required for meshnet plugin to function, i.e.: +The following manifest will create all that's required for meshnet plugin to +function, i.e.: - A `meshnet` namespace - A Custom Resource Definition for network topologies @@ -172,9 +206,15 @@ kubectl apply -k manifests/overlays/grpc-link #### Interaction with existing resources -Meshnet plugin was designed to work alongside any other existing or future Kubernetes resources that may not require any special topology to be set up for them. Every pod coming up will have its first interface setup by an existing CNI plugin (e.g. flannel, weave, calico) and will only have additional interfaces connected if there's a matching custom `Topology` resource. +Meshnet plugin was designed to work alongside any other existing or future +Kubernetes resources that may not require any special topology to be set up for +them. Every pod coming up will have its first interface setup by an existing CNI +plugin (e.g. flannel, weave, calico) and will only have additional interfaces +connected if there's a matching custom `Topology` resource. -During the initial installation process, meshnet will try to insert itself into the list of CNI plugins. For example, assuming the following configuration is present in `/etc/cni/net.d/weave.conf`: +During the initial installation process, meshnet will try to insert itself into +the list of CNI plugins. For example, assuming the following configuration is +present in `/etc/cni/net.d/weave.conf`: ```json { @@ -184,7 +224,8 @@ During the initial installation process, meshnet will try to insert itself into } ``` -Meshnet will convert the above to conflist and produce the file `/etc/cni/net.d/00-meshnet.conflist` with the following content: +Meshnet will convert the above to conflist and produce the file +`/etc/cni/net.d/00-meshnet.conflist` with the following content: ```json { @@ -208,19 +249,28 @@ Meshnet will convert the above to conflist and produce the file `/etc/cni/net.d/ ### Customising installation paths -In some cases, Kubernetes distros may store CNI configuration files and binaries in non-standard directories and override them with `--cni-bin-dir` and `--cni-conf-dir` flags. In order to install meshnet into the right directories, create a new overlay under `manifests/overlays` and patch the `cni-dir` or `cni-bin` volumes with the correct location. See [kops overlay](manifests/overlays/kops) for an example. +In some cases, Kubernetes distros may store CNI configuration files and binaries +in non-standard directories and override them with `--cni-bin-dir` and +`--cni-conf-dir` flags. In order to install meshnet into the right directories, +create a new overlay under `manifests/overlays` and patch the `cni-dir` or +`cni-bin` volumes with the correct location. See +[kops overlay](manifests/overlays/kops) for an example. ### Resilient topologies -If you need to have Pods restarted and re-scheduled by the kube-controller, it's possible to deploy them as StatefulSets with replica number = 1. See [this example](/tests/2node-sts.yml). +If you need to have Pods restarted and re-scheduled by the kube-controller, it's +possible to deploy them as StatefulSets with replica number = 1. See +[this example](/tests/2node-sts.yml). ### Examples -Inside the `tests` directory there are 4 manifests with the following test topologies: +Inside the `tests` directory there are 4 manifests with the following test +topologies: - A simple point-to-point 2-node topology - A 3-node topology connected as a triangle -- A 5-node topology connected as [quincunx](https://en.wikipedia.org/wiki/Quincunx) +- A 5-node topology connected as + [quincunx](https://en.wikipedia.org/wiki/Quincunx) - A 2-node topology with 2nd node connected to a macvlan interface #### Use k8s-topo to orchestrate network topologies @@ -310,25 +360,37 @@ k8s-topo --destroy examples/builder/random.yml There are two places to collect meshnet logs: -1. Meshnet daemon logs can be collected outside of the Kubernetes cluster. For example, the below command will collect logs from all meshnet daemons using [stern](https://github.com/wercker/stern) +1. Meshnet daemon logs can be collected outside of the Kubernetes cluster. For + example, the below command will collect logs from all meshnet daemons using + [stern](https://github.com/wercker/stern) - ```sh - stern meshnet -n meshnet - ``` + ```sh + stern meshnet -n meshnet + ``` -2. Meshnet plugin (binary) logs can be collected on the respective Kubernetes nodes, e.g. +2. Meshnet plugin (binary) logs can be collected on the respective Kubernetes + nodes, e.g. - ```text - root@kind-worker:/# journalctl -u kubelet - ``` + ```text + root@kind-worker:/# journalctl -u kubelet + ``` --- -Each POD is supposed to run an `init-wait` container that waits for the right number of interface to be connected before passing the ball to the main container. However, sometimes, PODs restart resulting in the missing interfaces inside the main container process, since they may have been added _AFTER_ the process that reads the container interface list (e.g. qemu-kvm for VM-based containers). This is the procedure I use to identify the cause of the failure: - -1. Identify which POD is at fault. This will most likely be the incorrect number of interfaces. -2. Identify which interface is missing or was added last. -3. Identify the correlation between the pair of containers interconnected by the missing interface -4. Look for the peer container's failures using `kubectl get events --sort-by=.metadata.creationTimestamp'` -5. Identify which k8s node this POD is running on `kubectl get pods acme-scs1001-a -o yaml | grep node` -6. On that node check the `journalctl` for any errors associated with the POD +Each POD is supposed to run an `init-wait` container that waits for the right +number of interface to be connected before passing the ball to the main +container. However, sometimes, PODs restart resulting in the missing interfaces +inside the main container process, since they may have been added _AFTER_ the +process that reads the container interface list (e.g. qemu-kvm for VM-based +containers). This is the procedure I use to identify the cause of the failure: + +1. Identify which POD is at fault. This will most likely be the incorrect + number of interfaces. +2. Identify which interface is missing or was added last. +3. Identify the correlation between the pair of containers interconnected by + the missing interface +4. Look for the peer container's failures using `kubectl get events +--sort-by=.metadata.creationTimestamp'` +5. Identify which k8s node this POD is running on `kubectl get pods +acme-scs1001-a -o yaml | grep node` +6. On that node check the `journalctl` for any errors associated with the POD diff --git a/third_party/meshnet/daemon/proto/meshnet/v1beta1/meshnet.proto b/third_party/meshnet/daemon/proto/meshnet/v1beta1/meshnet.proto index 40a65ccd0..4c02711ed 100644 --- a/third_party/meshnet/daemon/proto/meshnet/v1beta1/meshnet.proto +++ b/third_party/meshnet/daemon/proto/meshnet/v1beta1/meshnet.proto @@ -31,10 +31,10 @@ message PodQuery { } message SkipQuery { - string pod = 1; + string pod = 1; string peer = 2; string kube_ns = 3; - int64 link_id = 4; + int64 link_id = 4; } message BoolResponse { @@ -68,12 +68,12 @@ message WireDef { // Interface name, which comes from topology definition and to be put // inside container. // This filed is used when grpc-wire to be created. - string intf_name_in_pod = 3; + string intf_name_in_pod = 3; // Network name space of the local pod which is connected to this // grpc-wire - string local_pod_net_ns = 4; - + string local_pod_net_ns = 4; + // Each meshnet link has a uid. int64 link_uid = 5; @@ -89,7 +89,6 @@ message WireDef { string topo_ns = 8; string local_pod_ip = 9; - } message WireCreateResponse { @@ -103,8 +102,8 @@ message WireDownResponse { } message Packet { - // the remote machine interface id, to which this packet should be delivered. - int64 remot_intf_id = 1; + // the remote machine interface id, to which this packet should be delivered. + int64 remot_intf_id = 1; bytes frame = 2; } @@ -113,20 +112,19 @@ message GenerateNodeInterfaceNameRequest { string pod_name = 2; } - message GenerateNodeInterfaceNameResponse { bool ok = 1; - string node_intf_name = 2; + string node_intf_name = 2; } service Local { - rpc Get (PodQuery) returns (Pod); - rpc SetAlive (Pod) returns (BoolResponse); - rpc SkipReverse (SkipQuery) returns (BoolResponse); - rpc Skip (SkipQuery) returns (BoolResponse); - rpc IsSkipped (SkipQuery) returns (BoolResponse); + rpc Get(PodQuery) returns (Pod); + rpc SetAlive(Pod) returns (BoolResponse); + rpc SkipReverse(SkipQuery) returns (BoolResponse); + rpc Skip(SkipQuery) returns (BoolResponse); + rpc IsSkipped(SkipQuery) returns (BoolResponse); - rpc GRPCWireExists(WireDef) returns (WireCreateResponse); + rpc GRPCWireExists(WireDef) returns (WireCreateResponse); rpc AddGRPCWireLocal(WireDef) returns (BoolResponse); rpc RemGRPCWire(WireDef) returns (BoolResponse); @@ -138,12 +136,12 @@ service Local { } service Remote { - rpc Update (RemotePod) returns (BoolResponse); + rpc Update(RemotePod) returns (BoolResponse); rpc AddGRPCWireRemote(WireDef) returns (WireCreateResponse); rpc GRPCWireDownRemote(WireDef) returns (WireDownResponse); } service WireProtocol { - rpc SendToOnce (Packet) returns (BoolResponse); - rpc SendToStream (stream Packet) returns (BoolResponse); -} \ No newline at end of file + rpc SendToOnce(Packet) returns (BoolResponse); + rpc SendToStream(stream Packet) returns (BoolResponse); +} diff --git a/third_party/meshnet/docs/implementation.md b/third_party/meshnet/docs/implementation.md index 1f48ad3e9..7a75e883b 100644 --- a/third_party/meshnet/docs/implementation.md +++ b/third_party/meshnet/docs/implementation.md @@ -1,21 +1,41 @@ # Motivation -In K8S usually pods across nodes are connected using VxLAN/IPnIP/GRE overlay. Our objective is to connect these pods using grpc p2p overlay. One of the advantages is that there is **no reduction of MTU**. For example adding VXLAN will reduce virtual interface MTU by 20 bytes. With grpc-wire interface MTU remains 1500 (or can be made higher - not tried yet). Other advantages could be to add telemetry, generate wire up/down signal, etc. +In K8S usually pods across nodes are connected using VxLAN/IPnIP/GRE overlay. +Our objective is to connect these pods using grpc p2p overlay. One of the +advantages is that there is **no reduction of MTU**. For example adding VXLAN +will reduce virtual interface MTU by 20 bytes. With grpc-wire interface MTU +remains 1500 (or can be made higher - not tried yet). Other advantages could be +to add telemetry, generate wire up/down signal, etc. ## Introduction -Let's take an example CRD as given in the picture below -![CRD](./pics/crd.png) +Let's take an example CRD as given in the picture below ![CRD](./pics/crd.png) -When this crd is deployed with grpc-wire CNI, then the nodes across the K8S pods will interact over a grpc channel. Each grpc channel will provide a point to point connection between pods. For example `POD-1:e1 <---> POD-2:e1` will be a dedicated grpc channel for POD1 & POD-2 communication via their `e1` virtual interfaces. +When this crd is deployed with grpc-wire CNI, then the nodes across the K8S pods +will interact over a grpc channel. Each grpc channel will provide a point to +point connection between pods. For example `POD-1:e1 <---> POD-2:e1` will be a +dedicated grpc channel for POD1 & POD-2 communication via their `e1` virtual +interfaces. ![DEPLOYMENT](./pics/deployment.png) -Each node in the cluster runs a CNI daemon set. The daemon in the node is responsible to maintain the GRPC channel and send/receive packets over it. In a node, each pod is connected with the node daemon using a veth-pair. One end of the veth pair is inside the pod and the other end is with the daemon. Pods always writes to or reads from the the interface it has got. Whereas the daemon is always listening on the other end of the veth pair. As soon as the pod writes a packet, the daemon gets it and transports it over the grpc channel to the remote node. Daemon in the remote node delivers it to the destination pod. +Each node in the cluster runs a CNI daemon set. The daemon in the node is +responsible to maintain the GRPC channel and send/receive packets over it. In a +node, each pod is connected with the node daemon using a veth-pair. One end of +the veth pair is inside the pod and the other end is with the daemon. Pods +always writes to or reads from the the interface it has got. Whereas the daemon +is always listening on the other end of the veth pair. As soon as the pod writes +a packet, the daemon gets it and transports it over the grpc channel to the +remote node. Daemon in the remote node delivers it to the destination pod. ## Details -When a pod wants to send a packet to a remote pod, it writes it on the interface inside the pod. Pod is completely unaware of the grpc overlay being used. The interface that a pod sees is one end of a veth pair. The other end of the veth pair is with meshnet daemon. The meshnet daemon receives any packet that a pod wants to send. Meshnet daemon uses the following proto to deliver the packet to the destination pod (on a different node). +When a pod wants to send a packet to a remote pod, it writes it on the interface +inside the pod. Pod is completely unaware of the grpc overlay being used. The +interface that a pod sees is one end of a veth pair. The other end of the veth +pair is with meshnet daemon. The meshnet daemon receives any packet that a pod +wants to send. Meshnet daemon uses the following proto to deliver the packet to +the destination pod (on a different node). ```go message Packet { @@ -24,7 +44,15 @@ message Packet { } ``` -The packet itself carries the id of the destination interface. Destination interface is an interface in the remote node and the meshnet daemon in the remote machine has access to this interface. This destination interface is one end of the veth pair and the other end of this veth pair is within the destination pod. This is ensured during the wire creation time. So when the packet reaches the destination daemon, the demon simply writes the received packet on the interface carried by the packet itself. Since it's a veth pair the packet goes to the destination pod which is connected at the other end. It avoids any per packet lookup and packet delivery becomes an O(1) operation. +The packet itself carries the id of the destination interface. Destination +interface is an interface in the remote node and the meshnet daemon in the +remote machine has access to this interface. This destination interface is one +end of the veth pair and the other end of this veth pair is within the +destination pod. This is ensured during the wire creation time. So when the +packet reaches the destination daemon, the demon simply writes the received +packet on the interface carried by the packet itself. Since it's a veth pair the +packet goes to the destination pod which is connected at the other end. It +avoids any per packet lookup and packet delivery becomes an O(1) operation. Overall Tx/Rx mechanism is depicted in the picture below. @@ -32,14 +60,35 @@ Overall Tx/Rx mechanism is depicted in the picture below. As shown it the picture above :- -- When the pod-1 in node-1 has to send a BGP packet, it just writes it on the pod interface eth1. (_point C1 in the picture_) -- Other end of this veth-pair (`eth1-out1`) is with the daemon, where a thread is always waiting on `go channel` to read packet. (_point 1 in the picture_) -- Since the wire creation time, the daemon in node-1 knows, any packet received on `eth1-out1` has to be delivered to the daemon running on node-2 and the destination interface in node-2 is `eth2-out1` who’s id is `X2`. -- The thread in node-1 (_point 1 in the picture_) makes a GRPC service call `SendToOnce` to deliver the packet to the service handler in node-2 (_point 2 in the picture_). During the creation time node-1 and node-2 has established the GRPC connection. -- `SendToOnce` service in node-2 receives the packet and it also receives the desired destination interface id along with it. In our case it’s `X2`. It simply writes the packet on `X2`. Packet reaches the destination pod, which is at the other end of the veth pair `eth2-out1 (X2) <---> eth1` in node-2. In this case the destination pod is pod-2 and its interface `eth2`. +- When the pod-1 in node-1 has to send a BGP packet, it just writes it on the + pod interface eth1. (_point C1 in the picture_) +- Other end of this veth-pair (`eth1-out1`) is with the daemon, where a thread + is always waiting on `go channel` to read packet. (_point 1 in the picture_) +- Since the wire creation time, the daemon in node-1 knows, any packet + received on `eth1-out1` has to be delivered to the daemon running on node-2 + and the destination interface in node-2 is `eth2-out1` who’s id is `X2`. +- The thread in node-1 (_point 1 in the picture_) makes a GRPC service call + `SendToOnce` to deliver the packet to the service handler in node-2 (_point + 2 in the picture_). During the creation time node-1 and node-2 has + established the GRPC connection. +- `SendToOnce` service in node-2 receives the packet and it also receives the + desired destination interface id along with it. In our case it’s `X2`. It + simply writes the packet on `X2`. Packet reaches the destination pod, which + is at the other end of the veth pair `eth2-out1 (X2) <---> eth1` in node-2. + In this case the destination pod is pod-2 and its interface `eth2`. - In reverse direction - - When pod-2 in node-2 wants to send a packet to pod-1 in node-1, the same process continues. Pod-2 writes it it’s interface `eth2`. (_point C2 in the picture_). The name `eth2` is assigned by meshnet CRD. + - When pod-2 in node-2 wants to send a packet to pod-1 in node-1, the same + process continues. Pod-2 writes it it’s interface `eth2`. (_point C2 in + the picture_). The name `eth2` is assigned by meshnet CRD. - The packet goes to the other end of the veth pair `eth2-out1` - - The daemon in node-2 receive the packet (_point 3 in the picture_) and makes a GRPC service call `SendToOnce` to deliver the packet to the service handler in node-1 (_point 4 in the picture_) - - Since the wire creation time, the daemon in node-2 knows, any packet received on `eth2-out1` has to be delivered to the daemon running on node-1 and the destination interface in node-1 is `eth1-out1` who’s id is `X1`. - - `SendToOnce` service in node-1 receives the packet and the desired destination interface id along with it. In our case it’s `X1`. It simply writes the packet on `X1`. Packet reaches the destination pod, which is at the other end of the veth pair `eth1-out1 (X1) <---> eth1` in node-1. + - The daemon in node-2 receive the packet (_point 3 in the picture_) and + makes a GRPC service call `SendToOnce` to deliver the packet to the + service handler in node-1 (_point 4 in the picture_) + - Since the wire creation time, the daemon in node-2 knows, any packet + received on `eth2-out1` has to be delivered to the daemon running on + node-1 and the destination interface in node-1 is `eth1-out1` who’s id + is `X1`. + - `SendToOnce` service in node-1 receives the packet and the desired + destination interface id along with it. In our case it’s `X1`. It simply + writes the packet on `X1`. Packet reaches the destination pod, which is + at the other end of the veth pair `eth1-out1 (X1) <---> eth1` in node-1. diff --git a/topo/node/inclusterproxy/README.md b/topo/node/inclusterproxy/README.md index 4e030f12c..5862bf60d 100644 --- a/topo/node/inclusterproxy/README.md +++ b/topo/node/inclusterproxy/README.md @@ -1,41 +1,53 @@ # IN_CLUSTER_PROXY Node Type -The `IN_CLUSTER_PROXY` node type is a specialized KNE node designed to act as a back-to-back proxy inside the cluster. It binds to a specific target node (e.g., a Device Under Test / DUT) over a single dedicated link and forwards configured ports to it using `socat`. +The `IN_CLUSTER_PROXY` node type is a specialized KNE node designed to act as a +back-to-back proxy inside the cluster. It binds to a specific target node (e.g., +a Device Under Test / DUT) over a single dedicated link and forwards configured +ports to it using `socat`. ## Features -- **Automatic Command Generation**: Automatically computes static IP address sizing for sidecar point-to-point subnets and generates `socat` listener scriptlets directly without writing bash boilerplate. -- **Cross-Stack Support**: Transparently supports both point-to-point **IPv4 (`/31`)** and **IPv6 (`/127`)** addressing setups. -- **Static Topology Integrity Verification**: Proactively verifies that `eth1` connects directly to the declared target node backplane before attempting to load or deploy. +- **Automatic Command Generation**: Automatically computes static IP address + sizing for sidecar point-to-point subnets and generates `socat` listener + scriptlets directly without writing bash boilerplate. +- **Cross-Stack Support**: Transparently supports both point-to-point **IPv4 + (`/31`)** and **IPv6 (`/127`)** addressing setups. +- **Static Topology Integrity Verification**: Proactively verifies that `eth1` + connects directly to the declared target node backplane before attempting to + load or deploy. ## Node Constraints To pass static validation, the node **must** meet the following conditions: -| Parameter | Constraint | -| :--- | :--- | -| **Interfaces** | Exactly one interface named `eth1`. | -| **Links** | `eth1` **must** link directly to the node specified in the `proxy-pool-for` label. | -| **Services** | Exactly one Service mapping must be provided inside `Services` map. | -| **Labels** | The node must have the `proxy-pool-for` label correctly populated. | +| Parameter | Constraint | +| :------------- | :--------------------------------------------------------------------------------- | +| **Interfaces** | Exactly one interface named `eth1`. | +| **Links** | `eth1` **must** link directly to the node specified in the `proxy-pool-for` label. | +| **Services** | Exactly one Service mapping must be provided inside `Services` map. | +| **Labels** | The node must have the `proxy-pool-for` label correctly populated. | ## Configuration Labels -| Label Key | Type | Required | Description | -| :--- | :--- | :--- | :--- | -| `proxy-pool-for` | String | **Yes** | Name of the target node this proxy is mediating. | -| `peer-ip` | IP | No (Opt-in) | IP address of the peer (DUT) connected over `eth1` (e.g. `192.168.100.1` or `2001:db8::1`). | -| `peer-prefix` | String | No (Opt-in) | Prefix length of the peer IP (e.g. `31` or `127`). | -| `target-port` | Integer | No (Opt-in) | Port on the peer node to forward proxy streams to. | +| Label Key | Type | Required | Description | +| :--------------- | :------ | :---------- | :------------------------------------------------------------------------------------------ | +| `proxy-pool-for` | String | **Yes** | Name of the target node this proxy is mediating. | +| `peer-ip` | IP | No (Opt-in) | IP address of the peer (DUT) connected over `eth1` (e.g. `192.168.100.1` or `2001:db8::1`). | +| `peer-prefix` | String | No (Opt-in) | Prefix length of the peer IP (e.g. `31` or `127`). | +| `target-port` | Integer | No (Opt-in) | Port on the peer node to forward proxy streams to. | -> **Note on Opt-in Automatic Setup**: -> If **all three of** `peer-ip`, `peer-prefix`, and `target-port` are provided, the controller will automatically calculate the inverse IP (your side of the `/31` or `/127` link) and generate full commands addressing `socat`. If omitted, users must configure `command` and `args` in `.Config` structures manually. +> **Note on Opt-in Automatic Setup**: If **all three of** `peer-ip`, +> `peer-prefix`, and `target-port` are provided, the controller will +> automatically calculate the inverse IP (your side of the `/31` or `/127` link) +> and generate full commands addressing `socat`. If omitted, users must +> configure `command` and `args` in `.Config` structures manually. --- ## Example (Protobuf text format) -Below is an example of an `IN_CLUSTER_PROXY` node mediating a BGP lookup connection to node `cx1`. +Below is an example of an `IN_CLUSTER_PROXY` node mediating a BGP lookup +connection to node `cx1`. ```protobuf nodes: { @@ -59,9 +71,9 @@ nodes: { } services: { key: 1790 - value: { - name: "bgp-proxy" - inside: 1790 + value: { + name: "bgp-proxy" + inside: 1790 } } } @@ -77,4 +89,5 @@ links: { In this example, the proxy container will automatically spin up to: 1. Assign `192.168.100.0/31` to its `eth1` interface. -2. Run `socat` forwarding any stream sent to port `1790` out to `192.168.100.1:179` across the wire. +2. Run `socat` forwarding any stream sent to port `1790` out to + `192.168.100.1:179` across the wire. diff --git a/topo/testdata/invalid_topo.yaml b/topo/testdata/invalid_topo.yaml index e55c0b4dd..06c9ca4c6 100644 --- a/topo/testdata/invalid_topo.yaml +++ b/topo/testdata/invalid_topo.yaml @@ -1,3 +1,4 @@ +--- name: "test-data-topology" nodes: - name: "r1" diff --git a/topo/testdata/valid_topo.yaml b/topo/testdata/valid_topo.yaml index 8eb0573c1..6a1b58ba3 100644 --- a/topo/testdata/valid_topo.yaml +++ b/topo/testdata/valid_topo.yaml @@ -1,3 +1,4 @@ +--- name: "test-data-topology" nodes: - name: "r1" diff --git a/x/webhook/README.md b/x/webhook/README.md index 2b82d2bd2..39b891828 100644 --- a/x/webhook/README.md +++ b/x/webhook/README.md @@ -1,12 +1,11 @@ # KNE Mutating Webhook This directory contains the code and configurations (in the form of manifests) -for the mutating webhook. The webhook should be deployed onto a KNE -cluster. +for the mutating webhook. The webhook should be deployed onto a KNE cluster. -This webhook can be used to mutate any K8 resources. This directory contains -the generic webhook along with an example mutator that simply adds an alpine -linux container to created pods. +This webhook can be used to mutate any K8 resources. This directory contains the +generic webhook along with an example mutator that simply adds an alpine linux +container to created pods. To develop custom a custom mutation simply change the mutate function in the examples subdirectory. @@ -79,9 +78,9 @@ default kne-assembly-webhook-f5b8cf987-lpxjt We can now create the KNE topology. -*Note* The KNE topology must have the label `webhook:enabled` for each node, as in -[this example](examples/topology.textproto), -otherwise the webhook will ignore the pod upon create. +_Note_ The KNE topology must have the label `webhook:enabled` for each node, as +in [this example](examples/topology.textproto), otherwise the webhook will +ignore the pod upon create. ```bash labels { @@ -96,8 +95,8 @@ Use the normal KNE command to create the topology. kne create examples/topology.textproto ``` -You should now see r1 with 2 containers instead of the one, this is -because the webhook has injected the alpine linux container. +You should now see r1 with 2 containers instead of the one, this is because the +webhook has injected the alpine linux container. ```bash $ kubectl get pods -n webhook-example @@ -175,8 +174,8 @@ I0402 23:24:36.394188 1 mutate.go:45] Mutating &TypeMeta{Kind:Pod,APIVersi I0402 23:24:36.394227 1 addcontainer.go:34] Ignoring pod "r2", mutation not requested ``` -This output shows that it mutated the pod r1 but not r2 since -the label was not added to that KNE node. +This output shows that it mutated the pod r1 but not r2 since the label was not +added to that KNE node. ### TLS @@ -197,7 +196,6 @@ Edit `main.go` to specify any mutation functions as desired. The example uses the mutation function found in `examples/addcontainer/addcontainer.go` but any mutation function is supported. This includes mutating services and other resources besides just pods. However you may also have to change -`manifests/mutating.config.yaml` to select other resources types than just -pods. +`manifests/mutating.config.yaml` to select other resources types than just pods. After customization is done, rebuild the container and reapply the manifests. diff --git a/x/webhook/manifests/deploy.yaml b/x/webhook/manifests/deploy.yaml index fddb16a57..3f1214291 100644 --- a/x/webhook/manifests/deploy.yaml +++ b/x/webhook/manifests/deploy.yaml @@ -1,3 +1,4 @@ +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -14,7 +15,7 @@ spec: metadata: labels: app: kne-assembly-webhook - spec: + spec: containers: - image: webhook:latest imagePullPolicy: IfNotPresent diff --git a/x/webhook/manifests/mutating.config.yaml b/x/webhook/manifests/mutating.config.yaml index 8c0bdbd84..cde9f29df 100644 --- a/x/webhook/manifests/mutating.config.yaml +++ b/x/webhook/manifests/mutating.config.yaml @@ -1,3 +1,4 @@ +--- apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: diff --git a/x/webhook/manifests/namespace.yaml b/x/webhook/manifests/namespace.yaml index 2adf86a8a..5724d8e5d 100644 --- a/x/webhook/manifests/namespace.yaml +++ b/x/webhook/manifests/namespace.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: diff --git a/x/webhook/manifests/tls.secret.yaml b/x/webhook/manifests/tls.secret.yaml index 4e5bd8bbf..4946ca214 100644 --- a/x/webhook/manifests/tls.secret.yaml +++ b/x/webhook/manifests/tls.secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWVENDQWoyZ0F3SUJBZ0lVVEJRMWJtWFlOZFNCRC9iUllkakpsajJtNVlVd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0xERUxNQWtHQTFVRUJoTUNRVlV4SFRBYkJnTlZCQU1NRkd0dVpTMWhjM05sYldKc2VTMTNaV0pvYjI5cgpNQjRYRFRJME1EUXdNakl4TVRnME1Wb1hEVEkxTURRd01qSXhNVGcwTVZvd0xERUxNQWtHQTFVRUJoTUNRVlV4CkhUQWJCZ05WQkFNTUZHdHVaUzFoYzNObGJXSnNlUzEzWldKb2IyOXJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUYKQUFPQ0FROEFNSUlCQ2dLQ0FRRUE0M0F2L2lLRzRLNFE0N1luZlc1bGVtTUFLcWRTWjQ3YXhDRDBzM0hoSVI2dgpiTlRldmVmamEvRTN5S08vZ282ZTNVT3d6T01qanVEVHRveVJWZ05kQnBkUklXc2pKSXd2S1ZBR0tUV0ZRVmppCmoyNzIyTG9nNkJ2OVBOVmJSRFRiSUErNnRWbW9IUWFIei9KY3lOR0ZtQmxwZWxhWWY4SXZwQjNkWkY5T3lNSWoKWDVydXlxeTFyUi9uNUliZytZK0M1KzZDWW1OVDVNN2Nqajd3MzNwQ2dWVkRXaGk3NkU3QjJ0TVVTM01aczlMNwpvaHI0T3phK04wczl6ZlgreFY3bnVCTlQ5d1hmNGRET0g3REdUUVhvYjVKYVF0Uk45NlZuRFhtd3Z0VGlSZTZvClExMW1IRkNyQWprbGYyeXZwOXplM2tQekZ1djJkTHg5NzhjSk9vZWlzUUlEQVFBQm8yOHdiVEFyQmdOVkhSRUUKSkRBaWdpQnJibVV0WVhOelpXMWliSGt0ZDJWaWFHOXZheTVrWldaaGRXeDBMbk4yWXpBZEJnTlZIUTRFRmdRVQpkS2lmUkNadHc0MnVieENBVzlOSmd4ZWhubkl3SHdZRFZSMGpCQmd3Rm9BVWpMOUxtZHp0bzNhcEQ5Tm41UFMxCkVLNk04S1l3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUIyOTg1VGUzZzA2c2dMRzdKYTNpZmF1SXFEbDBEVk4KMHlqbXFQQnNNL2syU3JDSE53UW53Rk01MVRxVlhoek8yM2o3bUhhR1FVdlNpTUZzRG1kK1JCS09MVUNFSWwzLwphTlkrNVpaS2thTUZzM1d0bjIzVWtzaEpKR3VJR1N1dXkreTRqdTJ1WXJ4RTVuZWpvRzBvRTk4TXo5ZmZ4bDVFClh4TnRiejZPR1JFNXloQXNBcE1jbnVsY0ZPektFaS9hNHN3MW4vam5KbEwwV0ptRHN1T2FOOWNZMndFS0pCa0cKOEF4d0ZYMUxlOHFhRkl2RGxqWVlnc2tnTjFVZ1hzZkdxdm05eGYzejQ4bDJURGF5T1NxWUhTRHN1T3d1WXRHNwoxV3JWazVjb09FbzljZVBTQlpzYnpKQlpGeFZnbERvdzFVTVUyVWp4TEt4MDQza0hvMEpzSjNzPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==