Skip to content
Snippets Groups Projects
Commit e5d353d0 authored by unclejack's avatar unclejack Committed by Matthew Mosesohn
Browse files

contiv network support (#1914)


* Add Contiv support

Contiv is a network plugin for Kubernetes and Docker. It supports
vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies,
multiple networks and bridging pods onto physical networks.

* Update contiv version to 1.1.4

Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config.

* Load openvswitch module to workaround on CentOS7.4

* Set contiv cni version to 0.1.0

Correct contiv CNI version to 0.1.0.

* Use kube_apiserver_endpoint for K8S_API_SERVER

Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks
to a available endpoint no matter if there's a loadbalancer or not.

* Make contiv use its own etcd

Before this commit, contiv is using a etcd proxy mode to k8s etcd,
this work fine when the etcd hosts are co-located with contiv etcd
proxy, however the k8s peering certs are only in etcd group, as a
result the etcd-proxy is not able to peering with the k8s etcd on
etcd group, plus the netplugin is always trying to find the etcd
endpoint on localhost, this will cause problem for all netplugins
not runnign on etcd group nodes.
This commit make contiv uses its own etcd, separate from k8s one.
on kube-master nodes (where net-master runs), it will run as leader
mode and on all rest nodes it will run as proxy mode.

* Use cp instead of rsync to copy cni binaries

Since rsync has been removed from hyperkube, this commit changes it
to use cp instead.

* Make contiv-etcd able to run on master nodes

* Add rbac_enabled flag for contiv pods

* Add contiv into CNI network plugin lists

* migrate contiv test to tests/files

Signed-off-by: default avatarCristian Staretu <cristian.staretu@gmail.com>

* Add required rules for contiv netplugin

* Better handling json return of fwdMode

* Make contiv etcd port configurable

* Use default var instead of templating

* roles/download/defaults/main.yml: use contiv 1.1.7

Signed-off-by: default avatarCristian Staretu <cristian.staretu@gmail.com>
parent de422c82
Branches
Tags
No related merge requests found
Showing
with 298 additions and 0 deletions
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: contiv-netmaster
namespace: {{ system_namespace }}
rules:
- apiGroups:
- ""
- extensions
resources:
- pods
- nodes
- namespaces
- networkpolicies
verbs:
- watch
- list
- update
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: contiv-netmaster
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: contiv-netmaster
subjects:
- kind: ServiceAccount
name: contiv-netmaster
namespace: {{ system_namespace }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: contiv-netmaster
namespace: {{ system_namespace }}
labels:
kubernetes.io/cluster-service: "true"
# This manifest deploys the Contiv API Server on Kubernetes.
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
name: contiv-netmaster
namespace: {{ system_namespace }}
labels:
k8s-app: contiv-netmaster
spec:
updateStrategy:
type: RollingUpdate
template:
metadata:
name: contiv-netmaster
namespace: {{ system_namespace }}
labels:
k8s-app: contiv-netmaster
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
spec:
# The netmaster must run in the host network namespace so that
# it isn't governed by policy that would prevent it from working.
hostNetwork: true
hostPID: true
nodeSelector:
node-role.kubernetes.io/master: "true"
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
{% if rbac_enabled %}
serviceAccountName: contiv-netmaster
{% endif %}
containers:
- name: contiv-netmaster
image: {{ contiv_image_repo }}:{{ contiv_image_tag }}
args:
- -m
- -pkubernetes
env:
- name: CONTIV_ETCD
valueFrom:
configMapKeyRef:
name: contiv-config
key: cluster_store
- name: CONTIV_CONFIG
valueFrom:
configMapKeyRef:
name: contiv-config
key: config
securityContext:
privileged: true
volumeMounts:
- mountPath: /etc/openvswitch
name: etc-openvswitch
readOnly: false
- mountPath: /lib/modules
name: lib-modules
readOnly: false
- mountPath: /var/run
name: var-run
readOnly: false
- mountPath: /var/contiv
name: var-contiv
readOnly: false
- mountPath: /etc/kubernetes/ssl
name: etc-kubernetes-ssl
readOnly: false
- mountPath: /opt/cni/bin
name: cni-bin-dir
readOnly: false
volumes:
# Used by contiv-netmaster
- name: etc-openvswitch
hostPath:
path: /etc/openvswitch
- name: lib-modules
hostPath:
path: /lib/modules
- name: var-run
hostPath:
path: /var/run
- name: var-contiv
hostPath:
path: /var/contiv
- name: etc-kubernetes-ssl
hostPath:
path: /etc/kubernetes/ssl
- name: cni-bin-dir
hostPath:
path: /opt/cni/bin
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: contiv-netplugin
namespace: {{ system_namespace }}
rules:
- apiGroups:
- ""
- extensions
resources:
- endpoints
- nodes
- namespaces
- networkpolicies
- pods
- services
verbs:
- watch
- list
- update
- get
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: contiv-netplugin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: contiv-netplugin
subjects:
- kind: ServiceAccount
name: contiv-netplugin
namespace: {{ system_namespace }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: contiv-netplugin
namespace: {{ system_namespace }}
labels:
kubernetes.io/cluster-service: "true"
# This manifest installs contiv-netplugin container, as well
# as the Contiv CNI plugins and network config on
# each master and worker node in a Kubernetes cluster.
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
name: contiv-netplugin
namespace: {{ system_namespace }}
labels:
k8s-app: contiv-netplugin
spec:
selector:
matchLabels:
k8s-app: contiv-netplugin
updateStrategy:
type: RollingUpdate
template:
metadata:
labels:
k8s-app: contiv-netplugin
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
spec:
hostNetwork: true
hostPID: true
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
{% if rbac_enabled %}
serviceAccountName: contiv-netplugin
{% endif %}
containers:
# Runs netplugin container on each Kubernetes node. This
# container programs network policy and routes on each
# host.
- name: contiv-netplugin
image: {{ contiv_image_repo }}:{{ contiv_image_tag }}
args:
- -pkubernetes
- -x
env:
- name: VLAN_IF
value: {{ contiv_vlan_interface }}
- name: VTEP_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: CONTIV_ETCD
valueFrom:
configMapKeyRef:
name: contiv-config
key: cluster_store
- name: CONTIV_CNI_CONFIG
valueFrom:
configMapKeyRef:
name: contiv-config
key: cni_config
- name: CONTIV_CONFIG
valueFrom:
configMapKeyRef:
name: contiv-config
key: config
securityContext:
privileged: true
volumeMounts:
- mountPath: /etc/openvswitch
name: etc-openvswitch
readOnly: false
- mountPath: /lib/modules
name: lib-modules
readOnly: false
- mountPath: /var/run
name: var-run
readOnly: false
- mountPath: /var/contiv
name: var-contiv
readOnly: false
- mountPath: /etc/kubernetes/pki
name: etc-kubernetes-pki
readOnly: false
- mountPath: /etc/kubernetes/ssl
name: etc-kubernetes-ssl
readOnly: false
- mountPath: /opt/cni/bin
name: cni-bin-dir
readOnly: false
- mountPath: /etc/cni/net.d/
name: etc-cni-dir
readOnly: false
volumes:
# Used by contiv-netplugin
- name: etc-openvswitch
hostPath:
path: /etc/openvswitch
- name: lib-modules
hostPath:
path: /lib/modules
- name: var-run
hostPath:
path: /var/run
- name: var-contiv
hostPath:
path: /var/contiv
- name: etc-kubernetes-pki
hostPath:
path: /etc/kubernetes/pki
- name: etc-kubernetes-ssl
hostPath:
path: /etc/kubernetes/ssl
# Used to install CNI.
- name: cni-bin-dir
hostPath:
path: /opt/cni/bin
- name: etc-cni-dir
hostPath:
path: /etc/cni/net.d/
......@@ -20,5 +20,10 @@ dependencies:
tags:
- canal
- role: network_plugin/contiv
when: kube_network_plugin == 'contiv'
tags:
- contiv
- role: network_plugin/cloud
when: kube_network_plugin == 'cloud'
# Instance settings
cloud_image_family: ubuntu-1604-lts
cloud_region: us-west1-a
mode: separate
# Deployment settings
kube_network_plugin: contiv
deploy_netchecker: true
kubedns_min_replicas: 1
cloud_provider: gce
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment