Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add calico api server to calico cni plugin #19648

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

add calico api server to calico cni plugin #19648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
536fc85
feat:add calico api server to calico cni plugin
ComradeProgrammer Sep 15, 2024
52b38ae
Apply suggestions from code review
ComradeProgrammer Oct 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions hack/update/calico_version/update_calico_version.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ func main() {
}

func updateYAML(version string) {
// for Calico we are going to update both Calico and Calico API server mainifests
// first we update the Calico manifest
res, err := http.Get(fmt.Sprintf("https://raw.githubusercontent.com/projectcalico/calico/%s/manifests/calico.yaml", version))
ComradeProgrammer marked this conversation as resolved.
Show resolved Hide resolved
if err != nil {
klog.Fatalf("failed to get calico.yaml: %v", err)
Expand All @@ -79,4 +81,24 @@ func updateYAML(version string) {
if err := os.WriteFile("../../../pkg/minikube/cni/calico.yaml", yaml, 0644); err != nil {
klog.Fatalf("failed to write to YAML file: %v", err)
}
// then we update the Calico API server manifest
// doc: https://docs.tigera.io/calico/latest/operations/install-apiserver
resAPIServer, err := http.Get(fmt.Sprintf("https://raw.githubusercontent.com/projectcalico/calico/%s/manifests/apiserver.yaml", version))
if err != nil {
klog.Fatalf("failed to get apiserver.yaml: %v", err)
}
defer resAPIServer.Body.Close()
yamlAPIServer, err := io.ReadAll(resAPIServer.Body)
if err != nil {
klog.Fatalf("failed to read body: %v", err)
}
replacementsAPIServer := map[string]string{
`calico\/apiserver:.*`: "{{ .APIServerImageName }}",
}
for re, repl := range replacementsAPIServer {
yamlAPIServer = regexp.MustCompile(re).ReplaceAll(yamlAPIServer, []byte(repl))
}
if err := os.WriteFile("../../../pkg/minikube/cni/calico-apiserver.yaml", yamlAPIServer, 0644); err != nil {
klog.Fatalf("failed to write to YAML file: %v", err)
}
}
6 changes: 5 additions & 1 deletion pkg/minikube/bootstrapper/images/images.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ func KindNet(repo string) string {
}

// all calico images are from https://github.com/projectcalico/calico/blob/master/manifests/calico.yaml
const calicoVersion = "v3.28.1"
const calicoVersion = "v3.28.2"
const calicoRepo = "docker.io/calico"

// CalicoDaemonSet returns the image used for calicoDaemonSet
Expand All @@ -202,6 +202,10 @@ func CalicoBin(repo string) string {
return calicoCommon(repo, "cni")
}

// CalicoAPIServer returns image used for calico apiserver image
func CalicoAPIServer(repo string) string {
return calicoCommon(repo, "apiserver")
}
func calicoCommon(repo string, name string) string {
if repo == "" {
repo = calicoRepo
Expand Down
297 changes: 297 additions & 0 deletions pkg/minikube/cni/calico-apiserver.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,297 @@
# This is a tech-preview manifest which installs the Calico API server. Note that this manifest is liable to change
# or be removed in future releases without further warning.
#
# Namespace and namespace-scoped resources.
apiVersion: v1
kind: Namespace
metadata:
labels:
name: calico-apiserver
name: calico-apiserver
spec:

---

# Policy to ensure the API server isn't cut off. Can be modified, but ensure
# that the main API server is always able to reach the Calico API server.
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: allow-apiserver
namespace: calico-apiserver
spec:
podSelector:
matchLabels:
apiserver: "true"
ingress:
- ports:
- protocol: TCP
port: 5443

---

apiVersion: v1
kind: Service
metadata:
name: calico-api
namespace: calico-apiserver
spec:
ports:
- name: apiserver
port: 443
protocol: TCP
targetPort: 5443
selector:
apiserver: "true"
type: ClusterIP

---

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
apiserver: "true"
k8s-app: calico-apiserver
name: calico-apiserver
namespace: calico-apiserver
spec:
replicas: 1
selector:
matchLabels:
apiserver: "true"
strategy:
type: Recreate
template:
metadata:
labels:
apiserver: "true"
k8s-app: calico-apiserver
name: calico-apiserver
namespace: calico-apiserver
spec:
containers:
- args:
- --secure-port=5443
- -v=5
env:
- name: DATASTORE_TYPE
value: kubernetes
image: {{ .APIServerImageName }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this might need be to be a If statement( like a golang template ) simmilar to the addons. and I think the idea is if someone chooses China or whatever registery they have it should try to pull the image from there.

name: calico-apiserver
readinessProbe:
httpGet:
path: /readyz
port: 5443
scheme: HTTPS
timeoutSeconds: 5
periodSeconds: 60
securityContext:
privileged: false
runAsUser: 0
volumeMounts:
- mountPath: /code/apiserver.local.config/certificates
name: calico-apiserver-certs
dnsPolicy: ClusterFirst
nodeSelector:
kubernetes.io/os: linux
restartPolicy: Always
serviceAccount: calico-apiserver
serviceAccountName: calico-apiserver
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
- effect: NoSchedule
key: node-role.kubernetes.io/control-plane
volumes:
- name: calico-apiserver-certs
secret:
secretName: calico-apiserver-certs

---

apiVersion: v1
kind: ServiceAccount
metadata:
name: calico-apiserver
namespace: calico-apiserver

---

# Cluster-scoped resources below here.
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
name: v3.projectcalico.org
spec:
group: projectcalico.org
groupPriorityMinimum: 1500
service:
name: calico-api
namespace: calico-apiserver
port: 443
version: v3
versionPriority: 200

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: calico-crds
rules:
- apiGroups:
- extensions
- networking.k8s.io
- ""
resources:
- networkpolicies
- nodes
- namespaces
- pods
- serviceaccounts
verbs:
- get
- list
- watch
- apiGroups:
- crd.projectcalico.org
resources:
- globalnetworkpolicies
- networkpolicies
- clusterinformations
- hostendpoints
- globalnetworksets
- networksets
- bgpconfigurations
- bgppeers
- bgpfilters
- felixconfigurations
- kubecontrollersconfigurations
- ippools
- ipreservations
- ipamblocks
- blockaffinities
- caliconodestatuses
- ipamconfigs
verbs:
- get
- list
- watch
- create
- update
- delete
- apiGroups:
- policy
resourceNames:
- calico-apiserver
resources:
- podsecuritypolicies
verbs:
- use

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: calico-extension-apiserver-auth-access
rules:
- apiGroups:
- ""
resourceNames:
- extension-apiserver-authentication
resources:
- configmaps
verbs:
- list
- watch
- get
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
- clusterrolebindings
- roles
- rolebindings
verbs:
- get
- list
- watch

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: calico-webhook-reader
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- mutatingwebhookconfigurations
- validatingwebhookconfigurations
verbs:
- get
- list
- watch

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: calico-apiserver-access-crds
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-crds
subjects:
- kind: ServiceAccount
name: calico-apiserver
namespace: calico-apiserver

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: calico-apiserver-delegate-auth
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- kind: ServiceAccount
name: calico-apiserver
namespace: calico-apiserver

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: calico-apiserver-webhook-reader
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-webhook-reader
subjects:
- kind: ServiceAccount
name: calico-apiserver
namespace: calico-apiserver

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: calico-extension-apiserver-auth-access
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-extension-apiserver-auth-access
subjects:
- kind: ServiceAccount
name: calico-apiserver
namespace: calico-apiserver
Loading
Loading