Skip to content

Commit

Permalink
ci: parameterize cilium 1.14 templates (#2562)
Browse files Browse the repository at this point in the history
* parameterize version cilium 1.14.x for pipelines

* fix tag substitution

* update dualstack step

* update load test template
  • Loading branch information
camrynl authored Feb 12, 2024
1 parent 8386efc commit a12222b
Show file tree
Hide file tree
Showing 16 changed files with 138 additions and 37 deletions.
16 changes: 6 additions & 10 deletions .pipelines/cni/cilium/cilium-overlay-load-test-template.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -106,18 +106,14 @@ stages:
pwd
kubectl cluster-info
kubectl get po -owide -A
echo "deploy Cilium ConfigMap"
kubectl apply -f test/integration/manifests/cilium/v1.14.4/cilium-config/cilium-config-hubble.yaml
echo "install Cilium onto Overlay Cluster with hubble enabled"
kubectl apply -f test/integration/manifests/cilium/v1.14.4/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/v1.14.4/cilium-operator/files
echo "install Cilium v1.14.4 onto Overlay Cluster"
# Passes Cilium image to daemonset and deployment
envsubst '${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v1.14.4/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v1.14.4/cilium-operator/templates/deployment.tpl | kubectl apply -f -
export CILIUM_VERSION_TAG=${CILIUM_HUBBLE_VERSION_TAG}
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-config/cilium-config-hubble.yaml
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/files
envsubst '${CILIUM_IMAGE_REGISTRY},${CILIUM_VERSION_TAG}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_IMAGE_REGISTRY},${CILIUM_VERSION_TAG}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/templates/deployment.tpl | kubectl apply -f -
kubectl get po -owide -A
echo "Deploy Azure-CNS"
Expand Down
13 changes: 6 additions & 7 deletions .pipelines/networkobservability/pipeline.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ schedules:

variables:
clustername: ciliumhubble-$(Build.SourceBranchName)-$(Build.BuildId)
cilium_version: v1.14.4

stages:
- stage: createCluster
Expand Down Expand Up @@ -78,11 +77,11 @@ stages:
scriptType: "bash"
addSpnToEnvironment: true
inlineScript: |
kubectl apply -f test/integration/manifests/cilium/$(cilium_version)/cilium-config/cilium-config-hubble.yaml
kubectl apply -f test/integration/manifests/cilium/$(cilium_version)/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/$(cilium_version)/cilium-operator/files
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/$(cilium_version)/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/$(cilium_version)/cilium-operator/templates/deployment.tpl | kubectl apply -f -
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-config/cilium-config-hubble.yaml
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/files
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/templates/deployment.tpl | kubectl apply -f -
# Use different file directories for nightly and current cilium version
name: "installCilium"
displayName: "Install Cilium on AKS Overlay"
Expand Down Expand Up @@ -122,7 +121,7 @@ stages:
enabled: true
- script: |
kubectl apply -f test/integration/manifests/cilium/$(cilium_version)/hubble/hubble-peer-svc.yaml
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/hubble/hubble-peer-svc.yaml
kubectl get pods -Aowide
echo "verify Hubble metrics endpoint is usable"
go test ./test/integration/networkobservability -tags=networkobservability
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,16 @@ steps:
kubectl cluster-info
kubectl get po -owide -A
echo "deploy Cilium ConfigMap"
kubectl apply -f test/integration/manifests/cilium/cilium-config-dualstack.yaml
echo "install Cilium ${CILIUM_VERSION_TAG}"
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-config/cilium-config-dualstack.yaml
echo "install Cilium ${CILIUM_DUALSTACK_VERSION}"
# Passes Cilium image to daemonset and deployment
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/daemonset.yaml | kubectl apply -f -
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/deployment.yaml | kubectl apply -f -
# Use different file directories for nightly and current cilium version
kubectl apply -f test/integration/manifests/cilium/cilium-agent
kubectl apply -f test/integration/manifests/cilium/cilium-operator
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/files
export CILIUM_VERSION_TAG=${CILIUM_DUALSTACK_VERSION}
echo "install Cilium ${CILIUM_DUALSTACK_VERSION} onto Overlay Cluster"
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/templates/deployment.tpl | kubectl apply -f -
kubectl get po -owide -A
name: "installCilium"
displayName: "Install Cilium on AKS Dualstack Overlay"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,12 @@ steps:
set -e
make -C ./hack/aks set-kubeconf AZCLI=az CLUSTER=${{ parameters.clusterName }}
ls -lah
kubectl apply -f test/integration/manifests/cilium/v1.14.4/cilium-config/cilium-config-hubble.yaml
kubectl apply -f test/integration/manifests/cilium/v1.14.4/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/v1.14.4/cilium-operator/files
envsubst '${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v1.14.4/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v1.14.4/cilium-operator/templates/deployment.tpl | kubectl apply -f -
export CILIUM_VERSION_TAG=${CILIUM_HUBBLE_VERSION_TAG}
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-config/cilium-config-hubble.yaml
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/files
kubectl apply -f test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/files
envsubst '${CILIUM_IMAGE_REGISTRY},${CILIUM_VERSION_TAG}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-agent/templates/daemonset.tpl | kubectl apply -f -
envsubst '${CILIUM_IMAGE_REGISTRY},${CILIUM_VERSION_TAG}' < test/integration/manifests/cilium/v${CILIUM_TEMPLATE_DIR}/cilium-operator/templates/deployment.tpl | kubectl apply -f -
# Use different file directories for nightly and current cilium version
name: "installCilium"
displayName: "Install Cilium on AKS Overlay"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ spec:
fieldPath: metadata.namespace
- name: CILIUM_CLUSTERMESH_CONFIG
value: /var/lib/cilium/clustermesh/
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 10
Expand Down Expand Up @@ -163,7 +163,7 @@ spec:
hostNetwork: true
initContainers:
- name: install-cni-binaries
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
command:
- "/install-plugin.sh"
Expand Down Expand Up @@ -192,7 +192,7 @@ spec:
value: /run/cilium/cgroupv2
- name: BIN_PATH
value: /opt/cni/bin
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
name: mount-cgroup
resources: {}
Expand Down Expand Up @@ -224,7 +224,7 @@ spec:
env:
- name: BIN_PATH
value: /opt/cni/bin
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
name: apply-sysctl-overwrites
resources: {}
Expand Down Expand Up @@ -252,7 +252,7 @@ spec:
- /bin/bash
- -c
- --
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
name: mount-bpf-fs
resources: {}
Expand All @@ -279,7 +279,7 @@ spec:
key: clean-cilium-bpf-state
name: cilium-config
optional: true
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
name: clean-cilium-state
resources:
Expand Down Expand Up @@ -338,7 +338,7 @@ spec:
name: host-usr-lib
readOnly: true
- name: block-wireserver
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/cilium:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
command:
- /bin/bash
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
apiVersion: v1
data:
agent-not-ready-taint-key: node.cilium.io/agent-not-ready
arping-refresh-period: 30s
auto-direct-node-routes: "false"
bpf-lb-external-clusterip: "false"
bpf-lb-map-max: "65536"
bpf-lb-mode: snat
bpf-map-dynamic-size-ratio: "0.0025"
bpf-policy-map-max: "16384"
bpf-root: /sys/fs/bpf
cgroup-root: /run/cilium/cgroupv2
cilium-endpoint-gc-interval: 5m0s
cluster-id: "0"
cluster-name: default
debug: "false"
disable-cnp-status-updates: "true"
disable-endpoint-crd: "false"
enable-auto-protect-node-port-range: "true"
enable-bgp-control-plane: "false"
enable-bpf-clock-probe: "true"
enable-endpoint-health-checking: "false"
enable-endpoint-routes: "true"
enable-health-check-nodeport: "true"
enable-health-checking: "true"
enable-host-legacy-routing: "true"
enable-hubble: "false"
enable-ipv4: "true"
enable-ipv4-masquerade: "false"
enable-ipv6: "true"
enable-ipv6-masquerade: "false"
enable-k8s-terminating-endpoint: "true"
enable-l2-neigh-discovery: "true"
enable-l7-proxy: "false"
enable-local-node-route: "false"
enable-local-redirect-policy: "false"
enable-metrics: "true"
enable-policy: default
enable-remote-node-identity: "true"
enable-session-affinity: "true"
enable-svc-source-range-check: "true"
enable-vtep: "false"
enable-well-known-identities: "false"
enable-xt-socket-fallback: "true"
identity-allocation-mode: crd
install-iptables-rules: "true"
install-no-conntrack-iptables-rules: "false"
ipam: delegated-plugin
kube-proxy-replacement: strict
kube-proxy-replacement-healthz-bind-address: "0.0.0.0:10256"
local-router-ipv4: 169.254.23.0
local-router-ipv6: "fe80::"
metrics: +cilium_bpf_map_pressure
monitor-aggregation: medium
monitor-aggregation-flags: all
monitor-aggregation-interval: 5s
node-port-bind-protection: "true"
nodes-gc-interval: 5m0s
operator-api-serve-addr: 127.0.0.1:9234
operator-prometheus-serve-addr: :9963
preallocate-bpf-maps: "false"
procfs: /host/proc
prometheus-serve-addr: :9962
remove-cilium-node-taints: "true"
set-cilium-is-up-condition: "true"
sidecar-istio-proxy-image: cilium/istio_proxy
synchronize-k8s-nodes: "true"
tofqdns-dns-reject-response-code: refused
tofqdns-enable-dns-compression: "true"
tofqdns-endpoint-max-ip-per-hostname: "50"
tofqdns-idle-connection-grace-period: 0s
tofqdns-max-deferred-connection-deletes: "10000"
tofqdns-min-ttl: "0"
tofqdns-proxy-response-max-delay: 100ms
routing-mode: native
unmanaged-pod-watcher-interval: "15"
vtep-cidr: ""
vtep-endpoint: ""
vtep-mac: ""
vtep-mask: ""
# new default values from Cilium v1.14.4
enable-sctp: "false"
external-envoy-proxy: "false"
k8s-client-qps: "5"
k8s-client-burst: "10"
mesh-auth-enabled: "true"
mesh-auth-queue-size: "1024"
mesh-auth-rotated-identities-queue-size: "1024"
mesh-auth-gc-interval: "5m0s"
proxy-connect-timeout: "2"
proxy-max-requests-per-connection: "0"
proxy-max-connection-duration-seconds: "0"
set-cilium-node-taints: "true"
unmanaged-pod-watcher-interval: "15"
kind: ConfigMap
metadata:
annotations:
meta.helm.sh/release-name: cilium
meta.helm.sh/release-namespace: kube-system
labels:
app.kubernetes.io/managed-by: Helm
name: cilium-config
namespace: kube-system
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ spec:
spec:
containers:
- name: cilium-operator
image: $CILIUM_IMAGE_REGISTRY/cilium/operator-generic:1.14.4
image: $CILIUM_IMAGE_REGISTRY/cilium/operator-generic:$CILIUM_VERSION_TAG
imagePullPolicy: IfNotPresent
command:
- cilium-operator-generic
Expand Down

0 comments on commit a12222b

Please sign in to comment.