bzub bzub

Watcher Refactoring Notes

@Thoros Generic Watcher

Generic Watcher Code: https://gist.github.com/Thoro/2e81754c253a85981e06d4fd6839eee7

Use in controllers:

func (nec *NetworkEgressController) OnItemUpdate(update *watchers.Update) { nec.mu.Lock(); defer nec.mu.Unlock() switch v:= update.Item.(type) {
 default:

Docs and manifests are now in the kube-router repository.

This workaround solves many issues where software in a Kubernetes pod expects a static, rarely changed IP address. Since we bind to a Kubernetes Service IP, it comes with many benefits such as automatic DNS entries within the cluster, health checking automation, and abstraction of network details. In fact these features of Services are used in the pod examples here to avoid hard-coding IP addresses and ports into the pod definitions.

TODO: More details.

Results

    cluster 9ece8946-1b9d-4bb5-8d51-34c968119795

Container Linux Config / Ignition

Here's the relevant bits that configure IPs on loopback via systemd-networkd. They are the same on all my nodes, so no variables.

networkd:
  units:
    - name: 00-vip-lo.network
      contents: |
        [Match]
        Name=lo
        [Network]

TODO

Define defaults and override rules.
- Should there be a "default" DataPolicy that is assumed unless overridden?
- The DataPolicies, DataEndpoints, and StorageNodes lists are ordered. How can we use that ordering to make predictable results from selections?
  - Proposal for StorageNodes: The last group of selectors (all must match) to match a host is what applies.
  - Proposal for DataPolicies: The last policy to match a device or directory is what applies.
  - Proposal for DataEndpoints: Inclusive match. If any one rule describes a device or directory then it's added to the group.
Seems like it could be possible to combine DataPolicies and DataEndpoints into one resource type.

Hopefully there are few flaws in the logic and this proposal is a good compromise between simplicity and power.

	#!/usr/bin/env sh

	set -e

	[ -z "${KUBECONFIG}" ] && KUBECONFIG="${PWD}/assets/auth/kubeconfig"

	SUDO="sudo UNIFIED_CGROUP_HIERARCHY=0"

	${SUDO} rkt --insecure-options=image run \
	--interactive \

	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: kube-router-cfg
	namespace: kube-system
	labels:
	tier: node
	k8s-app: kube-router
	data:
	cni-conf.json: \|

	# This ConfigMap is used to configure a self-hosted Calico installation.
	kind: ConfigMap
	apiVersion: v1
	metadata:
	name: calico-config
	namespace: kube-system
	data:
	# Configure this with the location of your etcd cluster.
	etcd_endpoints: "http://kube-etcd:2379"

	apiVersion: extensions/v1beta1
	kind: DaemonSet
	metadata:
	labels:
	app: rook
	role: osd
	rook_cluster: rookcluster
	name: osd
	spec:
	selector:

	###
	### Stage 00-new-cluster complete. Logging to /tmp/np-test-logs/00-new-cluster.\{iptables,ipset\}
	###
	networkpolicy "test-network-policy" created
	###
	### Stage 01-np-created complete. Logging to /tmp/np-test-logs/01-np-created.\{iptables,ipset\}
	###
	deployment "test-np-server" created
	service "test-np-server" exposed
	###