kubeguard: add kube-router variant

5 files changed, 199 insertions, 3 deletions

diff --git a/inventory/group_vars/k8s-chtest/main.yml b/inventory/group_vars/k8s-chtest/main.yml
index 2e5d56d3..a7fe0120 100644
--- a/inventory/group_vars/k8s-chtest/main.yml
+++ b/inventory/group_vars/k8s-chtest/main.yml
@@ -5,6 +5,9 @@ docker_pkg_name: docker-ce
 kubernetes_version: 1.18.3
 kubernetes_container_runtime: docker
 kubernetes_network_plugin: kubeguard
+kubernetes_network_plugin_replaces_kube_proxy: true
+kubernetes_network_plugin_variant: with-kube-router
+kubernetes_network_plugin_version: 0.4.0
 
 kubernetes:
   cluster_name: chtest
diff --git a/inventory/group_vars/kubernetes-cluster/vars.yml b/inventory/group_vars/kubernetes-cluster/vars.yml
index 2d7a696f..edec4e3e 100644
--- a/inventory/group_vars/kubernetes-cluster/vars.yml
+++ b/inventory/group_vars/kubernetes-cluster/vars.yml
@@ -1,4 +1,5 @@
 ---
 kubernetes_network_plugin_replaces_kube_proxy: false
+kubernetes_network_plugin_variant: default
 
 kubernetes_nodelocal_dnscache_ip: 169.254.20.10
diff --git a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
index 37b5030d..2d706a03 100644
--- a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
+++ b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
@@ -1,8 +1,10 @@
 ---
 - name: make sure kubernetes_network_plugin_replaces_kube_proxy is not set
+  when:
+    - kubernetes_network_plugin_variant != 'with-kube-router'
   run_once: yes
   assert:
-    msg: "this network plugin can not replace kube-proxy please set kubernetes_network_plugin_replaces_kube_proxy to false."
+    msg: "kubeguard variant '{{ kubernetes_network_plugin_variant }}' can not replace kube-proxy please set kubernetes_network_plugin_replaces_kube_proxy to false or configure a differnt kubernetes_network_plugin_variant."
     that:
       - not kubernetes_network_plugin_replaces_kube_proxy
 
@@ -82,3 +84,12 @@
   template:
     src: net_kubeguard/cni.json.j2
     dest: /etc/cni/net.d/kubeguard.json
+
+- name: install packages needed for debugging kube-router
+  when: kubernetes_network_plugin_variant == 'with-kube-router'
+  apt:
+    name:
+    - iptables
+    - ipvsadm
+    - ipset
+    state: present
diff --git a/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml
index 95fee7c8..f364fb5f 100644
--- a/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml
+++ b/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml
@@ -1,3 +1,13 @@
 ---
-### kubeguard needs to be deployed before the cluster has been initialized.
-### there is nothing more todo here.
+- name: install kube-router variant
+  when: "kubernetes_network_plugin_variant == 'with-kube-router'"
+  block:
+  - name: generate kubeguard (kube-router) configuration
+    template:
+      src: "net_kubeguard/kube-router.{{ kubernetes_network_plugin_version }}.yml.j2"
+      dest: /etc/kubernetes/network-plugin.yml
+
+  - name: install kubeguard (kube-router) on to the cluster
+    command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/network-plugin.yml
+    register: kubeguard_apply_result
+    changed_when: (kubeguard_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0
diff --git a/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2 b/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2
new file mode 100644
index 00000000..51bfdaae
--- /dev/null
+++ b/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2
@@ -0,0 +1,171 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-router-kubeconfig
+  namespace: kube-system
+  labels:
+    tier: node
+    k8s-app: kube-router
+data:
+  kubeconfig.conf: |
+    apiVersion: v1
+    kind: Config
+    clusters:
+    - cluster:
+        certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        server: https://127.0.0.1:{{ kubernetes_api_lb_port | default('6443') }}
+      name: default
+    contexts:
+    - context:
+        cluster: default
+        namespace: default
+        user: default
+      name: default
+    current-context: default
+    users:
+    - name: default
+      user:
+        tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    k8s-app: kube-router
+    tier: node
+  name: kube-router
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      k8s-app: kube-router
+      tier: node
+  template:
+    metadata:
+      labels:
+        k8s-app: kube-router
+        tier: node
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+    spec:
+      priorityClassName: system-node-critical
+      serviceAccountName: kube-router
+      serviceAccount: kube-router
+      containers:
+      - name: kube-router
+        image: docker.io/cloudnativelabs/kube-router:v{{ kubernetes_network_plugin_version }}
+        imagePullPolicy: Always
+        args:
+        - --run-router=false
+        - --run-firewall=true
+        - --run-service-proxy={{ kubernetes_network_plugin_replaces_kube_proxy | string | lower }}
+        - --kubeconfig=/var/lib/kube-router/kubeconfig
+        - --hairpin-mode
+        - --iptables-sync-period=10s
+        - --ipvs-sync-period=10s
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 20244
+          initialDelaySeconds: 10
+          periodSeconds: 3
+        resources:
+          requests:
+            cpu: 250m
+            memory: 250Mi
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: lib-modules
+          mountPath: /lib/modules
+          readOnly: true
+        - name: kubeconfig
+          mountPath: /var/lib/kube-router
+          readOnly: true
+        - name: xtables-lock
+          mountPath: /run/xtables.lock
+          readOnly: false
+      hostNetwork: true
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+        operator: Exists
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready
+        operator: Exists
+      volumes:
+      - name: lib-modules
+        hostPath:
+          path: /lib/modules
+      - name: kubeconfig
+        configMap:
+          name: kube-router-kubeconfig
+          items:
+          - key: kubeconfig.conf
+            path: kubeconfig
+      - name: xtables-lock
+        hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-router
+  namespace: kube-system
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: kube-router
+  namespace: kube-system
+rules:
+  - apiGroups:
+    - ""
+    resources:
+      - namespaces
+      - pods
+      - services
+      - nodes
+      - endpoints
+    verbs:
+      - list
+      - get
+      - watch
+  - apiGroups:
+    - "networking.k8s.io"
+    resources:
+      - networkpolicies
+    verbs:
+      - list
+      - get
+      - watch
+  - apiGroups:
+    - extensions
+    resources:
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: kube-router
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kube-router
+subjects:
+- kind: ServiceAccount
+  name: kube-router
+  namespace: kube-system