Tunnels as external networks

deployments/helm-tunnel/Chart.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+appVersion: "0.0.1"
+description: Load balancer based on NSM
+name: meridio
+version: 0.0.1

deployments/helm-tunnel/templates/_helpers.tpl

@@ -0,0 +1,160 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Set IP Family
+*/}}
+
+{{- define "meridio.loadBalancer.sysctls" -}}
+{{- if eq .Values.ipFamily "dualstack" -}}
+{{- printf "sysctl -w net.ipv6.conf.all.forwarding=1 ; sysctl -w net.ipv4.conf.all.forwarding=1 ; sysctl -w net.ipv4.fib_multipath_hash_policy=1 ; sysctl -w net.ipv6.fib_multipath_hash_policy=1 ; sysctl -w net.ipv4.conf.all.rp_filter=0 ; sysctl -w net.ipv4.conf.default.rp_filter=0" -}}
+{{- else if eq .Values.ipFamily "ipv6" -}}
+{{- printf "sysctl -w net.ipv6.conf.all.forwarding=1 ; sysctl -w net.ipv6.fib_multipath_hash_policy=1" -}}
+{{- else -}}
+{{- printf "sysctl -w net.ipv4.conf.all.forwarding=1 ; sysctl -w net.ipv4.fib_multipath_hash_policy=1" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "meridio.proxy.sysctls" -}}
+{{- if eq .Values.ipFamily "dualstack" -}}
+{{- printf "sysctl -w net.ipv6.conf.all.forwarding=1 ; sysctl -w net.ipv4.conf.all.forwarding=1 ; sysctl -w net.ipv6.conf.all.accept_dad=0 ; sysctl -w net.ipv4.fib_multipath_hash_policy=1 ; sysctl -w net.ipv6.fib_multipath_hash_policy=1 ; sysctl -w net.ipv4.conf.all.rp_filter=0 ; sysctl -w net.ipv4.conf.default.rp_filter=0" -}}
+{{- else if eq .Values.ipFamily "ipv6" -}}
+{{- printf "sysctl -w net.ipv6.conf.all.forwarding=1 ; sysctl -w net.ipv6.conf.all.accept_dad=0 ; sysctl -w net.ipv6.fib_multipath_hash_policy=1" -}}
+{{- else -}}
+{{- printf "sysctl -w net.ipv4.conf.all.forwarding=1 ; sysctl -w net.ipv4.fib_multipath_hash_policy=1" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "meridio.nsp.serviceName" -}}
+{{- printf "%s-%s" .Values.nsp.serviceName .Values.trench.name -}}
+{{- end -}}
+
+{{- define "meridio.ipam.serviceName" -}}
+{{- printf "%s-%s" .Values.ipam.serviceName .Values.trench.name -}}
+{{- end -}}
+
+{{- define "meridio.proxy.networkServiceName" -}}
+{{- printf "%s.%s.%s" .Values.proxy.networkServiceName .Values.trench.name .Release.Namespace -}}
+{{- end -}}
+
+{{- define "meridio.loadBalancer.networkServiceName" -}}
+{{- printf "%s.%s.%s" .Values.loadBalancer.networkServiceName .Values.trench.name .Release.Namespace -}}
+{{- end -}}
+
+{{- define "meridio.configuration" -}}
+{{- printf "%s-%s" .Values.configuration.configmap .Values.trench.name -}}
+{{- end -}}
+
+{{- define "meridio.serviceAccount" -}}
+{{- printf "meridio-%s" .Values.trench.name -}}
+{{- end -}}
+
+{{- define "meridio.authServiceAccount" -}}
+{{- printf "meridio-auth-%s" .Values.trench.name -}}
+{{- end -}}
+
+{{- define "meridio.startupProbe" -}}
+{{- $healthAddr := .root.Values.probe.addr -}}
+{{- $healthService := .root.Values.probe.service -}}
+{{- $spiffe := false -}}
+{{- if .component.probe -}}
+{{- $healthAddr = .component.probe.addr | default $healthAddr -}}
+{{- $healthService = .component.probe.service | default $healthService -}}
+{{- $spiffe = .component.probe.spiffe | default $spiffe -}}
+{{- if .component.probe.startup }}
+{{- with .component.probe.startup -}}
+{{- $healthAddr = .addr | default $healthAddr -}}
+{{- $healthService = .service | default $healthService -}}
+{{- $spiffe = .spiffe | default $spiffe -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+exec:
+  command:
+  - /bin/grpc_health_probe
+{{- if $spiffe }}
+  - -spiffe
+{{- end }}
+  - -addr={{ $healthAddr }}
+  - -service={{ $healthService }}
+  - -connect-timeout=100ms
+  - -rpc-timeout=150ms
+initialDelaySeconds: 0
+periodSeconds: 2
+timeoutSeconds: 2
+failureThreshold: 30
+{{- end -}}
+
+{{- define "meridio.livenessProbe" -}}
+{{- $healthAddr := .root.Values.probe.addr -}}
+{{- $healthService := .root.Values.probe.service -}}
+{{- $spiffe := false -}}
+{{- if .component.probe -}}
+{{- $healthAddr = .component.probe.addr | default $healthAddr -}}
+{{- $healthService = .component.probe.service | default $healthService -}}
+{{- $spiffe = .component.probe.spiffe | default $spiffe -}}
+{{- if .component.probe.liveness }}
+{{- with .component.probe.liveness -}}
+{{- $healthAddr = .addr | default $healthAddr -}}
+{{- $healthService = .service | default $healthService -}}
+{{- $spiffe = .spiffe | default $spiffe -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+exec:
+  command:
+  - /bin/grpc_health_probe
+{{- if $spiffe }}
+  - -spiffe
+{{- end }}
+  - -addr={{ $healthAddr }}
+  - -service={{ $healthService }}
+  - -connect-timeout=100ms
+  - -rpc-timeout=150ms
+initialDelaySeconds: 0
+periodSeconds: 10
+timeoutSeconds: 3
+failureThreshold: 5
+{{- end -}}
+
+{{- define "meridio.readinessProbe" -}}
+{{- $healthAddr := .root.Values.probe.addr -}}
+{{- $healthService := .root.Values.probe.service -}}
+{{- $spiffe := false -}}
+{{- if .component.probe }}
+{{- $healthAddr = .component.probe.addr | default $healthAddr -}}
+{{- $healthService = .component.probe.service | default $healthService -}}
+{{- $spiffe = .component.probe.spiffe | default $spiffe -}}
+{{- if .component.probe.readiness }}
+{{- with .component.probe.readiness -}}
+{{- $healthAddr = .addr | default $healthAddr -}}
+{{- $healthService = .service | default $healthService -}}
+{{- $spiffe = .spiffe | default $spiffe -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+exec:
+  command:
+  - /bin/grpc_health_probe
+{{- if $spiffe }}
+  - -spiffe
+{{- end }}
+  - -addr={{ $healthAddr }}
+  - -service={{ $healthService }}
+  - -connect-timeout=100ms
+  - -rpc-timeout=150ms
+initialDelaySeconds: 0
+periodSeconds: 10
+timeoutSeconds: 3
+failureThreshold: 5
+{{- end -}}
+
+{{- define "meridio.bgpAuth" -}}
+{{- if .component.bgpAuth -}}
+{{- if .component.bgpAuth.bgpAuthKey -}}
+{{- if .component.bgpAuth.bgpAuthKeySource -}}
+key: {{ .component.bgpAuth.bgpAuthKey }}
+source: {{ .component.bgpAuth.bgpAuthKeySource }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

deployments/helm-tunnel/templates/config.yaml

@@ -0,0 +1,139 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "meridio.configuration" . }}
+data:
+  trench: |
+    name: {{ .Values.trench.name }}
+  conduits: |
+    items:
+    - name: {{ .Values.loadBalancer.networkServiceName }}
+      trench: {{ .Values.trench.name }}
+  streams: |
+    items:
+    - name: stream-a
+      conduit: {{ .Values.loadBalancer.networkServiceName }}
+      max-targets: 100
+    - name: stream-b
+      conduit: {{ .Values.loadBalancer.networkServiceName }}
+      max-targets: 100
+  flows: |
+    items:
+    - name: flow-a
+      vips:
+        - vip1
+        - vip2
+      source-subnets:
+        - 0.0.0.0/0
+        - 0:0:0:0:0:0:0:0/0
+      destination-port-ranges:
+        - 5000
+        - 4000
+      source-port-ranges:
+        - 1024-65535
+      protocols:
+        - tcp
+      stream: stream-a
+    - name: flow-b
+      vips:
+        - vip3
+      source-subnets:
+        - 0.0.0.0/0
+        - 0:0:0:0:0:0:0:0/0
+      destination-port-ranges:
+        - 5000
+        - 4000
+      source-port-ranges:
+        - 1024-65535
+      protocols:
+        - tcp
+      stream: stream-b
+  vips: |
+    items:
+    {{- range .Values.vips }}
+    - name: {{ .name }}
+      address: {{ .address }}
+      trench: {{ $.Values.trench.name }}
+    {{- end }}
+  attractors: |
+    items:
+    - name: {{ .Values.attractor.name }}
+      vips:
+        - vip1
+        - vip2
+        - vip3
+      gateways:
+        - gateway1
+        - gateway2
+      trench: {{ .Values.trench.name }}
+  gateways: |
+    items:
+    {{- range .Values.tunnel.fe.gateways }}
+    - name: {{ .name }}
+      address: {{ .address }}
+      ip-family: {{ .ipFamily }}
+      bfd: {{ .bfd }}
+      protocol: {{ .protocol }}
+      trench: {{ $.Values.trench.name }}
+      bgp-auth:
+{{ include "meridio.bgpAuth" (dict "component" .) | indent 8}}
+    {{- end }} 
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "meridio.serviceAccount" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: meridio-configuration-role-{{ .Values.trench.name }}
+rules:
+- apiGroups: 
+  - ""
+  resources: 
+  - configmaps
+  verbs: 
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: meridio-configuration-role-binding-{{ .Values.trench.name }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "meridio.serviceAccount" . }}
+roleRef:
+  kind: Role
+  name: meridio-configuration-role-{{ .Values.trench.name }}
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "meridio.authServiceAccount" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: meridio-auth-configuration-role-{{ .Values.trench.name }}
+rules:
+- apiGroups: 
+  - ""
+  resources: 
+  - secrets
+  verbs: 
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: meridio-auth-configuration-role-binding-{{ .Values.trench.name }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "meridio.authServiceAccount" . }}
+roleRef:
+  kind: Role
+  name: meridio-auth-configuration-role-{{ .Values.trench.name }}
+  apiGroup: rbac.authorization.k8s.io

deployments/helm-tunnel/templates/ipam-service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "meridio.ipam.serviceName" . }}
+spec:
+  selector:
+    app: ipam-{{ .Values.trench.name }}
+  type: ClusterIP
+  ports:
+    - protocol: TCP
+      port: {{ .Values.ipam.port }}
+      targetPort: {{ .Values.ipam.targetPort }}