mirror of
https://github.com/codedownio/sandwich.git
synced 2024-09-11 11:56:32 +03:00
Set a network policy for the discover pod too
This commit is contained in:
parent
2d51abb970
commit
7ec3e785da
@ -36,6 +36,7 @@ import Test.Sandwich.Contexts.Waits
|
|||||||
import UnliftIO.Environment
|
import UnliftIO.Environment
|
||||||
import UnliftIO.Exception
|
import UnliftIO.Exception
|
||||||
import UnliftIO.Process
|
import UnliftIO.Process
|
||||||
|
import UnliftIO.Timeout
|
||||||
|
|
||||||
|
|
||||||
-- | Introduce a MinIO server on a Kubernetes cluster.
|
-- | Introduce a MinIO server on a Kubernetes cluster.
|
||||||
@ -134,10 +135,12 @@ withK8SMinioS3Server' kubectlBinary kubectlMinioBinary (KubernetesClusterContext
|
|||||||
]
|
]
|
||||||
|
|
||||||
let createNetworkPolicy = do
|
let createNetworkPolicy = do
|
||||||
let (policyName, yaml) = networkPolicy deploymentName
|
let (policyName, discoverPodPolicyName, yaml) = networkPolicy deploymentName
|
||||||
runWithKubeConfig' kubectlBinary ["create", "--namespace", toString namespace, "-f", "-"] yaml
|
runWithKubeConfig' kubectlBinary ["create", "--namespace", toString namespace, "-f", "-"] yaml
|
||||||
pure policyName
|
pure (policyName, discoverPodPolicyName)
|
||||||
let destroyNetworkPolicy policyName = runWithKubeConfig kubectlBinary ["delete", "NetworkPolicy", policyName, "--namespace", toString namespace]
|
let destroyNetworkPolicy (policyName, discoverPodPolicyName) = do
|
||||||
|
runWithKubeConfig kubectlBinary ["delete", "NetworkPolicy", policyName, "--namespace", toString namespace]
|
||||||
|
runWithKubeConfig kubectlBinary ["delete", "NetworkPolicy", discoverPodPolicyName, "--namespace", toString namespace]
|
||||||
|
|
||||||
-- TODO: create network policy allowing ingress/egress for v1.min.io/tenant = deploymentName
|
-- TODO: create network policy allowing ingress/egress for v1.min.io/tenant = deploymentName
|
||||||
bracket createNetworkPolicy destroyNetworkPolicy $ \_ -> bracket_ create destroy $ do
|
bracket createNetworkPolicy destroyNetworkPolicy $ \_ -> bracket_ create destroy $ do
|
||||||
@ -171,10 +174,13 @@ withK8SMinioS3Server' kubectlBinary kubectlMinioBinary (KubernetesClusterContext
|
|||||||
, "--restart=Never"
|
, "--restart=Never"
|
||||||
, "--command"
|
, "--command"
|
||||||
, "--namespace", toString namespace
|
, "--namespace", toString namespace
|
||||||
|
, "--labels=app=discover-pod"
|
||||||
, "--"
|
, "--"
|
||||||
, "sh", "-c", [i|until nc -vz minio 80; do echo "Waiting for minio..."; sleep 3; done;|]
|
, "sh", "-c", [i|until nc -vz minio 80; do echo "Waiting for minio..."; sleep 3; done;|]
|
||||||
]) { env = Just env })
|
]) { env = Just env })
|
||||||
waitForProcess p >>= (`shouldBe` ExitSuccess)
|
timeout 300_000_000 (waitForProcess p >>= (`shouldBe` ExitSuccess)) >>= \case
|
||||||
|
Just () -> return ()
|
||||||
|
Nothing -> expectationFailure [i|Failed to wait for minio to come online.|]
|
||||||
|
|
||||||
info [__i|Ready to try port-forward:
|
info [__i|Ready to try port-forward:
|
||||||
export KUBECONFIG=#{kubernetesClusterKubeConfigPath}
|
export KUBECONFIG=#{kubernetesClusterKubeConfigPath}
|
||||||
@ -204,10 +210,11 @@ withK8SMinioS3Server' kubectlBinary kubectlMinioBinary (KubernetesClusterContext
|
|||||||
void $ action testServ
|
void $ action testServ
|
||||||
|
|
||||||
|
|
||||||
networkPolicy :: Text -> (String, String)
|
networkPolicy :: Text -> (String, String, String)
|
||||||
networkPolicy deploymentName = (policyName, yaml)
|
networkPolicy deploymentName = (policyName, discoverPodPolicyName, yaml)
|
||||||
where
|
where
|
||||||
policyName = "minio-allow"
|
policyName = "minio-allow"
|
||||||
|
discoverPodPolicyName = "discover-pod-allow"
|
||||||
|
|
||||||
yaml = [__i|apiVersion: networking.k8s.io/v1
|
yaml = [__i|apiVersion: networking.k8s.io/v1
|
||||||
kind: NetworkPolicy
|
kind: NetworkPolicy
|
||||||
@ -225,6 +232,25 @@ networkPolicy deploymentName = (policyName, yaml)
|
|||||||
ingress:
|
ingress:
|
||||||
- {}
|
- {}
|
||||||
|
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: #{discoverPodPolicyName}
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: discover-pod
|
||||||
|
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
- {}
|
||||||
|
|
||||||
egress:
|
egress:
|
||||||
- {}
|
- {}
|
||||||
|]
|
|]
|
||||||
|
Loading…
Reference in New Issue
Block a user