codedownio/sandwich
1
1
Fork 0
mirror of https://github.com/codedownio/sandwich.git synced 2024-09-11 11:56:32 +03:00
Code Issues Projects Releases Wiki Activity

Set a network policy for the discover pod too

Browse Source
This commit is contained in:
thomasjm 2024-06-07 02:34:13 -07:00
parent 2d51abb970
commit 7ec3e785da
1 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
sandwich-contexts-kubernetes/lib/Test/Sandwich/Contexts/Kubernetes/MinioS3Server.hs
View File

@ -36,6 +36,7 @@ import Test.Sandwich.Contexts.Waits
import UnliftIO.Environment import UnliftIO.Environment
import UnliftIO.Exception import UnliftIO.Exception
import UnliftIO.Process import UnliftIO.Process
import UnliftIO.Timeout
-- | Introduce a MinIO server on a Kubernetes cluster. -- | Introduce a MinIO server on a Kubernetes cluster.
@ -134,10 +135,12 @@ withK8SMinioS3Server' kubectlBinary kubectlMinioBinary (KubernetesClusterContext
] ]
let createNetworkPolicy = do let createNetworkPolicy = do
let (policyName, yaml) = networkPolicy deploymentName let (policyName, discoverPodPolicyName, yaml) = networkPolicy deploymentName
runWithKubeConfig' kubectlBinary ["create", "--namespace", toString namespace, "-f", "-"] yaml runWithKubeConfig' kubectlBinary ["create", "--namespace", toString namespace, "-f", "-"] yaml
pure policyName pure (policyName, discoverPodPolicyName)
let destroyNetworkPolicy policyName = runWithKubeConfig kubectlBinary ["delete", "NetworkPolicy", policyName, "--namespace", toString namespace] let destroyNetworkPolicy (policyName, discoverPodPolicyName) = do
runWithKubeConfig kubectlBinary ["delete", "NetworkPolicy", policyName, "--namespace", toString namespace]
runWithKubeConfig kubectlBinary ["delete", "NetworkPolicy", discoverPodPolicyName, "--namespace", toString namespace]
-- TODO: create network policy allowing ingress/egress for v1.min.io/tenant = deploymentName -- TODO: create network policy allowing ingress/egress for v1.min.io/tenant = deploymentName
bracket createNetworkPolicy destroyNetworkPolicy $ \_ -> bracket_ create destroy $ do bracket createNetworkPolicy destroyNetworkPolicy $ \_ -> bracket_ create destroy $ do
@ -171,10 +174,13 @@ withK8SMinioS3Server' kubectlBinary kubectlMinioBinary (KubernetesClusterContext
, "--restart=Never" , "--restart=Never"
, "--command" , "--command"
, "--namespace", toString namespace , "--namespace", toString namespace
, "--labels=app=discover-pod"
, "--" , "--"
, "sh", "-c", [i|until nc -vz minio 80; do echo "Waiting for minio..."; sleep 3; done;|] , "sh", "-c", [i|until nc -vz minio 80; do echo "Waiting for minio..."; sleep 3; done;|]
]) { env = Just env }) ]) { env = Just env })
waitForProcess p >>= (`shouldBe` ExitSuccess) timeout 300_000_000 (waitForProcess p >>= (`shouldBe` ExitSuccess)) >>= \case
Just () -> return ()
Nothing -> expectationFailure [i|Failed to wait for minio to come online.|]
info [__i|Ready to try port-forward: info [__i|Ready to try port-forward:
export KUBECONFIG=#{kubernetesClusterKubeConfigPath} export KUBECONFIG=#{kubernetesClusterKubeConfigPath}
@ -204,10 +210,11 @@ withK8SMinioS3Server' kubectlBinary kubectlMinioBinary (KubernetesClusterContext
void $ action testServ void $ action testServ
networkPolicy :: Text -> (String, String) networkPolicy :: Text -> (String, String, String)
networkPolicy deploymentName = (policyName, yaml) networkPolicy deploymentName = (policyName, discoverPodPolicyName, yaml)
where where
policyName = "minio-allow" policyName = "minio-allow"
discoverPodPolicyName = "discover-pod-allow"
yaml = [__i|apiVersion: networking.k8s.io/v1 yaml = [__i|apiVersion: networking.k8s.io/v1
kind: NetworkPolicy kind: NetworkPolicy
@ -225,6 +232,25 @@ networkPolicy deploymentName = (policyName, yaml)
ingress: ingress:
- {} - {}
egress:
- {}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: #{discoverPodPolicyName}
spec:
podSelector:
matchLabels:
app: discover-pod
policyTypes:
- Ingress
- Egress
ingress:
- {}
egress: egress:
- {} - {}
|] |]