Remove kube_dynamic from Sotw snap and mover envoy kyverno policy und…

…er deploy
utilitywarehouse · Jan 20, 2025 · 94429d0 · 94429d0
1 parent 3a88bfe
commit 94429d0
Show file tree

Hide file tree

Showing 19 changed files with 27 additions and 418 deletions.
diff --git a/controller/controller_test.go b/controller/controller_test.go
@@ -60,7 +60,7 @@ func TestReconcileServices_LabelledService(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify the default round robin policy is set on the clusters
 	for _, cl := range snap.GetResources(resource.ClusterType) {
 		cluster, err := xds.UnmarshalResourceToCluster(cl)
@@ -103,7 +103,7 @@ func TestReconcileServices_LabelledServiceLbPolicy(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify the correct lb policy (ring hash) is set on the clusters
 	for _, cl := range snap.GetResources(resource.ClusterType) {
 		cluster, err := xds.UnmarshalResourceToCluster(cl)
@@ -140,7 +140,7 @@ func TestReconcileServices_LabelledServiceInvalidLbPolicy(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify the default round robin policy is set on the clusters
 	for _, cl := range snap.GetResources(resource.ClusterType) {
 		cluster, err := xds.UnmarshalResourceToCluster(cl)
@@ -177,7 +177,7 @@ func TestReconcileServices_XdsService(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify the default round robin policy is set on the clusters
 	for _, cl := range snap.GetResources(resource.ClusterType) {
 		cluster, err := xds.UnmarshalResourceToCluster(cl)
@@ -220,7 +220,7 @@ func TestReconcileServices_XdsServiceNotExistent(t *testing.T) {
 	}
 	assert.Equal(t, 0, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 0, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType))) // kube_dynamic
+	assert.Equal(t, 0, len(snap.GetResources(resource.RouteType)))
 	snap, err = snapshotter.EndpointsSnapshot(testNodeID)
 	if err != nil {
 		t.Fatal(err)
@@ -254,7 +254,7 @@ func TestReconcileServices_XdsServiceDelete(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify we will have one Endpoint resource in the snapshot
 	snap, err = snapshotter.EndpointsSnapshot(testNodeID)
 	if err != nil {
@@ -271,7 +271,7 @@ func TestReconcileServices_XdsServiceDelete(t *testing.T) {
 	}
 	assert.Equal(t, 0, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 0, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType))) // kube_dynamic
+	assert.Equal(t, 0, len(snap.GetResources(resource.RouteType)))
 	snap, err = snapshotter.EndpointsSnapshot(testNodeID)
 	if err != nil {
 		t.Fatal(err)
@@ -304,7 +304,7 @@ func TestReconcileLocalEndpointSlice_SnapOnUpdate(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	snap, err = snapshotter.EndpointsSnapshot(testNodeID)
 	if err != nil {
 		t.Fatal(err)
@@ -394,7 +394,7 @@ func TestReconcileServices_XdsServiceWithRemoteEndpoints(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify we will have 1 Endpoint resource in the snapshot containing
 	// addresses from both local(2) and remote(2). 4 lbEndpoint addresses in
 	// total. Also verify that all priorities are set to 0.
@@ -457,7 +457,7 @@ func TestReconcileServices_XdsServiceWithRemoteEndpoints_NoRemoteEndpoints(t *te
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify we will have 1 Endpoint resource in the snapshot containing
 	// only local client addresses.
 	snap, err = snapshotter.EndpointsSnapshot(testNodeID)
@@ -508,7 +508,7 @@ func TestReconcileServices_XdsServiceWithOnlyRemoteEndpoints(t *testing.T) {
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify we will have 1 Endpoint resource in the snapshot containing
 	// only remote addresses (2).
 	snap, err = snapshotter.EndpointsSnapshot(testNodeID)
@@ -560,7 +560,7 @@ func TestReconcileServices_XdsServiceWithRemoteEndpointsAndLocalPriority(t *test
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify we will have 1 Endpoint resource in the snapshot containing
 	// addresses for local endpoints with priority 0 and for remote ones
 	// with priority 1.
@@ -622,7 +622,7 @@ func TestReconcileServices_XdsServiceWithOnlyRemoteEndpointsAndLocalPriority(t *
 	}
 	assert.Equal(t, 1, len(snap.GetResources(resource.ListenerType)))
 	assert.Equal(t, 1, len(snap.GetResources(resource.ClusterType)))
-	assert.Equal(t, 2, len(snap.GetResources(resource.RouteType))) // Includes kube_dynamic
+	assert.Equal(t, 1, len(snap.GetResources(resource.RouteType)))
 	// Verify we will have 1 Endpoint resource in the snapshot containing
 	// addresses for remote endpoints with priority 0, regardless of
 	// PriorityStrategy set to local-first.

diff --git a/deploy/kustomize/kyverno/mutate/kustomization.yaml b/deploy/kustomize/kyverno/mutate/kustomization.yaml
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - mutate-semaphore-xds-clients-env.yaml
+- mutate-semaphore-xds-envoy-sidecar.yaml
diff --git a/...e/mutate-semaphore-xds-envoy-sidecar.yaml → ...e/mutate-semaphore-xds-envoy-sidecar.yaml b/...e/mutate-semaphore-xds-envoy-sidecar.yaml → ...e/mutate-semaphore-xds-envoy-sidecar.yaml
@@ -3,10 +3,12 @@ kind: ClusterPolicy
 metadata:
   annotations:
     policies.kyverno.io/category: xDS
-    policies.kyverno.io/description: 'This policy ensures that pods labelled with
-      xds.semaphore.uw.systems/envoy-sidecar: "true" are injected with the init container
-      and the sidecar needed to use envoy to proxy grpc connections to targets specified
-      by xds.semaphore.uw.systems/envoy-sidecar-targets annotation.'
+    policies.kyverno.io/description: 'This policy ensures that pods labelled
+      with xds.semaphore.uw.systems/envoy-sidecar: "true" are injected with
+      an envoy sidecar to proxy grpc connections. It also points the rest of the
+      containers to semaphore-xds-localhost sys-semaphore service to get mock
+      xDS config that will point to a local port for envoy sidecar via gRPC
+      bootstrap conifg.'
     policies.kyverno.io/subject: Pod
     policies.kyverno.io/title: Mutate Sempaphore-xDS Envoy Sidecar
   name: mutate-semaphore-xds-envoy-sidecar

diff --git a/envoy-sidecar/README.md b/envoy-sidecar/README.md
diff --git a/envoy-sidecar/configurer/.gitignore b/envoy-sidecar/configurer/.gitignore
diff --git a/envoy-sidecar/configurer/Dockerfile b/envoy-sidecar/configurer/Dockerfile
diff --git a/envoy-sidecar/configurer/README.md b/envoy-sidecar/configurer/README.md
diff --git a/envoy-sidecar/configurer/configure.go b/envoy-sidecar/configurer/configure.go
diff --git a/envoy-sidecar/configurer/go.mod b/envoy-sidecar/configurer/go.mod