Skip to content

Commit c9e8b0b

Browse files
OdedVinerOdedViner
committed
Add ceph-csi NetworkPolicy manifest and CI deployment
Add deploy/ceph-csi-networkpolicy.yaml with ingress policies for CephFS and RBD CSI plugins. Apply it automatically during rook.sh cluster setup and teardown. Expose standalone deploy/teardown commands in rook.sh and minikube.sh. Target namespace is configurable via CEPHCSI_NAMESPACE (default: "default"). Signed-off-by: Oded Viner <oviner@redhat.com>
1 parent 1fbfe8e commit c9e8b0b

3 files changed

Lines changed: 182 additions & 10 deletions

File tree

‎deploy/ceph-csi-networkpolicy.yaml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#################################################################################################################
2+
# NetworkPolicy definitions for the Ceph-CSI driver pods.
3+
# These policies control ingress traffic for each CSI plugin type (CephFS and RBD).
4+
#
5+
# The controller plugins expose metrics and CSI-Addons ports, while node plugins expose CSI-Addons ports.
6+
# Monitoring ingress is restricted to the monitoring namespace; CSI-Addons ingress is restricted to the
7+
# csi-addons-controller-manager pod.
8+
#################################################################################################################
9+
apiVersion: networking.k8s.io/v1
10+
kind: NetworkPolicy
11+
metadata:
12+
name: ceph-csi-cephfs-ctrlplugin
13+
namespace: default # namespace:csi
14+
spec:
15+
podSelector:
16+
matchLabels:
17+
app: openshift-storage.cephfs.csi.ceph.com-ctrlplugin
18+
policyTypes:
19+
- Ingress
20+
ingress:
21+
- from:
22+
- namespaceSelector:
23+
matchLabels:
24+
kubernetes.io/metadata.name: monitoring # namespace:monitoring
25+
ports:
26+
- protocol: TCP
27+
port: 8080
28+
- protocol: TCP
29+
port: 8681
30+
- from:
31+
- namespaceSelector:
32+
matchLabels:
33+
kubernetes.io/metadata.name: default # namespace:csi
34+
podSelector:
35+
matchLabels:
36+
app: csi-addons-controller-manager
37+
ports:
38+
- protocol: TCP
39+
port: 9080
40+
---
41+
apiVersion: networking.k8s.io/v1
42+
kind: NetworkPolicy
43+
metadata:
44+
name: ceph-csi-cephfs-nodeplugin-csi-addons
45+
namespace: default # namespace:csi
46+
spec:
47+
podSelector:
48+
matchLabels:
49+
app: openshift-storage.cephfs.csi.ceph.com-nodeplugin-csi-addons
50+
policyTypes:
51+
- Ingress
52+
ingress:
53+
- from:
54+
- namespaceSelector:
55+
matchLabels:
56+
kubernetes.io/metadata.name: default # namespace:csi
57+
podSelector:
58+
matchLabels:
59+
app: csi-addons-controller-manager
60+
ports:
61+
- protocol: TCP
62+
port: 9071
63+
---
64+
apiVersion: networking.k8s.io/v1
65+
kind: NetworkPolicy
66+
metadata:
67+
name: ceph-csi-rbd-ctrlplugin
68+
namespace: default # namespace:csi
69+
spec:
70+
podSelector:
71+
matchLabels:
72+
app: openshift-storage.rbd.csi.ceph.com-ctrlplugin
73+
policyTypes:
74+
- Ingress
75+
ingress:
76+
- from:
77+
- namespaceSelector:
78+
matchLabels:
79+
kubernetes.io/metadata.name: monitoring # namespace:monitoring
80+
ports:
81+
- protocol: TCP
82+
port: 8080
83+
- protocol: TCP
84+
port: 8680
85+
- from:
86+
- namespaceSelector:
87+
matchLabels:
88+
kubernetes.io/metadata.name: default # namespace:csi
89+
podSelector:
90+
matchLabels:
91+
app: csi-addons-controller-manager
92+
ports:
93+
- protocol: TCP
94+
port: 9070
95+
---
96+
apiVersion: networking.k8s.io/v1
97+
kind: NetworkPolicy
98+
metadata:
99+
name: ceph-csi-rbd-nodeplugin-csi-addons
100+
namespace: default # namespace:csi
101+
spec:
102+
podSelector:
103+
matchLabels:
104+
app: openshift-storage.rbd.csi.ceph.com-nodeplugin-csi-addons
105+
policyTypes:
106+
- Ingress
107+
ingress:
108+
- from:
109+
- namespaceSelector:
110+
matchLabels:
111+
kubernetes.io/metadata.name: default # namespace:csi
112+
podSelector:
113+
matchLabels:
114+
app: csi-addons-controller-manager
115+
ports:
116+
- protocol: TCP
117+
port: 9071

‎scripts/minikube.sh‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,16 @@ teardown-rook)
337337
${minikube} ssh "sudo rm -rf /mnt/${DISK}/var/lib/rook; sudo rm -rf /var/lib/rook"
338338
${minikube} ssh "sudo mkdir -p /mnt/${DISK}/var/lib/rook; sudo ln -s /mnt/${DISK}/var/lib/rook /var/lib/rook"
339339
;;
340+
deploy-networkpolicy)
341+
echo "deploy ceph-csi network policies"
342+
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
343+
"$DIR"/rook.sh deploy-networkpolicy
344+
;;
345+
teardown-networkpolicy)
346+
echo "teardown ceph-csi network policies"
347+
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
348+
"$DIR"/rook.sh teardown-networkpolicy
349+
;;
340350
cephcsi)
341351
echo "copying the cephcsi image"
342352
copy_image_to_cluster "${CEPHCSI_IMAGE_REPO}"/cephcsi:"${CSI_IMAGE_VERSION}" "${CEPHCSI_IMAGE_REPO}"/cephcsi:"${CSI_IMAGE_VERSION}"
@@ -367,10 +377,12 @@ Available Commands:
367377
delete-block-pool Deletes a rook block pool (named $ROOK_BLOCK_POOL_NAME)
368378
create-block-ec-pool Creates a rook erasure coded block pool (named $ROOK_BLOCK_EC_POOL_NAME)
369379
delete-block-ec-pool Creates a rook erasure coded block pool (named $ROOK_BLOCK_EC_POOL_NAME)
370-
cleanup-snapshotter Cleanup snapshot controller
371-
teardown-rook Teardown rook from minikube
372-
cephcsi Copy built docker images to kubernetes cluster
373-
k8s-sidecar Copy kubernetes sidecar docker images to kubernetes cluster
380+
cleanup-snapshotter Cleanup snapshot controller
381+
teardown-rook Teardown rook from minikube
382+
deploy-networkpolicy Deploy ceph-csi network policies
383+
teardown-networkpolicy Remove ceph-csi network policies
384+
cephcsi Copy built docker images to kubernetes cluster
385+
k8s-sidecar Copy kubernetes sidecar docker images to kubernetes cluster
374386
" >&2
375387
;;
376388
esac

‎scripts/rook.sh‎

Lines changed: 49 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ ROOK_URL="https://raw.githubusercontent.com/rook/rook/${ROOK_VERSION}/deploy/exa
66
ROOK_BLOCK_POOL_NAME=${ROOK_BLOCK_POOL_NAME:-"newrbdpool"}
77
ROOK_BLOCK_EC_POOL_NAME=${ROOK_BLOCK_EC_POOL_NAME:-"ec-pool"}
88
ROOK_SUBVOLUMEGROUP_NAME=${ROOK_SUBVOLUMEGROUP_NAME:-"csi"}
9+
CEPHCSI_NAMESPACE=${CEPHCSI_NAMESPACE:-"default"}
910

1011
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
1112
# shellcheck disable=SC1091
@@ -30,9 +31,42 @@ function log_errors() {
3031
exit 1
3132
}
3233

34+
function deploy_networkpolicy() {
35+
local np_file="${SCRIPT_DIR}/../deploy/ceph-csi-networkpolicy.yaml"
36+
if [ ! -f "${np_file}" ]; then
37+
echo "NetworkPolicy file not found at ${np_file}, skipping"
38+
return 0
39+
fi
40+
41+
local temp_dir
42+
temp_dir="$(mktemp -d)"
43+
cp "${np_file}" "${temp_dir}/ceph-csi-networkpolicy.yaml"
44+
sed -i "s|namespace: default # namespace:csi|namespace: ${CEPHCSI_NAMESPACE} # namespace:csi|g" "${temp_dir}/ceph-csi-networkpolicy.yaml"
45+
sed -i "s|kubernetes.io/metadata.name: default # namespace:csi|kubernetes.io/metadata.name: ${CEPHCSI_NAMESPACE} # namespace:csi|g" "${temp_dir}/ceph-csi-networkpolicy.yaml"
46+
kubectl_retry create -f "${temp_dir}/ceph-csi-networkpolicy.yaml"
47+
rm -rf "${temp_dir}"
48+
echo "NetworkPolicy resources created in namespace ${CEPHCSI_NAMESPACE}"
49+
}
50+
51+
function teardown_networkpolicy() {
52+
local np_file="${SCRIPT_DIR}/../deploy/ceph-csi-networkpolicy.yaml"
53+
if [ ! -f "${np_file}" ]; then
54+
return 0
55+
fi
56+
57+
local temp_dir
58+
temp_dir="$(mktemp -d)"
59+
cp "${np_file}" "${temp_dir}/ceph-csi-networkpolicy.yaml"
60+
sed -i "s|namespace: default # namespace:csi|namespace: ${CEPHCSI_NAMESPACE} # namespace:csi|g" "${temp_dir}/ceph-csi-networkpolicy.yaml"
61+
sed -i "s|kubernetes.io/metadata.name: default # namespace:csi|kubernetes.io/metadata.name: ${CEPHCSI_NAMESPACE} # namespace:csi|g" "${temp_dir}/ceph-csi-networkpolicy.yaml"
62+
kubectl delete -f "${temp_dir}/ceph-csi-networkpolicy.yaml" --ignore-not-found
63+
rm -rf "${temp_dir}"
64+
}
65+
3366
function deploy_rook() {
3467
kubectl_retry create -f "${ROOK_URL}/common.yaml"
3568
kubectl_retry create -f "${ROOK_URL}/crds.yaml"
69+
deploy_networkpolicy
3670

3771
TEMP_DIR="$(mktemp -d)"
3872
curl -o "${TEMP_DIR}/operator.yaml" "${ROOK_URL}/operator.yaml"
@@ -84,6 +118,7 @@ function deploy_rook() {
84118
}
85119

86120
function teardown_rook() {
121+
teardown_networkpolicy
87122
create_or_delete_subvolumegroup "delete"
88123
kubectl delete -f "${ROOK_URL}/pool-test.yaml"
89124
kubectl delete -f "${ROOK_URL}/filesystem-test.yaml"
@@ -266,15 +301,23 @@ create-block-ec-pool)
266301
delete-block-ec-pool)
267302
delete_block_ec_pool
268303
;;
304+
deploy-networkpolicy)
305+
deploy_networkpolicy
306+
;;
307+
teardown-networkpolicy)
308+
teardown_networkpolicy
309+
;;
269310
*)
270311
echo " $0 [command]
271312
Available Commands:
272-
deploy Deploy a rook
273-
teardown Teardown a rook
274-
create-block-pool Create a rook block pool
275-
delete-block-pool Delete a rook block pool
276-
create-block-ec-pool Creates a rook erasure coded block pool
277-
delete-block-ec-pool Deletes a rook erasure coded block pool
313+
deploy Deploy a rook
314+
teardown Teardown a rook
315+
create-block-pool Create a rook block pool
316+
delete-block-pool Delete a rook block pool
317+
create-block-ec-pool Creates a rook erasure coded block pool
318+
delete-block-ec-pool Deletes a rook erasure coded block pool
319+
deploy-networkpolicy Deploy ceph-csi network policies
320+
teardown-networkpolicy Remove ceph-csi network policies
278321
" >&2
279322
;;
280323
esac

0 commit comments

Comments
 (0)