Examples with NetworkPolicy com.google.container.v1.NetworkPolicy used on opensource projects

Example 36 with NetworkPolicy

use of com.google.container.v1.NetworkPolicy in project strimzi by strimzi.

the class KafkaMirrorMaker2AssemblyOperatorTest method testUpdateClusterScaleDown.

@Test
public void testUpdateClusterScaleDown(VertxTestContext context) {
    int scaleTo = 2;
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(true);
    CrdOperator mockMirrorMaker2Ops = supplier.mirrorMaker2Operator;
    DeploymentOperator mockDcOps = supplier.deploymentOperations;
    PodDisruptionBudgetOperator mockPdbOps = supplier.podDisruptionBudgetOperator;
    ConfigMapOperator mockCmOps = supplier.configMapOperations;
    ServiceOperator mockServiceOps = supplier.serviceOperations;
    NetworkPolicyOperator mockNetPolOps = supplier.networkPolicyOperator;
    SecretOperator mockSecretOps = supplier.secretOperations;
    String kmm2Name = "foo";
    String kmm2Namespace = "test";
    KafkaMirrorMaker2 kmm2 = ResourceUtils.createEmptyKafkaMirrorMaker2(kmm2Namespace, kmm2Name);
    KafkaMirrorMaker2Cluster mirrorMaker2 = KafkaMirrorMaker2Cluster.fromCrd(Reconciliation.DUMMY_RECONCILIATION, kmm2, VERSIONS);
    // Change replicas to create ScaleDown
    kmm2.getSpec().setReplicas(scaleTo);
    when(mockMirrorMaker2Ops.get(kmm2Namespace, kmm2Name)).thenReturn(kmm2);
    when(mockMirrorMaker2Ops.getAsync(anyString(), anyString())).thenReturn(Future.succeededFuture(kmm2));
    when(mockMirrorMaker2Ops.updateStatusAsync(any(), any(KafkaMirrorMaker2.class))).thenReturn(Future.succeededFuture());
    when(mockServiceOps.get(kmm2Namespace, mirrorMaker2.getName())).thenReturn(mirrorMaker2.generateService());
    when(mockDcOps.get(kmm2Namespace, mirrorMaker2.getName())).thenReturn(mirrorMaker2.generateDeployment(new HashMap<String, String>(), true, null, null));
    when(mockDcOps.readiness(any(), anyString(), anyString(), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    when(mockDcOps.waitForObserved(any(), anyString(), anyString(), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    when(mockServiceOps.reconcile(any(), eq(kmm2Namespace), any(), any())).thenReturn(Future.succeededFuture());
    when(mockSecretOps.reconcile(any(), anyString(), any(), any())).thenReturn(Future.succeededFuture());
    when(mockDcOps.reconcile(any(), eq(kmm2Namespace), any(), any())).thenReturn(Future.succeededFuture());
    doAnswer(i -> Future.succeededFuture(scaleTo)).when(mockDcOps).scaleUp(any(), eq(kmm2Namespace), eq(mirrorMaker2.getName()), eq(scaleTo));
    doAnswer(i -> Future.succeededFuture(scaleTo)).when(mockDcOps).scaleDown(any(), eq(kmm2Namespace), eq(mirrorMaker2.getName()), eq(scaleTo));
    when(mockMirrorMaker2Ops.reconcile(any(), anyString(), any(), any())).thenReturn(Future.succeededFuture(ReconcileResult.created(new KafkaMirrorMaker2())));
    when(mockCmOps.reconcile(any(), anyString(), any(), any())).thenReturn(Future.succeededFuture(ReconcileResult.created(new ConfigMap())));
    when(mockPdbOps.reconcile(any(), anyString(), any(), any())).thenReturn(Future.succeededFuture(ReconcileResult.created(new PodDisruptionBudget())));
    when(mockNetPolOps.reconcile(any(), eq(kmm2.getMetadata().getNamespace()), eq(KafkaMirrorMaker2Resources.deploymentName(kmm2.getMetadata().getName())), any())).thenReturn(Future.succeededFuture(ReconcileResult.created(new NetworkPolicy())));
    KafkaConnectApi mockConnectClient = mock(KafkaConnectApi.class);
    when(mockConnectClient.list(anyString(), anyInt())).thenReturn(Future.succeededFuture(emptyList()));
    when(mockConnectClient.updateConnectLoggers(any(), anyString(), anyInt(), anyString(), any(OrderedProperties.class))).thenReturn(Future.succeededFuture());
    KafkaMirrorMaker2AssemblyOperator ops = new KafkaMirrorMaker2AssemblyOperator(vertx, new PlatformFeaturesAvailability(true, kubernetesVersion), supplier, ResourceUtils.dummyClusterOperatorConfig(VERSIONS), x -> mockConnectClient);
    Checkpoint async = context.checkpoint();
    ops.createOrUpdate(new Reconciliation("test-trigger", KafkaMirrorMaker2.RESOURCE_KIND, kmm2Namespace, kmm2Name), kmm2).onComplete(context.succeeding(v -> context.verify(() -> {
        verify(mockDcOps).scaleUp(any(), eq(kmm2Namespace), eq(mirrorMaker2.getName()), eq(scaleTo));
        async.flag();
    })));
}

Example 37 with NetworkPolicy

use of com.google.container.v1.NetworkPolicy in project strimzi by strimzi.

the class KafkaMirrorMaker2AssemblyOperatorTest method testCreateClusterWithZeroReplicas.

@Test
public void testCreateClusterWithZeroReplicas(VertxTestContext context) {
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(true);
    CrdOperator mockMirrorMaker2Ops = supplier.mirrorMaker2Operator;
    DeploymentOperator mockDcOps = supplier.deploymentOperations;
    PodDisruptionBudgetOperator mockPdbOps = supplier.podDisruptionBudgetOperator;
    ConfigMapOperator mockCmOps = supplier.configMapOperations;
    ServiceOperator mockServiceOps = supplier.serviceOperations;
    NetworkPolicyOperator mockNetPolOps = supplier.networkPolicyOperator;
    SecretOperator mockSecretOps = supplier.secretOperations;
    String kmm2Name = "foo";
    String kmm2Namespace = "test";
    KafkaMirrorMaker2 kmm2 = ResourceUtils.createEmptyKafkaMirrorMaker2(kmm2Namespace, kmm2Name, 0);
    when(mockMirrorMaker2Ops.get(kmm2Namespace, kmm2Name)).thenReturn(kmm2);
    when(mockMirrorMaker2Ops.getAsync(anyString(), anyString())).thenReturn(Future.succeededFuture(kmm2));
    ArgumentCaptor<Service> serviceCaptor = ArgumentCaptor.forClass(Service.class);
    when(mockServiceOps.reconcile(any(), anyString(), anyString(), serviceCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Deployment> dcCaptor = ArgumentCaptor.forClass(Deployment.class);
    when(mockDcOps.reconcile(any(), anyString(), anyString(), dcCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockDcOps.scaleUp(any(), anyString(), anyString(), anyInt())).thenReturn(Future.succeededFuture(42));
    when(mockDcOps.scaleDown(any(), anyString(), anyString(), anyInt())).thenReturn(Future.succeededFuture(42));
    when(mockDcOps.waitForObserved(any(), anyString(), anyString(), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    when(mockCmOps.reconcile(any(), anyString(), any(), any())).thenReturn(Future.succeededFuture(ReconcileResult.created(new ConfigMap())));
    when(mockNetPolOps.reconcile(any(), eq(kmm2.getMetadata().getNamespace()), eq(KafkaMirrorMaker2Resources.deploymentName(kmm2.getMetadata().getName())), any())).thenReturn(Future.succeededFuture(ReconcileResult.created(new NetworkPolicy())));
    when(mockSecretOps.reconcile(any(), eq(kmm2Namespace), any(), any())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<PodDisruptionBudget> pdbCaptor = ArgumentCaptor.forClass(PodDisruptionBudget.class);
    when(mockPdbOps.reconcile(any(), anyString(), any(), pdbCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<KafkaMirrorMaker2> mirrorMaker2Captor = ArgumentCaptor.forClass(KafkaMirrorMaker2.class);
    when(mockMirrorMaker2Ops.updateStatusAsync(any(), mirrorMaker2Captor.capture())).thenReturn(Future.succeededFuture());
    KafkaConnectApi mockConnectClient = mock(KafkaConnectApi.class);
    when(mockConnectClient.list(anyString(), anyInt())).thenReturn(Future.succeededFuture(emptyList()));
    when(mockConnectClient.updateConnectLoggers(any(), anyString(), anyInt(), anyString(), any(OrderedProperties.class))).thenReturn(Future.succeededFuture());
    KafkaMirrorMaker2AssemblyOperator ops = new KafkaMirrorMaker2AssemblyOperator(vertx, new PlatformFeaturesAvailability(true, kubernetesVersion), supplier, ResourceUtils.dummyClusterOperatorConfig(VERSIONS), x -> mockConnectClient);
    KafkaMirrorMaker2Cluster mirrorMaker2 = KafkaMirrorMaker2Cluster.fromCrd(Reconciliation.DUMMY_RECONCILIATION, kmm2, VERSIONS);
    Checkpoint async = context.checkpoint();
    ops.reconcile(new Reconciliation("test-trigger", KafkaMirrorMaker2.RESOURCE_KIND, kmm2Namespace, kmm2Name)).onComplete(context.succeeding(v -> context.verify(() -> {
        // 0 Replicas - readiness should never get called.
        verify(mockDcOps, never()).readiness(any(), anyString(), anyString(), anyLong(), anyLong());
        // Verify service
        List<Service> capturedServices = serviceCaptor.getAllValues();
        assertThat(capturedServices, hasSize(1));
        Service service = capturedServices.get(0);
        assertThat(service.getMetadata().getName(), is(mirrorMaker2.getServiceName()));
        assertThat(service, is(mirrorMaker2.generateService()));
        // Verify Deployment
        List<Deployment> capturedDc = dcCaptor.getAllValues();
        assertThat(capturedDc, hasSize(1));
        Deployment dc = capturedDc.get(0);
        assertThat(dc.getMetadata().getName(), is(mirrorMaker2.getName()));
        Map<String, String> annotations = new HashMap<>();
        annotations.put(Annotations.ANNO_STRIMZI_LOGGING_DYNAMICALLY_UNCHANGEABLE_HASH, Util.hashStub(Util.getLoggingDynamicallyUnmodifiableEntries(LOGGING_CONFIG)));
        assertThat(dc, is(mirrorMaker2.generateDeployment(annotations, true, null, null)));
        // Verify PodDisruptionBudget
        List<PodDisruptionBudget> capturedPdb = pdbCaptor.getAllValues();
        assertThat(capturedPdb, hasSize(1));
        PodDisruptionBudget pdb = capturedPdb.get(0);
        assertThat(pdb.getMetadata().getName(), is(mirrorMaker2.getName()));
        assertThat(pdb, is(mirrorMaker2.generatePodDisruptionBudget()));
        // Verify status
        List<KafkaMirrorMaker2> capturedMirrorMaker2s = mirrorMaker2Captor.getAllValues();
        assertThat(capturedMirrorMaker2s.get(0).getStatus().getUrl(), is(nullValue()));
        assertThat(capturedMirrorMaker2s.get(0).getStatus().getReplicas(), is(mirrorMaker2.getReplicas()));
        assertThat(capturedMirrorMaker2s.get(0).getStatus().getLabelSelector(), is(mirrorMaker2.getSelectorLabels().toSelectorString()));
        assertThat(capturedMirrorMaker2s.get(0).getStatus().getConditions().get(0).getStatus(), is("True"));
        assertThat(capturedMirrorMaker2s.get(0).getStatus().getConditions().get(0).getType(), is("Ready"));
        async.flag();
    })));
}

Example 38 with NetworkPolicy

use of com.google.container.v1.NetworkPolicy in project strimzi by strimzi.

the class NetworkPolicyResource method allowNetworkPolicySettingsForKafkaExporter.

public static void allowNetworkPolicySettingsForKafkaExporter(ExtensionContext extensionContext, String clusterName, String namespace) {
    String kafkaExporterDeploymentName = KafkaExporterResources.deploymentName(clusterName);
    LabelSelector labelSelector = new LabelSelectorBuilder().addToMatchLabels(Constants.SCRAPER_LABEL_KEY, Constants.SCRAPER_LABEL_VALUE).build();
    LOGGER.info("Apply NetworkPolicy access to {} from pods with LabelSelector {}", kafkaExporterDeploymentName, labelSelector);
    NetworkPolicy networkPolicy = NetworkPolicyTemplates.networkPolicyBuilder(namespace, kafkaExporterDeploymentName, labelSelector).editSpec().editFirstIngress().addNewPort().withNewPort(Constants.COMPONENTS_METRICS_PORT).withProtocol("TCP").endPort().endIngress().withNewPodSelector().addToMatchLabels("strimzi.io/cluster", clusterName).addToMatchLabels("strimzi.io/kind", Kafka.RESOURCE_KIND).addToMatchLabels("strimzi.io/name", kafkaExporterDeploymentName).endPodSelector().endSpec().build();
    LOGGER.debug("Creating NetworkPolicy: {}", networkPolicy.toString());
    ResourceManager.getInstance().createResource(extensionContext, networkPolicy);
    LOGGER.info("Network policy for LabelSelector {} successfully created", labelSelector);
}

Example 39 with NetworkPolicy

use of com.google.container.v1.NetworkPolicy in project strimzi by strimzi.

the class NetworkPolicyResource method allowNetworkPolicySettingsForResource.

/**
 * Method for allowing network policies for Connect
 * @param resource mean Connect resource
 * @param deploymentName name of resource deployment - for setting strimzi.io/name
 */
public static void allowNetworkPolicySettingsForResource(ExtensionContext extensionContext, HasMetadata resource, String deploymentName) {
    LabelSelector labelSelector = new LabelSelectorBuilder().addToMatchLabels(Constants.SCRAPER_LABEL_KEY, Constants.SCRAPER_LABEL_VALUE).build();
    final String namespaceName = StUtils.isParallelNamespaceTest(extensionContext) && !Environment.isNamespaceRbacScope() ? // if parallel namespace test use namespace from store and if RBAC is enable we don't run tests in parallel mode and with that said we don't create another namespaces
    extensionContext.getStore(ExtensionContext.Namespace.GLOBAL).get(Constants.NAMESPACE_KEY).toString() : // otherwise use resource namespace
    resource.getMetadata().getNamespace();
    if (kubeClient(namespaceName).listPods(namespaceName, labelSelector).size() == 0) {
        List<String> pods = kubeClient(namespaceName).listPods(namespaceName).stream().map(pod -> pod.getMetadata().getName()).collect(Collectors.toList());
        LOGGER.error("Pods inside {} namespace are {}", namespaceName, pods.toString());
        throw new RuntimeException("You did not create the Scraper instance(pod) before using the " + resource.getKind() + " in namespace:" + namespaceName);
    }
    LOGGER.info("Apply NetworkPolicy access to {} from pods with LabelSelector {}", deploymentName, labelSelector);
    NetworkPolicy networkPolicy = new NetworkPolicyBuilder().withApiVersion("networking.k8s.io/v1").withKind(Constants.NETWORK_POLICY).withNewMetadata().withName(resource.getMetadata().getName() + "-allow").withNamespace(namespaceName).endMetadata().withNewSpec().addNewIngress().addNewFrom().withPodSelector(labelSelector).endFrom().addNewPort().withNewPort(8083).withProtocol("TCP").endPort().addNewPort().withNewPort(9404).withProtocol("TCP").endPort().addNewPort().withNewPort(8080).withProtocol("TCP").endPort().addNewPort().withNewPort(Constants.JMX_PORT).withProtocol("TCP").endPort().endIngress().withNewPodSelector().addToMatchLabels("strimzi.io/cluster", resource.getMetadata().getName()).addToMatchLabels("strimzi.io/kind", resource.getKind()).addToMatchLabels("strimzi.io/name", deploymentName).endPodSelector().withPolicyTypes("Ingress").endSpec().build();
    LOGGER.debug("Creating NetworkPolicy: {}", networkPolicy.toString());
    ResourceManager.getInstance().createResource(extensionContext, networkPolicy);
    LOGGER.info("Network policy for LabelSelector {} successfully created", labelSelector);
}

Example 40 with NetworkPolicy

use of com.google.container.v1.NetworkPolicy in project strimzi by strimzi.

the class NetworkPolicyResource method allowNetworkPolicySettingsForClusterOperator.

public static void allowNetworkPolicySettingsForClusterOperator(ExtensionContext extensionContext, String namespace) {
    String clusterOperatorKind = "cluster-operator";
    LabelSelector labelSelector = new LabelSelectorBuilder().addToMatchLabels(Constants.SCRAPER_LABEL_KEY, Constants.SCRAPER_LABEL_VALUE).build();
    LOGGER.info("Apply NetworkPolicy access to {} from pods with LabelSelector {}", clusterOperatorKind, labelSelector);
    NetworkPolicy networkPolicy = NetworkPolicyTemplates.networkPolicyBuilder(namespace, clusterOperatorKind, labelSelector).editSpec().editFirstIngress().addNewPort().withNewPort(Constants.CLUSTER_OPERATOR_METRICS_PORT).withProtocol("TCP").endPort().endIngress().withNewPodSelector().addToMatchLabels("strimzi.io/kind", clusterOperatorKind).endPodSelector().endSpec().build();
    LOGGER.debug("Creating NetworkPolicy: {}", networkPolicy.toString());
    ResourceManager.getInstance().createResource(extensionContext, networkPolicy);
    LOGGER.info("Network policy for LabelSelector {} successfully created", labelSelector);
}