Skip to content

Commit

Permalink
AKS : Advanced Networking / Calico Network Policy (#2987)
Browse files Browse the repository at this point in the history 
This PR aims to add Calico Network policy to AKS as described in [MS Docs](https://docs.microsoft.com/en-us/azure/aks/use-network-policies).

Added `network_policy` to `kubernetes_cluster` resource.

PR Inspiration: #1479
  • Loading branch information
@thatInfrastructureGuy @katbyte
thatInfrastructureGuy authored and katbyte committed Mar 21, 2019
1 parent c9cfaa4 commit a7f35de
Show file tree
Hide file tree
Showing 9 changed files with 426 additions and 0 deletions.
9 changes: 9 additions & 0 deletions azurerm/data_source_kubernetes_cluster.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -249,6 +249,11 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
Computed: true,
},

"network_policy": {
Type: schema.TypeString,
Computed: true,
},

"service_cidr": {
Type: schema.TypeString,
Computed: true,
Expand Down Expand Up @@ -612,6 +617,10 @@ func flattenKubernetesClusterDataSourceNetworkProfile(profile *containerservice.

values["network_plugin"] = profile.NetworkPlugin

if profile.NetworkPolicy != "" {
values["network_policy"] = string(profile.NetworkPolicy)
}

if profile.ServiceCidr != nil {
values["service_cidr"] = *profile.ServiceCidr
}
Expand Down
85 changes: 85 additions & 0 deletions azurerm/data_source_kubernetes_cluster_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,36 @@ func TestAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzure(t *testin
},
})
}
func TestAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicy(t *testing.T) {
dataSourceName := "data.azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
clientId := os.Getenv("ARM_CLIENT_ID")
clientSecret := os.Getenv("ARM_CLIENT_SECRET")
location := testLocation()
config := testAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicy(ri, clientId, clientSecret, location)

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: config,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(dataSourceName),
resource.TestCheckResourceAttrSet(dataSourceName, "agent_pool_profile.0.vnet_subnet_id"),
resource.TestCheckResourceAttr(dataSourceName, "network_profile.0.network_plugin", "azure"),
resource.TestCheckResourceAttr(dataSourceName, "network_profile.0.network_policy", "calico"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.network_plugin"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.network_policy"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.dns_service_ip"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.docker_bridge_cidr"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.service_cidr"),
),
},
},
})
}

func TestAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureComplete(t *testing.T) {
dataSourceName := "data.azurerm_kubernetes_cluster.test"
Expand Down Expand Up @@ -182,6 +212,37 @@ func TestAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureComplete(t
})
}

func TestAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicyComplete(t *testing.T) {
dataSourceName := "data.azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
clientId := os.Getenv("ARM_CLIENT_ID")
clientSecret := os.Getenv("ARM_CLIENT_SECRET")
location := testLocation()
config := testAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicyComplete(ri, clientId, clientSecret, location)

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: config,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(dataSourceName),
resource.TestCheckResourceAttrSet(dataSourceName, "agent_pool_profile.0.vnet_subnet_id"),
resource.TestCheckResourceAttr(dataSourceName, "network_profile.0.network_plugin", "azure"),
resource.TestCheckResourceAttr(dataSourceName, "network_profile.0.network_policy", "calico"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.network_plugin"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.network_policy"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.dns_service_ip"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.docker_bridge_cidr"),
resource.TestCheckResourceAttrSet(dataSourceName, "network_profile.0.service_cidr"),
),
},
},
})
}

func TestAccDataSourceAzureRMKubernetesCluster_advancedNetworkingKubenet(t *testing.T) {
dataSourceName := "data.azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
Expand Down Expand Up @@ -354,6 +415,18 @@ data "azurerm_kubernetes_cluster" "test" {
`, r)
}

func testAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicy(rInt int, clientId string, clientSecret string, location string) string {
r := testAccAzureRMKubernetesCluster_advancedNetworkingWithPolicy(rInt, clientId, clientSecret, location, "azure", "calico")
return fmt.Sprintf(`
%s
data "azurerm_kubernetes_cluster" "test" {
name = "${azurerm_kubernetes_cluster.test.name}"
resource_group_name = "${azurerm_kubernetes_cluster.test.resource_group_name}"
}
`, r)
}

func testAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureComplete(rInt int, clientId string, clientSecret string, location string) string {
r := testAccAzureRMKubernetesCluster_advancedNetworkingComplete(rInt, clientId, clientSecret, location, "azure")
return fmt.Sprintf(`
Expand All @@ -366,6 +439,18 @@ data "azurerm_kubernetes_cluster" "test" {
`, r)
}

func testAccDataSourceAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicyComplete(rInt int, clientId string, clientSecret string, location string) string {
r := testAccAzureRMKubernetesCluster_advancedNetworkingWithPolicyComplete(rInt, clientId, clientSecret, location, "azure", "calico")
return fmt.Sprintf(`
%s
data "azurerm_kubernetes_cluster" "test" {
name = "${azurerm_kubernetes_cluster.test.name}"
resource_group_name = "${azurerm_kubernetes_cluster.test.resource_group_name}"
}
`, r)
}

func testAccDataSourceAzureRMKubernetesCluster_advancedNetworkingKubenet(rInt int, clientId string, clientSecret string, location string) string {
r := testAccAzureRMKubernetesCluster_advancedNetworking(rInt, clientId, clientSecret, location, "kubenet")
return fmt.Sprintf(`
Expand Down
17 changes: 17 additions & 0 deletions azurerm/resource_arm_kubernetes_cluster.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -312,6 +312,16 @@ func resourceArmKubernetesCluster() *schema.Resource {
}, false),
},

"network_policy": {
Type: schema.TypeString,
Optional: true,
Computed: true,
ForceNew: true,
ValidateFunc: validation.StringInSlice([]string{
string(containerservice.Calico),
}, false),
},

"dns_service_ip": {
Type: schema.TypeString,
Optional: true,
Expand Down Expand Up @@ -1013,8 +1023,11 @@ func expandKubernetesClusterNetworkProfile(d *schema.ResourceData) *containerser

networkPlugin := config["network_plugin"].(string)

networkPolicy := config["network_policy"].(string)

networkProfile := containerservice.NetworkProfile{
NetworkPlugin: containerservice.NetworkPlugin(networkPlugin),
NetworkPolicy: containerservice.NetworkPolicy(networkPolicy),
}

if v, ok := config["dns_service_ip"]; ok && v.(string) != "" {
Expand Down Expand Up @@ -1049,6 +1062,10 @@ func flattenKubernetesClusterNetworkProfile(profile *containerservice.NetworkPro

values["network_plugin"] = profile.NetworkPlugin

if profile.NetworkPolicy != "" {
values["network_policy"] = string(profile.NetworkPolicy)
}

if profile.ServiceCidr != nil {
values["service_cidr"] = *profile.ServiceCidr
}
Expand Down
188 changes: 188 additions & 0 deletions azurerm/resource_arm_kubernetes_cluster_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -452,6 +452,54 @@ func TestAccAzureRMKubernetesCluster_advancedNetworkingAzureComplete(t *testing.
})
}

func TestAccAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicy(t *testing.T) {
resourceName := "azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
clientId := os.Getenv("ARM_CLIENT_ID")
clientSecret := os.Getenv("ARM_CLIENT_SECRET")
config := testAccAzureRMKubernetesCluster_advancedNetworkingWithPolicy(ri, clientId, clientSecret, testLocation(), "azure", "calico")

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: config,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "network_profile.0.network_plugin", "azure"),
resource.TestCheckResourceAttr(resourceName, "network_profile.0.network_policy", "calico"),
),
},
},
})
}

func TestAccAzureRMKubernetesCluster_advancedNetworkingAzureCalicoPolicyComplete(t *testing.T) {
resourceName := "azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
clientId := os.Getenv("ARM_CLIENT_ID")
clientSecret := os.Getenv("ARM_CLIENT_SECRET")
config := testAccAzureRMKubernetesCluster_advancedNetworkingWithPolicyComplete(ri, clientId, clientSecret, testLocation(), "azure", "calico")

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: config,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "network_profile.0.network_plugin", "azure"),
resource.TestCheckResourceAttr(resourceName, "network_profile.0.network_policy", "calico"),
),
},
},
})
}

func testCheckAzureRMKubernetesClusterExists(resourceName string) resource.TestCheckFunc {
return func(s *terraform.State) error {
// Ensure we have enough information in state to look up in API
Expand Down Expand Up @@ -1122,3 +1170,143 @@ resource "azurerm_kubernetes_cluster" "test" {
}
`, rInt, location, rInt, rInt, rInt, rInt, rInt, rInt, rInt, clientId, clientSecret, networkPlugin)
}

func testAccAzureRMKubernetesCluster_advancedNetworkingWithPolicy(rInt int, clientId string, clientSecret string, location string, networkPlugin string, networkPolicy string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "test" {
name = "acctestRG-%d"
location = "%s"
}
resource "azurerm_virtual_network" "test" {
name = "acctestvirtnet%d"
address_space = ["10.1.0.0/16"]
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
tags {
environment = "Testing"
}
}
resource "azurerm_subnet" "test" {
name = "acctestsubnet%d"
resource_group_name = "${azurerm_resource_group.test.name}"
virtual_network_name = "${azurerm_virtual_network.test.name}"
address_prefix = "10.1.0.0/24"
}
resource "azurerm_kubernetes_cluster" "test" {
name = "acctestaks%d"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
dns_prefix = "acctestaks%d"
linux_profile {
admin_username = "acctestuser%d"
ssh_key {
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
}
}
agent_pool_profile {
name = "default"
count = "2"
vm_size = "Standard_DS2_v2"
vnet_subnet_id = "${azurerm_subnet.test.id}"
}
service_principal {
client_id = "%s"
client_secret = "%s"
}
network_profile {
network_plugin = "%s"
network_policy = "%s"
}
}
`, rInt, location, rInt, rInt, rInt, rInt, rInt, clientId, clientSecret, networkPlugin, networkPolicy)
}

func testAccAzureRMKubernetesCluster_advancedNetworkingWithPolicyComplete(rInt int, clientId string, clientSecret string, location string, networkPlugin string, networkPolicy string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "test" {
name = "acctestRG-%d"
location = "%s"
}
resource "azurerm_route_table" "test" {
name = "akc-routetable-%d"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
route {
name = "akc-route-%d"
address_prefix = "10.100.0.0/14"
next_hop_type = "VirtualAppliance"
next_hop_in_ip_address = "10.10.1.1"
}
}
resource "azurerm_virtual_network" "test" {
name = "acctestvirtnet%d"
address_space = ["10.1.0.0/16"]
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
tags {
environment = "Testing"
}
}
resource "azurerm_subnet" "test" {
name = "acctestsubnet%d"
resource_group_name = "${azurerm_resource_group.test.name}"
virtual_network_name = "${azurerm_virtual_network.test.name}"
address_prefix = "10.1.0.0/24"
route_table_id = "${azurerm_route_table.test.id}"
}
resource "azurerm_subnet_route_table_association" "test" {
subnet_id = "${azurerm_subnet.test.id}"
route_table_id = "${azurerm_route_table.test.id}"
}
resource "azurerm_kubernetes_cluster" "test" {
name = "acctestaks%d"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
dns_prefix = "acctestaks%d"
linux_profile {
admin_username = "acctestuser%d"
ssh_key {
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
}
}
agent_pool_profile {
name = "default"
count = "2"
vm_size = "Standard_DS2_v2"
vnet_subnet_id = "${azurerm_subnet.test.id}"
}
service_principal {
client_id = "%s"
client_secret = "%s"
}
network_profile {
network_plugin = "%s"
network_policy = "%s"
dns_service_ip = "10.10.0.10"
docker_bridge_cidr = "172.18.0.1/16"
service_cidr = "10.10.0.0/16"
}
}
`, rInt, location, rInt, rInt, rInt, rInt, rInt, rInt, rInt, clientId, clientSecret, networkPlugin, networkPolicy)
}

0 comments on commit a7f35de

Please sign in to comment.