Add Openshift SCC and Install Provider

cmd/liqoctl/cmd/providers.go

@@ -27,22 +27,24 @@ import (
 	"github.com/liqotech/liqo/pkg/liqoctl/install/gke"
 	"github.com/liqotech/liqo/pkg/liqoctl/install/k3s"
 	"github.com/liqotech/liqo/pkg/liqoctl/install/kubeadm"
+	"github.com/liqotech/liqo/pkg/liqoctl/install/openshift"
 )
 
 const (
 	installShortHelp = "Install Liqo on a selected %s cluster"
 	installLongHelp  = "Install Liqo on a selected %s cluster"
 )
 
-var providers = []string{"kubeadm", "kind", "k3s", "eks", "gke", "aks"}
+var providers = []string{"kubeadm", "kind", "k3s", "eks", "gke", "aks", "openshift"}
 
 var providerInitFunc = map[string]func(*cobra.Command){
-	"kubeadm": kubeadm.GenerateFlags,
-	"kind":    kubeadm.GenerateFlags,
-	"k3s":     k3s.GenerateFlags,
-	"eks":     eks.GenerateFlags,
-	"gke":     gke.GenerateFlags,
-	"aks":     aks.GenerateFlags,
+	"kubeadm":   kubeadm.GenerateFlags,
+	"kind":      kubeadm.GenerateFlags,
+	"k3s":       k3s.GenerateFlags,
+	"eks":       eks.GenerateFlags,
+	"gke":       gke.GenerateFlags,
+	"aks":       aks.GenerateFlags,
+	"openshift": openshift.GenerateFlags,
 }
 
 func getCommand(ctx context.Context, provider string) (*cobra.Command, error) {

deployments/liqo/README.md

@@ -63,6 +63,7 @@
 | networkManager.pod.annotations | object | `{}` | networkManager pod annotations |
 | networkManager.pod.extraArgs | list | `[]` | networkManager pod extra arguments |
 | networkManager.pod.labels | object | `{}` | networkManager pod labels |
+| openshiftConfig.enable | bool | `false` | enable the OpenShift support |
 | pullPolicy | string | `"IfNotPresent"` | The pullPolicy for liqo pods |
 | route.imageName | string | `"liqo/liqonet"` | route image repository |
 | route.pod.annotations | object | `{}` | route pod annotations |

deployments/liqo/templates/_helpers.tpl

@@ -170,3 +170,22 @@ Get the liqo clusterID ConfigMap name
 {{- $config := (merge (dict "name" "clusterid-configmap" "module" "clusterid-configmap") .) -}}
 {{ include "liqo.prefixedName" $config }}
 {{- end -}}
+
+{{/*
+Get the Pod security context
+*/}}
+{{- define "liqo.podSecurityContext" -}}
+runAsNonRoot: true
+{{- if not .Values.openshiftConfig.enable }}
+runAsUser: 1000
+runAsGroup: 1000
+fsGroup: 1000
+{{- end }}
+{{- end -}}
+
+{{/*
+Get the Container security context
+*/}}
+{{- define "liqo.containerSecurityContext" -}}
+allowPrivilegeEscalation: false
+{{- end -}}

deployments/liqo/templates/liqo-auth-deployment.yaml

@@ -27,16 +27,14 @@ spec:
       {{- end }}
     spec:
       securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
+        {{- include "liqo.podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "liqo.prefixedName" $authConfig }}
       {{- if .Values.auth.tls }}
       initContainers:
         - name: {{ $authConfig.containerName }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- include "liqo.containerSecurityContext" . | nindent 12 }}
           image: {{ .Values.auth.initContainer.imageName }}{{ include "liqo.suffix" $authConfig }}:{{ include "liqo.version" $authConfig }}
           volumeMounts:
             - mountPath: '/certs'
@@ -64,7 +62,7 @@ spec:
       containers:
         - image: {{ .Values.auth.imageName }}{{ include "liqo.suffix" $authConfig }}:{{ include "liqo.version" $authConfig }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- include "liqo.containerSecurityContext" . | nindent 12 }}
           name: {{ $authConfig.name }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: ["/usr/bin/auth-service"]

deployments/liqo/templates/liqo-controller-manager.yaml

@@ -24,10 +24,14 @@ spec:
         {{- toYaml .Values.controllerManager.pod.labels | nindent 8 }}
       {{- end }}
     spec:
+      securityContext:
+        {{- include "liqo.podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "liqo.prefixedName" $ctrlManagerConfig }}
       containers:
       - image: {{ .Values.controllerManager.imageName }}{{ include "liqo.suffix" $ctrlManagerConfig }}:{{ include "liqo.version" $ctrlManagerConfig }}
         imagePullPolicy: {{ .Values.pullPolicy }}
+        securityContext:
+          {{- include "liqo.containerSecurityContext" . | nindent 10 }}
         name: {{ $ctrlManagerConfig.name }}
         command: ["/usr/bin/liqo-controller-manager"]
         args:

deployments/liqo/templates/liqo-crd-replicator-deployment.yaml

@@ -24,10 +24,14 @@ spec:
            {{- toYaml .Values.crdReplicator.pod.labels | nindent 8 }}
         {{- end }}
     spec:
+      securityContext:
+        {{- include "liqo.podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "liqo.prefixedName" $crdReplicatorConfig }}
       containers:
         - image: {{ .Values.crdReplicator.imageName }}{{ include "liqo.suffix" $crdReplicatorConfig }}:{{ include "liqo.version" $crdReplicatorConfig }}
           imagePullPolicy: {{ .Values.pullPolicy }}
+          securityContext:
+            {{- include "liqo.containerSecurityContext" . | nindent 12 }}
           name: {{ $crdReplicatorConfig.name }}
           command: ["/usr/bin/crd-replicator"]
           args:

deployments/liqo/templates/liqo-gateway-rbac.yaml

@@ -53,4 +53,14 @@ metadata:
   name: {{ include "liqo.prefixedName" $gatewayConfig }}
   labels:
   {{- include "liqo.labels" $gatewayConfig | nindent 4 }}
-{{ .Files.Get (include "liqo.role-filename" (dict "prefix" ( include "liqo.prefixedName" $gatewayConfig))) }}
+{{ .Files.Get (include "liqo.role-filename" (dict "prefix" ( include "liqo.prefixedName" $gatewayConfig))) }}
+{{- if .Values.openshiftConfig.enable }}
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+{{- end }}

deployments/liqo/templates/liqo-network-manager-deployment.yaml

@@ -23,10 +23,14 @@ spec:
           {{- toYaml .Values.networkManager.pod.labels | nindent 8 }}
         {{- end }}
     spec:
+      securityContext:
+        {{- include "liqo.podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "liqo.prefixedName" $netManagerConfig }}
       containers:
         - image: {{ .Values.networkManager.imageName }}{{ include "liqo.suffix" $netManagerConfig }}:{{ include "liqo.version" $netManagerConfig }}
           imagePullPolicy: {{ .Values.pullPolicy }}
+          securityContext:
+            {{- include "liqo.containerSecurityContext" . | nindent 12 }}
           name: {{ $netManagerConfig.name }}
           command: ["/usr/bin/liqonet"]
           ports:

deployments/liqo/templates/liqo-route-rbac.yaml

@@ -52,4 +52,14 @@ metadata:
   name: {{ include "liqo.prefixedName" $routeConfig }}
   labels:
   {{- include "liqo.labels" $routeConfig | nindent 4 }}
-{{ .Files.Get (include "liqo.role-filename" (dict "prefix" ( include "liqo.prefixedName" $routeConfig))) }}
+{{ .Files.Get (include "liqo.role-filename" (dict "prefix" ( include "liqo.prefixedName" $routeConfig))) }}
+{{- if .Values.openshiftConfig.enable }}
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+{{- end }}

deployments/liqo/templates/liqo-webhook-deployment.yaml

@@ -26,11 +26,15 @@ spec:
         {{- toYaml .Values.webhook.pod.annotations | nindent 8 }}
       {{- end }}
     spec:
+      securityContext:
+        {{- include "liqo.podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "liqo.prefixedName" $webhookConfig }}
       initContainers:
         - name: {{ $webhookConfig.containerName }}
           image: {{ .Values.webhook.initContainer.imageName}}{{ include "liqo.suffix" $webhookConfig }}:{{ include "liqo.version" $webhookConfig }}
           imagePullPolicy: {{ .Values.pullPolicy }}
+          securityContext:
+            {{- include "liqo.containerSecurityContext" . | nindent 12 }}
           args:
             - --webhook-name={{ include "liqo.prefixedName" $webhookConfig }}
           env:
@@ -53,6 +57,8 @@ spec:
         - name: {{ $webhookConfig.name }}
           image: {{ .Values.webhook.imageName }}{{ include "liqo.suffix" $webhookConfig }}:{{ include "liqo.version" $webhookConfig }}
           imagePullPolicy: {{ .Values.pullPolicy }}
+          securityContext:
+            {{- include "liqo.containerSecurityContext" . | nindent 12 }}
           {{- if .Values.webhook.pod.extraArgs }}
           args:
             {{- toYaml .Values.webhook.pod.extraArgs | nindent 12 }}

deployments/liqo/templates/pre-delete-job.yaml

@@ -15,11 +15,15 @@ spec:
       labels:
         {{- include "liqo.labels" $predelete| nindent 8 }}
     spec:
+      securityContext:
+        {{- include "liqo.podSecurityContext" . | nindent 8 }}
       restartPolicy: Never
       serviceAccountName: {{ include "liqo.prefixedName" $predelete}}
       containers:
       - name: pre-delete-job
         image: "liqo/uninstaller{{ include "liqo.suffix" $predelete }}:{{ include "liqo.version" $predelete }}"
+        securityContext:
+          {{- include "liqo.containerSecurityContext" . | nindent 10 }}
         command: ["/usr/bin/uninstaller"]
         env:
           - name: POD_NAMESPACE

deployments/liqo/values.yaml

@@ -223,6 +223,11 @@ awsConfig:
   # -- name of the EKS cluster
   clusterName: ""
 
+# set the OpenShift-specific configurations
+openshiftConfig:
+  # -- enable the OpenShift support
+  enable: false
+
 # capsule subchart configuration
 capsule:
   # -- liqo needs capsule to work properly, but you can use your already deployed capsule installation

docs/pages/installation/chart_values.md

@@ -68,6 +68,7 @@ weight: 5
 | networkManager.pod.annotations | object | `{}` | networkManager pod annotations |
 | networkManager.pod.extraArgs | list | `[]` | networkManager pod extra arguments |
 | networkManager.pod.labels | object | `{}` | networkManager pod labels |
+| openshiftConfig.enable | bool | `false` | enable the OpenShift support |
 | pullPolicy | string | `"IfNotPresent"` | The pullPolicy for liqo pods |
 | route.imageName | string | `"liqo/liqonet"` | route image repository |
 | route.pod.annotations | object | `{}` | route pod annotations |

go.mod

@@ -24,6 +24,8 @@ require (
 	github.com/modern-go/reflect2 v1.0.1
 	github.com/onsi/ginkgo v1.16.4
 	github.com/onsi/gomega v1.16.0
+	github.com/openshift/api v0.0.0-20210521075222-e273a339932a
+	github.com/openshift/client-go v0.0.0-20210521082421-73d9475a9142
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/cast v1.4.0 // indirect
 	github.com/spf13/cobra v1.2.1

go.sum

@@ -976,6 +976,11 @@ github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.m
 github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
 github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
 github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
+github.com/openshift/api v0.0.0-20210521075222-e273a339932a h1:aBPwLqCg66SbQd+HrjB1GhgTfPtqSY4aeB022tEYmE0=
+github.com/openshift/api v0.0.0-20210521075222-e273a339932a/go.mod h1:izBmoXbUu3z5kUa4FjZhvekTsyzIWiOoaIgJiZBBMQs=
+github.com/openshift/build-machinery-go v0.0.0-20210423112049-9415d7ebd33e/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE=
+github.com/openshift/client-go v0.0.0-20210521082421-73d9475a9142 h1:ZHRIMCFIJN1p9LsJt4HQ+akDrys4PrYnXzOWI5LK03I=
+github.com/openshift/client-go v0.0.0-20210521082421-73d9475a9142/go.mod h1:fjS8r9mqDVsPb5td3NehsNOAWa4uiFkYEfVZioQ2gH0=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
 github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
 github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -1859,6 +1864,7 @@ k8s.io/api v0.19.3/go.mod h1:VF+5FT1B74Pw3KxMdKyinLo+zynBaMBiAfGMuldcNDs=
 k8s.io/api v0.19.10/go.mod h1:FSHnCfzQ9/b9qSSF1A1+QWk5cdO1auExjLcc/RJ/zB0=
 k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
 k8s.io/api v0.21.0/go.mod h1:+YbrhBBGgsxbF6o6Kj4KJPJnBmAKuXDeS3E18bgHNVU=
+k8s.io/api v0.21.1/go.mod h1:FstGROTmsSHBarKc8bylzXih8BLNYTiS3TZcsoEDg2s=
 k8s.io/api v0.21.3/go.mod h1:hUgeYHUbBp23Ue4qdX9tR8/ANi/g3ehylAqDn9NWVOg=
 k8s.io/api v0.22.0/go.mod h1:0AoXXqst47OI/L0oGKq9DG61dvGRPXs7X4/B7KyjBCU=
 k8s.io/api v0.22.1 h1:ISu3tD/jRhYfSW8jI/Q1e+lRxkR7w9UwQEZ7FgslrwY=
@@ -1876,6 +1882,7 @@ k8s.io/apimachinery v0.19.3/go.mod h1:DnPGDnARWFvYa3pMHgSxtbZb7gpzzAZ1pTfaUNDVlm
 k8s.io/apimachinery v0.19.10/go.mod h1:9eb44nUQSsz9QZiilFRuMj3ZbTmoWolU8S2gnXoRMjo=
 k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.21.0/go.mod h1:jbreFvJo3ov9rj7eWT7+sYiRx+qZuCYXwWT1bcDswPY=
+k8s.io/apimachinery v0.21.1/go.mod h1:jbreFvJo3ov9rj7eWT7+sYiRx+qZuCYXwWT1bcDswPY=
 k8s.io/apimachinery v0.21.3/go.mod h1:H/IM+5vH9kZRNJ4l3x/fXP/5bOPJaVP/guptnZPeCFI=
 k8s.io/apimachinery v0.22.0/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0=
 k8s.io/apimachinery v0.22.1 h1:DTARnyzmdHMz7bFWFDDm22AM4pLWTQECMpRTFu2d2OM=
@@ -1899,6 +1906,7 @@ k8s.io/client-go v0.19.3/go.mod h1:+eEMktZM+MG0KO+PTkci8xnbCZHvj9TqR6Q1XDUIJOM=
 k8s.io/client-go v0.19.10/go.mod h1:z1zmFQISK3I2eWLcRjhhX2/DpQUuq5Jemy45W2a5cPQ=
 k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
 k8s.io/client-go v0.21.0/go.mod h1:nNBytTF9qPFDEhoqgEPaarobC8QPae13bElIVHzIglA=
+k8s.io/client-go v0.21.1/go.mod h1:/kEw4RgW+3xnBGzvp9IWxKSNA+lXn3A7AuH3gdOAzLs=
 k8s.io/client-go v0.21.3/go.mod h1:+VPhCgTsaFmGILxR/7E1N0S+ryO010QBeNCv5JwRGYU=
 k8s.io/client-go v0.22.0/go.mod h1:GUjIuXR5PiEv/RVK5OODUsm6eZk7wtSWZSaSJbpFdGg=
 k8s.io/client-go v0.22.1 h1:jW0ZSHi8wW260FvcXHkIa0NLxFBQszTlhiAVsU5mopw=
@@ -1908,6 +1916,7 @@ k8s.io/code-generator v0.0.0-20191121015212-c4c8f8345c7e/go.mod h1:DVmfPQgxQENqD
 k8s.io/code-generator v0.16.8/go.mod h1:wFdrXdVi/UC+xIfLi+4l9elsTT/uEF61IfcN2wOLULQ=
 k8s.io/code-generator v0.19.2/go.mod h1:moqLn7w0t9cMs4+5CQyxnfA/HV8MF6aAVENF+WZZhgk=
 k8s.io/code-generator v0.21.0/go.mod h1:hUlps5+9QaTrKx+jiM4rmq7YmH8wPOIko64uZCHDh6Q=
+k8s.io/code-generator v0.21.1/go.mod h1:hUlps5+9QaTrKx+jiM4rmq7YmH8wPOIko64uZCHDh6Q=
 k8s.io/code-generator v0.21.3/go.mod h1:K3y0Bv9Cz2cOW2vXUrNZlFbflhuPvuadW6JdnN6gGKo=
 k8s.io/code-generator v0.22.0/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o=
 k8s.io/code-generator v0.22.1/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o=

pkg/liqoctl/install/openshift/doc.go

@@ -0,0 +1,16 @@
+// Copyright 2019-2021 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package openshift implements the logic to install Liqo on a OpenShift-based cluster
+package openshift

pkg/liqoctl/install/openshift/openshift_test.go

@@ -0,0 +1,78 @@
+// Copyright 2019-2021 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package openshift
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	configv1api "github.com/openshift/api/config/v1"
+	"github.com/spf13/cobra"
+
+	"github.com/liqotech/liqo/pkg/consts"
+)
+
+func TestFetchingParameters(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Test OpenShift provider")
+}
+
+var _ = Describe("Extract elements from OpenShift", func() {
+
+	var (
+		p *openshiftProvider
+	)
+
+	BeforeEach(func() {
+		p = NewProvider().(*openshiftProvider)
+	})
+
+	It("test flags", func() {
+		cmd := &cobra.Command{}
+
+		GenerateFlags(cmd)
+		cmd.Flags().String("cluster-name", "", "Name to assign to the Liqo Cluster")
+		cmd.Flags().String("reserved-subnets", "", "")
+
+		flags := cmd.Flags()
+		Expect(p.ValidateCommandArguments(flags)).To(Succeed())
+
+		Expect(p.ClusterLabels).ToNot(BeEmpty())
+		Expect(p.ClusterLabels[consts.ProviderClusterLabel]).To(Equal(providerPrefix))
+	})
+
+	It("test parse values", func() {
+		podCidr := "10.128.0.0/14"
+		serviceCidr := "172.30.0.0/16"
+
+		networkConfig := &configv1api.Network{
+			Status: configv1api.NetworkStatus{
+				ClusterNetwork: []configv1api.ClusterNetworkEntry{
+					{
+						CIDR: podCidr,
+					},
+				},
+				ServiceNetwork: []string{serviceCidr},
+			},
+		}
+
+		Expect(p.parseNetworkConfig(networkConfig)).To(Succeed())
+
+		Expect(p.podCIDR).To(Equal(podCidr))
+		Expect(p.serviceCIDR).To(Equal(serviceCidr))
+	})
+
+})