Skip to content

Commit 7409610

Browse files
jpayne3506jpayne3506
committed
[doc] chore: split and rename
1 parent 4e30ef9 commit 7409610

File tree

2 files changed

+79
-40
lines changed

2 files changed

+79
-40
lines changed

‎docs/feature/swift-v2/setup-guide.md‎ renamed to ‎docs/feature/swift-v2/setup-guide-azcni.md‎

Lines changed: 20 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Swiftv2 Cilium Setup Guide
1+
# Swiftv2 Cilium Upgrade Guide
22

33
## Steps
44
### Clone repo + checkout branch for *.yamls
@@ -7,6 +7,20 @@ git clone https://github.com/Azure/azure-container-networking.git
77
git checkout jpayne3506/conflist-generation < TODO Change before merge >
88
```
99

10+
### Update Conflist
11+
Leverage a cni build from branch or use `acnpublic.azurecr.io/azure-cni:linux-amd64-v1.7.5-3-g93d32acd0` < TODO Change before merge >
12+
- This will install our chained conflist through the use of `test/integration/manifests/cni/conflist-installer.yaml`
13+
14+
```
15+
export CONFLIST=azure-chained-cilium.conflist
16+
export CONFLIST_PRIORITY=05
17+
export CNI_IMAGE=acnpublic.azurecr.io/azure-cni:linux-amd64-v1.7.5-3-g93d32acd0
18+
envsubst '${CONFLIST},${CONFLIST_PRIORITY},${CNI_IMAGE}' < test/integration/manifests/cni/conflist-installer.yaml | kubectl apply -f -
19+
```
20+
21+
> NOTE: if your current conflist file name starts with `05` then change our previous filename to one with higher priority to ensure that it is consumed. i.e. `03-azure-chained-cilium.conflist`
22+
23+
1024
### Apply cilium config
1125
```
1226
export DIR=1.17
@@ -17,57 +31,23 @@ kubectl apply -f test/integration/manifests/cilium/v${DIR}/cilium-config/cilium-
1731

1832
- Remove `kube-proxy-replacement-healthz-bind-address: "0.0.0.0:10256"` from configmap if kube-proxy is current on nodes
1933

20-
### Apply cilium Agent + Operator
34+
### Apply cilium Agent + Operator + RBAC
2135
```
2236
kubectl apply -f test/integration/manifests/cilium/v${DIR}/cilium-operator/files
2337
kubectl apply -f test/integration/manifests/cilium/v${DIR}/cilium-agent/files
38+
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v${DIR}/cilium-agent/templates/daemonset.yaml | kubectl apply -f -
39+
envsubst '${CILIUM_VERSION_TAG},${CILIUM_IMAGE_REGISTRY}' < test/integration/manifests/cilium/v${DIR}/cilium-operator/templates/deployment.yaml | kubectl apply -f -
2440
```
2541

26-
### Apply/Edit CNS configmap
27-
```
28-
kubectl apply -f test/integration/manifests/cnsconfig/azcnichainedciliumconfigmap.yaml
29-
```
30-
#### Must have configmap values
31-
```
32-
"ProgramSNATIPTables": false
33-
"CNIConflistScenario": "azurecni-chained-cilium"
34-
"CNIConflistFilepath": "/etc/cni/net.d/05-azure-chained-cilium.conflist"
35-
```
36-
37-
### Update CNS image
38-
Leverage a cns build from branch or use `acnpublic.azurecr.io/azure-cns:v1.7.5-2-g94c36c070` < TODO Change before merge >
39-
- This will install our chained conflist through the use of `"CNIConflistScenario": "azurecni-chained-cilium"` and it will be installed on the node here `"CNIConflistFilepath": "/etc/cni/net.d/05-azure-chained-cilium.conflist"`
40-
41-
> NOTE: if your current conflist file name starts with `05` then change our previous filename to one with higher priority to ensure that it is consumed on restart. I.e. `03-azure-chained-cilium.conflist`
42-
43-
### If kube-proxy was present
44-
#### Remove kube-proxy
45-
> NOTE: Reapply `kube-proxy-replacement-healthz-bind-address: "0.0.0.0:10256"` to cilium configmap if previously removed
46-
47-
This can be done either by editing the node-selectors or deleting the ds. Both work...
48-
49-
#### Restart Cilium
50-
kubectl rollout restart ds -n kube-system cilium
51-
5242

5343
### Quick Summary
44+
- Apply conflist installer to update conflist on BYON
5445
- Apply/Edit Cilium Config with
5546
- `cni-chaining-mode: generic-veth`
5647
- remove `kube-proxy-replacement-healthz-bind-address`
5748
- You do not need to remove if node does not have kube-proxy enabled
5849
- If applied before agent is in ready state then no need to restart agent
59-
- Apply Agent + Operator
60-
- Apply/Edit CNS config with
61-
- "ProgramSNATIPTables": false
62-
- "CNIConflistScenario": "azurecni-chained-cilium"
63-
- "CNIConflistFilepath": "/etc/cni/net.d/05-azure-chained-cilium.conflist"
64-
- Update CNS image with build from branch or < TODO IMAGE NAME >
65-
- This will install chained conflist
66-
67-
#### If kube-proxy was present
68-
- Reapply `kube-proxy-replacement-healthz-bind-address: "0.0.0.0:10256"` to cilium configmap
69-
- Remove Kube-proxy
70-
- Restart Cilium
50+
- Apply Agent + Operator + RBAC
7151

7252

7353
## Quick Vaildation testing

‎docs/feature/swift-v2/setup-guide-cil.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Swiftv2 Cilium Setup Guide
2+
3+
## Steps
4+
### Clone repo + checkout branch for *.yamls
5+
```
6+
git clone https://github.com/Azure/azure-container-networking.git
7+
git checkout jpayne3506/conflist-generation < TODO Change before merge >
8+
```
9+
10+
### Update Conflist
11+
Leverage a cni build from branch or use `acnpublic.azurecr.io/azure-cni:linux-amd64-v1.7.5-3-g93d32acd0` < TODO Change before merge >
12+
- This will install our chained conflist through the use of `test/integration/manifests/cni/conflist-installer.yaml`
13+
14+
```
15+
export CONFLIST=azure-chained-cilium.conflist
16+
export CONFLIST_PRIORITY=05
17+
export CNI_IMAGE=acnpublic.azurecr.io/azure-cni:linux-amd64-v1.7.5-3-g93d32acd0
18+
envsubst '${CONFLIST},${CONFLIST_PRIORITY},${CNI_IMAGE}' < test/integration/manifests/cni/conflist-installer.yaml | kubectl apply -f -
19+
```
20+
21+
> NOTE: if your current conflist file name starts with `05` then change our previous filename to one with higher priority to ensure that it is consumed. i.e. `03-azure-chained-cilium.conflist`
22+
23+
24+
### Apply Watcher
25+
```
26+
kubectl apply -f test/integration/manifests/cilium/watcher/deployment.yaml
27+
```
28+
29+
- Watcher obtains existing RBAC and DS from managed node
30+
- We overwrite CM values through the use of DS args on the `cilium-agent` container
31+
i.e. overwrites `--cni-chaining-mode`
32+
```
33+
yq eval '.spec.template.spec.containers[0].args += ["--cni-chaining-mode=generic-veth"]' -i "$temp_file"
34+
```
35+
36+
37+
38+
### Quick Summary
39+
- Apply conflist installer to update conflist on BYON
40+
- Apply Watcher and Overwrite existing CM values through `cilium-agent` container
41+
42+
## Quick Vaildation testing
43+
- Create pods from deploy
44+
- test/integration/manifests/swiftv2/mt-deploy.yaml
45+
- Creates `container-*` pods on default namespace
46+
- Create Cilium Network Policies
47+
- test/integration/manifests/cilium/netpol/default-allow.yaml
48+
- Will only allow cilium managed endpoints to transmit traffic through default namespace
49+
- Check Cilium Management with
50+
- `kubectl get cep -A`
51+
- `kubectl get cnp -A`
52+
- Check connectivity
53+
- exec -it <container-*> -- sh
54+
- ip a
55+
- look for delegatedNIC IP
56+
- ping <IP>
57+
- confirm CNP working by attempting to ping coredns pods
58+
- should fail if both are being maintained by cilium
59+
- confirm with `kubectl get cep -A`

0 commit comments

Comments
 (0)