Adds support for MultiNetworkPolicy definitions

config/multi-networkpolicy.jsonnet

@@ -0,0 +1,37 @@
+{
+  kind: 'ConfigMap',
+  apiVersion: 'v1',
+  metadata: {
+    name: 'multi-networkpolicy-custom-rules',
+    namespace: 'kube-system',
+    labels: {
+      tier: 'node',
+      app: 'multi-networkpolicy',
+    },
+  },
+  // Add custom iptables rules below. The rules will not be applied unless you
+  // pass at least one of the following flags to multi-networkpolicy:
+  //
+  //   --custom-v4-igress-rule-file
+  //   --custom-v4-egress-rule-file
+  //   --custom-v6-igress-rule-file
+  //   --custom-v4-egress-rule-file
+  //
+  // Add iptables rules one per line in the appropriate sections below, minus
+  // "iptables -A <chain>" as that is added for you by multi-networkpolicy.
+  data: {
+    'custom-v4-ingress-rules.txt': |||
+      # No custom rules, yet.
+    |||,
+    'custom-v4-egress-rules.txt': |||
+      # No custom rules, yet.
+    |||,
+    'custom-v6-ingress-rules.txt': |||
+      # No custom rules, yet.
+    |||,
+    'custom-v6-egress-rules.txt': |||
+      # No custom rules, yet.
+    |||,
+  },
+}
+

k8s/daemonsets/core/multi-networkpolicy.jsonnet

@@ -0,0 +1,118 @@
+{
+  apiVersion: 'apps/v1',
+  kind: 'DaemonSet',
+  metadata: {
+    name: 'multi-networkpolicy',
+    namespace: 'kube-system',
+    labels: {
+      tier: 'node',
+      app: 'multi-networkpolicy',
+      name: 'multi-networkpolicy',
+    },
+  },
+  spec: {
+    selector: {
+      matchLabels: {
+        name: 'multi-networkpolicy',
+      },
+    },
+    updateStrategy: {
+      type: 'RollingUpdate',
+    },
+    template: {
+      metadata: {
+        labels: {
+          tier: 'node',
+          app: 'multi-networkpolicy',
+          name: 'multi-networkpolicy',
+        },
+      },
+      spec: {
+        hostNetwork: true,
+        nodeSelector: {
+          'kubernetes.io/arch': 'amd64',
+        },
+        tolerations: [
+          {
+            operator: 'Exists',
+            effect: 'NoSchedule',
+          },
+        ],
+        serviceAccountName: 'multi-networkpolicy',
+        containers: [
+          {
+            name: 'multi-networkpolicy',
+            image: 'measurementlab/multi-networkpolicy-iptables:latest',
+            imagePullPolicy: 'Always',
+            command: [
+              '/usr/bin/multi-networkpolicy-iptables',
+            ],
+            args: [
+              '--accept-icmp',
+              '--accept-icmpv6',
+              '--container-runtime-endpoint=/run/containerd/containerd.sock',
+              '--host-prefix=/host',
+              '--network-plugins=netctl,ipvlan',
+              '--pod-iptables=/var/lib/multi-networkpolicy/iptables',
+            ],
+            resources: {
+              requests: {
+                cpu: '100m',
+                memory: '80Mi',
+              },
+              limits: {
+                cpu: '100m',
+                memory: '150Mi',
+              },
+            },
+            securityContext: {
+              privileged: true,
+              capabilities: {
+                add: [
+                  'SYS_ADMIN',
+                  'NET_ADMIN',
+                ],
+              },
+            },
+            volumeMounts: [
+              {
+                name: 'host',
+                mountPath: '/host',
+              },
+              {
+                name: 'var-lib-multinetworkpolicy',
+                mountPath: '/var/lib/multi-networkpolicy',
+              },
+              {
+                name: 'multi-networkpolicy-custom-rules',
+                mountPath: '/etc/multi-networkpolicy/rules',
+                readOnly: true,
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'host',
+            hostPath: {
+              path: '/',
+            },
+          },
+          {
+            name: 'var-lib-multinetworkpolicy',
+            hostPath: {
+              path: '/var/lib/multi-networkpolicy',
+            },
+          },
+          {
+            name: 'multi-networkpolicy-custom-rules',
+            configMap: {
+              name: 'multi-networkpolicy-custom-rules',
+            },
+          },
+        ],
+      },
+    },
+  },
+}
+

k8s/daemonsets/experiments/msak.jsonnet

@@ -7,116 +7,123 @@ local services = [
   'msak/latency1=http:///latency/v1/authorize,https:///latency/v1/authorize,http:///latency/v1/result,https:///latency/v1/result',
 ];
 
-exp.Experiment(expName, 1, 'pusher-' + std.extVar('PROJECT_ID'), "none", [], datatypes) + {
-  spec+: {
-    template+: {
-      metadata+: {
-        annotations+: {
-          'secret.reloader.stakater.com/reload': 'measurement-lab-org-tls',
-        },
-      },
-      spec+: {
-        serviceAccountName: 'heartbeat-experiment',
-        initContainers+: [
-          {
-            // Copy the JSON schema where jostler expects it to be.
-            name: 'copy-schema',
-            image: 'measurementlab/msak:' + expVersion,
-            command: [
-              '/bin/sh',
-              '-c',
-              'cp /msak/throughput1.json /var/spool/datatypes/throughput1.json && ' +
-              'cp /msak/latency1.json /var/spool/datatypes/latency1.json',
-            ],
-            volumeMounts: [
-              exp.VolumeMountDatatypes(expName),
-            ],
+// List of ports that need to be opened in the pod network namespace.
+local ports = ['80/TCP', '443/TCP', '1053/UDP'];
+
+[
+  exp.Experiment(expName, 1, 'pusher-' + std.extVar('PROJECT_ID'), "none", [], datatypes) + {
+    spec+: {
+      template+: {
+        metadata+: {
+          annotations+: {
+            'secret.reloader.stakater.com/reload': 'measurement-lab-org-tls',
           },
-        ],
-        containers+: [
-          {
-            args: [
-              '-ws_addr=:80',
-              '-wss_addr=:443',
-              '-cert=/certs/tls.crt',
-              '-key=/certs/tls.key',
-              '-datadir=/var/spool/' + expName,
-              '-token.machine=$(NODE_NAME)',
-              '-token.verify-key=/verify/jwk_sig_EdDSA_locate_20200409.pub',
-              '-token.verify=true',
-              '-uuid-prefix-file=' + exp.uuid.prefixfile,
-              '-prometheusx.listen-address=$(PRIVATE_IP):9990',
-            ],
-            env: [
-              {
-                name: 'NODE_NAME',
-                valueFrom: {
-                  fieldRef: {
-                    fieldPath: 'spec.nodeName',
+        },
+        spec+: {
+          serviceAccountName: 'heartbeat-experiment',
+          initContainers+: [
+            {
+              // Copy the JSON schema where jostler expects it to be.
+              name: 'copy-schema',
+              image: 'measurementlab/msak:' + expVersion,
+              command: [
+                '/bin/sh',
+                '-c',
+                'cp /msak/throughput1.json /var/spool/datatypes/throughput1.json && ' +
+                'cp /msak/latency1.json /var/spool/datatypes/latency1.json',
+              ],
+              volumeMounts: [
+                exp.VolumeMountDatatypes(expName),
+              ],
+            },
+          ],
+          containers+: [
+            {
+              args: [
+                '-ws_addr=:80',
+                '-wss_addr=:443',
+                '-cert=/certs/tls.crt',
+                '-key=/certs/tls.key',
+                '-datadir=/var/spool/' + expName,
+                '-token.machine=$(NODE_NAME)',
+                '-token.verify-key=/verify/jwk_sig_EdDSA_locate_20200409.pub',
+                '-token.verify=true',
+                '-uuid-prefix-file=' + exp.uuid.prefixfile,
+                '-prometheusx.listen-address=$(PRIVATE_IP):9990',
+              ],
+              env: [
+                {
+                  name: 'NODE_NAME',
+                  valueFrom: {
+                    fieldRef: {
+                      fieldPath: 'spec.nodeName',
+                    },
                   },
                 },
-              },
-              {
-                name: 'PRIVATE_IP',
-                valueFrom: {
-                  fieldRef: {
-                    fieldPath: 'status.podIP',
+                {
+                  name: 'PRIVATE_IP',
+                  valueFrom: {
+                    fieldRef: {
+                      fieldPath: 'status.podIP',
+                    },
                   },
                 },
+              ],
+              image: 'measurementlab/msak:' + expVersion,
+              name: 'msak',
+              command: [
+                '/msak/msak-server',
+              ],
+              securityContext: {
+                capabilities: {
+                  drop: [
+                    'all',
+                  ],
+                },
               },
-            ],
-            image: 'measurementlab/msak:' + expVersion,
-            name: 'msak',
-            command: [
-              '/msak/msak-server',
-            ],
-            securityContext: {
-              capabilities: {
-                drop: [
-                  'all',
-                ],
-              },
+              volumeMounts: [
+                {
+                  mountPath: '/certs',
+                  name: 'measurement-lab-org-tls',
+                  readOnly: true,
+                },
+                {
+                  mountPath: '/verify',
+                  name: 'locate-verify-keys',
+                  readOnly: true,
+                },
+                exp.uuid.volumemount,
+              ] + [
+                exp.VolumeMount(expName + '/' + d) for d in datatypes
+              ],
+              ports: [
+                {
+                  containerPort: 9990,
+                },
+              ],
             },
-            volumeMounts: [
-              {
-                mountPath: '/certs',
-                name: 'measurement-lab-org-tls',
-                readOnly: true,
-              },
-              {
-                mountPath: '/verify',
-                name: 'locate-verify-keys',
-                readOnly: true,
-              },
-              exp.uuid.volumemount,
-            ] + [
-              exp.VolumeMount(expName + '/' + d) for d in datatypes
-            ],
-            ports: [
-              {
-                containerPort: 9990,
+          ] + std.flattenArrays([
+            exp.Heartbeat(expName, false, services),
+          ]),
+          volumes+: [
+            {
+              name: 'measurement-lab-org-tls',
+              secret: {
+                secretName: 'measurement-lab-org-tls',
               },
-            ],
-          },
-        ] + std.flattenArrays([
-          exp.Heartbeat(expName, false, services),
-        ]),
-        volumes+: [
-          {
-            name: 'measurement-lab-org-tls',
-            secret: {
-              secretName: 'measurement-lab-org-tls',
             },
-          },
-          {
-            name: 'locate-verify-keys',
-            secret: {
-              secretName: 'locate-verify-keys',
+            {
+              name: 'locate-verify-keys',
+              secret: {
+                secretName: 'locate-verify-keys',
+              },
             },
-          },
-          exp.Metadata.volume,
-        ],
+            exp.Metadata.volume,
+          ],
+        },
       },
     },
   },
-}
+  exp.MultiNetworkPolicy(expName, 1, ports),
+]
+