Add network policy resource with support for 1.8+ fields #118

pdecat · 2018-02-14T01:47:54Z

This is basically the same as #113 but with support for k8s 1.8+ Network Policy fields: egress, ip_block and policy_types.

~~This requires #117 for up to date k8s 1.9 client libraries.~~
Up to date k8s 1.10 client libraries provided by #162

TODO:

Rebase on master
Fix egress with single empty map on first apply
Add documentation for the new fields

pdecat · 2018-02-14T02:12:32Z

Unit tests results

# make test                                                                                    
==> Checking that code complies with gofmt requirements...        
go test -i $(go list ./... |grep -v 'vendor') || exit 1           
echo $(go list ./... |grep -v 'vendor') | \
        xargs -t -n4 go test  -timeout=30s -parallel=4
go test -timeout=30s -parallel=4 github.com/terraform-providers/terraform-provider-kubernetes github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 
?       github.com/terraform-providers/terraform-provider-kubernetes    [no test files]
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 0.027s

pdecat · 2018-02-14T02:13:08Z

Acceptance tests results

# make testacc TEST=./kubernetes/ TESTARGS='-run=TestAccKubernetesNetworkPolicy_.*'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes/ -v -run=TestAccKubernetesNetworkPolicy_.* -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic
--- PASS: TestAccKubernetesNetworkPolicy_basic (0.47s)
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (0.12s)
PASS
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 0.606s

pdecat · 2018-03-29T09:57:32Z

There is a bug that requires applying the configuration twice when egress contains a single empty map:

resource "kubernetes_network_policy" "allow-all-egress" {
  metadata {
    name = "allow-all-egress"
  }

  spec {
    pod_selector = {}

    ingress = [] # no rule at all to deny all ingress traffic

    egress = [{}] # single empty rule to allow all egress traffic
  }
}

After first apply, the following diff is still there:

  ~ kubernetes_network_policy.allow-all-egress                    
      spec.0.egress.#: "0" => "1"

On second apply, it is gone.

pdecat · 2018-05-15T09:24:15Z

The issue when the Network Policy has an egress at creation is resolved.

pdecat · 2018-05-15T09:42:24Z

Acceptance tests results

make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesNetworkPolicy_.*'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesNetworkPolicy_.* -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic
--- PASS: TestAccKubernetesNetworkPolicy_basic (0.40s)
=== RUN   TestAccKubernetesNetworkPolicy_withEgressAtCreation
--- PASS: TestAccKubernetesNetworkPolicy_withEgressAtCreation (0.11s)
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (0.11s)
PASS
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes

pdecat · 2018-05-15T11:40:05Z

Acceptance tests results with policy_types assertions

make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesNetworkPolicy_.*'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesNetworkPolicy_.* -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic                                                                                                      
--- PASS: TestAccKubernetesNetworkPolicy_basic (0.40s)                         
=== RUN   TestAccKubernetesNetworkPolicy_withEgressAtCreation                                 
--- PASS: TestAccKubernetesNetworkPolicy_withEgressAtCreation (0.12s)                                                                               
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (0.10s)                                                                                                               
PASS                                                                                                                                                                     
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 0.647s

pdecat · 2018-05-15T11:41:51Z

Note

I've made the policy_types property required because the default value is only evaluated server side on resource creation.

During the initial creation, a default value is determined and stored, then PolicyTypes is no longer considered unset, it will stick to that value on further updates unless explicitly overridden.

Leaving the policy_types property optional here would prevent further updates adding egress rules after the initial resource creation without egress rules nor policy_types from working as expected as PolicyTypes will stick to Ingress server side.

Edit: I initially considered leaving it optional and overriding the default behavior client side but this started to make it overly complicated.

pdecat · 2018-10-05T09:30:23Z

Rebased on master to use k8s 1.10 clients libraries.

pdecat · 2018-10-05T14:03:03Z

Acceptance tests results

New run after rebase on master that provides k8s 1.10 client libs with local minikube 0.29/kubernetes 1.10.0:

# make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesNetworkPolicy_.*'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesNetworkPolicy_.* -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic
--- PASS: TestAccKubernetesNetworkPolicy_basic (0.55s)
=== RUN   TestAccKubernetesNetworkPolicy_withEgressAtCreation
--- PASS: TestAccKubernetesNetworkPolicy_withEgressAtCreation (0.13s)
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (0.11s)
PASS
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 0.839s

pdecat · 2018-10-05T15:45:51Z

I've added the documentation for the k8s 1.8+ fields.

pdecat · 2018-10-06T08:04:16Z

Acceptance tests results

New run with local minikube 0.30 / kubernetes 1.12.1:

# make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesNetworkPolicy_.*'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesNetworkPolicy_.* -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic
--- PASS: TestAccKubernetesNetworkPolicy_basic (0.48s)
=== RUN   TestAccKubernetesNetworkPolicy_withEgressAtCreation
--- PASS: TestAccKubernetesNetworkPolicy_withEgressAtCreation (0.15s)
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (0.11s)
PASS
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 0.786s

pdecat · 2018-11-10T11:50:30Z

Hi @alexsomesan, would you mind having a look at this PR? I believe it would be a good candidate for the v1.4.0 milestone.

…ymmetric behavior

… evaluated server side on resource creation

pdecat · 2019-01-10T12:11:30Z

Rebased on master.

pdecat · 2019-01-10T13:08:45Z

Acceptance tests results:

# make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesNetworkPolicy_.* -count=1'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesNetworkPolicy_.* -count=1 -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic
--- PASS: TestAccKubernetesNetworkPolicy_basic (5.30s)
=== RUN   TestAccKubernetesNetworkPolicy_withEgressAtCreation
--- PASS: TestAccKubernetesNetworkPolicy_withEgressAtCreation (1.26s)
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (1.33s)
PASS
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 7.937s

alexsomesan

This looks very nice overall.

Just one small thing: please remove the d.SetId("") in the Delete function, then we're good to go.

Did you test build this with Go 1.11.x?

alexsomesan · 2019-01-10T13:15:47Z

kubernetes/resource_kubernetes_network_policy.go

+
+// Use generated swagger docs from kubernetes' client-go to avoid copy/pasting them here
+var (
+	networkPolicySpecDoc                  = api.NetworkPolicy{}.SwaggerDoc()["spec"]


kubernetes/resource_kubernetes_network_policy.go

pdecat · 2019-01-10T13:31:23Z

All recent builds and tests done with:

# go version
go version go1.11.4 linux/amd64

pdecat · 2019-01-10T13:32:32Z

Acceptance tests results:

# make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesNetworkPolicy_.* -count=1'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesNetworkPolicy_.* -count=1 -timeout 120m
=== RUN   TestAccKubernetesNetworkPolicy_basic
--- PASS: TestAccKubernetesNetworkPolicy_basic (5.28s)
=== RUN   TestAccKubernetesNetworkPolicy_withEgressAtCreation
--- PASS: TestAccKubernetesNetworkPolicy_withEgressAtCreation (1.25s)
=== RUN   TestAccKubernetesNetworkPolicy_importBasic
--- PASS: TestAccKubernetesNetworkPolicy_importBasic (1.34s)
PASS
ok      github.com/terraform-providers/terraform-provider-kubernetes/kubernetes 7.912s

alexsomesan

LGTM

pdecat · 2019-01-10T13:43:50Z

Thank you so much @alexsomesan !

pdecat · 2019-01-10T13:48:26Z

CHANGELOG.md

@@ -8,6 +8,10 @@ BUG FIXES:

 * `resource/kubernetes_stateful_set`: Fix updates of stateful set images ([#252](https://github.com/terraform-providers/terraform-provider-kubernetes/issues/252))

+FEATURES:


@alexsomesan I should probably have put FEATURES before IMPROVEMENTS and BUG FIXES

pdecat force-pushed the f-network-policy-support-1.9 branch from 7419cc5 to 405e938 Compare February 14, 2018 01:49

radeksimko added the new-resource label Feb 22, 2018

pdecat force-pushed the f-network-policy-support-1.9 branch from 405e938 to 565a859 Compare March 1, 2018 18:14

pdecat mentioned this pull request Mar 8, 2018

Refactor labelSelector schema and its flatteners/expanders functions for reuse #140

Merged

radeksimko added the kubernetes/1.8 label Mar 18, 2018

pdecat force-pushed the f-network-policy-support-1.9 branch 3 times, most recently from 565a859 to 773cec0 Compare March 23, 2018 09:58

pdecat force-pushed the f-network-policy-support-1.9 branch from 773cec0 to 15e6210 Compare April 18, 2018 08:33

pdecat force-pushed the f-network-policy-support-1.9 branch from 15e6210 to 0ba7866 Compare May 7, 2018 06:16

lainra mentioned this pull request Aug 20, 2018

New Feature request: NetworkPolicy support sl1pm4t/terraform-provider-kubernetes#46

Closed

pdecat mentioned this pull request Oct 5, 2018

Add network policy resource #113

Closed

2 tasks

pdecat force-pushed the f-network-policy-support-1.9 branch from 3f17665 to 805e685 Compare October 5, 2018 09:12

ghost added the size/XXL label Oct 5, 2018

pdecat force-pushed the f-network-policy-support-1.9 branch 2 times, most recently from cc2f6b6 to af19aa2 Compare October 18, 2018 07:19

pdecat force-pushed the f-network-policy-support-1.9 branch from af19aa2 to 4736f9a Compare October 24, 2018 10:38

pdecat force-pushed the f-network-policy-support-1.9 branch from 4736f9a to c00c61c Compare November 2, 2018 15:46

pdecat and others added 16 commits January 10, 2019 13:09

Add kubernetes_network_policy resource

ee66cda

Cast Protocol to string and add unit tests to ensure flatten/expand s…

71188f9

…ymmetric behavior

Fix network policy resource update

6dc7e6d

Add network policy documentation

70efd91

Network policy ingress ports default to TCP protocol

9a006be

Fix network policy ingress pod selector update

78fbd3f

Update code to use k8s libs version 1.9.0

3713aa5

Add k8s 1.8+ Network Policy fields: egress, ip_block and policy_types

6ca3dbe

Fix issue when Network Policy has an egress at creation

b0de33f

Make policy_types property required because the default value is only…

dc1656f

… evaluated server side on resource creation

Fix website documentation link to network_policy.html

49ef9c3

Fix indentation

3f01061

Add documentation for kubernetes 1.8+ Network Policy fields

9304daa

Allow label selectors updates on network policies

f4c9533

Update changelog for hashicorp#118

79f514a

Convert returned types to pointers

5c45144

pdecat force-pushed the f-network-policy-support-1.9 branch from 05de880 to 5c45144 Compare January 10, 2019 12:11

alexsomesan reviewed Jan 10, 2019

View reviewed changes

Remove d.SetId("")

2c81670

alexsomesan approved these changes Jan 10, 2019

View reviewed changes

alexsomesan merged commit bd7821f into hashicorp:master Jan 10, 2019

pdecat deleted the f-network-policy-support-1.9 branch January 10, 2019 13:43

pdecat commented Jan 10, 2019

View reviewed changes

GuiSim mentioned this pull request Jan 10, 2019

Feature request: add kubernetes_network_policy resource #110

Closed

ghost locked and limited conversation to collaborators Apr 21, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add network policy resource with support for 1.8+ fields #118

Add network policy resource with support for 1.8+ fields #118

pdecat commented Feb 14, 2018 •

edited

Loading

pdecat commented Feb 14, 2018

pdecat commented Feb 14, 2018

pdecat commented Mar 29, 2018 •

edited

Loading

pdecat commented May 15, 2018

pdecat commented May 15, 2018

pdecat commented May 15, 2018

pdecat commented May 15, 2018 •

edited

Loading

pdecat commented Oct 5, 2018

pdecat commented Oct 5, 2018 •

edited

Loading

pdecat commented Oct 5, 2018

pdecat commented Oct 6, 2018

pdecat commented Nov 10, 2018

pdecat commented Jan 10, 2019

pdecat commented Jan 10, 2019 •

edited

Loading

alexsomesan left a comment

alexsomesan Jan 10, 2019

pdecat commented Jan 10, 2019 •

edited

Loading

pdecat commented Jan 10, 2019

alexsomesan left a comment

pdecat commented Jan 10, 2019

pdecat Jan 10, 2019

		@@ -8,6 +8,10 @@ BUG FIXES:

		* `resource/kubernetes_stateful_set`: Fix updates of stateful set images ([#252](https://github.com/terraform-providers/terraform-provider-kubernetes/issues/252))

		FEATURES:

Add network policy resource with support for 1.8+ fields #118

Add network policy resource with support for 1.8+ fields #118

Conversation

pdecat commented Feb 14, 2018 • edited Loading

pdecat commented Feb 14, 2018

Unit tests results

pdecat commented Feb 14, 2018

Acceptance tests results

pdecat commented Mar 29, 2018 • edited Loading

pdecat commented May 15, 2018

pdecat commented May 15, 2018

Acceptance tests results

pdecat commented May 15, 2018

Acceptance tests results with policy_types assertions

pdecat commented May 15, 2018 • edited Loading

Note

pdecat commented Oct 5, 2018

pdecat commented Oct 5, 2018 • edited Loading

Acceptance tests results

pdecat commented Oct 5, 2018

pdecat commented Oct 6, 2018

Acceptance tests results

pdecat commented Nov 10, 2018

pdecat commented Jan 10, 2019

pdecat commented Jan 10, 2019 • edited Loading

alexsomesan left a comment

Choose a reason for hiding this comment

alexsomesan Jan 10, 2019

Choose a reason for hiding this comment

pdecat commented Jan 10, 2019 • edited Loading

pdecat commented Jan 10, 2019

alexsomesan left a comment

Choose a reason for hiding this comment

pdecat commented Jan 10, 2019

pdecat Jan 10, 2019

Choose a reason for hiding this comment

pdecat commented Feb 14, 2018 •

edited

Loading

pdecat commented Mar 29, 2018 •

edited

Loading

pdecat commented May 15, 2018 •

edited

Loading

pdecat commented Oct 5, 2018 •

edited

Loading

pdecat commented Jan 10, 2019 •

edited

Loading

pdecat commented Jan 10, 2019 •

edited

Loading