integrate iptables-manager

Signed-off-by: zhu733756 <zhu733756@kubesphere.io>

11 files changed, 194 insertions, 65 deletions

diff --git a/build/helm/cloudcore/README.md b/build/helm/cloudcore/README.md
index 37bcdf15f..f1d6c9fff 100644
--- a/build/helm/cloudcore/README.md
+++ b/build/helm/cloudcore/README.md
@@ -14,15 +14,16 @@ helm upgrade --install cloudcore ./cloudcore --namespace kubeedge --create-names
 
 ## Custom Values
 
+### cloudcore
+
 - `cloudCore.modules.cloudHub.advertiseAddress`, defines the unmissable public IPs which can be accessed by edge nodes.
 - `cloudCore.hostNetWork`, default `true`, which shares the host network, used for setting the forward iptables rules on the host.
 - `cloudCore.image.repository`, default `kubeedge`, defines the image repo.
 - `cloudCore.image.tag`, default `v1.8.2`, defines the image tag.
 - `cloudCore.image.pullPolicy`, default `IfNotPresent`, defines the policies to pull images.
 - `cloudCore.image.imagePullSecrets`, defines the secrets to pull images.
-- `cloudCore.labels`, defines common labels.
-- `cloudCore.service.ingressLabels`, defines extra labels to the service if loadbalancer is enabed.
-- `cloudCore.annotions`, defines common annotions.
+- `cloudCore.labels`, defines the labels.
+- `cloudCore.annotions`, defines the annotions.
 - `cloudCore.affinity`, `cloudCore.nodeSelector`, `cloudCore.tolerations`, defines the node scheduling policies.
 - `cloudCore.resources`, defines the resources limits and requests.
 - `cloudCore.modules.cloudHub.nodeLimit`, defines the edge nodes limits.
@@ -39,6 +40,18 @@ helm upgrade --install cloudcore ./cloudcore --namespace kubeedge --create-names
 - `cloudCore.service.cloudstreamNodePort`,  default `30003`, which defines the exposed node port for cloud stream service.
 - `cloudCore.service.tunnelNodePort`,  default `30004`, which defines the exposed node port for cloud tunnel service.
 
+### iptables-manager
+- `iptablesManager.enable`,  default `true`
+- `iptablesManager.mode`,  default `internal`, can be modified to `external`, the external mode will set up a iptables manager component which shares the host network. That mode can be enabled on version > v1.8.2. See pr https://github.com/kubeedge/kubeedge/pull/3265.
+- `iptablesManager.image.repository`, default `kubeedge`, defines the image repo.
+- `iptablesManager.image.tag`, default `v1.8.2`, defines the image tag.
+- `iptablesManager.image.pullPolicy`, default `IfNotPresent`, defines the policies to pull images.
+- `iptablesManager.image.imagePullSecrets`, defines the secrets to pull images.
+- `iptablesManager.labels`, defines the labels.
+- `iptablesManager.annotions`, defines the annotions.
+- `iptablesManager.affinity`, `iptablesManager.nodeSelector`, `iptablesManager.tolerations`, defines the node scheduling policies.
+- `iptablesManager.resources`, defines the resources limits and requests.
+
 ## Uninstall
 
 ```
diff --git a/build/helm/cloudcore/templates/clusterrolebinding.yaml b/build/helm/cloudcore/templates/clusterrolebinding.yaml
deleted file mode 100644
index 132658275..000000000
--- a/build/helm/cloudcore/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cloudcore
-  {{- with .Values.cloudCore.labels }}
-  labels: {{- toYaml . | nindent 4 }}
-  {{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cloudcore
-subjects:
-- kind: ServiceAccount
-  name: cloudcore
-  namespace: {{ .Release.Namespace }}
diff --git a/build/helm/cloudcore/templates/configmap.yaml b/build/helm/cloudcore/templates/configmap_cloudcore.yaml
index 31a291db0..31a291db0 100644
--- a/build/helm/cloudcore/templates/configmap.yaml
+++ b/build/helm/cloudcore/templates/configmap_cloudcore.yaml
diff --git a/build/helm/cloudcore/templates/daemonset_iptablesmanager.yaml b/build/helm/cloudcore/templates/daemonset_iptablesmanager.yaml
new file mode 100644
index 000000000..1fe598381
--- /dev/null
+++ b/build/helm/cloudcore/templates/daemonset_iptablesmanager.yaml
@@ -0,0 +1,47 @@
+{{- if and (.Values.iptablesManager.enable) (eq .Values.iptablesManager.mode "external") }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: cloud-iptables-manager
+  {{- with .Values.iptablesManager.labels }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.iptablesManager.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- with .Values.iptablesManager.labels }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+  template:
+    metadata:
+      {{- with .Values.iptablesManager.labels }}
+      labels: {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccount: iptables-manager-sa
+      hostNetwork: {{ .Values.iptablesManager.hostNetWork }}
+      {{- with .Values.iptablesManager.affinity }}
+      affinity: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.iptablesManager.tolerations }}
+      tolerations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.iptablesManager.nodeSelector }}
+      nodeSelector: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      restartPolicy: Always
+      containers:
+      - name: iptables-manager
+        command: ['iptables-manager']
+        image: {{ .Values.iptablesManager.image.repository }}:{{ .Values.iptablesManager.image.tag }}
+        imagePullPolicy: {{ .Values.iptablesManager.image.pullPolicy }}
+        {{- with .Values.iptablesManager.securityContext }}
+        securityContext: {{ toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with .Values.iptablesManager.resources }}
+        resources: {{ toYaml . | nindent 10 }}
+        {{- end }} 
+{{- end }}
\ No newline at end of file
diff --git a/build/helm/cloudcore/templates/deployment.yaml b/build/helm/cloudcore/templates/deployment_cloudcore.yaml
index 6f1cf00cb..6d759c889 100644
--- a/build/helm/cloudcore/templates/deployment.yaml
+++ b/build/helm/cloudcore/templates/deployment_cloudcore.yaml
@@ -16,9 +16,6 @@ spec:
     {{- end }}
   template:
     metadata:
-      {{- with .Values.cloudCore.annotations }}
-      annotations: {{- toYaml . | nindent 8 }}
-      {{- end }}
       {{- with .Values.cloudCore.labels }}
       labels: {{- toYaml . | nindent 8 }}
       {{- end }}
@@ -38,7 +35,6 @@ spec:
       tolerations: {{ toYaml . | nindent 8 }}
       {{- end }}
       serviceAccount: cloudcore
-      serviceAccountName: cloudcore
       {{- with .Values.imagePullSecrets }} 
       imagePullSecrets: {{- toYaml . | indent 8 }} 
       {{- end }}  
diff --git a/build/helm/cloudcore/templates/clusterrole.yaml b/build/helm/cloudcore/templates/rbac_cloudcore.yaml
index 5f1104fba..2495920c7 100644
--- a/build/helm/cloudcore/templates/clusterrole.yaml
+++ b/build/helm/cloudcore/templates/rbac_cloudcore.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -30,3 +31,31 @@ rules:
 - apiGroups: ["rules.kubeedge.io"]
   resources: ["rules", "ruleendpoints", "rules/status", "ruleendpoints/status"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  {{- with .Values.cloudCore.labels }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: cloudcore
+
+--- 
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cloudcore
+  {{- with .Values.cloudCore.labels }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cloudcore
+subjects:
+- kind: ServiceAccount
+  name: cloudcore
+  namespace: {{ .Release.Namespace }}
+
+
diff --git a/build/helm/cloudcore/templates/rbac_iptablesmanager.yaml b/build/helm/cloudcore/templates/rbac_iptablesmanager.yaml
new file mode 100644
index 000000000..73c626e0a
--- /dev/null
+++ b/build/helm/cloudcore/templates/rbac_iptablesmanager.yaml
@@ -0,0 +1,40 @@
+{{- if and (.Values.iptablesManager.enable) (eq .Values.iptablesManager.mode "external") }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  {{- with .Values.iptablesManager.labels }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: iptables-manager-sa
+  namespace: {{ .Release.Namespace }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: iptables-manager
+  {{- with .Values.iptablesManager.labels }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: iptables-manager
+subjects:
+- kind: ServiceAccount
+  name: iptables-manager-sa
+  namespace: {{ .Release.Namespace }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: iptables-manager
+  {{- with .Values.iptablesManager.labels }}
+  labels: {{- toYaml . | nindent 4 }}
+  {{- end }}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["get", "list", "watch"]
+{{- end }}
\ No newline at end of file
diff --git a/build/helm/cloudcore/templates/secret.yaml b/build/helm/cloudcore/templates/secret_cloudcore.yaml
index e61c65243..e61c65243 100644
--- a/build/helm/cloudcore/templates/secret.yaml
+++ b/build/helm/cloudcore/templates/secret_cloudcore.yaml
diff --git a/build/helm/cloudcore/templates/service.yaml b/build/helm/cloudcore/templates/service_cloudcore.yaml
index e7b5140c1..2cccce2db 100644
--- a/build/helm/cloudcore/templates/service.yaml
+++ b/build/helm/cloudcore/templates/service_cloudcore.yaml
@@ -4,54 +4,45 @@ metadata:
   {{- with .Values.cloudCore.labels }}
   labels: {{- toYaml . | nindent 4 }}
   {{- end }}
-  {{- if eq .Values.cloudCore.service.type "LoadBalancer" }}
-  {{- with .Values.cloudCore.service.ingressLabels }}
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- end }}
   name: cloudcore
 spec:
+  {{- if and (eq .Values.cloudCore.service.type "NodePort") (eq .Values.cloudCore.hostNetWork "false") }}
   type: {{ .Values.cloudCore.service.type }}
-  {{- if eq .Values.cloudCore.service.type "LoadBalancer" }}
-  externalTrafficPolicy: {{ .Values.cloudCore.service.externalTrafficPolicy | default "cluster" }}
-  {{- end}}
+  {{- else }}
+  type: ClusterIP
+  {{- end }}
   ports:
   - port: 10000
     targetPort: 10000
-    {{- if eq .Values.cloudCore.service.type "NodePort" }}
+    {{- if and (eq .Values.cloudCore.service.type "NodePort") (eq .Values.cloudCore.hostNetWork "false") }}
     nodePort: {{ .Values.cloudCore.service.cloudhubNodePort }}
     {{- end }}
     name: cloudhub
   - port: 10001
     targetPort: 10001
-    {{- if eq .Values.cloudCore.service.type "NodePort" }}
+    {{- if and (eq .Values.cloudCore.service.type "NodePort") (eq .Values.cloudCore.hostNetWork "false") }}
     nodePort: {{ .Values.cloudCore.service.cloudhubQuicNodePort }}
     {{- end }}
     name: cloudhub-quic
   - port: 10002
     targetPort: 10002
-    {{- if eq .Values.cloudCore.service.type "NodePort" }}
+    {{- if and (eq .Values.cloudCore.service.type "NodePort") (eq .Values.cloudCore.hostNetWork "false") }}
     nodePort: {{ .Values.cloudCore.service.cloudhubHttpsNodePort }}
     {{- end }}
     name: cloudhub-https
   - port: 10003
     targetPort: 10003
-    {{- if eq .Values.cloudCore.service.type "NodePort" }}
+    {{- if and (eq .Values.cloudCore.service.type "NodePort") (eq .Values.cloudCore.hostNetWork "false") }}
     nodePort: {{ .Values.cloudCore.service.cloudstreamNodePort }}
     {{- end }}
     name: cloudstream
   - port: 10004
     targetPort: 10004
-    {{- if eq .Values.cloudCore.service.type "NodePort" }}
+    {{- if and (eq .Values.cloudCore.service.type "NodePort") (eq .Values.cloudCore.hostNetWork "false") }}
     nodePort: {{ .Values.cloudCore.service.tunnelNodePort }}
     {{- end }}
     name: tunnelport
   selector:
   {{- with .Values.cloudCore.labels }}
   {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- if eq .Values.cloudCore.service.type "LoadBalancer" }}
-  {{- with .Values.cloudCore.service.ingressLabels }}
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- end }}
+  {{- end }}
\ No newline at end of file
diff --git a/build/helm/cloudcore/templates/serviceaccount.yaml b/build/helm/cloudcore/templates/serviceaccount.yaml
deleted file mode 100644
index 6da02adbf..000000000
--- a/build/helm/cloudcore/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  {{- with .Values.cloudCore.labels }}
-  labels: {{- toYaml . | nindent 4 }}
-  {{- end }}
-  name: cloudcore
diff --git a/build/helm/cloudcore/values.yaml b/build/helm/cloudcore/values.yaml
index 441844bf8..1ded6baee 100644
--- a/build/helm/cloudcore/values.yaml
+++ b/build/helm/cloudcore/values.yaml
@@ -1,20 +1,22 @@
-# Default values for kubeedge cloudcore.
+# Default values for kubeedge.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
 appVersion: "1.8.2"
 
 cloudCore:
-  hostNetWork: "true"
   replicaCount: 1
+  hostNetWork: "true"
   image:
     repository: "kubeedge/cloudcore"
     tag: "v1.8.2"
     pullPolicy: "IfNotPresent"
     imagePullSecrets: []
-  securityContext:
+  securityContext: 
     privileged: true
   labels:
     k8s-app: kubeedge
     kubeedge: cloudcore
-  annotations: []
+  annotations: {}
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
@@ -22,10 +24,8 @@ cloudCore:
         - matchExpressions:
           - key: node-role.kubernetes.io/edge
             operator: DoesNotExist
-          # - key: node-role.kubernetes.io/worker
-          #   operator: Exists
-  nodeSelector: []
-  tolerations: []
+  tolerations: {}
+  nodeSelector: {}
   resources:
     limits:
       cpu: 200m
@@ -35,26 +35,61 @@ cloudCore:
       memory: 512Mi
   modules:
     cloudHub:
-      advertiseAddress:
-        - ""            
+      advertiseAddress:   # Causion!: Leave this entry to empty will cause CloudCore to exit abnormally once KubeEdge is enabled. 
+        - ""              # At least a public IP Address or an IP which can be accessed by edge nodes must be provided!           
       nodeLimit: "1000"
       websocket:
-        enable: true
+        enable: "true"
       quic:
-        enable: false
+        enable: "false"
         maxIncomingStreams: "10000"
       https:
-        enable: true
+        enable: "true"
     cloudStream:
-      enable: true
+      enable: "true"
     dynamicController:
-      enable: false
+      enable: "false"
     router:
-      enable: false
+      enable: "false"
   service:
-    type: NodePort
+    type: "NodePort"
     cloudhubNodePort: "30000"
     cloudhubQuicNodePort: "30001"
     cloudhubHttpsNodePort: "30002"
     cloudstreamNodePort: "30003"
     tunnelNodePort: "30004"
+
+iptablesManager:
+  enable: "true"
+  mode: "internal"
+  hostNetWork: true
+  image:
+    repository: "kubeedge/iptables-manager"
+    tag: "v1.8.2"
+    pullPolicy: "IfNotPresent"
+    imagePullSecrets: []
+  securityContext: 
+    capabilities:
+      add:
+        - NET_ADMIN
+        - NET_RAW
+  labels:
+    k8s-app: iptables-manager
+    kubeedge: iptables-manager
+  annotations: {}
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: node-role.kubernetes.io/edge
+            operator: DoesNotExist
+  tolerations: {}
+  nodeSelector: {}
+  resources:
+    limits:
+      cpu: 200m
+      memory: 50Mi
+    requests:
+      cpu: 100m
+      memory: 25Mi
\ No newline at end of file