kubernetes: Updated connectivity check

Improved connectivity check with the ability to test various connectivity and
policy variations.

Signed-off-by: Thomas Graf <thomas@cilium.io>

examples/kubernetes/connectivity-check/README.md

@@ -1,22 +1,4 @@
-# Connectivity Checker App
+# Connectivity Check
 
-Deploys a simple echo REST API with multiple replicas. Probe pods with multiple
-replicas checks connectivity to echo pods with a ClusterIP service. Readiness
-and liveness probe of probes will fail if connectivity to echo pods are
-unhealthy.
-
-```
-$ kubectl create -f connectivity-check.yaml
-$ kubectl get pods
-NAME                    READY     STATUS    RESTARTS   AGE
-echo-7d9f9564df-2hkhp   1/1       Running   0          37s
-echo-7d9f9564df-jr87s   1/1       Running   0          37s
-echo-7d9f9564df-lk6dl   1/1       Running   0          37s
-echo-7d9f9564df-q5dpb   1/1       Running   0          37s
-echo-7d9f9564df-zwhtw   1/1       Running   0          37s
-probe-8689f6579-899hc   1/1       Running   0          37s
-probe-8689f6579-9wzz7   1/1       Running   0          37s
-probe-8689f6579-k8ggp   1/1       Running   0          37s
-probe-8689f6579-sqdfb   1/1       Running   0          37s
-probe-8689f6579-thv7j   1/1       Running   0          37s
-```
+Set of deployments that will perform a series of connectivity checks via
+liveness and readiness checks. An unhealthy/unready pod indicates a problem.

examples/kubernetes/connectivity-check/echo-a.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: echo-a
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+  selector:
+    name: echo-a
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: echo-a
+spec:
+  selector:
+    matchLabels:
+      name: echo-a
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: echo-a
+    spec:
+      containers:
+      - name: echo-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        readinessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "localhost"]

examples/kubernetes/connectivity-check/echo-b.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: echo-b
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+  selector:
+    name: echo-b
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: echo-b
+spec:
+  selector:
+    matchLabels:
+      name: echo-b
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: echo-b
+    spec:
+      containers:
+      - name: echo-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        readinessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "localhost"]

examples/kubernetes/connectivity-check/pod-to-a-allowed.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pod-to-a-allowed-cnp
+spec:
+  selector:
+    matchLabels:
+      name: pod-to-a-allowed-cnp
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: pod-to-a-allowed-cnp
+    spec:
+      containers:
+      - name: pod-to-a-allowed-cnp-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "echo-a"]
+        readinessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "echo-a"]
+---
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "pod-to-a-allowed-cnp"
+spec:
+  endpointSelector:
+    matchLabels:
+      name: pod-to-a-allowed-cnp
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        name: echo-a
+    toPorts:
+    - ports:
+      - port: "80"
+        protocol: TCP
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s:k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: "53"
+        protocol: UDP

examples/kubernetes/connectivity-check/pod-to-a-denied.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pod-to-a-l3-denied-cnp
+spec:
+  selector:
+    matchLabels:
+      name: pod-to-a-l3-denied-cnp
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: pod-to-a-l3-denied-cnp
+    spec:
+      containers:
+      - name: pod-to-a-l3-denied-cnp-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command: ["bash", "-c", "! curl -sS --connect-timeout 5 -o /dev/null echo-a"]
+        readinessProbe:
+          exec:
+            command: ["bash", "-c", "! curl -sS --connect-timeout 5 -o /dev/null echo-a"]
+---
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "pod-to-a-l3-denied-cnp"
+spec:
+  endpointSelector:
+    matchLabels:
+      name: pod-to-a-l3-denied-cnp
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s:k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: "53"
+        protocol: UDP

examples/kubernetes/connectivity-check/pod-to-a.yaml

@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pod-to-a
+spec:
+  selector:
+    matchLabels:
+      name: pod-to-a
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: pod-to-a
+    spec:
+      containers:
+      - name: pod-to-a-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "echo-a"]

examples/kubernetes/connectivity-check/pod-to-b-intra-node.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pod-to-b-intra-node
+spec:
+  selector:
+    matchLabels:
+      name: pod-to-b-intra-node
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: pod-to-b-intra-node
+    spec:
+      containers:
+      - name: pod-to-b-intra-node-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "echo-b"]
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: name
+                operator: In
+                values:
+                - echo-b
+            topologyKey: "kubernetes.io/hostname"

examples/kubernetes/connectivity-check/pod-to-b-multi-node.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pod-to-b-multi-node
+spec:
+  selector:
+    matchLabels:
+      name: pod-to-b-multi-node
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: pod-to-b-multi-node
+    spec:
+      containers:
+      - name: pod-to-b-multi-node-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command: ["curl", "-sS", "-o", "/dev/null", "echo-b"]
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: name
+                operator: In
+                values:
+                - echo-b
+            topologyKey: "kubernetes.io/hostname"

examples/kubernetes/connectivity-check/pod-to-external-1111.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pod-to-a-external-1111
+spec:
+  selector:
+    matchLabels:
+      name: pod-to-a-external-1111
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        name: pod-to-a-external-1111
+    spec:
+      containers:
+      - name: pod-to-a-external-1111-container
+        image: docker.io/cilium/json-mock:1.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command: ["bash", "-c", "curl -sS --connect-timeout 5 -o /dev/null 1.1.1.1"]
+        readinessProbe:
+          exec:
+            command: ["bash", "-c", "curl -sS --connect-timeout 5 -o /dev/null 1.1.1.1"]