Validate cilium version

pkg/apis/kops/validation/validation.go

@@ -132,7 +132,7 @@ func validateClusterSpec(spec *kops.ClusterSpec, c *kops.Cluster, fieldPath *fie
 	}
 
 	if spec.Networking != nil {
-		allErrs = append(allErrs, validateNetworking(spec, spec.Networking, fieldPath.Child("networking"))...)
+		allErrs = append(allErrs, validateNetworking(c, spec.Networking, fieldPath.Child("networking"))...)
 		if spec.Networking.Calico != nil {
 			allErrs = append(allErrs, validateNetworkingCalico(spec.Networking.Calico, spec.EtcdClusters[0], fieldPath.Child("networking", "calico"))...)
 		}
@@ -490,7 +490,8 @@ func validateNodeAuthorization(n *kops.NodeAuthorizationSpec, c *kops.Cluster, f
 	return allErrs
 }
 
-func validateNetworking(c *kops.ClusterSpec, v *kops.NetworkingSpec, fldPath *field.Path) field.ErrorList {
+func validateNetworking(cluster *kops.Cluster, v *kops.NetworkingSpec, fldPath *field.Path) field.ErrorList {
+	c := &cluster.Spec
 	allErrs := field.ErrorList{}
 	optionTaken := false
 
@@ -586,7 +587,7 @@ func validateNetworking(c *kops.ClusterSpec, v *kops.NetworkingSpec, fldPath *fi
 		}
 		optionTaken = true
 
-		allErrs = append(allErrs, validateNetworkingCilium(c, v.Cilium, fldPath.Child("cilium"))...)
+		allErrs = append(allErrs, validateNetworkingCilium(cluster, v.Cilium, fldPath.Child("cilium"))...)
 	}
 
 	if v.LyftVPC != nil {
@@ -650,9 +651,33 @@ func validateNetworkingCanal(v *kops.CanalNetworkingSpec, fldPath *field.Path) f
 	return allErrs
 }
 
-func validateNetworkingCilium(c *kops.ClusterSpec, v *kops.CiliumNetworkingSpec, fldPath *field.Path) field.ErrorList {
+func validateNetworkingCilium(cluster *kops.Cluster, v *kops.CiliumNetworkingSpec, fldPath *field.Path) field.ErrorList {
+	c := &cluster.Spec
 	allErrs := field.ErrorList{}
 
+	if v.Version != "" {
+		versionFld := fldPath.Child("version")
+		version, err := semver.ParseTolerant(v.Version)
+
+		version.Pre = nil
+		version.Build = nil
+		if err != nil {
+			allErrs = append(allErrs, field.Invalid(versionFld, v.Version, "Could not parse as semantic version"))
+		}
+
+		v8, _ := semver.Parse("1.8.0")
+		v7, _ := semver.Parse("1.7.0")
+		v6, _ := semver.Parse("1.6.0")
+
+		if !(version.GTE(v6) && version.LT(v8)) {
+			allErrs = append(allErrs, field.Invalid(versionFld, v.Version, "Only versions 1.6 and 1.7 are supported"))
+		}
+
+		if !cluster.IsKubernetesGTE("1.12") && version.GTE(v7) {
+			allErrs = append(allErrs, field.Forbidden(versionFld, "Version >= 1.7 requires kubernetesVersion 1.12 or higher"))
+		}
+	}
+
 	if v.EnableNodePort && c.KubeProxy != nil && (c.KubeProxy.Enabled == nil || *c.KubeProxy.Enabled) {
 		allErrs = append(allErrs, field.Forbidden(fldPath.Root().Child("spec", "kubeProxy", "enabled"), "When Cilium NodePort is enabled, kubeProxy must be disabled"))
 	}

pkg/apis/kops/validation/validation_test.go

@@ -292,7 +292,7 @@ func Test_Validate_Networking_Flannel(t *testing.T) {
 		cluster := &kops.Cluster{}
 		cluster.Spec.Networking = networking
 
-		errs := validateNetworking(&cluster.Spec, networking, field.NewPath("networking"))
+		errs := validateNetworking(cluster, networking, field.NewPath("networking"))
 		testErrors(t, g.Input, errs, g.ExpectedErrors)
 	}
 }
@@ -579,12 +579,50 @@ func Test_Validate_Cilium(t *testing.T) {
 			},
 			ExpectedErrors: []string{"Forbidden::cilium.ipam"},
 		},
+		{
+			Cilium: kops.CiliumNetworkingSpec{
+				Version: "1.0",
+			},
+			Spec: kops.ClusterSpec{
+				KubernetesVersion: "1.11.0",
+			},
+			ExpectedErrors: []string{"Invalid value::cilium.version"},
+		},
+		{
+			Cilium: kops.CiliumNetworkingSpec{
+				Version: "1.7.0",
+			},
+			Spec: kops.ClusterSpec{
+				KubernetesVersion: "1.11.0",
+			},
+			ExpectedErrors: []string{"Forbidden::cilium.version"},
+		},
+		{
+			Cilium: kops.CiliumNetworkingSpec{
+				Version: "1.7.0-rc1",
+			},
+			Spec: kops.ClusterSpec{
+				KubernetesVersion: "1.11.0",
+			},
+			ExpectedErrors: []string{"Forbidden::cilium.version"},
+		},
+		{
+			Cilium: kops.CiliumNetworkingSpec{
+				Version: "1.7",
+			},
+			Spec: kops.ClusterSpec{
+				KubernetesVersion: "1.12.0",
+			},
+		},
 	}
 	for _, g := range grid {
 		g.Spec.Networking = &kops.NetworkingSpec{
 			Cilium: &g.Cilium,
 		}
-		errs := validateNetworkingCilium(&g.Spec, g.Spec.Networking.Cilium, field.NewPath("cilium"))
+		cluster := &kops.Cluster{
+			Spec: g.Spec,
+		}
+		errs := validateNetworkingCilium(cluster, g.Spec.Networking.Cilium, field.NewPath("cilium"))
 		testErrors(t, g.Spec, errs, g.ExpectedErrors)
 	}
 }

pkg/model/components/BUILD.bazel

@@ -4,6 +4,7 @@ go_library(
     name = "go_default_library",
     srcs = [
         "apiserver.go",
+        "cilium.go",
         "containerd.go",
         "context.go",
         "defaults.go",

pkg/model/components/cilium.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package components
+
+import (
+	"k8s.io/kops/pkg/apis/kops"
+	"k8s.io/kops/upup/pkg/fi/loader"
+)
+
+// CiliumOptionsBuilder adds options for the cilium to the model
+type CiliumOptionsBuilder struct {
+	Context *OptionsContext
+}
+
+var _ loader.OptionsBuilder = &CiliumOptionsBuilder{}
+
+func (b *CiliumOptionsBuilder) BuildOptions(o interface{}) error {
+	clusterSpec := o.(*kops.ClusterSpec)
+	c := clusterSpec.Networking.Cilium
+	if c == nil {
+		return nil
+	}
+
+	if c.Version == "" {
+		if b.Context.IsKubernetesLT("1.12.0") {
+			c.Version = "v1.6.9"
+		} else {
+			c.Version = "v1.7.4"
+		}
+	}
+
+	if c.BPFCTGlobalAnyMax == 0 {
+		c.BPFCTGlobalAnyMax = 262144
+
+	}
+	if c.BPFCTGlobalTCPMax == 0 {
+		c.BPFCTGlobalTCPMax = 524288
+	}
+
+	if c.ClusterName == "" {
+		c.ClusterName = "default"
+	}
+
+	if c.MonitorAggregation == "" {
+		c.MonitorAggregation = "medium"
+	}
+
+	if c.SidecarIstioProxyImage == "" {
+		c.SidecarIstioProxyImage = "cilium/istio_proxy"
+	}
+
+	if c.Tunnel == "" {
+		c.Tunnel = "vxlan"
+	}
+
+	if c.ToFqdnsDNSRejectResponseCode == "" {
+		c.ToFqdnsDNSRejectResponseCode = "refused"
+	}
+
+	if c.ContainerRuntimeLabels == "" {
+		c.ContainerRuntimeLabels = "none"
+	}
+
+	if c.AgentPrometheusPort == 0 {
+		c.AgentPrometheusPort = 9090
+	}
+
+	return nil
+
+}