Update scripts to create an AKS cluster and scripts for Cilium tests - #6
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the AKS provisioning scripts to support selecting different network policy/data plane combinations at runtime, and refines the Cilium ingress/egress tutorial scripts to be more step-based (new helper scripts, clearer connectivity checks, and cleanup helpers).
Changes:
- Add an interactive menu to the AKS cluster creation scripts to choose Azure/Calico/Cilium network policy configurations (and enable ACNS during cluster creation).
- Restructure the Cilium ingress tutorial into more granular steps (new call/policy/get/cleanup scripts) and add readiness waits before running checks.
- Restructure the Cilium egress tutorial into more granular steps (new call/policy/get/endpoint-list/cleanup scripts) and refine connectivity-check messaging.
Reviewed changes
Copilot reviewed 18 out of 25 changed files in this pull request and generated 17 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/01-user-assigned-managed-identity.sh | Adds interactive network-policy selection + refactors feature registration flow; enables ACNS during az aks create. |
| scripts/01-system-assigned-managed-identity.sh | Same as above for system-assigned identity variant; enables ACNS during az aks create. |
| policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh | Updates stable version URLs (master→main) and adjusts cleanup of downloaded artifacts. |
| policies/cilium/ingress-tutorial/01-deploy-demo.sh | Adds waits for workloads to be ready before running connectivity checks. |
| policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh | Tightens curl timeouts for tutorial calls. |
| policies/cilium/ingress-tutorial/06-call-other-web-method.sh | Tightens curl timeouts for tutorial calls. |
| policies/cilium/ingress-tutorial/08-call-deathstar-methods.sh | New step script to exercise ingress behavior with clearer output and timeouts. |
| policies/cilium/ingress-tutorial/09-create-l3-l4-l7-policy.sh | New step script to apply the L3/L4/L7 policy manifest. |
| policies/cilium/ingress-tutorial/10-call-deathstar-methods.sh | New step script to test calls after policy application. |
| policies/cilium/ingress-tutorial/11-get-policy.sh | New helper script to fetch the applied CiliumNetworkPolicy. |
| policies/cilium/ingress-tutorial/12-cleanup.sh | New cleanup script to delete the tutorial namespace (with forced-finalizer fallback). |
| policies/cilium/ingress-tutorial/09-call-deathstar-methods-from-tiefighter.sh | Removes the older combined call script in favor of the new step scripts. |
| policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh | Updates stable version URLs (master→main) and adjusts cleanup of downloaded artifacts. |
| policies/cilium/egress-tutorial/01-deploy-demo.sh | Adds wait for mediabot readiness before running connectivity checks. |
| policies/cilium/egress-tutorial/02-call-services.sh | New baseline connectivity-check step before policies are applied. |
| policies/cilium/egress-tutorial/03-create-dns-matchname-policy.sh | New step script to apply the matchName FQDN policy. |
| policies/cilium/egress-tutorial/04-call-services.sh | New step script to validate behavior after matchName policy. |
| policies/cilium/egress-tutorial/05-create-dns-pattern-policy.sh | New step script to apply the matchPattern FQDN policy. |
| policies/cilium/egress-tutorial/06-call-services.sh | New step script to validate behavior after matchPattern policy. |
| policies/cilium/egress-tutorial/07-create-dns-port-policy.sh | New step script to apply the port-restricted FQDN policy. |
| policies/cilium/egress-tutorial/08-call-services.sh | New step script to validate behavior after port restrictions. |
| policies/cilium/egress-tutorial/09-get-policy.sh | New helper script to fetch the applied CiliumNetworkPolicy. |
| policies/cilium/egress-tutorial/10-cilium-endpoint-list.sh | New helper script to run cilium endpoint list on nodes hosting target pods. |
| policies/cilium/egress-tutorial/11-cleanup.sh | New cleanup script to delete the tutorial namespace (with forced-finalizer fallback). |
| policies/cilium/egress-tutorial/07-call-services.sh | Removes the older combined call script in favor of the new step scripts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+79
to
+81
| echo "====================================" | ||
| echo "Run Docker Container (1-3): " | ||
| echo "====================================" |
| "Azure Network Plugin + Calico Network Policy" | ||
| "Quit" | ||
| ) | ||
| name="" |
Comment on lines
+82
to
+87
| options=( | ||
| "Azure Network Plugin + Azure Network Policy" | ||
| "Azure Network Plugin + Cilium Network Policy" | ||
| "Azure Network Plugin + Calico Network Policy" | ||
| "Quit" | ||
| ) |
Comment on lines
+137
to
+141
| for aks_feature in "${aks_features[@]}"; do | ||
| echo "Checking if [$aks_feature] extension is already registered..." | ||
| extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_feature') && @.properties.state == 'Registered'].{Name:name}" --output tsv) | ||
| if [[ -z $extension ]]; then | ||
| echo "[$aks_extension] extension is not registered." | ||
| echo "Registering [$aks_extension] extension..." | ||
| echo "[$aks_feature] extension is not registered." |
| for aks_extension in "${registering_extensions[@]}"; do | ||
| echo -n "Checking if [$aks_extension] extension is already registered..." | ||
| for aks_feature in "${registering_extensions[@]}"; do | ||
| echo -n "Checking if [$aks_feature] extension is already registered..." |
| echo "Calling http://api.github.com from mediabot pod..." | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist and HTTP is redirected to HTTPS | ||
| echo "Calling https://status.github.com from mediabot pod..." | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist |
| echo "Calling http://api.github.com from mediabot pod..." | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should fail as the network policy allows only HTTPS traffic on port 443 | ||
| echo "Calling https://status.github.com from mediabot pod..." | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist |
|
|
||
| # Azure Kubernetes Service (AKS) cluster | ||
| prefix="local" # local, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes | ||
| prefix="local" # zeus, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes |
|
|
||
| # Azure Kubernetes Service (AKS) cluster | ||
| prefix="local" # horus, local, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes | ||
| prefix="local" # horus, zeus, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes |
| echo "Calling http://api.github.com from mediabot pod..." | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist and HTTP is redirected to HTTPS | ||
| echo "Calling https://status.github.com from mediabot pod..." | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should fails as status.github.com is not allowed by the DNS whitelist |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Update scripts to create an AKS cluster and scripts for Cilium tests.
Changes
01-system-assigned-managed-identity.shscript used to create an AKS cluster with a system-assigned managed identity. The new script adds a menu to decide which network policy enable (Azure, Calico, Cilium)01-user-assigned-managed-identity.shscript used to create an AKS cluster with a system-assigned managed identity. The new script adds a menu to decide which network policy enable (Azure, Calico, Cilium)policies/cilium/ingress-tutorial.policies/cilium/egress-tutorial