fenar · fenar · May 10, 2022 · May 10, 2022 · May 10, 2022 · May 10, 2022
diff --git a/5gcore/templates/SCC-AdminRoleBinding.yaml b/5gcore/templates/SCC-AdminRoleBinding.yaml
@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: default-scc-admin-binding
+  namespace: open5gcore
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: scc-admin
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: open5gcore
diff --git a/5gcore/templates/amf-configmap.yaml b/5gcore/templates/amf-configmap.yaml
@@ -30,13 +30,12 @@ data:
             mnc: {{ .Values.amf.mnc }}
           s_nssai:
           - sst: 1
-            sd: 1
         security:
             integrity_order : [ NIA2, NIA1, NIA0 ]
             ciphering_order : [ NEA0, NEA1, NEA2 ]
         network_name:
             full: Open5GS
-        amf_name: open5gs-amf0
+        amf_name: open5gs-amf
     nrf:
-     sbi:
-       name: open5gs-nrf
+      sbi:
+        name: open5gs-nrf
diff --git a/5gcore/templates/amf-deploy.yaml b/5gcore/templates/amf-deploy.yaml
@@ -10,25 +10,22 @@ spec:
     epc-mode: amf
   ports:
     - protocol: SCTP
-      port: 38412
+      port: {{ .Values.cnf.amf.sctp.port }}
       targetPort: 38412
-      nodePort: 30412
+      nodePort: {{ .Values.cnf.amf.sctp.nodeport }} 
 ---
-apiVersion: v1
-kind: Service
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
 metadata:
-  name: open5gs-amf
-  labels:
-    epc-mode: amf
+  name: allow-sctp
 spec:
-  type: NodePort
-  selector:
-    epc-mode: amf
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 80
-      nodePort: 30080    
+  podSelector:
+    matchLabels:
+      epc-mode: amf
+  ingress:
+  - ports:
+    - protocol: SCTP
+      port: {{ .Values.cnf.amf.sctp.port }}
 ---
 kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
@@ -42,28 +39,28 @@ spec:
   - ports:
     - protocol: SCTP
       port: 80
----
+---      
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: open5gs-amf-d
   labels:
     epc-mode: amf
 spec:
-  replicas: 1
   selector:
     matchLabels:
       epc-mode: amf
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: "scc-admin"
         sidecar.istio.io/inject: "true"
       labels:
         epc-mode: amf
     spec:    
       containers:
         - name: amf
-          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
           imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
           command: ["open5gs-amfd", "-c", "/open5gs/config-map/amf.yaml"]
           volumeMounts:

diff --git a/5gcore/templates/ausf-configmap.yaml b/5gcore/templates/ausf-configmap.yaml
@@ -11,5 +11,5 @@ data:
       - addr: 0.0.0.0
         advertise: open5gs-ausf
     nrf:
-     sbi:
-      name: open5gs-nrf
+      sbi:
+        name: open5gs-nrf
diff --git a/5gcore/templates/ausf-deploy.yaml b/5gcore/templates/ausf-deploy.yaml
@@ -19,20 +19,21 @@ metadata:
   labels:
     epc-mode: ausf
 spec:
-  replicas: 1
+  #replicas: 1
   selector:
     matchLabels:
       epc-mode: ausf
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: "scc-admin"
         sidecar.istio.io/inject: "true"
       labels:
         epc-mode: ausf
     spec:    
       containers:
         - name: ausf
-          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
           imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
           command: ["open5gs-ausfd", "-c", "/open5gs/config-map/ausf.yaml"]
           volumeMounts:

diff --git a/5gcore/templates/nrf-configmap.yaml b/5gcore/templates/nrf-configmap.yaml
@@ -6,8 +6,6 @@ metadata:
     epc-mode: nrf
 data:
   nrf.yaml: |
-    #logger:
-       #file: /var/log/open5gs/nrf.log
     nrf:
-        sbi:
-          addr: 0.0.0.0
+      sbi:
+        name: open5gs-nrf
diff --git a/5gcore/templates/nrf-deploy.yaml b/5gcore/templates/nrf-deploy.yaml
@@ -19,22 +19,23 @@ metadata:
   labels:
     epc-mode: nrf
 spec:
-  replicas: 1
+  #replicas: 1
   selector:
     matchLabels:
       epc-mode: nrf
   template:
     metadata:
       annotations:
-        sidecar.istio.io/inject: "true"
+        openshift.io/required-scc: "scc-admin"
+        sidecar.istio.io/inject: "false"
       labels:
         epc-mode: nrf
     spec:  
       containers:
         - name: nrf
-          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
           imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
-          command: ["open5gs-nrfd", "-c", "/open5gs/config-map/nrf.yaml"]
+          command: ["open5gs-nrfd", "-d", "-c", "/open5gs/config-map/nrf.yaml"]
           volumeMounts:
             - name: open5gs-nrf-config
               mountPath: /open5gs/config-map/nrf.yaml

diff --git a/5gcore/templates/nssf-configmap.yaml b/5gcore/templates/nssf-configmap.yaml
@@ -18,5 +18,5 @@ data:
         s_nssai:
           sst: 1        
     nrf:
-     sbi:
-      name: open5gs-nrf
+      sbi:
+        name: open5gs-nrf
diff --git a/5gcore/templates/nssf-deploy.yaml b/5gcore/templates/nssf-deploy.yaml
@@ -19,20 +19,21 @@ metadata:
   labels:
     epc-mode: nssf
 spec:
-  replicas: 1
+  #replicas: 1
   selector:
     matchLabels:
       epc-mode: nssf
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: "scc-admin"
         sidecar.istio.io/inject: "true"
       labels:
         epc-mode: nssf
     spec:   
       containers:
         - name: nssf
-          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
           imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
           command: ["open5gs-nssfd", "-c", "/open5gs/config-map/nssf.yaml"]
           volumeMounts:
@@ -42,4 +43,4 @@ spec:
       volumes:
         - name: open5gs-nssf-config
           configMap:
-            name: open5gs-nssf-config           
+            name: open5gs-nssf-config
diff --git a/5gcore/templates/pcf-configmap.yaml b/5gcore/templates/pcf-configmap.yaml
@@ -14,5 +14,5 @@ data:
       - addr: 0.0.0.0
         advertise: open5gs-pcf
     nrf:
-     sbi:
-      name: open5gs-nrf 
+      sbi:
+        name: open5gs-nrf 
diff --git a/5gcore/templates/pcf-deploy.yaml b/5gcore/templates/pcf-deploy.yaml
@@ -19,20 +19,21 @@ metadata:
   labels:
     epc-mode: pcf
 spec:
-  replicas: 1
+  #replicas: 1
   selector:
     matchLabels:
       epc-mode: pcf
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: "scc-admin"
         sidecar.istio.io/inject: "true"
       labels:
         epc-mode: pcf
     spec:    
       containers:
         - name: pcf
-          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
           imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
           command: ["open5gs-pcfd", "-c", "/open5gs/config-map/pcf.yaml"]
           volumeMounts:
@@ -42,4 +43,4 @@ spec:
       volumes:
         - name: open5gs-pcf-config
           configMap:
-            name: open5gs-pcf-config         
+            name: open5gs-pcf-config
diff --git a/5gcore/templates/resource-limits.yaml b/5gcore/templates/resource-limits.yaml
@@ -0,0 +1,37 @@
+apiVersion: "v1"
+kind: "LimitRange"
+metadata:
+  name: "resource-limits-pod"
+spec:
+  limits:
+    - type: "Pod"
+      max:
+        cpu: "600"
+        memory: "2Gi"
+      min:
+        cpu: "10m"
+        memory: "4Mi"
+      maxLimitRequestRatio:
+        cpu: "100"
+---
+apiVersion: "v1"
+kind: "LimitRange"
+metadata:
+  name: "resource-limits-container"
+spec:
+  limits:
+    - type: "Container"
+      max:
+        cpu: "300"
+        memory: "1Gi"
+      min:
+        cpu: "5m"
+        memory: "4Mi"
+      default:
+        cpu: "100m"
+        memory: "100Mi"
+      defaultRequest:
+        cpu: "100m"
+        memory: "100Mi"
+      maxLimitRequestRatio:
+        cpu: "300"
diff --git a/5gcore/templates/scc-admin.yaml b/5gcore/templates/scc-admin.yaml
@@ -0,0 +1,19 @@
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: scc-admin
+allowPrivilegedContainer: true
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+fsGroup:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+users:
+- system:serviceaccount:open5gcore:scc-admin-sa
+- system:serviceaccount:open5gcore:default
+- my-admin-user
+groups:
+- my-admin-group
diff --git a/5gcore/templates/smf-configmap.yaml b/5gcore/templates/smf-configmap.yaml
@@ -15,21 +15,20 @@ data:
         - addr: 0.0.0.0
           advertise: open5gs-smf
         pfcp:
-           dev: {{ .Values.k8s.interface }}
+          dev: {{ .Values.k8s.interface }}
         gtpc:
           dev: {{ .Values.k8s.interface }}
         gtpu:
-          dev: {{ .Values.k8s.interface }}    
+          dev: {{ .Values.k8s.tuninterface }} 
         subnet:
          - addr: 10.45.0.1/16
            dnn: {{ .Values.dnn }}
         dns:
           - 8.8.8.8
-          - 8.8.4.4
         mtu: 1400
     nrf:
-     sbi:
-      name: open5gs-nrf 
+      sbi:
+        name: open5gs-nrf 
     upf:
       pfcp:
         - name: open5gs-upf

diff --git a/5gcore/templates/smf-deploy.yaml b/5gcore/templates/smf-deploy.yaml
@@ -19,20 +19,20 @@ metadata:
   labels:
     epc-mode: smf
 spec:
-  replicas: 1
   selector:
     matchLabels:
       epc-mode: smf
   template:
     metadata:       
       annotations:
+        openshift.io/required-scc: "scc-admin"
         sidecar.istio.io/inject: "true"
       labels:
         epc-mode: smf
     spec:   
       containers:
       - name: smf
-        image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+        image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
         imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
         command: ["/bin/sh", "-c"]
         args:
@@ -44,4 +44,4 @@ spec:
       volumes:
         - name: open5gs-smf-config
           configMap:
-            name: open5gs-smf-config                
+            name: open5gs-smf-config
diff --git a/5gcore/templates/udm-configmap.yaml b/5gcore/templates/udm-configmap.yaml
@@ -13,5 +13,5 @@ data:
       - addr: 0.0.0.0
         advertise: open5gs-udm
     nrf:
-     sbi:
-      name: open5gs-nrf
+      sbi:
+        name: open5gs-nrf
diff --git a/5gcore/templates/udm-deploy.yaml b/5gcore/templates/udm-deploy.yaml
@@ -19,20 +19,21 @@ metadata:
   labels:
     epc-mode: udm
 spec:
-  replicas: 1
+  #replicas: 1
   selector:
     matchLabels:
       epc-mode: udm
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: "scc-admin"
         sidecar.istio.io/inject: "true"
       labels:
         epc-mode: udm
     spec:   
       containers:
         - name: udm
-          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.tag }}"
+          image: "{{ .Values.open5gcore.image.repository }}:{{ .Values.open5gcore.image.oldtag }}"
           imagePullPolicy: {{ .Values.open5gcore.image.pullPolicy }}
           command: ["open5gs-udmd", "-c", "/open5gs/config-map/udm.yaml"]
           volumeMounts: