Configure Kubernetes network policies with Calico CNI for microsegmentation and security enforcement

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Default values
CLUSTER_POD_CIDR="${1:-192.168.0.0/16}"
CALICO_VERSION="v3.26.4"

# Usage message
usage() {
    echo "Usage: $0 [CLUSTER_POD_CIDR]"
    echo "Example: $0 192.168.0.0/16"
    exit 1
}

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    log_warning "Script interrupted or failed. Cleaning up..."
    rm -f /tmp/calico-*.yaml
    rm -f /tmp/test-apps.yaml
    rm -f /tmp/calicoctl-config.yaml
}

trap cleanup ERR INT TERM

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]] && ! sudo -n true 2>/dev/null; then
        log_error "This script requires root privileges or sudo access"
        exit 1
    fi
}

# Auto-detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf check-update || true"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum check-update || true"
                ;;
            *) 
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
        log_info "Detected distribution: $ID using $PKG_MGR"
    else
        log_error "Cannot detect distribution - /etc/os-release not found"
        exit 1
    fi
}

# Check prerequisites
check_prerequisites() {
    log_info "[1/10] Checking prerequisites..."
    
    # Check if kubectl is installed and configured
    if ! command -v kubectl &> /dev/null; then
        log_error "kubectl is not installed or not in PATH"
        exit 1
    fi
    
    # Test cluster connectivity
    if ! kubectl cluster-info &> /dev/null; then
        log_error "Cannot connect to Kubernetes cluster. Check your kubeconfig"
        exit 1
    fi
    
    # Check cluster admin permissions
    if ! kubectl auth can-i '*' '*' --all-namespaces &> /dev/null; then
        log_error "Insufficient permissions. Cluster admin access required"
        exit 1
    fi
    
    # Install required packages
    case "$PKG_MGR" in
        apt)
            sudo $PKG_UPDATE
            sudo $PKG_INSTALL curl wget jq
            ;;
        dnf|yum)
            sudo $PKG_UPDATE
            sudo $PKG_INSTALL curl wget jq
            ;;
    esac
    
    log_success "Prerequisites check completed"
}

# Install Calico operator
install_calico_operator() {
    log_info "[2/10] Installing Calico operator..."
    
    kubectl create namespace calico-system --dry-run=client -o yaml | kubectl apply -f -
    kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/tigera-operator.yaml
    
    # Wait for operator to be ready
    kubectl wait --for=condition=available --timeout=300s deployment/tigera-operator -n tigera-operator
    
    log_success "Calico operator installed"
}

# Configure Calico installation
configure_calico() {
    log_info "[3/10] Configuring Calico installation..."
    
    cat > /tmp/calico-installation.yaml << EOF
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    ipPools:
    - blockSize: 26
      cidr: ${CLUSTER_POD_CIDR}
      encapsulation: VXLANCrossSubnet
      natOutgoing: Enabled
      nodeSelector: all()
  registry: quay.io/
  nodeUpdateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  flexVolumePath: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/
  nodeMetricsPort: 9091
  typhaMetricsPort: 9093
EOF
    
    chmod 644 /tmp/calico-installation.yaml
    kubectl apply -f /tmp/calico-installation.yaml
    
    log_success "Calico configuration applied"
}

# Wait for Calico pods
wait_for_calico() {
    log_info "[4/10] Waiting for Calico components to be ready..."
    
    # Wait for all calico-system pods to be running
    kubectl wait --for=condition=ready --timeout=600s pod -l k8s-app=calico-node -n calico-system
    kubectl wait --for=condition=ready --timeout=300s pod -l k8s-app=calico-kube-controllers -n calico-system
    
    log_success "Calico components are ready"
}

# Install calicoctl
install_calicoctl() {
    log_info "[5/10] Installing calicoctl CLI tool..."
    
    curl -L https://github.com/projectcalico/calico/releases/download/${CALICO_VERSION}/calicoctl-linux-amd64 -o /tmp/calicoctl
    sudo chmod 755 /tmp/calicoctl
    sudo mv /tmp/calicoctl /usr/local/bin/calicoctl
    
    # Configure calicoctl
    mkdir -p ~/.calicoctl
    cat > ~/.calicoctl/config << EOF
apiVersion: projectcalico.org/v3
kind: CalicoAPIConfig
metadata:
spec:
  datastoreType: "kubernetes"
  kubeconfig: "${HOME}/.kube/config"
EOF
    chmod 644 ~/.calicoctl/config
    
    # Verify installation
    calicoctl version
    
    log_success "calicoctl installed and configured"
}

# Create test namespaces
create_namespaces() {
    log_info "[6/10] Creating test application namespaces..."
    
    kubectl create namespace frontend --dry-run=client -o yaml | kubectl apply -f -
    kubectl create namespace backend --dry-run=client -o yaml | kubectl apply -f -
    kubectl create namespace database --dry-run=client -o yaml | kubectl apply -f -
    
    kubectl label namespace frontend tier=frontend --overwrite
    kubectl label namespace backend tier=backend --overwrite
    kubectl label namespace database tier=database --overwrite
    
    log_success "Test namespaces created and labeled"
}

# Deploy test applications
deploy_test_apps() {
    log_info "[7/10] Deploying test applications..."
    
    cat > /tmp/test-apps.yaml << 'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend-app
  namespace: frontend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
        tier: frontend
    spec:
      containers:
      - name: nginx
        image: nginx:1.24-alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
---
apiVersion: v1
kind: Service
metadata:
  name: frontend-service
  namespace: frontend
spec:
  selector:
    app: frontend
  ports:
  - port: 80
    targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend-app
  namespace: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
        tier: backend
    spec:
      containers:
      - name: httpd
        image: httpd:2.4-alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
---
apiVersion: v1
kind: Service
metadata:
  name: backend-service
  namespace: backend
spec:
  selector:
    app: backend
  ports:
  - port: 80
    targetPort: 80
EOF
    
    chmod 644 /tmp/test-apps.yaml
    kubectl apply -f /tmp/test-apps.yaml
    
    log_success "Test applications deployed"
}

# Create network policies
create_network_policies() {
    log_info "[8/10] Creating network policies..."
    
    # Default deny all policy for each namespace
    for ns in frontend backend database; do
        kubectl apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: $ns
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF
    done
    
    # Allow frontend to backend communication
    kubectl apply -f - << 'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: backend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP
      port: 80
EOF
    
    log_success "Network policies created"
}

# Verify installation
verify_installation() {
    log_info "[9/10] Verifying Calico installation..."
    
    # Check Calico node status
    calicoctl get nodes -o wide
    
    # Check network policies
    kubectl get networkpolicies --all-namespaces
    
    # Verify pods are running
    kubectl get pods --all-namespaces | grep -E "(calico|tigera)"
    
    log_success "Installation verification completed"
}

# Main installation function
main() {
    log_info "[10/10] Calico CNI installation completed successfully!"
    log_info "Next steps:"
    echo "  1. Test network policy enforcement with: kubectl exec -it <pod> -- curl <service>"
    echo "  2. Monitor network flows with: calicoctl get felixConfiguration"
    echo "  3. Create additional network policies as needed"
    echo "  4. Configure logging and monitoring for policy violations"
    
    cleanup
}

# Argument validation
if [ $# -gt 1 ]; then
    usage
fi

# Execute installation steps
check_privileges
detect_distro
check_prerequisites
install_calico_operator
configure_calico
wait_for_calico
install_calicoctl
create_namespaces
deploy_test_apps
create_network_policies
verify_installation
main