Add Kubernetes manifests to deploy rbcs and kaya-rbcs in the rbcs namespace

- memcached (1Gi) shared by both cache servers via a single service - rbcs (java) and kaya-rbcs deployments with identical resource limits (1 cpu / 512Mi) - strict network policies whitelisting only the required communications - manually-triggered benchmark jobs running 'client benchmark -s 256 -e 10000' against the rbcs and rbcs-kaya services
2026-08-02 23:10:55 +00:00
parent 752406db22
commit 96cf433793
3 changed files with 446 additions and 0 deletions
@@ -0,0 +1,134 @@
+# Default deny: no traffic in or out of the namespace unless explicitly allowed below.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: rbcs
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+---
+# Allow all pods to resolve services via cluster DNS.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns-egress
+  namespace: rbcs
+spec:
+  podSelector: {}
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+# memcached: only the two cache servers may reach it; it needs no egress.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: memcached-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      app: memcached
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values: [rbcs, rbcs-kaya]
+      ports:
+        - protocol: TCP
+          port: 11211
+  egress: []
+---
+# rbcs (java): reachable by benchmark client pods only; egress to memcached only.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rbcs-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      app: rbcs
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              role: benchmark
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: memcached
+      ports:
+        - protocol: TCP
+          port: 11211
+---
+# rbcs-kaya (kaya-rbcs): reachable by benchmark client pods only; egress to memcached only.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rbcs-kaya-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      app: rbcs-kaya
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              role: benchmark
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: memcached
+      ports:
+        - protocol: TCP
+          port: 11211
+---
+# Benchmark client pods: no ingress; egress only to the two cache servers.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: benchmark-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      role: benchmark
+  policyTypes: [Ingress, Egress]
+  ingress: []
+  egress:
+    - to:
+        - podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values: [rbcs, rbcs-kaya]
+      ports:
+        - protocol: TCP
+          port: 8080