reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add namespaceLabels and namespaceUID, remove namespace in ns struct

Browse Source
This commit is contained in:
gobomb authored and chenyiming committed 2020-08-02 21:06:17 +08:00
1 parent 1ff09fd4d1
commit 0789670344
2 files changed
+28 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

npc/controller.go
+5 -5
View File
@@ -60,9 +60,9 @@ func New(nodeName string, ipt iptables.Interface, ips ipset.Interface, clientset
func (npc *controller) onNewNsSelector(selector *selector) error {
for _, ns := range npc.nss {
if ns.namespace != nil {
if selector.matchesNamespaceSelector(ns.namespace.ObjectMeta.Labels) {
if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
if ns.namespaceUID != "" {
if selector.matchesNamespaceSelector(ns.namespaceLabels) {
if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
return err
}
}
@@ -73,10 +73,10 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
func (npc *controller) onNewNamespacePodsSelector(selector *selector) error {
for _, ns := range npc.nss {
if ns.namespace != nil && len(ns.pods) > 0 {
if ns.namespaceUID != "" && len(ns.pods) > 0 {
for _, pod := range ns.pods {
if hasIP(pod) {
if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels) {
if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespaceLabels) {
if err := selector.addEntry(pod.ObjectMeta.UID, pod.Status.PodIP, podComment(pod)); err != nil {
return err
}
npc/namespace.go
+23 -18
View File
@@ -22,11 +22,12 @@ type ns struct {
ipt iptables.Interface // interface to iptables
ips ipset.Interface // interface to ipset
name string // k8s Namespace name
nodeName string // my node name
namespace *coreapi.Namespace // k8s Namespace object
pods map[types.UID]*coreapi.Pod // k8s Pod objects by UID
policies map[types.UID]interface{} // k8s NetworkPolicy objects by UID
name string // k8s Namespace name
nodeName string // my node name
namespaceUID types.UID // k8s Namespace UID
namespaceLabels map[string]string // k8s Namespace labels
pods map[types.UID]*coreapi.Pod // k8s Pod objects by UID
policies map[types.UID]interface{} // k8s NetworkPolicy objects by UID
uid types.UID // surrogate UID to own allPods selector
allPods *selectorSpec // hash:ip ipset of all pod IPs in this namespace
@@ -54,7 +55,8 @@ func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, n
ipt: ipt,
ips: ips,
name: name,
namespace: namespaceObj,
namespaceUID: namespaceObj.ObjectMeta.UID,
namespaceLabels: namespaceObj.ObjectMeta.Labels,
nodeName: nodeName,
pods: make(map[types.UID]*coreapi.Pod),
policies: make(map[types.UID]interface{}),
@@ -88,7 +90,7 @@ func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, n
}
func (ns *ns) empty() bool {
return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespace == nil
return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespaceUID == ""
}
func (ns *ns) destroy() error {
@@ -188,7 +190,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
}
}
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP, podComment(obj))
if err != nil {
return err
}
@@ -211,7 +213,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
return err
}
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, oldObj.Status.PodIP); err != nil {
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, ns.namespaceLabels, oldObj.Status.PodIP); err != nil {
return err
}
@@ -234,7 +236,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
return err
}
}
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, ns.namespaceLabels, newObj.Status.PodIP, podComment(newObj))
if err != nil {
return err
}
@@ -279,8 +281,8 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
}
}
for _, ps := range ns.namespacedPodsSelectors.entries {
oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels)
newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels)
oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespaceLabels)
newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespaceLabels)
if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP {
continue
}
@@ -333,7 +335,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
if err := ns.podSelectors.delFromMatchingPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
return err
}
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP); err != nil {
return err
}
return nil
@@ -495,7 +497,8 @@ func (ns *ns) deleteBypassRules() error {
}
func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
ns.namespace = obj
ns.namespaceUID = obj.ObjectMeta.UID
ns.namespaceLabels = obj.ObjectMeta.Labels
// Insert a rule to bypass policies
if err := ns.ensureBypassRules(); err != nil {
@@ -508,10 +511,12 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
}
func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
ns.namespace = newObj
ns.namespaceUID = newObj.ObjectMeta.UID
// Re-evaluate namespace selector membership if labels have changed
if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) {
ns.namespaceLabels = newObj.ObjectMeta.Labels
for _, selector := range ns.nsSelectors.entries {
oldMatch := selector.matchesNamespaceSelector(oldObj.ObjectMeta.Labels)
newMatch := selector.matchesNamespaceSelector(newObj.ObjectMeta.Labels)
@@ -519,12 +524,12 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
continue
}
if oldMatch {
if err := selector.delEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName)); err != nil {
if err := selector.delEntry(ns.namespaceUID, string(ns.allPods.ipsetName)); err != nil {
return err
}
}
if newMatch {
if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
return err
}
}
@@ -535,7 +540,7 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
}
func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
ns.namespace = nil
ns.namespaceUID = ""
// Remove bypass rule
if err := ns.deleteBypassRules(); err != nil {