From 078967034450753dfc5f3b01bd27de502baa9d6d Mon Sep 17 00:00:00 2001 From: gobomb Date: Fri, 24 Jul 2020 17:38:44 +0800 Subject: [PATCH] add namespaceLabels and namespaceUID, remove namespace in ns struct --- npc/controller.go | 10 +++++----- npc/namespace.go | 41 +++++++++++++++++++++++------------------ 2 files changed, 28 insertions(+), 23 deletions(-) diff --git a/npc/controller.go b/npc/controller.go index ecba6056..4837acd5 100644 --- a/npc/controller.go +++ b/npc/controller.go @@ -60,9 +60,9 @@ func New(nodeName string, ipt iptables.Interface, ips ipset.Interface, clientset func (npc *controller) onNewNsSelector(selector *selector) error { for _, ns := range npc.nss { - if ns.namespace != nil { - if selector.matchesNamespaceSelector(ns.namespace.ObjectMeta.Labels) { - if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil { + if ns.namespaceUID != "" { + if selector.matchesNamespaceSelector(ns.namespaceLabels) { + if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil { return err } } @@ -73,10 +73,10 @@ func (npc *controller) onNewNsSelector(selector *selector) error { func (npc *controller) onNewNamespacePodsSelector(selector *selector) error { for _, ns := range npc.nss { - if ns.namespace != nil && len(ns.pods) > 0 { + if ns.namespaceUID != "" && len(ns.pods) > 0 { for _, pod := range ns.pods { if hasIP(pod) { - if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels) { + if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespaceLabels) { if err := selector.addEntry(pod.ObjectMeta.UID, pod.Status.PodIP, podComment(pod)); err != nil { return err } diff --git a/npc/namespace.go b/npc/namespace.go index 3c061111..99bae91c 100644 --- a/npc/namespace.go +++ b/npc/namespace.go @@ -22,11 +22,12 @@ type ns struct { ipt iptables.Interface // interface to iptables ips ipset.Interface // interface to ipset - name string // k8s Namespace name - nodeName string // my node name - namespace *coreapi.Namespace // k8s Namespace object - pods map[types.UID]*coreapi.Pod // k8s Pod objects by UID - policies map[types.UID]interface{} // k8s NetworkPolicy objects by UID + name string // k8s Namespace name + nodeName string // my node name + namespaceUID types.UID // k8s Namespace UID + namespaceLabels map[string]string // k8s Namespace labels + pods map[types.UID]*coreapi.Pod // k8s Pod objects by UID + policies map[types.UID]interface{} // k8s NetworkPolicy objects by UID uid types.UID // surrogate UID to own allPods selector allPods *selectorSpec // hash:ip ipset of all pod IPs in this namespace @@ -54,7 +55,8 @@ func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, n ipt: ipt, ips: ips, name: name, - namespace: namespaceObj, + namespaceUID: namespaceObj.ObjectMeta.UID, + namespaceLabels: namespaceObj.ObjectMeta.Labels, nodeName: nodeName, pods: make(map[types.UID]*coreapi.Pod), policies: make(map[types.UID]interface{}), @@ -88,7 +90,7 @@ func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, n } func (ns *ns) empty() bool { - return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespace == nil + return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespaceUID == "" } func (ns *ns) destroy() error { @@ -188,7 +190,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error { } } - err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj)) + err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP, podComment(obj)) if err != nil { return err } @@ -211,7 +213,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { return err } - if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, oldObj.Status.PodIP); err != nil { + if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, ns.namespaceLabels, oldObj.Status.PodIP); err != nil { return err } @@ -234,7 +236,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { return err } } - err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj)) + err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, ns.namespaceLabels, newObj.Status.PodIP, podComment(newObj)) if err != nil { return err } @@ -279,8 +281,8 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { } } for _, ps := range ns.namespacedPodsSelectors.entries { - oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels) - newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels) + oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespaceLabels) + newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespaceLabels) if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP { continue } @@ -333,7 +335,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error { if err := ns.podSelectors.delFromMatchingPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP); err != nil { return err } - if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP); err != nil { + if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP); err != nil { return err } return nil @@ -495,7 +497,8 @@ func (ns *ns) deleteBypassRules() error { } func (ns *ns) addNamespace(obj *coreapi.Namespace) error { - ns.namespace = obj + ns.namespaceUID = obj.ObjectMeta.UID + ns.namespaceLabels = obj.ObjectMeta.Labels // Insert a rule to bypass policies if err := ns.ensureBypassRules(); err != nil { @@ -508,10 +511,12 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error { } func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error { - ns.namespace = newObj + ns.namespaceUID = newObj.ObjectMeta.UID // Re-evaluate namespace selector membership if labels have changed if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) { + ns.namespaceLabels = newObj.ObjectMeta.Labels + for _, selector := range ns.nsSelectors.entries { oldMatch := selector.matchesNamespaceSelector(oldObj.ObjectMeta.Labels) newMatch := selector.matchesNamespaceSelector(newObj.ObjectMeta.Labels) @@ -519,12 +524,12 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error { continue } if oldMatch { - if err := selector.delEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName)); err != nil { + if err := selector.delEntry(ns.namespaceUID, string(ns.allPods.ipsetName)); err != nil { return err } } if newMatch { - if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil { + if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil { return err } } @@ -535,7 +540,7 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error { } func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error { - ns.namespace = nil + ns.namespaceUID = "" // Remove bypass rule if err := ns.deleteBypassRules(); err != nil {