npc: Get rid of the legacy netpol

net/bridge.go

@@ -216,7 +216,6 @@ type BridgeConfig struct {
 	NoBridgedFastdp  bool
 	AWSVPC           bool
 	NPC              bool
-	LegacyNPC        bool
 	MTU              int
 	Mac              string
 	Port             int
@@ -462,16 +461,14 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
 		// Ignore error because chains might already exist
 		// TODO(brb): use constants for WEAVE-NPC* chains
 		_ = ipt.NewChain("filter", "WEAVE-NPC")
-		if !config.LegacyNPC {
-			_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
-			if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
-				return err
-			}
-			fwdRules = append(fwdRules, []string{
-				"-i", config.WeaveBridgeName,
-				"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
-				"-j", "WEAVE-NPC-EGRESS"})
+		_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
+			return err
 		}
+		fwdRules = append(fwdRules, []string{
+			"-i", config.WeaveBridgeName,
+			"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
+			"-j", "WEAVE-NPC-EGRESS"})
 
 		// If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail
 		fwdRules = append(fwdRules,

npc/analyser.go

@@ -4,97 +4,12 @@ import (
 	"fmt"
 
 	apiv1 "k8s.io/api/core/v1"
-	extnapi "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	"github.com/weaveworks/weave/net/ipset"
 )
 
-// analysePolicyLegacy is used to analyse extensions/v1beta1/NetworkPolicy (legacy) and
-// implements pre-1.7 k8s netpol semantics, whilst analysePolicy - networking.k8s.io/v1/NetworkPolicy
-// and 1.7 semantics.
-
-func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
-	rules map[string]*ruleSpec,
-	nsSelectors, podSelectors map[string]*selectorSpec,
-	err error) {
-
-	nsSelectors = make(map[string]*selectorSpec)
-	podSelectors = make(map[string]*selectorSpec)
-	rules = make(map[string]*ruleSpec)
-
-	policyTypes := []policyType{policyTypeIngress}
-	targetSelector, err := newSelectorSpec(&policy.Spec.PodSelector, policyTypes, ns.name, ipset.HashIP)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	podSelectors[targetSelector.key] = targetSelector
-
-	for _, ingressRule := range policy.Spec.Ingress {
-		if ingressRule.Ports != nil && len(ingressRule.Ports) == 0 {
-			// Ports is empty, this rule matches no ports (no traffic matches).
-			continue
-		}
-
-		if ingressRule.From != nil && len(ingressRule.From) == 0 {
-			// From is empty, this rule matches no sources (no traffic matches).
-			continue
-		}
-
-		if ingressRule.From == nil {
-			// From is not provided, this rule matches all sources (traffic not restricted by source).
-			if ingressRule.Ports == nil {
-				// Ports is not provided, this rule matches all ports (traffic not restricted by port).
-				rule := newRuleSpec(policyTypeIngress, nil, nil, targetSelector, nil)
-				rules[rule.key] = rule
-			} else {
-				// Ports is present and contains at least one item, then this rule allows traffic
-				// only if the traffic matches at least one port in the ports list.
-				withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
-					rule := newRuleSpec(policyTypeIngress, &proto, nil, targetSelector, &port)
-					rules[rule.key] = rule
-				})
-			}
-		} else {
-			// From is present and contains at least on item, this rule allows traffic only if the
-			// traffic matches at least one item in the from list.
-			for _, peer := range ingressRule.From {
-				var srcSelector *selectorSpec
-				if peer.PodSelector != nil {
-					srcSelector, err = newSelectorSpec(peer.PodSelector, nil, ns.name, ipset.HashIP)
-					if err != nil {
-						return nil, nil, nil, err
-					}
-					podSelectors[srcSelector.key] = srcSelector
-				}
-				if peer.NamespaceSelector != nil {
-					srcSelector, err = newSelectorSpec(peer.NamespaceSelector, nil, "", ipset.ListSet)
-					if err != nil {
-						return nil, nil, nil, err
-					}
-					nsSelectors[srcSelector.key] = srcSelector
-				}
-
-				if ingressRule.Ports == nil {
-					// Ports is not provided, this rule matches all ports (traffic not restricted by port).
-					rule := newRuleSpec(policyTypeIngress, nil, srcSelector, targetSelector, nil)
-					rules[rule.key] = rule
-				} else {
-					// Ports is present and contains at least one item, then this rule allows traffic
-					// only if the traffic matches at least one port in the ports list.
-					withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
-						rule := newRuleSpec(policyTypeIngress, &proto, srcSelector, targetSelector, &port)
-						rules[rule.key] = rule
-					})
-				}
-			}
-		}
-	}
-
-	return rules, nsSelectors, podSelectors, nil
-}
-
 func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 	rules map[string]*ruleSpec,
 	nsSelectors, podSelectors map[string]*selectorSpec,
@@ -249,12 +164,6 @@ func addIfNotExist(s *selectorSpec, ss map[string]*selectorSpec) {
 	}
 }
 
-func withNormalisedProtoAndPortLegacy(npps []extnapi.NetworkPolicyPort, f func(proto, port string)) {
-	for _, npp := range npps {
-		f(proto(npp.Protocol), port(npp.Port))
-	}
-}
-
 func withNormalisedProtoAndPort(npps []networkingv1.NetworkPolicyPort, f func(proto, port string)) {
 	for _, npp := range npps {
 		f(proto(npp.Protocol), port(npp.Port))

npc/controller.go

@@ -37,14 +37,11 @@ type controller struct {
 
 	nss         map[string]*ns // ns name -> ns struct
 	nsSelectors *selectorSet   // selector string -> nsSelector
-
-	legacy bool // use legacy network policy semantics (k8s pre-1.7)
 }
 
-func New(nodeName string, legacy bool, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController {
+func New(nodeName string, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController {
 	c := &controller{
 		nodeName: nodeName,
-		legacy:   legacy,
 		ipt:      ipt,
 		ips:      ips,
 		nss:      make(map[string]*ns)}
@@ -71,7 +68,7 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
 func (npc *controller) withNS(name string, f func(ns *ns) error) error {
 	ns, found := npc.nss[name]
 	if !found {
-		newNs, err := newNS(name, npc.nodeName, npc.legacy, npc.ipt, npc.ips, npc.nsSelectors)
+		newNs, err := newNS(name, npc.nodeName, npc.ipt, npc.ips, npc.nsSelectors)
 		if err != nil {
 			return err
 		}

npc/controller_test.go

@@ -198,7 +198,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
 
 	// Namespaces first
 	m := newMockIPSet()
-	controller := New("foo", false, newMockIPTables(), &m)
+	controller := New("foo", newMockIPTables(), &m)
 
 	const (
 		selectorIPSetName = "weave-I239Zp%sCvoVt*D6u=A!2]YEk"
@@ -214,7 +214,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
 
 	// NetworkPolicy first
 	m = newMockIPSet()
-	controller = New("foo", false, newMockIPTables(), &m)
+	controller = New("foo", newMockIPTables(), &m)
 
 	controller.AddNetworkPolicy(networkPolicy)
 
@@ -224,7 +224,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
 	require.Equal(t, true, len(m.sets[selectorIPSetName].subSets[sourceIPSetName]) > 0)
 }
 
-// Tests default-allow ipset behavior when running in non-legacy mode.
+// Tests default-allow ipset behavior
 func TestDefaultAllow(t *testing.T) {
 	const (
 		ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N"
@@ -235,7 +235,7 @@ func TestDefaultAllow(t *testing.T) {
 	)
 
 	m := newMockIPSet()
-	controller := New("bar", false, newMockIPTables(), &m)
+	controller := New("bar", newMockIPTables(), &m)
 
 	defaultNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
@@ -363,7 +363,7 @@ func TestOutOfOrderPodEvents(t *testing.T) {
 	)
 
 	m := newMockIPSet()
-	controller := New("qux", false, newMockIPTables(), &m)
+	controller := New("qux", newMockIPTables(), &m)
 
 	defaultNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
@@ -445,7 +445,7 @@ func TestNewTargetSelector(t *testing.T) {
 	)
 
 	m := newMockIPSet()
-	controller := New("baz", false, newMockIPTables(), &m)
+	controller := New("baz", newMockIPTables(), &m)
 
 	defaultNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
@@ -520,7 +520,7 @@ func TestEgressPolicyWithIPBlock(t *testing.T) {
 
 	m := newMockIPSet()
 	ipt := newMockIPTables()
-	controller := New("foo", false, ipt, &m)
+	controller := New("foo", ipt, &m)
 
 	netpol := &networkingv1.NetworkPolicy{
 		ObjectMeta: metav1.ObjectMeta{

npc/namespace.go

@@ -1,7 +1,6 @@
 package npc
 
 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 
@@ -33,8 +32,8 @@ type ns struct {
 	allPods *selectorSpec // hash:ip ipset of all pod IPs in this namespace
 
 	// stores IP addrs of pods which are not selected by any target podSelector of
-	// any netpol; used only in non-legacy mode and is used as a target in
-	// the WEAVE-NPC-{INGRESS,EGRESS}-DEFAULT iptables chain.
+	// any netpol; used as a target in the WEAVE-NPC-{INGRESS,EGRESS}-DEFAULT
+	// iptables chains.
 	ingressDefaultAllowIPSet ipset.Name
 	egressDefaultAllowIPSet  ipset.Name
 
@@ -42,11 +41,9 @@ type ns struct {
 	podSelectors *selectorSet
 	ipBlocks     *ipBlockSet
 	rules        *ruleSet
-
-	legacy bool
 }
 
-func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
+func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
 	allPods, err := newSelectorSpec(&metav1.LabelSelector{}, nil, name, ipset.HashIP)
 	if err != nil {
 		return nil, err
@@ -64,24 +61,21 @@ func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset
 		nsSelectors: nsSelectors,
 		ipBlocks:    newIPBlockSet(ips),
 		rules:       newRuleSet(ipt),
-		legacy:      legacy}
+	}
 
 	ns.podSelectors = newSelectorSet(ips, ns.onNewPodSelector, ns.onNewTargetPodSelector, ns.onDestroyTargetPodSelector)
 
-	if !legacy {
-		ingressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("ingress-default-allow:"+name))
-		if err := ips.Create(ingressDefaultAllowIPSet, ipset.HashIP); err != nil {
-			return nil, err
-		}
-		ns.ingressDefaultAllowIPSet = ingressDefaultAllowIPSet
-
-		egressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("egress-default-allow:"+name))
-		if err := ips.Create(egressDefaultAllowIPSet, ipset.HashIP); err != nil {
-			return nil, err
-		}
-		ns.egressDefaultAllowIPSet = egressDefaultAllowIPSet
-
+	ingressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("ingress-default-allow:"+name))
+	if err := ips.Create(ingressDefaultAllowIPSet, ipset.HashIP); err != nil {
+		return nil, err
 	}
+	ns.ingressDefaultAllowIPSet = ingressDefaultAllowIPSet
+
+	egressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("egress-default-allow:"+name))
+	if err := ips.Create(egressDefaultAllowIPSet, ipset.HashIP); err != nil {
+		return nil, err
+	}
+	ns.egressDefaultAllowIPSet = egressDefaultAllowIPSet
 
 	if err := ns.podSelectors.provision(ns.uid, nil, map[string]*selectorSpec{ns.allPods.key: ns.allPods}); err != nil {
 		return nil, err
@@ -113,10 +107,6 @@ func (ns *ns) onNewPodSelector(selector *selector) error {
 }
 
 func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType) error {
-	if ns.legacy {
-		return nil
-	}
-
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
 			// Remove the pod from default-allow if dst podselector matches the pod
@@ -133,10 +123,6 @@ func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType)
 }
 
 func (ns *ns) onDestroyTargetPodSelector(selector *selector, policyType policyType) error {
-	if ns.legacy {
-		return nil
-	}
-
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
 			if selector.matches(pod.ObjectMeta.Labels) {
@@ -192,16 +178,14 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
 		return err
 	}
 	// If there are no matching target selectors, add the pod to default-allow
-	if !ns.legacy {
-		if !foundIngress {
-			if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
-				return err
-			}
+	if !foundIngress {
+		if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
+			return err
 		}
-		if !foundEgress {
-			if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
-				return err
-			}
+	}
+	if !foundEgress {
+		if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
+			return err
 		}
 	}
 
@@ -221,13 +205,11 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 			ns.ips.DelEntry(oldObj.ObjectMeta.UID, LocalIpset, oldObj.Status.PodIP)
 		}
 
-		if !ns.legacy {
-			if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
-				return err
-			}
-			if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
-				return err
-			}
+		if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
+			return err
+		}
+		if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
+			return err
 		}
 
 		return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
@@ -242,23 +224,21 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 			return err
 		}
 
-		if !ns.legacy {
-			if !foundIngress {
-				if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
-					return err
-				}
+		if !foundIngress {
+			if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
+				return err
 			}
-			if !foundEgress {
-				if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
-					return err
-				}
+		}
+		if !foundEgress {
+			if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
+				return err
 			}
 		}
 
 		return nil
 	}
 
-	if !ns.legacy && oldObj.Status.PodIP != newObj.Status.PodIP {
+	if oldObj.Status.PodIP != newObj.Status.PodIP {
 		if err := ns.updateDefaultAllowIPSetEntry(oldObj, newObj, ns.ingressDefaultAllowIPSet); err != nil {
 			return err
 		}
@@ -287,13 +267,11 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 				}
 			}
 
-			if !ns.legacy {
-				if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeIngress); err != nil {
-					return err
-				}
-				if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeEgress); err != nil {
-					return err
-				}
+			if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeIngress); err != nil {
+				return err
+			}
+			if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeEgress); err != nil {
+				return err
 			}
 		}
 	}
@@ -329,13 +307,11 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
 		ns.ips.DelEntry(obj.ObjectMeta.UID, LocalIpset, obj.Status.PodIP)
 	}
 
-	if !ns.legacy {
-		if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
-			return err
-		}
-		if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
-			return err
-		}
+	if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
+		return err
+	}
+	if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
+		return err
 	}
 
 	return ns.podSelectors.delFromMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP)
@@ -458,20 +434,7 @@ func bypassRules(namespace string, ingress, egress ipset.Name) map[string][][]st
 	}
 }
 
-func bypassRuleLegacy(nsIpsetName ipset.Name, namespace string) []string {
-	return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace}
-}
-
 func (ns *ns) ensureBypassRules() error {
-	if ns.legacy {
-		ipset := ns.allPods.ipsetName
-		common.Log.Debugf("ensuring rule for DefaultAllow in namespace: %s, set %s", ns.name, ipset)
-		if err := ns.ipt.Append(TableFilter, DefaultChain, bypassRuleLegacy(ipset, ns.name)...); err != nil {
-			return err
-		}
-		return nil
-	}
-
 	for chain, rules := range bypassRules(ns.name, ns.ingressDefaultAllowIPSet, ns.egressDefaultAllowIPSet) {
 		for _, rule := range rules {
 			common.Log.Debugf("adding rule for DefaultAllow in namespace: %s, chain: %s, %s", ns.name, chain, rule)
@@ -485,15 +448,6 @@ func (ns *ns) ensureBypassRules() error {
 }
 
 func (ns *ns) deleteBypassRules() error {
-	if ns.legacy {
-		ipset := ns.allPods.ipsetName
-		common.Log.Debugf("removing default rule in namespace: %s, set %s", ns.name, ipset)
-		if err := ns.ipt.Delete(TableFilter, DefaultChain, bypassRuleLegacy(ipset, ns.name)...); err != nil {
-			return err
-		}
-		return nil
-	}
-
 	for chain, rules := range bypassRules(ns.name, ns.ingressDefaultAllowIPSet, ns.egressDefaultAllowIPSet) {
 		for _, rule := range rules {
 			common.Log.Debugf("removing rule for DefaultAllow in namespace: %s, chain: %s, %s", ns.name, chain, rule)
@@ -509,11 +463,9 @@ func (ns *ns) deleteBypassRules() error {
 func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
 	ns.namespace = obj
 
-	// Insert a rule to bypass policies if namespace is DefaultAllow
-	if !ns.isDefaultDeny(obj) {
-		if err := ns.ensureBypassRules(); err != nil {
-			return err
-		}
+	// Insert a rule to bypass policies
+	if err := ns.ensureBypassRules(); err != nil {
+		return err
 	}
 
 	// Add namespace ipset to matching namespace selectors
@@ -524,24 +476,6 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
 func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
 	ns.namespace = newObj
 
-	// Update bypass rule if ingress default has changed
-	oldDefaultDeny := ns.isDefaultDeny(oldObj)
-	newDefaultDeny := ns.isDefaultDeny(newObj)
-
-	if oldDefaultDeny != newDefaultDeny {
-		common.Log.Infof("namespace DefaultDeny changed from %t to %t", oldDefaultDeny, newDefaultDeny)
-		if oldDefaultDeny {
-			if err := ns.ensureBypassRules(); err != nil {
-				return err
-			}
-		}
-		if newDefaultDeny {
-			if err := ns.deleteBypassRules(); err != nil {
-				return err
-			}
-		}
-	}
-
 	// Re-evaluate namespace selector membership if labels have changed
 	if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) {
 		for _, selector := range ns.nsSelectors.entries {
@@ -570,10 +504,8 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
 	ns.namespace = nil
 
 	// Remove bypass rule
-	if !ns.isDefaultDeny(obj) {
-		if err := ns.deleteBypassRules(); err != nil {
-			return err
-		}
+	if err := ns.deleteBypassRules(); err != nil {
+		return err
 	}
 
 	// Remove namespace ipset from any matching namespace selectors
@@ -582,41 +514,16 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
 		return err
 	}
 
-	if !ns.legacy {
-		if err := ns.ips.Destroy(ns.ingressDefaultAllowIPSet); err != nil {
-			return err
-		}
-		if err := ns.ips.Destroy(ns.egressDefaultAllowIPSet); err != nil {
-			return err
-		}
+	if err := ns.ips.Destroy(ns.ingressDefaultAllowIPSet); err != nil {
+		return err
+	}
+	if err := ns.ips.Destroy(ns.egressDefaultAllowIPSet); err != nil {
+		return err
 	}
 
 	return nil
 }
 
-func (ns *ns) isDefaultDeny(namespace *coreapi.Namespace) bool {
-	nnpJSON, found := namespace.ObjectMeta.Annotations["net.beta.kubernetes.io/network-policy"]
-	if !found {
-		return false
-	}
-
-	if !ns.legacy {
-		common.Log.Warn("DefaultDeny annotation is supported only in legacy mode (--use-legacy-netpol)")
-		return false
-	}
-
-	var nnp NamespaceNetworkPolicy
-	if err := json.Unmarshal([]byte(nnpJSON), &nnp); err != nil {
-		common.Log.Warn("Ignoring network policy annotation: unmarshal failed:", err)
-		// If we can't understand the annotation, behave as if it isn't present
-		return false
-	}
-
-	return nnp.Ingress != nil &&
-		nnp.Ingress.Isolation != nil &&
-		*(nnp.Ingress.Isolation) == DefaultDeny
-}
-
 func hasIP(pod *coreapi.Pod) bool {
 	// Ensure pod isn't dead, has an IP address and isn't sharing the host network namespace
 	return pod.Status.Phase != "Succeeded" && pod.Status.Phase != "Failed" &&
@@ -670,16 +577,9 @@ func (ns *ns) analyse(obj interface{}) (
 	ns.policies[uid] = obj
 
 	// Analyse policy, determine which rules and ipsets are required
-	if ns.legacy {
-		rules, nsSelectors, podSelectors, err = ns.analysePolicyLegacy(obj.(*extnapi.NetworkPolicy))
-		if err != nil {
-			return
-		}
-	} else {
-		rules, nsSelectors, podSelectors, ipBlocks, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy))
-		if err != nil {
-			return
-		}
+	rules, nsSelectors, podSelectors, ipBlocks, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy))
+	if err != nil {
+		return
 	}
 
 	return

prog/weave-kube/weave-daemonset-k8s-1.7.yaml

@@ -25,14 +25,6 @@ items:
           - get
           - list
           - watch
-      - apiGroups:
-          - extensions
-        resources:
-          - networkpolicies
-        verbs:
-          - get
-          - list
-          - watch
       - apiGroups:
           - 'networking.k8s.io'
         resources:
@@ -163,7 +155,6 @@ items:
                       fieldPath: spec.nodeName
               image: 'weaveworks/weave-npc:latest'
               imagePullPolicy: Always
-#npc-args
               resources:
                 requests:
                   cpu: 10m

prog/weave-npc/main.go

@@ -10,7 +10,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	coreapi "k8s.io/api/core/v1"
-	extnapi "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -32,7 +31,6 @@ var (
 	logLevel    string
 	allowMcast  bool
 	nodeName    string
-	legacy      bool
 	maxList     int
 )
 
@@ -114,7 +112,7 @@ func resetIPSets(ips ipset.Interface) error {
 	return nil
 }
 
-func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface, legacy bool) error {
+func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	// Configure main chain static rules
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
 		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil {
@@ -153,28 +151,26 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface, legacy bool) e
 		return err
 	}
 
-	if !legacy {
-		if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
-			"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
-			return err
-		}
+	if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
+		"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
+		return err
+	}
 
-		ruleSpecs := [][]string{
-			{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"},
-			{"-m", "state", "--state", "NEW", "-m", "set", "!", "--match-set", npc.LocalIpset, "src", "-j", "RETURN"},
-		}
-		if allowMcast {
-			ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})
-		}
-		ruleSpecs = append(ruleSpecs, [][]string{
-			{"-m", "state", "--state", "NEW", "-j", string(npc.EgressDefaultChain)},
-			{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", string(npc.EgressCustomChain)},
-			{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"},
-			{"-m", "mark", "!", "--mark", npc.EgressMark, "-j", "DROP"},
-		}...)
-		if err := addChainWithRules(ipt, npc.TableFilter, npc.EgressChain, ruleSpecs); err != nil {
-			return err
-		}
+	ruleSpecs := [][]string{
+		{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"},
+		{"-m", "state", "--state", "NEW", "-m", "set", "!", "--match-set", npc.LocalIpset, "src", "-j", "RETURN"},
+	}
+	if allowMcast {
+		ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})
+	}
+	ruleSpecs = append(ruleSpecs, [][]string{
+		{"-m", "state", "--state", "NEW", "-j", string(npc.EgressDefaultChain)},
+		{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", string(npc.EgressCustomChain)},
+		{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"},
+		{"-m", "mark", "!", "--mark", npc.EgressMark, "-j", "DROP"},
+	}...)
+	if err := addChainWithRules(ipt, npc.TableFilter, npc.EgressChain, ruleSpecs); err != nil {
+		return err
 	}
 
 	return nil
@@ -243,10 +239,6 @@ func root(cmd *cobra.Command, args []string) {
 	}
 	common.Log.Infof("Starting Weaveworks NPC %s; node name %q", version, nodeName)
 
-	if legacy {
-		common.Log.Info("Running in legacy mode (k8s pre-1.7 network policy semantics)")
-	}
-
 	if err := metrics.Start(metricsAddr); err != nil {
 		common.Log.Fatalf("Failed to start metrics: %v", err)
 	}
@@ -268,9 +260,9 @@ func root(cmd *cobra.Command, args []string) {
 
 	handleError(resetIPTables(ipt))
 	handleError(resetIPSets(ips))
-	handleError(createBaseRules(ipt, ips, legacy))
+	handleError(createBaseRules(ipt, ips))
 
-	npc := npc.New(nodeName, legacy, ipt, ips)
+	npc := npc.New(nodeName, ipt, ips)
 
 	nsController := makeController(client.Core().RESTClient(), "namespaces", &coreapi.Namespace{},
 		cache.ResourceEventHandlerFuncs{
@@ -331,11 +323,7 @@ func root(cmd *cobra.Command, args []string) {
 			handleError(npc.UpdateNetworkPolicy(old, new))
 		},
 	}
-	if legacy {
-		npController = makeController(client.Extensions().RESTClient(), "networkpolicies", &extnapi.NetworkPolicy{}, npHandlers)
-	} else {
-		npController = makeController(client.NetworkingV1().RESTClient(), "networkpolicies", &networkingv1.NetworkPolicy{}, npHandlers)
-	}
+	npController = makeController(client.NetworkingV1().RESTClient(), "networkpolicies", &networkingv1.NetworkPolicy{}, npHandlers)
 
 	go nsController.Run(wait.NeverStop)
 	go podController.Run(wait.NeverStop)
@@ -356,7 +344,6 @@ func main() {
 	rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)")
 	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
 	rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node")
-	rootCmd.PersistentFlags().BoolVar(&legacy, "use-legacy-netpol", false, "use legacy network policies (pre k8s 1.7 vsn)")
 	rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)")
 
 	handleError(rootCmd.Execute())

prog/weaver/main.go

@@ -182,7 +182,6 @@ func main() {
 	mflag.StringVar(&bridgeConfig.WeaveBridgeName, []string{"-weave-bridge"}, "weave", "name of weave bridge")
 	mflag.StringVar(&bridgeConfig.DockerBridgeName, []string{"-docker-bridge"}, "", "name of Docker bridge")
 	mflag.BoolVar(&bridgeConfig.NPC, []string{"-expect-npc"}, false, "set up iptables rules for npc")
-	mflag.BoolVar(&bridgeConfig.LegacyNPC, []string{"-use-legacy-netpol"}, false, "use legacy network policies (pre k8s 1.7 vsn)")
 	mflag.StringVar(&routerName, []string{"-name"}, "", "name of router (defaults to MAC of interface)")
 	mflag.StringVar(&nickName, []string{"-nickname"}, "", "nickname of peer (defaults to hostname)")
 	mflag.StringVar(&password, []string{"-password"}, "", "network password")

site/kubernetes/kube-addon.md

@@ -370,7 +370,6 @@ You can customise the YAML you get from `cloud.weave.works` by passing some of W
   - `disable-npc`: boolean (`true|false`). Default: `false`.
   - `env.NAME=VALUE`: add environment variable `NAME` and set it to `VALUE`.
   - `seLinuxOptions.NAME=VALUE`: add SELinux option `NAME` and set it to `VALUE`, e.g. `seLinuxOptions.type=spc_t`
-  - `use-legacy-netpol`: use [legacy NetworkPolicy semantics](https://v1-6.docs.kubernetes.io/docs/api-reference/v1.6/#networkpolicy-v1beta1-extensions), boolean (`true|false`). Default: `true` for Kubernetes version <= 1.6, `false` for > 1.6.
 
 The list of variables you can set is:
 

test/840_weave_kube_3_test.sh

@@ -44,15 +44,14 @@ for host in $HOSTS; do
 done
 
 if [ -n "$COVERAGE" ]; then
-    WEAVE_ENV_VARS="env:\\n                - name: EXTRA_ARGS\\n                  value: \"-test.coverprofile=/home/weave/cover.prof -- --use-legacy-netpol\""
+    WEAVE_ENV_VARS="env:\\n                - name: EXTRA_ARGS\\n                  value: \"-test.coverprofile=/home/weave/cover.prof --\""
 else
-    WEAVE_ENV_VARS="env:\\n                - name: EXTRA_ARGS\\n                  value: \"--use-legacy-netpol\""
+    WEAVE_ENV_VARS="env:"
 fi
 
 # Ensure Kubernetes uses locally built container images and inject code coverage environment variable (or do nothing depending on $COVERAGE):
 sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \
     -e "s%env:%$WEAVE_ENV_VARS%" \
-    -e "s%#npc-args%              args:\n                - '--use-legacy-netpol'%" \
     "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.8.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -"
 
 sleep 5
@@ -76,10 +75,19 @@ assert "run_on $HOST1 ps aux | grep -c '[d]efunct'" "0"
 assert "run_on $HOST2 ps aux | grep -c '[d]efunct'" "0"
 assert "run_on $HOST3 ps aux | grep -c '[d]efunct'" "0"
 
-# Set up a simple network policy so all our test pods can talk to each other
-run_on $HOST1 "$KUBECTL annotate ns default net.beta.kubernetes.io/network-policy='{\"ingress\":{\"isolation\":\"DefaultDeny\"}}'"
+# Set up simple network policies so all our test pods can talk to each other
 run_on $HOST1 "$KUBECTL apply -f -" <<EOF
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+EOF
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: test840
@@ -102,7 +110,7 @@ EOF
 
 # Another policy, this time with no 'from' section, just to check that doesn't cause a crash
 run_on $HOST1 "$KUBECTL apply -f -" <<EOF
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: test840f
@@ -179,23 +187,6 @@ run_on $HOST1 "$KUBECTL run nettest-deny --labels=\"access=deny,run=nettest-deny
 denyPodName=$($SSH $HOST1 "$KUBECTL get pods -l run=nettest-deny -o go-template='{{(index .items 0).metadata.name}}'")
 assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
 
-if [ -n "$COVERAGE" ]; then
-    WEAVE_ENV_VARS="env:\\n                - name: EXTRA_ARGS\\n                  value: \"-test.coverprofile=/home/weave/cover.prof --\""
-else
-    WEAVE_ENV_VARS="env:"
-fi
-
-# Restart weave-net with npc in non-legacy mode
-$SSH $HOST1 "$KUBECTL delete ds weave-net -n=kube-system"
-sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \
-    -e "s%env:%$WEAVE_ENV_VARS%" \
-    "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.8.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -"
-
-assert_raises 'wait_for_x check_all_pods_communicate pods'
-
-# nettest-deny should still not be able to reach nettest pods
-assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
-
 # check access via virtual IP
 VIRTUAL_IP=$($SSH $HOST1 $KUBECTL get service netvirt -o template --template={{.spec.clusterIP}})
 assert_raises   "$SSH $HOST1 $KUBECTL exec     $podName -- curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null"