From 07d31a85581cd3122f2c53a3c04f24d0980bc9dd Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Thu, 7 Jun 2018 14:50:39 +0200 Subject: [PATCH] npc: Get rid of the legacy netpol --- net/bridge.go | 17 +- npc/analyser.go | 91 -------- npc/controller.go | 7 +- npc/controller_test.go | 14 +- npc/namespace.go | 214 +++++-------------- prog/weave-kube/weave-daemonset-k8s-1.7.yaml | 9 - prog/weave-npc/main.go | 59 ++--- prog/weaver/main.go | 1 - site/kubernetes/kube-addon.md | 1 - test/840_weave_kube_3_test.sh | 39 ++-- 10 files changed, 111 insertions(+), 341 deletions(-) diff --git a/net/bridge.go b/net/bridge.go index d511b757..07aedc15 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -216,7 +216,6 @@ type BridgeConfig struct { NoBridgedFastdp bool AWSVPC bool NPC bool - LegacyNPC bool MTU int Mac string Port int @@ -462,16 +461,14 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error { // Ignore error because chains might already exist // TODO(brb): use constants for WEAVE-NPC* chains _ = ipt.NewChain("filter", "WEAVE-NPC") - if !config.LegacyNPC { - _ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS") - if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil { - return err - } - fwdRules = append(fwdRules, []string{ - "-i", config.WeaveBridgeName, - "-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'", - "-j", "WEAVE-NPC-EGRESS"}) + _ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS") + if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil { + return err } + fwdRules = append(fwdRules, []string{ + "-i", config.WeaveBridgeName, + "-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'", + "-j", "WEAVE-NPC-EGRESS"}) // If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail fwdRules = append(fwdRules, diff --git a/npc/analyser.go b/npc/analyser.go index 6d44bac3..2675ce1c 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -4,97 +4,12 @@ import ( "fmt" apiv1 "k8s.io/api/core/v1" - extnapi "k8s.io/api/extensions/v1beta1" networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/util/intstr" "github.com/weaveworks/weave/net/ipset" ) -// analysePolicyLegacy is used to analyse extensions/v1beta1/NetworkPolicy (legacy) and -// implements pre-1.7 k8s netpol semantics, whilst analysePolicy - networking.k8s.io/v1/NetworkPolicy -// and 1.7 semantics. - -func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) ( - rules map[string]*ruleSpec, - nsSelectors, podSelectors map[string]*selectorSpec, - err error) { - - nsSelectors = make(map[string]*selectorSpec) - podSelectors = make(map[string]*selectorSpec) - rules = make(map[string]*ruleSpec) - - policyTypes := []policyType{policyTypeIngress} - targetSelector, err := newSelectorSpec(&policy.Spec.PodSelector, policyTypes, ns.name, ipset.HashIP) - if err != nil { - return nil, nil, nil, err - } - podSelectors[targetSelector.key] = targetSelector - - for _, ingressRule := range policy.Spec.Ingress { - if ingressRule.Ports != nil && len(ingressRule.Ports) == 0 { - // Ports is empty, this rule matches no ports (no traffic matches). - continue - } - - if ingressRule.From != nil && len(ingressRule.From) == 0 { - // From is empty, this rule matches no sources (no traffic matches). - continue - } - - if ingressRule.From == nil { - // From is not provided, this rule matches all sources (traffic not restricted by source). - if ingressRule.Ports == nil { - // Ports is not provided, this rule matches all ports (traffic not restricted by port). - rule := newRuleSpec(policyTypeIngress, nil, nil, targetSelector, nil) - rules[rule.key] = rule - } else { - // Ports is present and contains at least one item, then this rule allows traffic - // only if the traffic matches at least one port in the ports list. - withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) { - rule := newRuleSpec(policyTypeIngress, &proto, nil, targetSelector, &port) - rules[rule.key] = rule - }) - } - } else { - // From is present and contains at least on item, this rule allows traffic only if the - // traffic matches at least one item in the from list. - for _, peer := range ingressRule.From { - var srcSelector *selectorSpec - if peer.PodSelector != nil { - srcSelector, err = newSelectorSpec(peer.PodSelector, nil, ns.name, ipset.HashIP) - if err != nil { - return nil, nil, nil, err - } - podSelectors[srcSelector.key] = srcSelector - } - if peer.NamespaceSelector != nil { - srcSelector, err = newSelectorSpec(peer.NamespaceSelector, nil, "", ipset.ListSet) - if err != nil { - return nil, nil, nil, err - } - nsSelectors[srcSelector.key] = srcSelector - } - - if ingressRule.Ports == nil { - // Ports is not provided, this rule matches all ports (traffic not restricted by port). - rule := newRuleSpec(policyTypeIngress, nil, srcSelector, targetSelector, nil) - rules[rule.key] = rule - } else { - // Ports is present and contains at least one item, then this rule allows traffic - // only if the traffic matches at least one port in the ports list. - withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) { - rule := newRuleSpec(policyTypeIngress, &proto, srcSelector, targetSelector, &port) - rules[rule.key] = rule - }) - } - } - } - } - - return rules, nsSelectors, podSelectors, nil -} - func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( rules map[string]*ruleSpec, nsSelectors, podSelectors map[string]*selectorSpec, @@ -249,12 +164,6 @@ func addIfNotExist(s *selectorSpec, ss map[string]*selectorSpec) { } } -func withNormalisedProtoAndPortLegacy(npps []extnapi.NetworkPolicyPort, f func(proto, port string)) { - for _, npp := range npps { - f(proto(npp.Protocol), port(npp.Port)) - } -} - func withNormalisedProtoAndPort(npps []networkingv1.NetworkPolicyPort, f func(proto, port string)) { for _, npp := range npps { f(proto(npp.Protocol), port(npp.Port)) diff --git a/npc/controller.go b/npc/controller.go index 4b3415a4..e8425993 100644 --- a/npc/controller.go +++ b/npc/controller.go @@ -37,14 +37,11 @@ type controller struct { nss map[string]*ns // ns name -> ns struct nsSelectors *selectorSet // selector string -> nsSelector - - legacy bool // use legacy network policy semantics (k8s pre-1.7) } -func New(nodeName string, legacy bool, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController { +func New(nodeName string, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController { c := &controller{ nodeName: nodeName, - legacy: legacy, ipt: ipt, ips: ips, nss: make(map[string]*ns)} @@ -71,7 +68,7 @@ func (npc *controller) onNewNsSelector(selector *selector) error { func (npc *controller) withNS(name string, f func(ns *ns) error) error { ns, found := npc.nss[name] if !found { - newNs, err := newNS(name, npc.nodeName, npc.legacy, npc.ipt, npc.ips, npc.nsSelectors) + newNs, err := newNS(name, npc.nodeName, npc.ipt, npc.ips, npc.nsSelectors) if err != nil { return err } diff --git a/npc/controller_test.go b/npc/controller_test.go index 0a59479d..fac426dd 100644 --- a/npc/controller_test.go +++ b/npc/controller_test.go @@ -198,7 +198,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) { // Namespaces first m := newMockIPSet() - controller := New("foo", false, newMockIPTables(), &m) + controller := New("foo", newMockIPTables(), &m) const ( selectorIPSetName = "weave-I239Zp%sCvoVt*D6u=A!2]YEk" @@ -214,7 +214,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) { // NetworkPolicy first m = newMockIPSet() - controller = New("foo", false, newMockIPTables(), &m) + controller = New("foo", newMockIPTables(), &m) controller.AddNetworkPolicy(networkPolicy) @@ -224,7 +224,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) { require.Equal(t, true, len(m.sets[selectorIPSetName].subSets[sourceIPSetName]) > 0) } -// Tests default-allow ipset behavior when running in non-legacy mode. +// Tests default-allow ipset behavior func TestDefaultAllow(t *testing.T) { const ( ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N" @@ -235,7 +235,7 @@ func TestDefaultAllow(t *testing.T) { ) m := newMockIPSet() - controller := New("bar", false, newMockIPTables(), &m) + controller := New("bar", newMockIPTables(), &m) defaultNamespace := &coreapi.Namespace{ ObjectMeta: metav1.ObjectMeta{ @@ -363,7 +363,7 @@ func TestOutOfOrderPodEvents(t *testing.T) { ) m := newMockIPSet() - controller := New("qux", false, newMockIPTables(), &m) + controller := New("qux", newMockIPTables(), &m) defaultNamespace := &coreapi.Namespace{ ObjectMeta: metav1.ObjectMeta{ @@ -445,7 +445,7 @@ func TestNewTargetSelector(t *testing.T) { ) m := newMockIPSet() - controller := New("baz", false, newMockIPTables(), &m) + controller := New("baz", newMockIPTables(), &m) defaultNamespace := &coreapi.Namespace{ ObjectMeta: metav1.ObjectMeta{ @@ -520,7 +520,7 @@ func TestEgressPolicyWithIPBlock(t *testing.T) { m := newMockIPSet() ipt := newMockIPTables() - controller := New("foo", false, ipt, &m) + controller := New("foo", ipt, &m) netpol := &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ diff --git a/npc/namespace.go b/npc/namespace.go index 01b9a892..9d43f1f8 100644 --- a/npc/namespace.go +++ b/npc/namespace.go @@ -1,7 +1,6 @@ package npc import ( - "encoding/json" "errors" "fmt" @@ -33,8 +32,8 @@ type ns struct { allPods *selectorSpec // hash:ip ipset of all pod IPs in this namespace // stores IP addrs of pods which are not selected by any target podSelector of - // any netpol; used only in non-legacy mode and is used as a target in - // the WEAVE-NPC-{INGRESS,EGRESS}-DEFAULT iptables chain. + // any netpol; used as a target in the WEAVE-NPC-{INGRESS,EGRESS}-DEFAULT + // iptables chains. ingressDefaultAllowIPSet ipset.Name egressDefaultAllowIPSet ipset.Name @@ -42,11 +41,9 @@ type ns struct { podSelectors *selectorSet ipBlocks *ipBlockSet rules *ruleSet - - legacy bool } -func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) { +func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) { allPods, err := newSelectorSpec(&metav1.LabelSelector{}, nil, name, ipset.HashIP) if err != nil { return nil, err @@ -64,24 +61,21 @@ func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset nsSelectors: nsSelectors, ipBlocks: newIPBlockSet(ips), rules: newRuleSet(ipt), - legacy: legacy} + } ns.podSelectors = newSelectorSet(ips, ns.onNewPodSelector, ns.onNewTargetPodSelector, ns.onDestroyTargetPodSelector) - if !legacy { - ingressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("ingress-default-allow:"+name)) - if err := ips.Create(ingressDefaultAllowIPSet, ipset.HashIP); err != nil { - return nil, err - } - ns.ingressDefaultAllowIPSet = ingressDefaultAllowIPSet - - egressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("egress-default-allow:"+name)) - if err := ips.Create(egressDefaultAllowIPSet, ipset.HashIP); err != nil { - return nil, err - } - ns.egressDefaultAllowIPSet = egressDefaultAllowIPSet - + ingressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("ingress-default-allow:"+name)) + if err := ips.Create(ingressDefaultAllowIPSet, ipset.HashIP); err != nil { + return nil, err } + ns.ingressDefaultAllowIPSet = ingressDefaultAllowIPSet + + egressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("egress-default-allow:"+name)) + if err := ips.Create(egressDefaultAllowIPSet, ipset.HashIP); err != nil { + return nil, err + } + ns.egressDefaultAllowIPSet = egressDefaultAllowIPSet if err := ns.podSelectors.provision(ns.uid, nil, map[string]*selectorSpec{ns.allPods.key: ns.allPods}); err != nil { return nil, err @@ -113,10 +107,6 @@ func (ns *ns) onNewPodSelector(selector *selector) error { } func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType) error { - if ns.legacy { - return nil - } - for _, pod := range ns.pods { if hasIP(pod) { // Remove the pod from default-allow if dst podselector matches the pod @@ -133,10 +123,6 @@ func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType) } func (ns *ns) onDestroyTargetPodSelector(selector *selector, policyType policyType) error { - if ns.legacy { - return nil - } - for _, pod := range ns.pods { if hasIP(pod) { if selector.matches(pod.ObjectMeta.Labels) { @@ -192,16 +178,14 @@ func (ns *ns) addPod(obj *coreapi.Pod) error { return err } // If there are no matching target selectors, add the pod to default-allow - if !ns.legacy { - if !foundIngress { - if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil { - return err - } + if !foundIngress { + if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil { + return err } - if !foundEgress { - if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil { - return err - } + } + if !foundEgress { + if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil { + return err } } @@ -221,13 +205,11 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { ns.ips.DelEntry(oldObj.ObjectMeta.UID, LocalIpset, oldObj.Status.PodIP) } - if !ns.legacy { - if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { - return err - } - if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { - return err - } + if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { + return err + } + if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { + return err } return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, oldObj.Status.PodIP) @@ -242,23 +224,21 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { return err } - if !ns.legacy { - if !foundIngress { - if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { - return err - } + if !foundIngress { + if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { + return err } - if !foundEgress { - if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { - return err - } + } + if !foundEgress { + if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { + return err } } return nil } - if !ns.legacy && oldObj.Status.PodIP != newObj.Status.PodIP { + if oldObj.Status.PodIP != newObj.Status.PodIP { if err := ns.updateDefaultAllowIPSetEntry(oldObj, newObj, ns.ingressDefaultAllowIPSet); err != nil { return err } @@ -287,13 +267,11 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { } } - if !ns.legacy { - if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeIngress); err != nil { - return err - } - if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeEgress); err != nil { - return err - } + if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeIngress); err != nil { + return err + } + if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeEgress); err != nil { + return err } } } @@ -329,13 +307,11 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error { ns.ips.DelEntry(obj.ObjectMeta.UID, LocalIpset, obj.Status.PodIP) } - if !ns.legacy { - if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil { - return err - } - if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP); err != nil { - return err - } + if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil { + return err + } + if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP); err != nil { + return err } return ns.podSelectors.delFromMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP) @@ -458,20 +434,7 @@ func bypassRules(namespace string, ingress, egress ipset.Name) map[string][][]st } } -func bypassRuleLegacy(nsIpsetName ipset.Name, namespace string) []string { - return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace} -} - func (ns *ns) ensureBypassRules() error { - if ns.legacy { - ipset := ns.allPods.ipsetName - common.Log.Debugf("ensuring rule for DefaultAllow in namespace: %s, set %s", ns.name, ipset) - if err := ns.ipt.Append(TableFilter, DefaultChain, bypassRuleLegacy(ipset, ns.name)...); err != nil { - return err - } - return nil - } - for chain, rules := range bypassRules(ns.name, ns.ingressDefaultAllowIPSet, ns.egressDefaultAllowIPSet) { for _, rule := range rules { common.Log.Debugf("adding rule for DefaultAllow in namespace: %s, chain: %s, %s", ns.name, chain, rule) @@ -485,15 +448,6 @@ func (ns *ns) ensureBypassRules() error { } func (ns *ns) deleteBypassRules() error { - if ns.legacy { - ipset := ns.allPods.ipsetName - common.Log.Debugf("removing default rule in namespace: %s, set %s", ns.name, ipset) - if err := ns.ipt.Delete(TableFilter, DefaultChain, bypassRuleLegacy(ipset, ns.name)...); err != nil { - return err - } - return nil - } - for chain, rules := range bypassRules(ns.name, ns.ingressDefaultAllowIPSet, ns.egressDefaultAllowIPSet) { for _, rule := range rules { common.Log.Debugf("removing rule for DefaultAllow in namespace: %s, chain: %s, %s", ns.name, chain, rule) @@ -509,11 +463,9 @@ func (ns *ns) deleteBypassRules() error { func (ns *ns) addNamespace(obj *coreapi.Namespace) error { ns.namespace = obj - // Insert a rule to bypass policies if namespace is DefaultAllow - if !ns.isDefaultDeny(obj) { - if err := ns.ensureBypassRules(); err != nil { - return err - } + // Insert a rule to bypass policies + if err := ns.ensureBypassRules(); err != nil { + return err } // Add namespace ipset to matching namespace selectors @@ -524,24 +476,6 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error { func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error { ns.namespace = newObj - // Update bypass rule if ingress default has changed - oldDefaultDeny := ns.isDefaultDeny(oldObj) - newDefaultDeny := ns.isDefaultDeny(newObj) - - if oldDefaultDeny != newDefaultDeny { - common.Log.Infof("namespace DefaultDeny changed from %t to %t", oldDefaultDeny, newDefaultDeny) - if oldDefaultDeny { - if err := ns.ensureBypassRules(); err != nil { - return err - } - } - if newDefaultDeny { - if err := ns.deleteBypassRules(); err != nil { - return err - } - } - } - // Re-evaluate namespace selector membership if labels have changed if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) { for _, selector := range ns.nsSelectors.entries { @@ -570,10 +504,8 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error { ns.namespace = nil // Remove bypass rule - if !ns.isDefaultDeny(obj) { - if err := ns.deleteBypassRules(); err != nil { - return err - } + if err := ns.deleteBypassRules(); err != nil { + return err } // Remove namespace ipset from any matching namespace selectors @@ -582,41 +514,16 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error { return err } - if !ns.legacy { - if err := ns.ips.Destroy(ns.ingressDefaultAllowIPSet); err != nil { - return err - } - if err := ns.ips.Destroy(ns.egressDefaultAllowIPSet); err != nil { - return err - } + if err := ns.ips.Destroy(ns.ingressDefaultAllowIPSet); err != nil { + return err + } + if err := ns.ips.Destroy(ns.egressDefaultAllowIPSet); err != nil { + return err } return nil } -func (ns *ns) isDefaultDeny(namespace *coreapi.Namespace) bool { - nnpJSON, found := namespace.ObjectMeta.Annotations["net.beta.kubernetes.io/network-policy"] - if !found { - return false - } - - if !ns.legacy { - common.Log.Warn("DefaultDeny annotation is supported only in legacy mode (--use-legacy-netpol)") - return false - } - - var nnp NamespaceNetworkPolicy - if err := json.Unmarshal([]byte(nnpJSON), &nnp); err != nil { - common.Log.Warn("Ignoring network policy annotation: unmarshal failed:", err) - // If we can't understand the annotation, behave as if it isn't present - return false - } - - return nnp.Ingress != nil && - nnp.Ingress.Isolation != nil && - *(nnp.Ingress.Isolation) == DefaultDeny -} - func hasIP(pod *coreapi.Pod) bool { // Ensure pod isn't dead, has an IP address and isn't sharing the host network namespace return pod.Status.Phase != "Succeeded" && pod.Status.Phase != "Failed" && @@ -670,16 +577,9 @@ func (ns *ns) analyse(obj interface{}) ( ns.policies[uid] = obj // Analyse policy, determine which rules and ipsets are required - if ns.legacy { - rules, nsSelectors, podSelectors, err = ns.analysePolicyLegacy(obj.(*extnapi.NetworkPolicy)) - if err != nil { - return - } - } else { - rules, nsSelectors, podSelectors, ipBlocks, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy)) - if err != nil { - return - } + rules, nsSelectors, podSelectors, ipBlocks, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy)) + if err != nil { + return } return diff --git a/prog/weave-kube/weave-daemonset-k8s-1.7.yaml b/prog/weave-kube/weave-daemonset-k8s-1.7.yaml index 301e67ab..6f5ba5fc 100644 --- a/prog/weave-kube/weave-daemonset-k8s-1.7.yaml +++ b/prog/weave-kube/weave-daemonset-k8s-1.7.yaml @@ -25,14 +25,6 @@ items: - get - list - watch - - apiGroups: - - extensions - resources: - - networkpolicies - verbs: - - get - - list - - watch - apiGroups: - 'networking.k8s.io' resources: @@ -163,7 +155,6 @@ items: fieldPath: spec.nodeName image: 'weaveworks/weave-npc:latest' imagePullPolicy: Always -#npc-args resources: requests: cpu: 10m diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go index 276c90e7..cce45b87 100644 --- a/prog/weave-npc/main.go +++ b/prog/weave-npc/main.go @@ -10,7 +10,6 @@ import ( "github.com/pkg/errors" "github.com/spf13/cobra" coreapi "k8s.io/api/core/v1" - extnapi "k8s.io/api/extensions/v1beta1" networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/fields" "k8s.io/apimachinery/pkg/runtime" @@ -32,7 +31,6 @@ var ( logLevel string allowMcast bool nodeName string - legacy bool maxList int ) @@ -114,7 +112,7 @@ func resetIPSets(ips ipset.Interface) error { return nil } -func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface, legacy bool) error { +func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error { // Configure main chain static rules if err := ipt.Append(npc.TableFilter, npc.MainChain, "-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil { @@ -153,28 +151,26 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface, legacy bool) e return err } - if !legacy { - if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain, - "-j", "MARK", "--set-xmark", npc.EgressMark); err != nil { - return err - } + if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain, + "-j", "MARK", "--set-xmark", npc.EgressMark); err != nil { + return err + } - ruleSpecs := [][]string{ - {"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"}, - {"-m", "state", "--state", "NEW", "-m", "set", "!", "--match-set", npc.LocalIpset, "src", "-j", "RETURN"}, - } - if allowMcast { - ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"}) - } - ruleSpecs = append(ruleSpecs, [][]string{ - {"-m", "state", "--state", "NEW", "-j", string(npc.EgressDefaultChain)}, - {"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", string(npc.EgressCustomChain)}, - {"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"}, - {"-m", "mark", "!", "--mark", npc.EgressMark, "-j", "DROP"}, - }...) - if err := addChainWithRules(ipt, npc.TableFilter, npc.EgressChain, ruleSpecs); err != nil { - return err - } + ruleSpecs := [][]string{ + {"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"}, + {"-m", "state", "--state", "NEW", "-m", "set", "!", "--match-set", npc.LocalIpset, "src", "-j", "RETURN"}, + } + if allowMcast { + ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"}) + } + ruleSpecs = append(ruleSpecs, [][]string{ + {"-m", "state", "--state", "NEW", "-j", string(npc.EgressDefaultChain)}, + {"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", string(npc.EgressCustomChain)}, + {"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"}, + {"-m", "mark", "!", "--mark", npc.EgressMark, "-j", "DROP"}, + }...) + if err := addChainWithRules(ipt, npc.TableFilter, npc.EgressChain, ruleSpecs); err != nil { + return err } return nil @@ -243,10 +239,6 @@ func root(cmd *cobra.Command, args []string) { } common.Log.Infof("Starting Weaveworks NPC %s; node name %q", version, nodeName) - if legacy { - common.Log.Info("Running in legacy mode (k8s pre-1.7 network policy semantics)") - } - if err := metrics.Start(metricsAddr); err != nil { common.Log.Fatalf("Failed to start metrics: %v", err) } @@ -268,9 +260,9 @@ func root(cmd *cobra.Command, args []string) { handleError(resetIPTables(ipt)) handleError(resetIPSets(ips)) - handleError(createBaseRules(ipt, ips, legacy)) + handleError(createBaseRules(ipt, ips)) - npc := npc.New(nodeName, legacy, ipt, ips) + npc := npc.New(nodeName, ipt, ips) nsController := makeController(client.Core().RESTClient(), "namespaces", &coreapi.Namespace{}, cache.ResourceEventHandlerFuncs{ @@ -331,11 +323,7 @@ func root(cmd *cobra.Command, args []string) { handleError(npc.UpdateNetworkPolicy(old, new)) }, } - if legacy { - npController = makeController(client.Extensions().RESTClient(), "networkpolicies", &extnapi.NetworkPolicy{}, npHandlers) - } else { - npController = makeController(client.NetworkingV1().RESTClient(), "networkpolicies", &networkingv1.NetworkPolicy{}, npHandlers) - } + npController = makeController(client.NetworkingV1().RESTClient(), "networkpolicies", &networkingv1.NetworkPolicy{}, npHandlers) go nsController.Run(wait.NeverStop) go podController.Run(wait.NeverStop) @@ -356,7 +344,6 @@ func main() { rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)") rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic") rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node") - rootCmd.PersistentFlags().BoolVar(&legacy, "use-legacy-netpol", false, "use legacy network policies (pre k8s 1.7 vsn)") rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)") handleError(rootCmd.Execute()) diff --git a/prog/weaver/main.go b/prog/weaver/main.go index 93622c5a..79c1b65a 100644 --- a/prog/weaver/main.go +++ b/prog/weaver/main.go @@ -182,7 +182,6 @@ func main() { mflag.StringVar(&bridgeConfig.WeaveBridgeName, []string{"-weave-bridge"}, "weave", "name of weave bridge") mflag.StringVar(&bridgeConfig.DockerBridgeName, []string{"-docker-bridge"}, "", "name of Docker bridge") mflag.BoolVar(&bridgeConfig.NPC, []string{"-expect-npc"}, false, "set up iptables rules for npc") - mflag.BoolVar(&bridgeConfig.LegacyNPC, []string{"-use-legacy-netpol"}, false, "use legacy network policies (pre k8s 1.7 vsn)") mflag.StringVar(&routerName, []string{"-name"}, "", "name of router (defaults to MAC of interface)") mflag.StringVar(&nickName, []string{"-nickname"}, "", "nickname of peer (defaults to hostname)") mflag.StringVar(&password, []string{"-password"}, "", "network password") diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index fbb5c0b6..3c5880a4 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -370,7 +370,6 @@ You can customise the YAML you get from `cloud.weave.works` by passing some of W - `disable-npc`: boolean (`true|false`). Default: `false`. - `env.NAME=VALUE`: add environment variable `NAME` and set it to `VALUE`. - `seLinuxOptions.NAME=VALUE`: add SELinux option `NAME` and set it to `VALUE`, e.g. `seLinuxOptions.type=spc_t` - - `use-legacy-netpol`: use [legacy NetworkPolicy semantics](https://v1-6.docs.kubernetes.io/docs/api-reference/v1.6/#networkpolicy-v1beta1-extensions), boolean (`true|false`). Default: `true` for Kubernetes version <= 1.6, `false` for > 1.6. The list of variables you can set is: diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index a0001937..0efde493 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -44,15 +44,14 @@ for host in $HOSTS; do done if [ -n "$COVERAGE" ]; then - WEAVE_ENV_VARS="env:\\n - name: EXTRA_ARGS\\n value: \"-test.coverprofile=/home/weave/cover.prof -- --use-legacy-netpol\"" + WEAVE_ENV_VARS="env:\\n - name: EXTRA_ARGS\\n value: \"-test.coverprofile=/home/weave/cover.prof --\"" else - WEAVE_ENV_VARS="env:\\n - name: EXTRA_ARGS\\n value: \"--use-legacy-netpol\"" + WEAVE_ENV_VARS="env:" fi # Ensure Kubernetes uses locally built container images and inject code coverage environment variable (or do nothing depending on $COVERAGE): sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \ -e "s%env:%$WEAVE_ENV_VARS%" \ - -e "s%#npc-args% args:\n - '--use-legacy-netpol'%" \ "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.8.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -" sleep 5 @@ -76,10 +75,19 @@ assert "run_on $HOST1 ps aux | grep -c '[d]efunct'" "0" assert "run_on $HOST2 ps aux | grep -c '[d]efunct'" "0" assert "run_on $HOST3 ps aux | grep -c '[d]efunct'" "0" -# Set up a simple network policy so all our test pods can talk to each other -run_on $HOST1 "$KUBECTL annotate ns default net.beta.kubernetes.io/network-policy='{\"ingress\":{\"isolation\":\"DefaultDeny\"}}'" +# Set up simple network policies so all our test pods can talk to each other run_on $HOST1 "$KUBECTL apply -f -" </dev/null" -if [ -n "$COVERAGE" ]; then - WEAVE_ENV_VARS="env:\\n - name: EXTRA_ARGS\\n value: \"-test.coverprofile=/home/weave/cover.prof --\"" -else - WEAVE_ENV_VARS="env:" -fi - -# Restart weave-net with npc in non-legacy mode -$SSH $HOST1 "$KUBECTL delete ds weave-net -n=kube-system" -sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \ - -e "s%env:%$WEAVE_ENV_VARS%" \ - "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.8.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -" - -assert_raises 'wait_for_x check_all_pods_communicate pods' - -# nettest-deny should still not be able to reach nettest pods -assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null" - # check access via virtual IP VIRTUAL_IP=$($SSH $HOST1 $KUBECTL get service netvirt -o template --template={{.spec.clusterIP}}) assert_raises "$SSH $HOST1 $KUBECTL exec $podName -- curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null"