From 29ec43bdc818fee724f2e4f0ffe9bfe50158894e Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Thu, 17 May 2018 18:21:39 +0200 Subject: [PATCH] npc: Rename default-allow ipset for ingress As we're going to introduce one for egress, we cannot use "default-allow" name for ingress. --- npc/controller_test.go | 64 +++++++++++++++++++++--------------------- npc/namespace.go | 34 +++++++++++----------- 2 files changed, 49 insertions(+), 49 deletions(-) diff --git a/npc/controller_test.go b/npc/controller_test.go index f7dd7fdb..6928fc52 100644 --- a/npc/controller_test.go +++ b/npc/controller_test.go @@ -196,10 +196,10 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) { // Tests default-allow ipset behavior when running in non-legacy mode. func TestDefaultAllow(t *testing.T) { const ( - defaultAllowIPSetName = "weave-E.1.0W^NGSp]0_t5WwH/]gX@L" - fooPodIP = "10.32.0.10" - barPodIP = "10.32.0.11" - barPodNewIP = "10.32.0.12" + ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N" + fooPodIP = "10.32.0.10" + barPodIP = "10.32.0.11" + barPodNewIP = "10.32.0.12" ) m := newMockIPSet() @@ -213,7 +213,7 @@ func TestDefaultAllow(t *testing.T) { controller.AddNamespace(defaultNamespace) // Should create an ipset for default-allow - require.Contains(t, m.sets, defaultAllowIPSetName) + require.Contains(t, m.sets, ingressDefaultAllowIPSetName) podFoo := &coreapi.Pod{ ObjectMeta: metav1.ObjectMeta{ @@ -225,7 +225,7 @@ func TestDefaultAllow(t *testing.T) { controller.AddPod(podFoo) // Should add the foo pod to default-allow - require.True(t, m.entryExists(defaultAllowIPSetName, fooPodIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, fooPodIP)) podBar := &coreapi.Pod{ ObjectMeta: metav1.ObjectMeta{ @@ -239,7 +239,7 @@ func TestDefaultAllow(t *testing.T) { controller.UpdatePod(podBarNoIP, podBar) // Should add the bar pod to default-allow - require.True(t, m.entryExists(defaultAllowIPSetName, barPodIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, barPodIP)) // Allow access from the bar pod to the foo pod netpol := &networkingv1.NetworkPolicy{ @@ -261,51 +261,51 @@ func TestDefaultAllow(t *testing.T) { controller.AddNetworkPolicy(netpol) // Should remove the foo pod from default-allow as the netpol selects it - require.False(t, m.entryExists(defaultAllowIPSetName, fooPodIP)) - require.True(t, m.entryExists(defaultAllowIPSetName, barPodIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, fooPodIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, barPodIP)) podBarWithNewIP := *podBar podBarWithNewIP.Status.PodIP = barPodNewIP controller.UpdatePod(podBar, &podBarWithNewIP) // Should update IP addr of the bar pod in default-allow - require.False(t, m.entryExists(defaultAllowIPSetName, barPodIP)) - require.True(t, m.entryExists(defaultAllowIPSetName, barPodNewIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, barPodIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, barPodNewIP)) controller.UpdatePod(&podBarWithNewIP, podBarNoIP) // Should remove the bar pod from default-allow as it does not have any IP addr - require.False(t, m.entryExists(defaultAllowIPSetName, barPodNewIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, barPodNewIP)) podFooWithNewLabel := *podFoo podFooWithNewLabel.ObjectMeta.Labels = map[string]string{"run": "new-foo"} controller.UpdatePod(podFoo, &podFooWithNewLabel) // Should bring back the foo pod to default-allow as it does not match dst of any netpol - require.True(t, m.entryExists(defaultAllowIPSetName, fooPodIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, fooPodIP)) controller.UpdatePod(&podFooWithNewLabel, podFoo) // Should remove from default-allow as it matches the netpol after the update - require.False(t, m.entryExists(defaultAllowIPSetName, fooPodIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, fooPodIP)) controller.DeleteNetworkPolicy(netpol) // Should bring back the foo pod to default-allow as no netpol selects it - require.True(t, m.entryExists(defaultAllowIPSetName, fooPodIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, fooPodIP)) controller.DeletePod(podFoo) // Should remove foo pod from default-allow - require.False(t, m.entryExists(defaultAllowIPSetName, fooPodIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, fooPodIP)) controller.DeleteNamespace(defaultNamespace) // Should remove default ipset - require.NotContains(t, m.sets, defaultAllowIPSetName) + require.NotContains(t, m.sets, ingressDefaultAllowIPSetName) } func TestOutOfOrderPodEvents(t *testing.T) { const ( - defaultAllowIPSetName = "weave-E.1.0W^NGSp]0_t5WwH/]gX@L" - runBarIPSetName = "weave-bZ~x=yBgzH)Ht()K*Uv3z{M]Y" - podIP = "10.32.0.10" + ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N" + runBarIPSetName = "weave-bZ~x=yBgzH)Ht()K*Uv3z{M]Y" + podIP = "10.32.0.10" ) m := newMockIPSet() @@ -328,7 +328,7 @@ func TestOutOfOrderPodEvents(t *testing.T) { controller.AddPod(podFoo) // Should be in default-allow as no netpol selects podFoo - require.True(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) netpol := &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ @@ -349,7 +349,7 @@ func TestOutOfOrderPodEvents(t *testing.T) { controller.AddNetworkPolicy(netpol) // Shouldn't be in default-allow as netpol above selects podFoo - require.False(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) podBar := &coreapi.Pod{ ObjectMeta: metav1.ObjectMeta{ @@ -361,8 +361,8 @@ func TestOutOfOrderPodEvents(t *testing.T) { controller.AddPod(podBar) // Should be in default-allow as no netpol selects podBar - require.True(t, m.entryExists(defaultAllowIPSetName, podIP)) - require.True(t, m.Exist(podBar.ObjectMeta.UID, defaultAllowIPSetName, podIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) + require.True(t, m.Exist(podBar.ObjectMeta.UID, ingressDefaultAllowIPSetName, podIP)) // Should be in run=bar ipset require.True(t, m.entryExists(runBarIPSetName, podIP)) @@ -373,20 +373,20 @@ func TestOutOfOrderPodEvents(t *testing.T) { // Should be in default-allow as no netpol selects podBar and podFoo removal // should not affect podBar in default-allow - require.True(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) controller.DeletePod(podBar) // Should remove from default-allow and run=bar ipsets - require.Equal(t, 0, len(m.sets[defaultAllowIPSetName].subSets)) + require.Equal(t, 0, len(m.sets[ingressDefaultAllowIPSetName].subSets)) require.False(t, m.entryExists(runBarIPSetName, podIP)) } // Test case for https://github.com/weaveworks/weave/issues/3222 func TestNewDstSelector(t *testing.T) { const ( - defaultAllowIPSetName = "weave-E.1.0W^NGSp]0_t5WwH/]gX@L" - podIP = "10.32.0.10" + ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N" + podIP = "10.32.0.10" ) m := newMockIPSet() @@ -408,7 +408,7 @@ func TestNewDstSelector(t *testing.T) { Status: coreapi.PodStatus{PodIP: podIP}} controller.AddPod(podFoo) - require.True(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) netpolBar := &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ @@ -428,7 +428,7 @@ func TestNewDstSelector(t *testing.T) { controller.AddNetworkPolicy(netpolBar) // netpolBar dst selector selects podFoo - require.False(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) netpolFoo := &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ @@ -449,8 +449,8 @@ func TestNewDstSelector(t *testing.T) { controller.DeleteNetworkPolicy(netpolBar) // netpolFoo dst-selects podFoo - require.False(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.False(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) controller.DeleteNetworkPolicy(netpolFoo) // No netpol dst-selects podFoo - require.True(t, m.entryExists(defaultAllowIPSetName, podIP)) + require.True(t, m.entryExists(ingressDefaultAllowIPSetName, podIP)) } diff --git a/npc/namespace.go b/npc/namespace.go index 5dc3f46e..2fa91887 100644 --- a/npc/namespace.go +++ b/npc/namespace.go @@ -35,7 +35,7 @@ type ns struct { // stores IP addrs of pods which are not selected by any dst podSelector of // any netpol; used only in non-legacy mode and is used as a dst in // the WEAVE-NPC-DEFAULT iptables chain. - defaultAllowIPSet ipset.Name + ingressDefaultAllowIPSet ipset.Name nsSelectors *selectorSet podSelectors *selectorSet @@ -66,11 +66,11 @@ func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset ns.podSelectors = newSelectorSet(ips, ns.onNewPodSelector, ns.onNewDstPodSelector, ns.onDestroyDstPodSelector) if !legacy { - defaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("default-allow:"+name)) - if err := ips.Create(defaultAllowIPSet, ipset.HashIP); err != nil { + ingressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("ingress-default-allow:"+name)) + if err := ips.Create(ingressDefaultAllowIPSet, ipset.HashIP); err != nil { return nil, err } - ns.defaultAllowIPSet = defaultAllowIPSet + ns.ingressDefaultAllowIPSet = ingressDefaultAllowIPSet } if err := ns.podSelectors.provision(ns.uid, nil, map[string]*selectorSpec{ns.allPods.key: ns.allPods}); err != nil { @@ -111,7 +111,7 @@ func (ns *ns) onNewDstPodSelector(selector *selector) error { if hasIP(pod) { // Remove the pod from default-allow if dst podselector matches the pod if selector.matches(pod.ObjectMeta.Labels) { - if err := ns.ips.DelEntry(pod.ObjectMeta.UID, ns.defaultAllowIPSet, pod.Status.PodIP); err != nil { + if err := ns.ips.DelEntry(pod.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, pod.Status.PodIP); err != nil { return err } } @@ -150,7 +150,7 @@ func (ns *ns) addToDefaultAllowIfNoMatching(pod *coreapi.Pod) error { } } if !found { - if err := ns.ips.AddEntry(pod.ObjectMeta.UID, ns.defaultAllowIPSet, pod.Status.PodIP, podComment(pod)); err != nil { + if err := ns.ips.AddEntry(pod.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, pod.Status.PodIP, podComment(pod)); err != nil { return err } } @@ -181,7 +181,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error { } // If there are no matching dst selectors, add the pod to default-allow if !ns.legacy && !found { - if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.defaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil { + if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil { return err } } @@ -203,7 +203,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { } if !ns.legacy { - if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP); err != nil { + if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { return err } } @@ -221,7 +221,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { } if !ns.legacy && !found { - if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.defaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { + if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { return err } } @@ -231,15 +231,15 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { if !ns.legacy && oldObj.Status.PodIP != newObj.Status.PodIP && - ns.ips.Exist(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP) { + ns.ips.Exist(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP) { // Instead of iterating over all selectors we check whether old pod IP // has been inserted into default-allow ipset to decide whether the IP // in the ipset has to be updated. - if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP); err != nil { + if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { return err } - if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.defaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { + if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil { return err } } @@ -267,7 +267,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error { if !ns.legacy && ns.podSelectors.dstSelectorExist(ps) { switch { case !oldMatch && newMatch: - if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP); err != nil { + if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil { return err } case oldMatch && !newMatch: @@ -294,7 +294,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error { } if !ns.legacy { - if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.defaultAllowIPSet, obj.Status.PodIP); err != nil { + if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil { return err } } @@ -381,7 +381,7 @@ func (ns *ns) ensureBypassRule() error { if ns.legacy { ipset = ns.allPods.ipsetName } else { - ipset = ns.defaultAllowIPSet + ipset = ns.ingressDefaultAllowIPSet } common.Log.Debugf("ensuring rule for DefaultAllow in namespace: %s, set %s", ns.name, ipset) @@ -393,7 +393,7 @@ func (ns *ns) deleteBypassRule() error { if ns.legacy { ipset = ns.allPods.ipsetName } else { - ipset = ns.defaultAllowIPSet + ipset = ns.ingressDefaultAllowIPSet } common.Log.Debugf("removing default rule in namespace: %s, set %s", ns.name, ipset) @@ -477,7 +477,7 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error { } if !ns.legacy { - return ns.ips.Destroy(ns.defaultAllowIPSet) + return ns.ips.Destroy(ns.ingressDefaultAllowIPSet) } return nil