reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add seperate match function to matach pod/namespace/namespacedpod selectors

Browse Source
This commit is contained in:
Murali Reddy committed 2019-06-07 11:52:40 +05:30
1 parent 7a6ba40982
commit a6f2ee5ccc
3 files changed
+84 -38
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

npc/controller.go
+6 -5
View File
@@ -5,14 +5,15 @@ import (
"sync"
"github.com/pkg/errors"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/net/ipset"
"github.com/weaveworks/weave/npc/iptables"
coreapi "k8s.io/api/core/v1"
extnapi "k8s.io/api/extensions/v1beta1"
networkingv1 "k8s.io/api/networking/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/net/ipset"
"github.com/weaveworks/weave/npc/iptables"
)
type NetworkPolicyController interface {
@@ -60,7 +61,7 @@ func New(nodeName string, ipt iptables.Interface, ips ipset.Interface, clientset
func (npc *controller) onNewNsSelector(selector *selector) error {
for _, ns := range npc.nss {
if ns.namespace != nil {
if selector.matches(nil, &ns.namespace.ObjectMeta.Labels) {
if selector.matchesNamespaceSelector(ns.namespace.ObjectMeta.Labels) {
if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
return err
}
@@ -75,7 +76,7 @@ func (npc *controller) onNewNamespacePodsSelector(selector *selector) error {
if ns.namespace != nil && len(ns.pods) > 0 {
for _, pod := range ns.pods {
if hasIP(pod) {
if selector.matches(&pod.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels) {
if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels) {
if err := selector.addEntry(pod.ObjectMeta.UID, pod.Status.PodIP, podComment(pod)); err != nil {
return err
}
npc/namespace.go
+20 -20
View File
@@ -98,7 +98,7 @@ func (ns *ns) destroy() error {
func (ns *ns) onNewPodSelector(selector *selector) error {
for _, pod := range ns.pods {
if hasIP(pod) {
if selector.matches(&pod.ObjectMeta.Labels, nil) {
if selector.matchesPodSelector(pod.ObjectMeta.Labels) {
if err := selector.addEntry(pod.ObjectMeta.UID, pod.Status.PodIP, podComment(pod)); err != nil {
return err
}
@@ -114,7 +114,7 @@ func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType)
if hasIP(pod) {
// Remove the pod from default-allow if dst podselector matches the pod
ipset := ns.defaultAllowIPSetName(policyType)
if selector.matches(&pod.ObjectMeta.Labels, nil) {
if selector.matchesPodSelector(pod.ObjectMeta.Labels) {
if err := ns.ips.DelEntry(pod.ObjectMeta.UID, ipset, pod.Status.PodIP); err != nil {
return err
}
@@ -128,7 +128,7 @@ func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType)
func (ns *ns) onDestroyTargetPodSelector(selector *selector, policyType policyType) error {
for _, pod := range ns.pods {
if hasIP(pod) {
if selector.matches(&pod.ObjectMeta.Labels, nil) {
if selector.matchesPodSelector(pod.ObjectMeta.Labels) {
if err := ns.addToDefaultAllowIfNoMatching(pod, policyType); err != nil {
return err
}
@@ -144,7 +144,7 @@ func (ns *ns) addToDefaultAllowIfNoMatching(pod *coreapi.Pod, policyType policyT
found := false
// TODO(mp) optimize (avoid iterating over selectors) by ref counting IP addrs.
for _, s := range ns.podSelectors.entries {
if ns.podSelectors.targetSelectorExist(s, policyType) && s.matches(&pod.ObjectMeta.Labels, nil) {
if ns.podSelectors.targetSelectorExist(s, policyType) && s.matchesPodSelector(pod.ObjectMeta.Labels) {
found = true
break
}
@@ -172,7 +172,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
return nil
}
foundIngress, foundEgress, err := ns.podSelectors.addToMatching(obj.ObjectMeta.UID, &obj.ObjectMeta.Labels, nil, obj.Status.PodIP, podComment(obj))
foundIngress, foundEgress, err := ns.podSelectors.addToMatchingPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
if err != nil {
return err
}
@@ -188,7 +188,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
}
}
_, _, err = ns.namespacedPodsSelectors.addToMatching(obj.ObjectMeta.UID, &obj.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
if err != nil {
return err
}
@@ -211,15 +211,15 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
return err
}
if err := ns.namespacedPodsSelectors.delFromMatching(oldObj.ObjectMeta.UID, &oldObj.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels, oldObj.Status.PodIP); err != nil {
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, oldObj.Status.PodIP); err != nil {
return err
}
return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.UID, &oldObj.ObjectMeta.Labels, nil, oldObj.Status.PodIP)
return ns.podSelectors.delFromMatchingPodSelector(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
}
if !hasIP(oldObj) && hasIP(newObj) {
foundIngress, foundEgress, err := ns.podSelectors.addToMatching(newObj.ObjectMeta.UID, &newObj.ObjectMeta.Labels, nil, newObj.Status.PodIP, podComment(newObj))
foundIngress, foundEgress, err := ns.podSelectors.addToMatchingPodSelector(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
if err != nil {
return err
}
@@ -234,7 +234,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
return err
}
}
_, _, err = ns.namespacedPodsSelectors.addToMatching(newObj.ObjectMeta.UID, &newObj.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
if err != nil {
return err
}
@@ -255,8 +255,8 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
oldObj.Status.PodIP != newObj.Status.PodIP {
for _, ps := range ns.podSelectors.entries {
oldMatch := ps.matches(&oldObj.ObjectMeta.Labels, nil)
newMatch := ps.matches(&newObj.ObjectMeta.Labels, nil)
oldMatch := ps.matchesPodSelector(oldObj.ObjectMeta.Labels)
newMatch := ps.matchesPodSelector(newObj.ObjectMeta.Labels)
if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP {
continue
}
@@ -279,8 +279,8 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
}
}
for _, ps := range ns.namespacedPodsSelectors.entries {
oldMatch := ps.matches(&oldObj.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels)
newMatch := ps.matches(&newObj.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels)
oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels)
newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels)
if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP {
continue
}
@@ -330,10 +330,10 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.egressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
return err
}
if err := ns.podSelectors.delFromMatching(obj.ObjectMeta.UID, &obj.ObjectMeta.Labels, nil, obj.Status.PodIP); err != nil {
if err := ns.podSelectors.delFromMatchingPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
return err
}
if err := ns.namespacedPodsSelectors.delFromMatching(obj.ObjectMeta.UID, &obj.ObjectMeta.Labels, &ns.namespace.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
return err
}
return nil
@@ -503,7 +503,7 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
}
// Add namespace ipset to matching namespace selectors
_, _, err := ns.nsSelectors.addToMatching(obj.ObjectMeta.UID, nil, &obj.ObjectMeta.Labels, string(ns.allPods.ipsetName), namespaceComment(ns))
err := ns.nsSelectors.addToMatchingNamespaceSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, string(ns.allPods.ipsetName), namespaceComment(ns))
return err
}
@@ -513,8 +513,8 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
// Re-evaluate namespace selector membership if labels have changed
if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) {
for _, selector := range ns.nsSelectors.entries {
oldMatch := selector.matches(nil, &oldObj.ObjectMeta.Labels)
newMatch := selector.matches(nil, &newObj.ObjectMeta.Labels)
oldMatch := selector.matchesNamespaceSelector(oldObj.ObjectMeta.Labels)
newMatch := selector.matchesNamespaceSelector(newObj.ObjectMeta.Labels)
if oldMatch == newMatch {
continue
}
@@ -543,7 +543,7 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
}
// Remove namespace ipset from any matching namespace selectors
err := ns.nsSelectors.delFromMatching(obj.ObjectMeta.UID, nil, &obj.ObjectMeta.Labels, string(ns.allPods.ipsetName))
err := ns.nsSelectors.delFromMatchingNamespaceSelector(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, string(ns.allPods.ipsetName))
if err != nil {
return err
}
npc/selector.go
+58 -13
View File
@@ -75,15 +75,16 @@ type selector struct {
spec *selectorSpec
}
func (s *selector) matches(podsLabelMap *map[string]string, namespaceLabelMap *map[string]string) bool {
if podsLabelMap != nil && namespaceLabelMap != nil {
return s.spec.podSelector.Matches(labels.Set(*podsLabelMap)) && s.spec.namespaceSelector.Matches(labels.Set(*namespaceLabelMap))
} else if podsLabelMap != nil {
return s.spec.podSelector.Matches(labels.Set(*podsLabelMap))
} else if namespaceLabelMap != nil {
return s.spec.namespaceSelector.Matches(labels.Set(*namespaceLabelMap))
}
return false
func (s *selector) matchesPodSelector(podsLabelMap map[string]string) bool {
return s.spec.podSelector.Matches(labels.Set(podsLabelMap))
}
func (s *selector) matchesNamespaceSelector(namespaceLabelMap map[string]string) bool {
return s.spec.namespaceSelector.Matches(labels.Set(namespaceLabelMap))
}
func (s *selector) matchesNamespacedPodSelector(podsLabelMap, namespaceLabelMap map[string]string) bool {
return s.spec.podSelector.Matches(labels.Set(podsLabelMap)) && s.spec.namespaceSelector.Matches(labels.Set(namespaceLabelMap))
}
func (s *selector) addEntry(user types.UID, entry string, comment string) error {
@@ -126,11 +127,11 @@ func newSelectorSet(ips ipset.Interface, onNewSelector selectorFn, onNewTargetSe
targetSelectorsCount: make(map[string]map[policyType]int)}
}
func (ss *selectorSet) addToMatching(user types.UID, podLabelsMap *map[string]string, namespaceLabelsMap *map[string]string, entry string, comment string) (bool, bool, error) {
func (ss *selectorSet) addToMatchingPodSelector(user types.UID, podLabelsMap map[string]string, entry string, comment string) (bool, bool, error) {
foundIngress := false
foundEgress := false
for _, s := range ss.entries {
if s.matches(podLabelsMap, namespaceLabelsMap) {
if s.matchesPodSelector(podLabelsMap) {
if ss.targetSelectorExist(s, policyTypeIngress) {
foundIngress = true
}
@@ -145,9 +146,53 @@ func (ss *selectorSet) addToMatching(user types.UID, podLabelsMap *map[string]st
return foundIngress, foundEgress, nil
}
func (ss *selectorSet) delFromMatching(user types.UID, podLabelsMap *map[string]string, namespaceLabelsMap *map[string]string, entry string) error {
func (ss *selectorSet) addToMatchingNamespaceSelector(user types.UID, namespaceLabelsMap map[string]string, entry string, comment string) error {
for _, s := range ss.entries {
if s.matches(podLabelsMap, namespaceLabelsMap) {
if s.matchesNamespaceSelector(namespaceLabelsMap) {
if err := s.addEntry(user, entry, comment); err != nil {
return err
}
}
}
return nil
}
func (ss *selectorSet) addToMatchingNamespacedPodSelector(user types.UID, podLabelsMap map[string]string, namespaceLabelsMap map[string]string, entry string, comment string) error {
for _, s := range ss.entries {
if s.matchesNamespacedPodSelector(podLabelsMap, namespaceLabelsMap) {
if err := s.addEntry(user, entry, comment); err != nil {
return err
}
}
}
return nil
}
func (ss *selectorSet) delFromMatchingPodSelector(user types.UID, podLabelsMap map[string]string, entry string) error {
for _, s := range ss.entries {
if s.matchesPodSelector(podLabelsMap) {
if err := s.delEntry(user, entry); err != nil {
return err
}
}
}
return nil
}
func (ss *selectorSet) delFromMatchingNamespaceSelector(user types.UID, namespaceLabelsMap map[string]string, entry string) error {
for _, s := range ss.entries {
if s.matchesNamespaceSelector(namespaceLabelsMap) {
if err := s.delEntry(user, entry); err != nil {
return err
}
}
}
return nil
}
func (ss *selectorSet) delFromMatchingNamespacedPodSelector(user types.UID, podLabelsMap map[string]string, namespaceLabelsMap map[string]string, entry string) error {
for _, s := range ss.entries {
if s.matchesNamespacedPodSelector(podLabelsMap, namespaceLabelsMap) {
if err := s.delEntry(user, entry); err != nil {
return err
}