From 791d9aecfcf6a56cae6908f85351820ed85453f4 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 25 May 2018 10:29:40 +0000 Subject: [PATCH 1/3] Extend k8s test to cover namespaceSelector and >10 Namespaces --- test/840_weave_kube_3_test.sh | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index 63d305bf..f9a345cd 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -225,12 +225,39 @@ run_on $HOST1 "$KUBECTL delete netpol allow-nettest-deny" # nettest-deny should still not be able to reach nettest pods assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null" -# allow access for all +# Create many namespaces to stress namespaceSelector +for n in 1 2 3 4 5 6 7 8 9 10; do + run_on $HOST1 "$KUBECTL create namespace namespace${n}" +done + +# allow access from any namespace run_on $HOST1 "$KUBECTL apply -f -" </dev/null" + +# host should still not be able to reach pods via service virtual IP or NodePort +# because host is not in a namespace +assert_raises "! $SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null" +assert_raises "! $SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null" + +# allow access from anywhere +run_on $HOST1 "$KUBECTL apply -f -" </dev/null" - # Virtual IP and NodePort should now work assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null" assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null" From 4c1c2a5661e393ae9e0321e271e45aaef0ab8ca0 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 25 May 2018 17:15:48 +0000 Subject: [PATCH 2/3] Add --max-list-size option for ipset lists and default it to 1024 for cases where the size is fixed by the kernel --- npc/ipset/ipset.go | 8 +++++++- prog/weave-npc/main.go | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/npc/ipset/ipset.go b/npc/ipset/ipset.go index 1e57b1d7..63516fd9 100644 --- a/npc/ipset/ipset.go +++ b/npc/ipset/ipset.go @@ -1,6 +1,7 @@ package ipset import ( + "fmt" "log" "os/exec" "strings" @@ -40,6 +41,7 @@ type entryKey struct { type ipset struct { *log.Logger enableComments bool + maxListSize int // List of users per ipset entry. User is either a namespace or a pod. // There might be multiple users for the same ipset & entry pair because // events from k8s API server might be out of order causing duplicate IPs: @@ -47,10 +49,11 @@ type ipset struct { users map[entryKey]map[types.UID]struct{} } -func New(logger *log.Logger) Interface { +func New(logger *log.Logger, maxListSize int) Interface { ips := &ipset{ Logger: logger, enableComments: true, + maxListSize: maxListSize, users: make(map[entryKey]map[types.UID]struct{}), } @@ -71,6 +74,9 @@ func New(logger *log.Logger) Interface { func (i *ipset) Create(ipsetName Name, ipsetType Type) error { args := []string{"create", string(ipsetName), string(ipsetType)} + if ipsetType == ListSet && i.maxListSize > 0 { + args = append(args, fmt.Sprintf("size %d", i.maxListSize)) + } if i.enableComments { args = append(args, "comment") } diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go index 01b5266c..92764699 100644 --- a/prog/weave-npc/main.go +++ b/prog/weave-npc/main.go @@ -31,6 +31,7 @@ var ( allowMcast bool nodeName string legacy bool + maxList int ) func handleError(err error) { common.CheckFatal(err) } @@ -152,7 +153,7 @@ func root(cmd *cobra.Command, args []string) { ipt, err := iptables.New() handleError(err) - ips := ipset.New(common.LogLogger()) + ips := ipset.New(common.LogLogger(), maxList) handleError(resetIPTables(ipt)) handleError(resetIPSets(ips)) @@ -245,6 +246,7 @@ func main() { rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic") rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node") rootCmd.PersistentFlags().BoolVar(&legacy, "use-legacy-netpol", false, "use legacy network policies (pre k8s 1.7 vsn)") + rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)") handleError(rootCmd.Execute()) } From 8e374d9416b84bd334b0374001586a785b677e80 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 11 Jun 2018 13:52:15 +0000 Subject: [PATCH 3/3] D'oh --- npc/ipset/ipset.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/npc/ipset/ipset.go b/npc/ipset/ipset.go index 63516fd9..00f1d105 100644 --- a/npc/ipset/ipset.go +++ b/npc/ipset/ipset.go @@ -75,7 +75,7 @@ func New(logger *log.Logger, maxListSize int) Interface { func (i *ipset) Create(ipsetName Name, ipsetType Type) error { args := []string{"create", string(ipsetName), string(ipsetType)} if ipsetType == ListSet && i.maxListSize > 0 { - args = append(args, fmt.Sprintf("size %d", i.maxListSize)) + args = append(args, "size", fmt.Sprintf("%d", i.maxListSize)) } if i.enableComments { args = append(args, "comment")