From c742ec49938de9fe81acfaa40f1559d4973ad7d1 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Fri, 3 Aug 2018 13:02:50 +0200 Subject: [PATCH 1/3] npc: Enable ipBlock for Ingress policy When using ipBlock in Ingress policy, one should be aware that source IP addr of packet destined to Pod in many cases is mangled, see docs/k8s-src-ip.md for the cases. However, the mangling in some cases can be prevented with setting externalTrafficPolicy to Local. --- npc/analyser.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/npc/analyser.go b/npc/analyser.go index a19bb711..d33068ba 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -63,6 +63,7 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( } else { for _, peer := range ingressRule.From { var srcSelector *selectorSpec + var srcRuleHost ruleHost // NetworkPolicyPeer describes a peer to allow traffic from. // Exactly one of its fields must be specified. @@ -72,17 +73,22 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( return nil, nil, nil, nil, err } addIfNotExist(srcSelector, podSelectors) - + srcRuleHost = srcSelector } else if peer.NamespaceSelector != nil { srcSelector, err = newSelectorSpec(peer.NamespaceSelector, nil, "", ipset.ListSet) if err != nil { return nil, nil, nil, nil, err } nsSelectors[srcSelector.key] = srcSelector + srcRuleHost = srcSelector + } else if peer.IPBlock != nil { + ipBlock := newIPBlockSpec(peer.IPBlock, ns.name) + ipBlocks[ipBlock.key] = ipBlock + srcRuleHost = ipBlock } if allPorts { - rule := newRuleSpec(policyTypeIngress, nil, srcSelector, targetSelector, nil) + rule := newRuleSpec(policyTypeIngress, nil, srcRuleHost, targetSelector, nil) rules[rule.key] = rule } else { withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) { From aec8756151560fb449aa41c2e5511021d4872b62 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Fri, 3 Aug 2018 13:56:34 +0200 Subject: [PATCH 2/3] npc: Add integration test case for ingress.ipBlock --- test/840_weave_kube_3_test.sh | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index 2e7a5e8a..f8ea2c1a 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -255,6 +255,27 @@ assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http assert_raises "! $SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null" assert_raises "! $SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null" +# allow access only from weave bridge IP of host1 to test ipBlock +run_on $HOST1 "$KUBECTL apply -f -" </dev/null" + +run_on $HOST1 "$KUBECTL delete netpol allow-via-weave-bridge-of-host1" + # allow access from anywhere run_on $HOST1 "$KUBECTL apply -f -" < Date: Tue, 14 Aug 2018 11:59:12 +0200 Subject: [PATCH 3/3] Add recommendation to docs about ingress.ipBlock usage Also, update link to NetworkPolicy API object spec. --- site/kubernetes/kube-addon.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 1f13e0a9..46528440 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -154,7 +154,7 @@ labels. For more information on configuring network policies in Kubernetes see the [walkthrough](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/) and the [NetworkPolicy API object -definition](https://v1-7.docs.kubernetes.io/docs/api-reference/v1.7/#networkpolicy-v1-networking) +definition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#networkpolicy-v1-networking-k8s-io) **Note:** as of version 1.9 of Weave Net, the Network Policy Controller allows all multicast traffic. Since a single multicast @@ -163,6 +163,11 @@ definition](https://v1-7.docs.kubernetes.io/docs/api-reference/v1.7/#networkpoli all multicast traffic) by adding `--allow-mcast=false` as an argument to `weave-npc` in the YAML configuration. +**Note:** Since ingress traffic is masqueraded, it makes sense to use +`ipBlock` selector in an ingress rule only when limiting access to a Service +annotated with `externalTrafficPolicy=Local` or between Pods when `podIP` is used +to access a Pod. + ## Troubleshooting The first thing to check is whether Weave Net is up and