reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,364 Commits 7 Branches 85 Tags
master
Commit Graph
100 Commits
Author SHA1 Message Date
Raj Chaudhuri c1d3107418 Changed module name, edited default manifests in prog/weave-kube 
* Module name changed to `github.com/rajch/weave`
* Added environment variable `CHECKPOINT_DISABLE=1` to default manifests, to bypass weaveworks telemetry
 2024-03-01 18:05:19 +05:30
Bryan Boreham 8c52698222 Move egress logging rule beside drop rule 
Otherwise we might log a blocked connection even though the packet
was not dropped.
 2020-08-26 10:02:32 +00:00
Bryan Boreham b3d387fb86 Update Kubernetes client packages to 0.18.6 
Lots of functions need Context parameters added
 2020-08-04 10:11:30 +00:00
Bryan Boreham f9e27f76d6 Merge remote-tracking branch 'gobomb/fix-nil-ns-pointer' 
Needed a few modifications to resolve conflicts due to changed
datatype of UID.
 2020-08-03 12:32:31 +00:00
gobomb 2ec3e1ef1a add fake namespace uid for npc test 2020-08-02 23:42:12 +08:00
gobomb 0789670344 add namespaceLabels and namespaceUID, remove namespace in ns struct 2020-08-02 21:06:17 +08:00
Bryan Boreham 34dc4dabce Clean up some lint warnings 
I ran golangci-lint and it pointed out a few things to clean up.
 2020-07-31 10:28:55 +00:00
Bryan Boreham df52117bfa Remove unused code 2020-07-31 09:03:27 +00:00
Bryan Boreham ca4f93d0d7 Remove the dependency of 'ipset' package on Kubernetes 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs, so have it define the `UID` type.

Conceptually this is a simple change because `UID` is a `string`, but
unfortunately it is used in a lot of places.
 2020-07-29 13:08:35 +00:00
Bryan Boreham a3c76e141b Move name constants to separate 'chains' package, to reduce dependencies 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs required by `npc`.
 2020-07-29 12:55:46 +00:00
Simon Howe 94e75e45af Make ConfigureIPTables idempotent and poll it 
- Instead of EnsureBridge
- Adds ipset.ExistEntry method
- Refactor ipset method names Exist <-> EntryExists
- Turn on iptable-refresh by default (10s)
- Adds a test that checks iptables are refreshed, check EXPOSE recovers
 2020-07-15 11:35:41 +02:00
Murali Reddy 77fbb2c12b introduce weavenpc_policy_enforcement_errors prometheus metric 
to track number of errors occured during enforcing network policies

Fixes #3791
 2020-05-22 09:54:11 +00:00
Kitt Hsu a547d4571c Fix the source of iptable rules generated for Ingress NetworkPolicy when both port and IP block specified 2019-06-28 15:02:22 +08:00
Murali Reddy a6f2ee5ccc add seperate match function to matach pod/namespace/namespacedpod selectors 2019-06-07 11:52:40 +05:30
Murali Reddy 7a6ba40982 fix unit test failures 2019-05-30 15:58:18 +05:30
Murali Reddy 75e106b667 using an explicti selector set for network policies with both namespace and pod lable selectors 2019-05-30 12:03:28 +05:30
Murali Reddy bb4f51499d add support for combination of podSelector and namespaceSelector 
in network policies

- enhance selectorSpec to accomodate both pod and namespace selectors
- enhance analysePolicy to handle policies with both selectors

Fixes #3312
 2019-05-28 12:40:39 +05:30
Murali Reddy ea2084d871 return from further processign networkpolicy if base rule failed to gets created 2019-05-06 16:27:38 +05:30
Murali Reddy 4a1fbc7c38 lazily add iptables rule to drop egress traffic from the pods only 
if network policies are applied

does not address #3464 but just avoids the issue atleast for those who
dont use network policies
 2019-05-03 18:40:59 +05:30
Murali Reddy d00e7335bb dont maintain weave-local-pods ipset on pod add/delete/update 2018-10-16 14:02:23 +05:30
Martynas Pumputis f68579654b Merge pull request #3375 from weaveworks/issue-3302 
Fix weave-npc crash when named ports specified in the named ports
 2018-08-17 14:20:41 +02:00
Murali Reddy a19d025677 addressing review comment 2018-08-14 20:16:04 +05:30
Murali Reddy 6625e29071 addressing review comments 2018-08-10 19:36:18 +05:30
Murali Reddy d5e864736b weave-npc doesn't handle named ports 
Support for names ports in enhancement, but with this PR just adding more graceful failure.

Fixes #3032
 2018-08-10 18:37:08 +05:30
Martynas Pumputis c742ec4993 npc: Enable ipBlock for Ingress policy 
When using ipBlock in Ingress policy, one should be aware
that source IP addr of packet destined to Pod in many cases
is mangled, see docs/k8s-src-ip.md for the cases.

However, the mangling in some cases can be prevented with
setting externalTrafficPolicy to Local.
 2018-08-03 13:21:45 +02:00
Martynas Pumputis 1649080a35 npc: Add ns name into ipBlock ipset name 
Otherwise, the same ipBlock ipset can be used among different namespaces which
results in panic as refcounting of ipsets happens only per namespace, so
npc will try to create the same ipset twice.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis c1ee358f66 npc: Fix ipset package import path after rebase 2018-07-24 10:06:55 +02:00
Martynas Pumputis 2c708b57a1 npc: Improve analyser comments 2018-07-24 10:06:55 +02:00
Martynas Pumputis 07d31a8558 npc: Get rid of the legacy netpol 2018-07-24 10:06:55 +02:00
Martynas Pumputis cf3a3be8f2 npc: Replace isNil by reflect.IsNil 2018-07-24 10:06:23 +02:00
Martynas Pumputis 49224ec9f7 npc: Rename policy{Ingress,Egress} to policyType{Ingress,Egress} 2018-07-24 10:06:23 +02:00
Martynas Pumputis a85a19e40a npc: Add unit test for egress policy with ipblock 2018-07-24 10:06:23 +02:00
Martynas Pumputis cec3c8a846 npc: Add iptables mocked interface 2018-07-24 10:06:23 +02:00
Martynas Pumputis 7da7ce85df npc: Extend TestDefaultAllow unit test to include egress 2018-07-24 10:06:23 +02:00
Martynas Pumputis 6055431b6f npc: Refactor bypassRules 2018-07-24 10:06:23 +02:00
Martynas Pumputis c0e2deb5a0 npc: Add WEAVE-NPC-EGRESS-ACCEPT chain 
For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 1f86ed55ba npc: Ensure default-allow rules for egress 2018-07-24 10:06:23 +02:00
Martynas Pumputis 35f1ba17e1 npc: Provision egress rules 2018-07-24 10:06:23 +02:00
Martynas Pumputis b84fbf86ec npc: Add a dummy isNil method to ruleHost interface 2018-07-24 10:06:23 +02:00
Martynas Pumputis a5e0b3452d npc: Create rules with IPBlock (egress only) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 0a1ca30aae npc: Add getRuleSpec for ipBlockSpec 2018-07-24 10:06:23 +02:00
Martynas Pumputis 2e85018c26 npc: Add ruleHost interface 
The idea for the interface is taken from the kitt1987/ipblock work.

The interface is going to be implemented by selectorSpec and
ipBlockSpec.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis affdc6f5af npc: Provision networkingv1.IPBlock (only for Egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 9198bb5a68 npc: Refactor npc/ipblock.go 
- No need to validate networkingv1.IPBlock fields as k8s does it.
- Fix provisioning.
 2018-07-24 10:06:23 +02:00
Kitt Hsu 9769c8d5b9 support ipblock in npc 
NOTE(brb): This commit is cherry-picked from the kitt1987/ipblock
branch.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8904a4b144 npc: Get rid of selectorSpec.target 
We treat selectorSpec as a target selector if len(selectorSpec.policyTypes) > 0.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8d1ee752d4 npc: Rename dstSelector to targetSelector 
dstSelector becomes ambiguous once we introduce the egress.

So, from now on, we call selector a target selector if it selects
pods to which a netpol applies (aka NetworkPolicySpec.podSelector).
 2018-07-24 10:06:23 +02:00
Martynas Pumputis f02a11b27b npc: Analyse egress policy 
This is a copy-paste from the ingress part with small modifications.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 5e675f26f7 npc: Embed policyType into rule 
This ensures two rules with the same rulespec but of different
policyType will end up having different keys.

Sharing the same key would prevent from provisioning the rules.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 497a9c7fd0 npc: Replace rulesType by policyType 2018-07-24 10:06:23 +02:00