reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,798 Commits 7 Branches 85 Tags
c5772c814c670290ef93e332facf535bdfdb95d5
Commit Graph
6798 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martynas Pumputis c5772c814c npc: Add comments for traffic steering 2018-07-24 10:06:55 +02:00
Martynas Pumputis 10a5b6fb51 npc: Use constants for chains 2018-07-24 10:06:55 +02:00
Martynas Pumputis 07d31a8558 npc: Get rid of the legacy netpol 2018-07-24 10:06:55 +02:00
Martynas Pumputis cf3a3be8f2 npc: Replace isNil by reflect.IsNil 2018-07-24 10:06:23 +02:00
Martynas Pumputis 49224ec9f7 npc: Rename policy{Ingress,Egress} to policyType{Ingress,Egress} 2018-07-24 10:06:23 +02:00
Martynas Pumputis dee24aec65 npc: Add integration test for egress 
Also, install dig (bind-tools) in the network-tester image.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 9a63ade1b5 npc: Do not create WEAVE-NPC-EGRESS* chains in legacy netpol mode 2018-07-24 10:06:23 +02:00
Martynas Pumputis 18a6237ec7 npc: Check whether weave-local-pods exists before creating 
We do not destroy it anymore, thus the check.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis be8298926a npc: Pass --use-legacy-netpol to weaver in 840 2018-07-24 10:06:23 +02:00
Martynas Pumputis 86958be6cf npc: Add --use-legacy-netpol flag to weaver 
Egress does not work in the legacy netpol mode, so in the legacy case
we don't have to create the egress traffic steering rules. Otherwise,
some traffic will be blocked.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis a2d07c85da npc: Remove WEAVE-NPC-EGRESS* chains upon "weave reset" 
Also, fix removal of rule which steers traffic for ingress
processing.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 295ddc5248 npc: Try not to clear WEAVE-NPC-EGRESS chain 
First check whether the chain exists with the required rules, and
if not - create it.

If we flush each time we start weave-npc then we create a (short)
time window during which all egress traffic is allowed.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis a85a19e40a npc: Add unit test for egress policy with ipblock 2018-07-24 10:06:23 +02:00
Martynas Pumputis cec3c8a846 npc: Add iptables mocked interface 2018-07-24 10:06:23 +02:00
Martynas Pumputis 7da7ce85df npc: Extend TestDefaultAllow unit test to include egress 2018-07-24 10:06:23 +02:00
Martynas Pumputis 6055431b6f npc: Refactor bypassRules 2018-07-24 10:06:23 +02:00
Martynas Pumputis c0e2deb5a0 npc: Add WEAVE-NPC-EGRESS-ACCEPT chain 
For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 1f86ed55ba npc: Ensure default-allow rules for egress 2018-07-24 10:06:23 +02:00
Martynas Pumputis 35f1ba17e1 npc: Provision egress rules 2018-07-24 10:06:23 +02:00
Martynas Pumputis b84fbf86ec npc: Add a dummy isNil method to ruleHost interface 2018-07-24 10:06:23 +02:00
Martynas Pumputis a5e0b3452d npc: Create rules with IPBlock (egress only) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 0a1ca30aae npc: Add getRuleSpec for ipBlockSpec 2018-07-24 10:06:23 +02:00
Martynas Pumputis 2e85018c26 npc: Add ruleHost interface 
The idea for the interface is taken from the kitt1987/ipblock work.

The interface is going to be implemented by selectorSpec and
ipBlockSpec.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis affdc6f5af npc: Provision networkingv1.IPBlock (only for Egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 9198bb5a68 npc: Refactor npc/ipblock.go 
- No need to validate networkingv1.IPBlock fields as k8s does it.
- Fix provisioning.
 2018-07-24 10:06:23 +02:00
Kitt Hsu 9769c8d5b9 support ipblock in npc 
NOTE(brb): This commit is cherry-picked from the kitt1987/ipblock
branch.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 688328dc57 npc: Steer traffic for egress processing 
We need two rules:

* `-A INPUT -i weave -j WEAVE-NPC-EGRESS`: applies to packets destined
  to a local node.
* `-A FORWARD -i weave -j WEAVE-NPC-EGRESS`: the rest. It can match
  an ingress packet.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8904a4b144 npc: Get rid of selectorSpec.target 
We treat selectorSpec as a target selector if len(selectorSpec.policyTypes) > 0.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8d1ee752d4 npc: Rename dstSelector to targetSelector 
dstSelector becomes ambiguous once we introduce the egress.

So, from now on, we call selector a target selector if it selects
pods to which a netpol applies (aka NetworkPolicySpec.podSelector).
 2018-07-24 10:06:23 +02:00
Martynas Pumputis f02a11b27b npc: Analyse egress policy 
This is a copy-paste from the ingress part with small modifications.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 5e675f26f7 npc: Embed policyType into rule 
This ensures two rules with the same rulespec but of different
policyType will end up having different keys.

Sharing the same key would prevent from provisioning the rules.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 497a9c7fd0 npc: Replace rulesType by policyType 2018-07-24 10:06:23 +02:00
Martynas Pumputis 5afcd0595d npc: Parse PolicyTypes field when analysing a netpol 2018-07-24 10:06:23 +02:00
Martynas Pumputis f27d4d2117 npc: Add defaultAllowIPSetName helper 2018-07-24 10:06:23 +02:00
Martynas Pumputis 79727a86fa npc: Manage entries in egressDefaultAllowIPSet 2018-07-24 10:06:23 +02:00
Martynas Pumputis d474c1c26d npc: Add policyType to selectorSpec 
This allows us to distinguish between ingress and egress
dst selectors (required when managing entries in default-allow
ipsets).
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 29ec43bdc8 npc: Rename default-allow ipset for ingress 
As we're going to introduce one for egress, we cannot use
"default-allow" name for ingress.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis cabc05b06c npc: Add rule type (ingress, egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 89e820d62e npc: Create WEAVE-NPC-EGRESS chain with the base rules 
The following rules are provisioned by weave-npc:

-A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
-A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
-A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
-A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
-A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP

-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j RETURN

-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j RETURN

For each rule we create two (mark and return). We cannot just accept
a packet if it matches any rule, as a packet might need to traverse
the ingress npc as well which happens later in the chain (in some cases
we cannot detect whether packet is ingress or egress, so we need to
check both chains).
 2018-07-24 10:06:23 +02:00
Bryan Boreham 88616007b0 Merge pull request #3353 from louismunro/fix_xtables_lock 
Fix xtables.lock race condition between weave and kube-proxy.
 2018-07-23 13:35:26 +01:00
Munro, Louis b262a1eedc Fix xtables.lock race condition between weave and kube-proxy. 
Fixes #3351
 2018-07-22 13:12:00 -04:00
Bryan Boreham b8ce722a2c Merge pull request #3346 from murali-reddy/issue-3206 
3206: Protect against CNI plugin being called with the host namespace
 2018-07-19 12:02:49 +01:00
Bryan Boreham b8fa4af06a Merge branch '2.3' 2018-07-17 12:25:49 +01:00
Bryan Boreham ea8f041a20 Fix indentation of TOC 2018-07-17 11:38:09 +01:00
Bryan Boreham 52e8cdb011 Merge pull request #3348 from weaveworks/check-running 
Add instructions to check weave-kube logs
 2018-07-17 11:35:29 +01:00
Bryan Boreham ac9f47783c Review feedback 2018-07-17 10:24:26 +01:00
Murali Reddy 27f9aa16d6 3206: Protect against CNI plugin being called with the host namespace 
adding a check to verify if network namespace is not host network namespace

Fixes #3206
 2018-07-16 12:43:09 +05:30
Bryan Boreham 08dc649b9a Merge branch '2.3' 2018-07-12 08:58:54 +00:00
Bryan Boreham bb1a373272 Add instructions to check weave-kube logs 
"Check it is running" and "check the logs" are important steps when
troubleshooting.
 2018-07-12 08:53:02 +00:00
Martynas Pumputis e192f68891 Merge pull request #3345 from stevenjohnstone/issues/3337-symlink-upgrades-broken 
Issue #3337: fix upgrade_cni_plugin

Fix #3337
 2018-07-09 12:17:32 +02:00