Skip to content

Commit 2c0ae6d

Browse files
matmerrjaer-tsun
matmerr
authored and
jaer-tsun
committed
Allow egress all and ingress all without target set (#435)
* allow all egress and ingress without drop * remove comment breaks * update test * remove sleep and socket cleanup * address feedback * all namespaces * fix tests * update npm test * aks-engine * aks-engine * pipeline * pipeline * pipeline * pipeline * remove comment breaks * remove comment breaks * remove comment breaks * remove comment breaks * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline * pipeline
1 parent cd236e1 commit 2c0ae6d

File tree

8 files changed

+137
-28
lines changed

8 files changed

+137
-28
lines changed

‎.pipelines/e2e-job-template.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,22 @@ parameters:
99
jobs:
1010
- job: ${{ parameters.name }}
1111
dependsOn: unit_tests
12+
timeoutInMinutes: 90
1213
pool:
1314
name: Networking-ContainerNetworking
1415
demands: agent.os -equals Linux
1516
container:
1617
image: ${{ parameters.pipelineBuildImage }}
1718
variables:
18-
GOPATH: "$(System.DefaultWorkingDirectory)/gopath"
19+
GOPATH: "$(Agent.TempDirectory)/go" # Go workspace path
1920
GOBIN: "$(GOPATH)/bin" # Go binaries path
2021
modulePath: "$(GOPATH)/src/github.com/Azure/aks-engine"
2122
acnPath: "$(GOPATH)/src/github.com/Azure/azure-container-networking"
2223
Tag: $[ dependencies.unit_tests.outputs['EnvironmentalVariables.Tag'] ]
2324
CommitHash: $[ dependencies.unit_tests.outputs['EnvironmentalVariables.CommitHash'] ]
24-
25+
CLEANUP_ON_EXIT: true
26+
CLEANUP_IF_FAIL: true
27+
AKS_ENGINE_VERSION: v0.41.3
2528
steps:
2629
- template: e2e-step-template.yaml
2730
parameters:

‎.pipelines/e2e-step-template.yaml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,15 @@ steps:
2929

3030
- bash: |
3131
ls -lah
32-
export CNI_URL='"'https://$(ARTIFACT_STORAGE).blob.core.windows.net/acn-$(CommitHash)/azure-vnet-cni-${{ parameters.clusterDefinitionCniBuildOS }}-amd64-$(Tag)${{ parameters.clusterDefinitionCniBuildExt }}'"'
32+
export CNI_URL=https://$(ARTIFACT_STORAGE).blob.core.windows.net/acn-$(CommitHash)/azure-vnet-cni-${{ parameters.clusterDefinitionCniBuildOS }}-amd64-$(Tag)${{ parameters.clusterDefinitionCniBuildExt }}
3333
export CNI_TYPE=${{ parameters.clusterDefinitionCniTypeKey }}
3434
echo CNI type is $CNI_TYPE
35-
sed -i "s|\"$CNI_TYPE\":\".*\"|\"$CNI_TYPE\":$CNI_URL|g" '${{ parameters.clusterDefinition }}'
36-
sed -i "s|\"azureCNIVersion\":\".*\"|\"azureCNIVersion\":\"$(Tag)\"|g" '${{ parameters.clusterDefinition }}'
35+
#sed -i "s|\"$CNI_TYPE\":\".*\"|\"$CNI_TYPE\":$CNI_URL|g" '${{ parameters.clusterDefinition }}'
36+
# sed -i "s|\"$CNI_TYPE\":\".*\"|\"$CNI_TYPE\":$CNI_URL|g" '${{ parameters.clusterDefinition }}'
37+
cat '${{ parameters.clusterDefinition }}' | jq --arg cnikey $CNI_TYPE --arg cniurl $CNI_URL '.properties.orchestratorProfile.kubernetesConfig[$cnikey]= $cniurl' > '${{ parameters.clusterDefinition }}'.tmp #
38+
# sed -i "s|\"azureCNIVersion\":\".*\"|\"azureCNIVersion\":\"$(Tag)\"|g" '${{ parameters.clusterDefinition }}'
39+
#sed -i "s|\"azureCNIVersion\":\".*\"|\"azureCNIVersion\":\"$(Tag)\"|g" '${{ parameters.clusterDefinition }}'
40+
cat '${{ parameters.clusterDefinition }}'.tmp | jq --arg tag $(Tag) '.properties.orchestratorProfile.kubernetesConfig.azureCNIVersion = $tag' > '${{ parameters.clusterDefinition }}'
3741
echo "Running E2E tests against a cluster built with the following API model:"
3842
cat '${{ parameters.clusterDefinition }}'
3943
cp ${{ parameters.clusterDefinition }} clusterDefinition.json
@@ -61,6 +65,10 @@ steps:
6165
mkdir -p $(Build.ArtifactStagingDirectory)/kube-${{ parameters.name }}
6266
cp -r _output/k*/kubeconfig/kubeconfig.$REGIONS.json $(Build.ArtifactStagingDirectory)/kube-${{ parameters.name }}
6367
cp -r _output/kubernetes-*-ssh $(Build.ArtifactStagingDirectory)/kube-${{ parameters.name }}
68+
echo "Deleting work directory"
69+
sudo rm -rf ./
70+
echo "Deleting file in GOPATH"
71+
sudo rm -rf '$(GOPATH)'
6472
name: DeployAKSEngine
6573
displayName: Deploy AKS-Engine
6674
workingDirectory: "$(modulePath)"

‎cni/telemetry/service/telemetrymain.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,10 @@ func main() {
123123

124124
log.Logf("read config returned %+v", config)
125125

126+
// Cleaning up orphan socket if present
127+
tbtemp := telemetry.NewTelemetryBuffer("")
128+
tbtemp.Cleanup(telemetry.FdName)
129+
126130
for {
127131
tb = telemetry.NewTelemetryBuffer("")
128132

‎npm/nwpolicy.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
package npm
44

55
import (
6-
"github.com/Azure/azure-container-networking/npm/iptm"
76
"github.com/Azure/azure-container-networking/log"
7+
"github.com/Azure/azure-container-networking/npm/iptm"
88
"github.com/Azure/azure-container-networking/npm/util"
99
networkingv1 "k8s.io/api/networking/v1"
1010
)
@@ -33,7 +33,7 @@ func (npMgr *NetworkPolicyManager) AddNetworkPolicy(npObj *networkingv1.NetworkP
3333
ns *namespace
3434
)
3535

36-
npNs, npName := "ns-" + npObj.ObjectMeta.Namespace, npObj.ObjectMeta.Name
36+
npNs, npName := "ns-"+npObj.ObjectMeta.Namespace, npObj.ObjectMeta.Name
3737
log.Printf("NETWORK POLICY CREATING: %v", npObj)
3838

3939
var exists bool
@@ -148,7 +148,7 @@ func (npMgr *NetworkPolicyManager) DeleteNetworkPolicy(npObj *networkingv1.Netwo
148148
ns *namespace
149149
)
150150

151-
npNs, npName := "ns-" + npObj.ObjectMeta.Namespace, npObj.ObjectMeta.Name
151+
npNs, npName := "ns-"+npObj.ObjectMeta.Namespace, npObj.ObjectMeta.Name
152152
log.Printf("NETWORK POLICY DELETING: %v", npObj)
153153

154154
var exists bool
@@ -178,14 +178,14 @@ func (npMgr *NetworkPolicyManager) DeleteNetworkPolicy(npObj *networkingv1.Netwo
178178
if err != nil {
179179
log.Printf("Error deducting policy %s from %s", npName, oldPolicy.ObjectMeta.Name)
180180
}
181-
181+
182182
if deductedPolicy == nil {
183183
delete(ns.processedNpMap, hashedSelector)
184184
} else {
185185
ns.processedNpMap[hashedSelector] = deductedPolicy
186186
}
187187
}
188-
188+
189189
if npMgr.canCleanUpNpmChains() {
190190
if err = iptMgr.UninitNpmChains(); err != nil {
191191
log.Errorf("Error: failed to uninitialize azure-npm chains.")

‎npm/plugin/main.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,6 @@ func main() {
6262

6363
go npMgr.SendNpmTelemetry()
6464

65-
time.Sleep(time.Second * waitForTelemetryInSeconds)
66-
6765
if err = npMgr.Start(wait.NeverStop); err != nil {
6866
log.Logf("npm failed with error %v.", err)
6967
panic(err.Error)

‎npm/pod.go‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,7 @@ import (
1010
)
1111

1212
func isValidPod(podObj *corev1.Pod) bool {
13-
return podObj.Status.Phase != corev1.PodPhase(util.KubePodStatusFailedFlag) &&
14-
podObj.Status.Phase != corev1.PodPhase(util.KubePodStatusSucceededFlag) &&
15-
podObj.Status.Phase != corev1.PodPhase(util.KubePodStatusUnknownFlag) &&
16-
len(podObj.Status.PodIP) > 0
13+
return len(podObj.Status.PodIP) > 0
1714
}
1815

1916
func isSystemPod(podObj *corev1.Pod) bool {
@@ -142,7 +139,7 @@ func (npMgr *NetworkPolicyManager) DeletePod(podObj *corev1.Pod) error {
142139
if err = ipsMgr.DeleteFromSet(podLabelKey, podIP); err != nil {
143140
log.Errorf("Error: failed to delete pod from label ipset.")
144141
return err
145-
}
142+
}
146143

147144
label := podLabelKey + ":" + podLabelVal
148145
log.Printf("Deleting pod %s from ipset %s", podIP, label)

‎npm/translatePolicy.go‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -964,9 +964,9 @@ func getAllowKubeSystemEntries(ns string, targetSelector metav1.LabelSelector) [
964964
// 3. iptables entries generated from the input network policy object.
965965
func translatePolicy(npObj *networkingv1.NetworkPolicy) ([]string, []string, []*iptm.IptEntry) {
966966
var (
967-
resultSets []string
968-
resultLists []string
969-
entries []*iptm.IptEntry
967+
resultSets []string
968+
resultLists []string
969+
entries []*iptm.IptEntry
970970
hasIngress, hasEgress bool
971971
)
972972

@@ -1010,20 +1010,36 @@ func translatePolicy(npObj *networkingv1.NetworkPolicy) ([]string, []string, []*
10101010
resultSets = append(resultSets, ingressSets...)
10111011
resultLists = append(resultLists, ingressLists...)
10121012
entries = append(entries, ingressEntries...)
1013-
hasIngress = true
1013+
1014+
if npObj.Spec.Ingress != nil &&
1015+
len(npObj.Spec.Ingress) == 1 &&
1016+
len(npObj.Spec.Ingress[0].Ports) == 0 &&
1017+
len(npObj.Spec.Ingress[0].From) == 0 {
1018+
hasIngress = false
1019+
} else {
1020+
hasIngress = true
1021+
}
10141022
}
10151023

10161024
if ptype == networkingv1.PolicyTypeEgress {
10171025
egressSets, egressLists, egressEntries := translateEgress(npNs, npObj.Spec.PodSelector, npObj.Spec.Egress)
10181026
resultSets = append(resultSets, egressSets...)
10191027
resultLists = append(resultLists, egressLists...)
10201028
entries = append(entries, egressEntries...)
1021-
hasEgress = true
1029+
1030+
if npObj.Spec.Egress != nil &&
1031+
len(npObj.Spec.Egress) == 1 &&
1032+
len(npObj.Spec.Egress[0].Ports) == 0 &&
1033+
len(npObj.Spec.Egress[0].To) == 0 {
1034+
hasEgress = false
1035+
} else {
1036+
hasEgress = true
1037+
}
10221038
}
10231039
}
10241040

10251041
entries = append(entries, getDefaultDropEntries(npNs, npObj.Spec.PodSelector, hasIngress, hasEgress)...)
1026-
1042+
log.Printf("Translating Policy: %+v", npObj)
10271043
resultSets, resultLists = util.UniqueStrSlice(resultSets), util.UniqueStrSlice(resultLists)
10281044

10291045
return resultSets, resultLists, entries

‎npm/translatePolicy_test.go‎

Lines changed: 88 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1271,7 +1271,7 @@ func TestTranslatePolicy(t *testing.T) {
12711271
},
12721272
}
12731273
expectedIptEntries = append(expectedIptEntries, nonKubeSystemEntries...)
1274-
expectedIptEntries = append(expectedIptEntries, getDefaultDropEntries("testnamespace", targetSelector, true, false)...)
1274+
expectedIptEntries = append(expectedIptEntries, getDefaultDropEntries("testnamespace", targetSelector, false, false)...)
12751275
if !reflect.DeepEqual(iptEntries, expectedIptEntries) {
12761276
t.Errorf("translatedPolicy failed @ ALLOW-all-TO-app:frontend-FROM-all-namespaces-policy policy comparison")
12771277
marshalledIptEntries, _ := json.Marshal(iptEntries)
@@ -2018,7 +2018,7 @@ func TestTranslatePolicy(t *testing.T) {
20182018
}
20192019

20202020
expectedIptEntries = append(expectedIptEntries, nonKubeSystemEntries...)
2021-
expectedIptEntries = append(expectedIptEntries, getDefaultDropEntries("dangerous", targetSelector, true, false)...)
2021+
expectedIptEntries = append(expectedIptEntries, getDefaultDropEntries("dangerous", targetSelector, false, false)...)
20222022
if !reflect.DeepEqual(iptEntries, expectedIptEntries) {
20232023
t.Errorf("translatedPolicy failed @ ALLOW-ALL-TO-app:backdoor-policy policy comparison")
20242024
marshalledIptEntries, _ := json.Marshal(iptEntries)
@@ -2325,7 +2325,6 @@ func TestTranslatePolicy(t *testing.T) {
23252325
PolicyTypes: []networkingv1.PolicyType{
23262326
networkingv1.PolicyTypeEgress,
23272327
},
2328-
Egress: []networkingv1.NetworkPolicyEgressRule{},
23292328
},
23302329
}
23312330

@@ -2361,6 +2360,90 @@ func TestTranslatePolicy(t *testing.T) {
23612360
t.Errorf("expectedIptEntries: %s", marshalledExpectedIptEntries)
23622361
}
23632362

2363+
targetSelector = metav1.LabelSelector{
2364+
MatchLabels: map[string]string{
2365+
"app": "backend",
2366+
},
2367+
}
2368+
2369+
//////
2370+
/// This policy tests the case where pods should have unlimited egress traffic
2371+
//////
2372+
allowAllEgress := &networkingv1.NetworkPolicy{
2373+
ObjectMeta: metav1.ObjectMeta{
2374+
Name: "ALLOW-all-FROM-app:backend-policy",
2375+
Namespace: "testnamespace",
2376+
},
2377+
Spec: networkingv1.NetworkPolicySpec{
2378+
PodSelector: targetSelector,
2379+
PolicyTypes: []networkingv1.PolicyType{
2380+
networkingv1.PolicyTypeEgress,
2381+
},
2382+
Egress: []networkingv1.NetworkPolicyEgressRule{networkingv1.NetworkPolicyEgressRule{}},
2383+
},
2384+
}
2385+
2386+
sets, lists, iptEntries = translatePolicy(allowAllEgress)
2387+
2388+
expectedSets = []string{
2389+
"app:backend",
2390+
}
2391+
if !reflect.DeepEqual(sets, expectedSets) {
2392+
t.Errorf("translatedPolicy failed @ ALLOW-all-FROM-app:backend-policy sets comparison")
2393+
t.Errorf("sets: %v", sets)
2394+
t.Errorf("expectedSets: %v", expectedSets)
2395+
}
2396+
2397+
expectedLists = []string{
2398+
util.KubeAllNamespacesFlag,
2399+
}
2400+
if !reflect.DeepEqual(lists, expectedLists) {
2401+
t.Errorf("translatedPolicy failed @ ALLOW-all-FROM-app:backend-policy lists comparison")
2402+
t.Errorf("lists: %v", lists)
2403+
t.Errorf("expectedLists: %v", expectedLists)
2404+
}
2405+
2406+
expectedIptEntries = []*iptm.IptEntry{}
2407+
expectedIptEntries = append(
2408+
expectedIptEntries,
2409+
getAllowKubeSystemEntries("testnamespace", targetSelector)...,
2410+
)
2411+
2412+
nonKubeSystemEntries = []*iptm.IptEntry{
2413+
&iptm.IptEntry{
2414+
Chain: util.IptablesAzureEgressPortChain,
2415+
Specs: []string{
2416+
util.IptablesModuleFlag,
2417+
util.IptablesSetModuleFlag,
2418+
util.IptablesMatchSetFlag,
2419+
util.GetHashedName("app:backend"),
2420+
util.IptablesSrcFlag,
2421+
util.IptablesModuleFlag,
2422+
util.IptablesSetModuleFlag,
2423+
util.IptablesMatchSetFlag,
2424+
util.GetHashedName(util.KubeAllNamespacesFlag),
2425+
util.IptablesDstFlag,
2426+
util.IptablesJumpFlag,
2427+
util.IptablesAccept,
2428+
util.IptablesModuleFlag,
2429+
util.IptablesCommentModuleFlag,
2430+
util.IptablesCommentFlag,
2431+
"ALLOW-ALL-FROM-app:backend-TO-" +
2432+
util.KubeAllNamespacesFlag,
2433+
},
2434+
},
2435+
}
2436+
expectedIptEntries = append(expectedIptEntries, nonKubeSystemEntries...)
2437+
// has egress, but empty map means allow all
2438+
expectedIptEntries = append(expectedIptEntries, getDefaultDropEntries("testnamespace", targetSelector, false, false)...)
2439+
if !reflect.DeepEqual(iptEntries, expectedIptEntries) {
2440+
t.Errorf("translatedPolicy failed @ ALLOW-all-FROM-app:backend-policy policy comparison")
2441+
marshalledIptEntries, _ := json.Marshal(iptEntries)
2442+
marshalledExpectedIptEntries, _ := json.Marshal(expectedIptEntries)
2443+
t.Errorf("iptEntries: %s", marshalledIptEntries)
2444+
t.Errorf("expectedIptEntries: %s", marshalledExpectedIptEntries)
2445+
}
2446+
23642447
targetSelector = metav1.LabelSelector{}
23652448
denyAllFromNsUnsafePolicy := &networkingv1.NetworkPolicy{
23662449
ObjectMeta: metav1.ObjectMeta{
@@ -2835,8 +2918,8 @@ func TestAllowPrecedenceOverDeny(t *testing.T) {
28352918
}
28362919
denyAllPolicy := &networkingv1.NetworkPolicy{
28372920
ObjectMeta: metav1.ObjectMeta{
2838-
Name: "default-deny",
2839-
Namespace: "default",
2921+
Name: "default-deny",
2922+
Namespace: "default",
28402923
},
28412924
Spec: networkingv1.NetworkPolicySpec{
28422925
PodSelector: targetSelector,

0 commit comments

Comments
 (0)