Skip to content

Commit 36f188c

Browse files
author
Yongli Chen
authored
Merge policies (#390)
1 parent 8bf1124 commit 36f188c

18 files changed

+5416
-1158
lines changed

‎npm/ipsm/ipsm.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@ func (ipsMgr *IpsetManager) DeleteList(listName string) error {
119119

120120
// AddToList inserts an ipset to an ipset list.
121121
func (ipsMgr *IpsetManager) AddToList(listName string, setName string) error {
122+
if listName == setName {
123+
return nil
124+
}
125+
122126
if ipsMgr.Exists(listName, setName, util.IpsetSetListFlag) {
123127
return nil
124128
}

‎npm/iptm/iptm.go‎

Lines changed: 40 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ const (
2727
type IptEntry struct {
2828
Command string
2929
Name string
30-
HashedName string
3130
Chain string
3231
Flag string
3332
LockWaitTimeInSeconds string
@@ -80,9 +79,9 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
8079
// Add default allow CONNECTED/RELATED rule to AZURE-NPM chain.
8180
entry.Chain = util.IptablesAzureChain
8281
entry.Specs = []string{
83-
util.IptablesMatchFlag,
82+
util.IptablesModuleFlag,
83+
util.IptablesStateModuleFlag,
8484
util.IptablesStateFlag,
85-
util.IptablesMatchStateFlag,
8685
util.IptablesRelatedState + "," + util.IptablesEstablishedState,
8786
util.IptablesJumpFlag,
8887
util.IptablesAccept,
@@ -100,12 +99,38 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
10099
}
101100
}
102101

102+
// Create AZURE-NPM-KUBE-SYSTEM chain.
103+
if err := iptMgr.AddChain(util.IptablesAzureKubeSystemChain); err != nil {
104+
return err
105+
}
106+
107+
// Append AZURE-NPM-KUBE-SYSTEM chain to AZURE-NPM chain.
108+
entry = &IptEntry{
109+
Chain: util.IptablesAzureChain,
110+
Specs: []string{
111+
util.IptablesJumpFlag,
112+
util.IptablesAzureKubeSystemChain,
113+
},
114+
}
115+
exists, err = iptMgr.Exists(entry)
116+
if err != nil {
117+
return err
118+
}
119+
120+
if !exists {
121+
iptMgr.OperationFlag = util.IptablesAppendFlag
122+
if _, err = iptMgr.Run(entry); err != nil {
123+
log.Errorf("Error: failed to add AZURE-NPM-KUBE-SYSTEM chain to AZURE-NPM chain.")
124+
return err
125+
}
126+
}
127+
103128
// Create AZURE-NPM-INGRESS-PORT chain.
104129
if err := iptMgr.AddChain(util.IptablesAzureIngressPortChain); err != nil {
105130
return err
106131
}
107132

108-
// Insert AZURE-NPM-INGRESS-PORT chain to AZURE-NPM chain.
133+
// Append AZURE-NPM-INGRESS-PORT chain to AZURE-NPM chain.
109134
entry.Chain = util.IptablesAzureChain
110135
entry.Specs = []string{util.IptablesJumpFlag, util.IptablesAzureIngressPortChain}
111136
exists, err = iptMgr.Exists(entry)
@@ -121,13 +146,8 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
121146
}
122147
}
123148

124-
// Create AZURE-NPM-INGRESS-FROM-NS chain.
125-
if err = iptMgr.AddChain(util.IptablesAzureIngressFromNsChain); err != nil {
126-
return err
127-
}
128-
129-
// Create AZURE-NPM-INGRESS-FROM-POD chain.
130-
if err = iptMgr.AddChain(util.IptablesAzureIngressFromPodChain); err != nil {
149+
// Create AZURE-NPM-INGRESS-FROM chain.
150+
if err = iptMgr.AddChain(util.IptablesAzureIngressFromChain); err != nil {
131151
return err
132152
}
133153

@@ -152,13 +172,8 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
152172
}
153173
}
154174

155-
// Create AZURE-NPM-EGRESS-TO-NS chain.
156-
if err = iptMgr.AddChain(util.IptablesAzureEgressToNsChain); err != nil {
157-
return err
158-
}
159-
160-
// Create AZURE-NPM-EGRESS-TO-POD chain.
161-
if err = iptMgr.AddChain(util.IptablesAzureEgressToPodChain); err != nil {
175+
// Create AZURE-NPM-EGRESS-TO chain.
176+
if err = iptMgr.AddChain(util.IptablesAzureEgressToChain); err != nil {
162177
return err
163178
}
164179

@@ -167,7 +182,7 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
167182
return err
168183
}
169184

170-
// Insert AZURE-NPM-TARGET-SETS chain to AZURE-NPM chain.
185+
// Append AZURE-NPM-TARGET-SETS chain to AZURE-NPM chain.
171186
entry.Chain = util.IptablesAzureChain
172187
entry.Specs = []string{util.IptablesJumpFlag, util.IptablesAzureTargetSetsChain}
173188
exists, err = iptMgr.Exists(entry)
@@ -190,12 +205,11 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
190205
func (iptMgr *IptablesManager) UninitNpmChains() error {
191206
IptablesAzureChainList := []string{
192207
util.IptablesAzureChain,
208+
util.IptablesAzureKubeSystemChain,
193209
util.IptablesAzureIngressPortChain,
194-
util.IptablesAzureIngressFromNsChain,
195-
util.IptablesAzureIngressFromPodChain,
210+
util.IptablesAzureIngressFromChain,
196211
util.IptablesAzureEgressPortChain,
197-
util.IptablesAzureEgressToNsChain,
198-
util.IptablesAzureEgressToPodChain,
212+
util.IptablesAzureEgressToChain,
199213
util.IptablesAzureTargetSetsChain,
200214
}
201215

@@ -282,6 +296,7 @@ func (iptMgr *IptablesManager) DeleteChain(chain string) error {
282296
log.Printf("Chain doesn't exist %s.", entry.Chain)
283297
return nil
284298
}
299+
285300
log.Errorf("Error: failed to delete iptables chain %s.", entry.Chain)
286301
return err
287302
}
@@ -291,7 +306,7 @@ func (iptMgr *IptablesManager) DeleteChain(chain string) error {
291306

292307
// Add adds a rule in iptables.
293308
func (iptMgr *IptablesManager) Add(entry *IptEntry) error {
294-
log.Printf("Add iptables entry: %+v.", entry)
309+
log.Printf("Adding iptables entry: %+v.", entry)
295310

296311
exists, err := iptMgr.Exists(entry)
297312
if err != nil {
@@ -302,7 +317,7 @@ func (iptMgr *IptablesManager) Add(entry *IptEntry) error {
302317
return nil
303318
}
304319

305-
iptMgr.OperationFlag = util.IptablesInsertionFlag
320+
iptMgr.OperationFlag = util.IptablesAppendFlag
306321
if _, err := iptMgr.Run(entry); err != nil {
307322
log.Errorf("Error: failed to create iptables rules.")
308323
return err

‎npm/namespace.go‎

Lines changed: 56 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,25 @@ import (
1414
)
1515

1616
type namespace struct {
17-
name string
18-
setMap map[string]string
19-
podMap map[types.UID]*corev1.Pod
20-
npMap map[string]*networkingv1.NetworkPolicy
21-
ipsMgr *ipsm.IpsetManager
22-
iptMgr *iptm.IptablesManager
17+
name string
18+
setMap map[string]string
19+
podMap map[types.UID]*corev1.Pod
20+
rawNpMap map[string]*networkingv1.NetworkPolicy
21+
processedNpMap map[string]*networkingv1.NetworkPolicy
22+
ipsMgr *ipsm.IpsetManager
23+
iptMgr *iptm.IptablesManager
2324
}
2425

2526
// newNS constructs a new namespace object.
2627
func newNs(name string) (*namespace, error) {
2728
ns := &namespace{
28-
name: name,
29-
setMap: make(map[string]string),
30-
podMap: make(map[types.UID]*corev1.Pod),
31-
npMap: make(map[string]*networkingv1.NetworkPolicy),
32-
ipsMgr: ipsm.NewIpsetManager(),
33-
iptMgr: iptm.NewIptablesManager(),
29+
name: name,
30+
setMap: make(map[string]string),
31+
podMap: make(map[types.UID]*corev1.Pod),
32+
rawNpMap: make(map[string]*networkingv1.NetworkPolicy),
33+
processedNpMap: make(map[string]*networkingv1.NetworkPolicy),
34+
ipsMgr: ipsm.NewIpsetManager(),
35+
iptMgr: iptm.NewIptablesManager(),
3436
}
3537

3638
return ns, nil
@@ -40,16 +42,26 @@ func isSystemNs(nsObj *corev1.Namespace) bool {
4042
return nsObj.ObjectMeta.Name == util.KubeSystemFlag
4143
}
4244

45+
func (ns *namespace) policyExists(npObj *networkingv1.NetworkPolicy) bool {
46+
if np, exists := ns.rawNpMap[npObj.ObjectMeta.Name]; exists {
47+
if isSamePolicy(np, npObj) {
48+
return true
49+
}
50+
}
51+
52+
return false
53+
}
54+
4355
// InitAllNsList syncs all-namespace ipset list.
4456
func (npMgr *NetworkPolicyManager) InitAllNsList() error {
4557
allNs := npMgr.nsMap[util.KubeAllNamespacesFlag]
46-
for nsName := range npMgr.nsMap {
47-
if nsName == util.KubeAllNamespacesFlag {
58+
for ns:= range npMgr.nsMap {
59+
if ns == util.KubeAllNamespacesFlag {
4860
continue
4961
}
5062

51-
if err := allNs.ipsMgr.AddToList(util.KubeAllNamespacesFlag, nsName); err != nil {
52-
log.Errorf("Error: failed to add namespace set %s to list %s", nsName, util.KubeAllNamespacesFlag)
63+
if err := allNs.ipsMgr.AddToList(util.KubeAllNamespacesFlag, ns); err != nil {
64+
log.Errorf("Error: failed to add namespace set %s to ipset list %s", ns, util.KubeAllNamespacesFlag)
5365
return err
5466
}
5567
}
@@ -60,13 +72,13 @@ func (npMgr *NetworkPolicyManager) InitAllNsList() error {
6072
// UninitAllNsList cleans all-namespace ipset list.
6173
func (npMgr *NetworkPolicyManager) UninitAllNsList() error {
6274
allNs := npMgr.nsMap[util.KubeAllNamespacesFlag]
63-
for nsName := range npMgr.nsMap {
64-
if nsName == util.KubeAllNamespacesFlag {
75+
for ns := range npMgr.nsMap {
76+
if ns == util.KubeAllNamespacesFlag {
6577
continue
6678
}
6779

68-
if err := allNs.ipsMgr.DeleteFromList(util.KubeAllNamespacesFlag, nsName); err != nil {
69-
log.Errorf("Error: failed to delete namespace set %s from list %s", nsName, util.KubeAllNamespacesFlag)
80+
if err := allNs.ipsMgr.DeleteFromList(util.KubeAllNamespacesFlag, ns); err != nil {
81+
log.Errorf("Error: failed to delete namespace set %s from list %s", ns, util.KubeAllNamespacesFlag)
7082
return err
7183
}
7284
}
@@ -81,8 +93,8 @@ func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
8193

8294
var err error
8395

84-
nsName, nsNs, nsLabel := nsObj.ObjectMeta.Name, nsObj.ObjectMeta.Namespace, nsObj.ObjectMeta.Labels
85-
log.Printf("NAMESPACE CREATING: [%s/%s/%+v]", nsName, nsNs, nsLabel)
96+
nsName, nsLabel := "ns-" + nsObj.ObjectMeta.Name, nsObj.ObjectMeta.Labels
97+
log.Printf("NAMESPACE CREATING: [%s/%v]", nsName, nsLabel)
8698

8799
ipsMgr := npMgr.nsMap[util.KubeAllNamespacesFlag].ipsMgr
88100
// Create ipset for the namespace.
@@ -97,16 +109,21 @@ func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
97109
}
98110

99111
// Add the namespace to its label's ipset list.
100-
var labelKeys []string
101112
nsLabels := nsObj.ObjectMeta.Labels
102113
for nsLabelKey, nsLabelVal := range nsLabels {
103-
labelKey := util.GetNsIpsetName(nsLabelKey, nsLabelVal)
114+
labelKey := "ns-" + nsLabelKey
104115
log.Printf("Adding namespace %s to ipset list %s", nsName, labelKey)
105116
if err = ipsMgr.AddToList(labelKey, nsName); err != nil {
106117
log.Errorf("Error: failed to add namespace %s to ipset list %s", nsName, labelKey)
107118
return err
108119
}
109-
labelKeys = append(labelKeys, labelKey)
120+
121+
label := "ns-" + nsLabelKey + ":" + nsLabelVal
122+
log.Printf("Adding namespace %s to ipset list %s", nsName, label)
123+
if err = ipsMgr.AddToList(label, nsName); err != nil {
124+
log.Errorf("Error: failed to add namespace %s to ipset list %s", nsName, label)
125+
return err
126+
}
110127
}
111128

112129
ns, err := newNs(nsName)
@@ -122,11 +139,11 @@ func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
122139
func (npMgr *NetworkPolicyManager) UpdateNamespace(oldNsObj *corev1.Namespace, newNsObj *corev1.Namespace) error {
123140
var err error
124141

125-
oldNsName, oldNsNs, oldNsLabel := oldNsObj.ObjectMeta.Name, oldNsObj.ObjectMeta.Namespace, oldNsObj.ObjectMeta.Labels
126-
newNsName, newNsNs, newNsLabel := newNsObj.ObjectMeta.Name, newNsObj.ObjectMeta.Namespace, newNsObj.ObjectMeta.Labels
142+
oldNsNs, oldNsLabel := "ns-" + oldNsObj.ObjectMeta.Name, oldNsObj.ObjectMeta.Labels
143+
newNsNs, newNsLabel := "ns-" + newNsObj.ObjectMeta.Name, newNsObj.ObjectMeta.Labels
127144
log.Printf(
128-
"NAMESPACE UPDATING:\n old namespace: [%s/%s/%+v]\n new namespace: [%s/%s/%+v]",
129-
oldNsName, oldNsNs, oldNsLabel, newNsName, newNsNs, newNsLabel,
145+
"NAMESPACE UPDATING:\n old namespace: [%s/%v]\n new namespace: [%s/%v]",
146+
oldNsNs, oldNsLabel, newNsNs, newNsLabel,
130147
)
131148

132149
if err = npMgr.DeleteNamespace(oldNsObj); err != nil {
@@ -149,8 +166,8 @@ func (npMgr *NetworkPolicyManager) DeleteNamespace(nsObj *corev1.Namespace) erro
149166

150167
var err error
151168

152-
nsName, nsNs, nsLabel := nsObj.ObjectMeta.Name, nsObj.ObjectMeta.Namespace, nsObj.ObjectMeta.Labels
153-
log.Printf("NAMESPACE DELETING: [%s/%s/%+v]", nsName, nsNs, nsLabel)
169+
nsName, nsLabel := "ns-" + nsObj.ObjectMeta.Name, nsObj.ObjectMeta.Labels
170+
log.Printf("NAMESPACE DELETING: [%s/%v]", nsName, nsLabel)
154171

155172
_, exists := npMgr.nsMap[nsName]
156173
if !exists {
@@ -159,16 +176,21 @@ func (npMgr *NetworkPolicyManager) DeleteNamespace(nsObj *corev1.Namespace) erro
159176

160177
// Delete the namespace from its label's ipset list.
161178
ipsMgr := npMgr.nsMap[util.KubeAllNamespacesFlag].ipsMgr
162-
var labelKeys []string
163179
nsLabels := nsObj.ObjectMeta.Labels
164180
for nsLabelKey, nsLabelVal := range nsLabels {
165-
labelKey := util.GetNsIpsetName(nsLabelKey, nsLabelVal)
181+
labelKey := "ns-" + nsLabelKey
166182
log.Printf("Deleting namespace %s from ipset list %s", nsName, labelKey)
167183
if err = ipsMgr.DeleteFromList(labelKey, nsName); err != nil {
168184
log.Errorf("Error: failed to delete namespace %s from ipset list %s", nsName, labelKey)
169185
return err
170186
}
171-
labelKeys = append(labelKeys, labelKey)
187+
188+
label := "ns-" + nsLabelKey + ":" + nsLabelVal
189+
log.Printf("Deleting namespace %s from ipset list %s", nsName, label)
190+
if err = ipsMgr.DeleteFromList(label, nsName); err != nil {
191+
log.Errorf("Error: failed to delete namespace %s from ipset list %s", nsName, label)
192+
return err
193+
}
172194
}
173195

174196
// Delete the namespace from all-namespace ipset list.

‎npm/npm.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ type NetworkPolicyManager struct {
4848
nodeName string
4949
nsMap map[string]*namespace
5050
isAzureNpmChainCreated bool
51+
isSafeToCleanUpAzureNpmChain bool
5152

5253
clusterState telemetry.ClusterState
5354
reportManager *telemetry.ReportManager
@@ -219,6 +220,7 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
219220
nodeName: os.Getenv("HOSTNAME"),
220221
nsMap: make(map[string]*namespace),
221222
isAzureNpmChainCreated: false,
223+
isSafeToCleanUpAzureNpmChain: false,
222224
clusterState: telemetry.ClusterState{
223225
PodCount: 0,
224226
NsCount: 0,

0 commit comments

Comments
 (0)