Skip to content

Commit b799db1

Browse files
rejain789rejain789
committed
revert
1 parent 19c40d7 commit b799db1

File tree

5 files changed

+190
-16
lines changed

5 files changed

+190
-16
lines changed

‎cns/middlewares/k8sSwiftV2.go‎

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"github.com/Azure/azure-container-networking/cns/middlewares/utils"
1111
"github.com/Azure/azure-container-networking/cns/types"
1212
"github.com/Azure/azure-container-networking/crd/multitenancy/api/v1alpha1"
13+
"github.com/Azure/azure-container-networking/network/policy"
1314
"github.com/pkg/errors"
1415
v1 "k8s.io/api/core/v1"
1516
k8stypes "k8s.io/apimachinery/pkg/types"
@@ -40,7 +41,9 @@ var _ cns.IPConfigsHandlerMiddleware = (*K8sSWIFTv2Middleware)(nil)
4041
// and release IP configs handlers.
4142
func (k *K8sSWIFTv2Middleware) IPConfigsRequestHandlerWrapper(defaultHandler, failureHandler cns.IPConfigsHandlerFunc) cns.IPConfigsHandlerFunc {
4243
return func(ctx context.Context, req cns.IPConfigsRequest) (*cns.IPConfigsResponse, error) {
43-
podInfo, respCode, message := k.validateIPConfigsRequest(ctx, &req)
44+
podInfo, respCode, defaultDenyACLbool, message := k.GetPodInfoForIPConfigsRequest(ctx, &req)
45+
46+
logger.Printf("defaultDenyACLbool value is: %v", defaultDenyACLbool)
4447

4548
if respCode != types.Success {
4649
return &cns.IPConfigsResponse{
@@ -55,6 +58,31 @@ func (k *K8sSWIFTv2Middleware) IPConfigsRequestHandlerWrapper(defaultHandler, fa
5558
if !req.SecondaryInterfacesExist {
5659
return ipConfigsResp, err
5760
}
61+
62+
// ipConfigsResp has infra IP configs -> if defaultDenyACLbool is enabled, add the default deny endpoint policies as a property in PodIpInfo
63+
for i := range ipConfigsResp.PodIPInfo {
64+
ipInfo := &ipConfigsResp.PodIPInfo[i]
65+
// there will be no pod connectivity to and from those pods
66+
var defaultDenyEgressPolicy, defaultDenyIngressPolicy policy.Policy
67+
68+
if defaultDenyACLbool && ipInfo.NICType == cns.InfraNIC {
69+
defaultDenyEgressPolicy, err = getEndpointPolicy(string(policy.ACLPolicy), cns.ActionTypeBlock, cns.DirectionTypeOut, 10_000)
70+
if err != nil {
71+
logger.Errorf("failed to add default deny acl's for pod %v with err %v", podInfo.Name(), err)
72+
}
73+
74+
defaultDenyIngressPolicy, err = getEndpointPolicy(string(policy.ACLPolicy), cns.ActionTypeBlock, cns.DirectionTypeIn, 10_000)
75+
if err != nil {
76+
logger.Errorf("failed to add default deny acl's for pod %v with err %v", podInfo.Name(), err)
77+
}
78+
79+
ipInfo.EndpointPolicies = append(ipInfo.EndpointPolicies, defaultDenyEgressPolicy, defaultDenyIngressPolicy)
80+
logger.Printf("Created endpoint policies for defaultDenyEgressPolicy and defaultDenyIngressPolicy")
81+
82+
break
83+
}
84+
}
85+
5886
// If the pod is v2, get the infra IP configs from the handler first and then add the SWIFTv2 IP config
5987
defer func() {
6088
// Release the default IP config if there is an error
@@ -100,21 +128,23 @@ func (k *K8sSWIFTv2Middleware) IPConfigsRequestHandlerWrapper(defaultHandler, fa
100128
}
101129
}
102130

103-
// validateIPConfigsRequest validates if pod is multitenant by checking the pod labels, used in SWIFT V2 AKS scenario.
131+
// GetPodInfoForIPConfigsRequest validates if pod is multitenant by checking the pod labels, used in SWIFT V2 AKS scenario.
104132
// nolint
105-
func (k *K8sSWIFTv2Middleware) validateIPConfigsRequest(ctx context.Context, req *cns.IPConfigsRequest) (podInfo cns.PodInfo, respCode types.ResponseCode, message string) {
133+
func (k *K8sSWIFTv2Middleware) GetPodInfoForIPConfigsRequest(ctx context.Context, req *cns.IPConfigsRequest) (podInfo cns.PodInfo, respCode types.ResponseCode, defaultDenyACL bool, message string) {
134+
defaultDenyACLbool := false
135+
106136
// Retrieve the pod from the cluster
107137
podInfo, err := cns.UnmarshalPodInfo(req.OrchestratorContext)
108138
if err != nil {
109139
errBuf := errors.Wrapf(err, "failed to unmarshalling pod info from ipconfigs request %+v", req)
110-
return nil, types.UnexpectedError, errBuf.Error()
140+
return nil, types.UnexpectedError, defaultDenyACLbool, errBuf.Error()
111141
}
112142
logger.Printf("[SWIFTv2Middleware] validate ipconfigs request for pod %s", podInfo.Name())
113143
podNamespacedName := k8stypes.NamespacedName{Namespace: podInfo.Namespace(), Name: podInfo.Name()}
114144
pod := v1.Pod{}
115145
if err := k.Cli.Get(ctx, podNamespacedName, &pod); err != nil {
116146
errBuf := errors.Wrapf(err, "failed to get pod %+v", podNamespacedName)
117-
return nil, types.UnexpectedError, errBuf.Error()
147+
return nil, types.UnexpectedError, defaultDenyACLbool, errBuf.Error()
118148
}
119149

120150
// check the pod labels for Swift V2, set the request's SecondaryInterfaceSet flag to true and check if its MTPNC CRD is ready
@@ -126,12 +156,16 @@ func (k *K8sSWIFTv2Middleware) validateIPConfigsRequest(ctx context.Context, req
126156
mtpnc := v1alpha1.MultitenantPodNetworkConfig{}
127157
mtpncNamespacedName := k8stypes.NamespacedName{Namespace: podInfo.Namespace(), Name: podInfo.Name()}
128158
if err := k.Cli.Get(ctx, mtpncNamespacedName, &mtpnc); err != nil {
129-
return nil, types.UnexpectedError, fmt.Errorf("failed to get pod's mtpnc from cache : %w", err).Error()
159+
return nil, types.UnexpectedError, defaultDenyACLbool, fmt.Errorf("failed to get pod's mtpnc from cache : %w", err).Error()
130160
}
131161
// Check if the MTPNC CRD is ready. If one of the fields is empty, return error
132162
if !mtpnc.IsReady() {
133-
return nil, types.UnexpectedError, errMTPNCNotReady.Error()
163+
return nil, types.UnexpectedError, defaultDenyACLbool, errMTPNCNotReady.Error()
134164
}
165+
166+
// copying defaultDenyACL bool from mtpnc
167+
defaultDenyACLbool = mtpnc.Status.DefaultDenyACL
168+
135169
// If primary Ip is set in status field, it indicates the presence of secondary interfaces
136170
if mtpnc.Status.PrimaryIP != "" {
137171
req.SecondaryInterfacesExist = true
@@ -140,7 +174,7 @@ func (k *K8sSWIFTv2Middleware) validateIPConfigsRequest(ctx context.Context, req
140174
for _, interfaceInfo := range interfaceInfos {
141175
if interfaceInfo.DeviceType == v1alpha1.DeviceTypeInfiniBandNIC {
142176
if interfaceInfo.MacAddress == "" || interfaceInfo.NCID == "" {
143-
return nil, types.UnexpectedError, errMTPNCNotReady.Error()
177+
return nil, types.UnexpectedError, defaultDenyACLbool, errMTPNCNotReady.Error()
144178
}
145179
req.BackendInterfaceExist = true
146180
req.BackendInterfaceMacAddresses = append(req.BackendInterfaceMacAddresses, interfaceInfo.MacAddress)
@@ -154,7 +188,7 @@ func (k *K8sSWIFTv2Middleware) validateIPConfigsRequest(ctx context.Context, req
154188
logger.Printf("[SWIFTv2Middleware] pod %s has secondary interface : %v", podInfo.Name(), req.SecondaryInterfacesExist)
155189
logger.Printf("[SWIFTv2Middleware] pod %s has backend interface : %v", podInfo.Name(), req.BackendInterfaceExist)
156190
// retrieve podinfo from orchestrator context
157-
return podInfo, types.Success, ""
191+
return podInfo, types.Success, defaultDenyACLbool, ""
158192
}
159193

160194
// getIPConfig returns the pod's SWIFT V2 IP configuration.

‎cns/middlewares/k8sSwiftV2_linux.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"github.com/Azure/azure-container-networking/cns/logger"
1010
"github.com/Azure/azure-container-networking/cns/middlewares/utils"
1111
"github.com/Azure/azure-container-networking/crd/multitenancy/api/v1alpha1"
12+
"github.com/Azure/azure-container-networking/network/policy"
1213
"github.com/pkg/errors"
1314
)
1415

@@ -103,3 +104,7 @@ func (k *K8sSWIFTv2Middleware) assignSubnetPrefixLengthFields(_ *cns.PodIpInfo,
103104
}
104105

105106
func (k *K8sSWIFTv2Middleware) addDefaultRoute(*cns.PodIpInfo, string) {}
107+
108+
func getEndpointPolicy(_, _, _ string, _ int) (policy.Policy, error) {
109+
return policy.Policy{}, nil
110+
}

‎cns/middlewares/k8sSwiftV2_linux_test.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ func TestValidateMultitenantIPConfigsRequestSuccess(t *testing.T) {
144144
happyReq.OrchestratorContext = b
145145
happyReq.SecondaryInterfacesExist = false
146146

147-
_, respCode, err := middleware.validateIPConfigsRequest(context.TODO(), happyReq)
147+
_, respCode, _, err := middleware.GetPodInfoForIPConfigsRequest(context.TODO(), happyReq)
148148
assert.Equal(t, err, "")
149149
assert.Equal(t, respCode, types.Success)
150150
assert.Equal(t, happyReq.SecondaryInterfacesExist, true)
@@ -158,7 +158,7 @@ func TestValidateMultitenantIPConfigsRequestSuccess(t *testing.T) {
158158
happyReq2.OrchestratorContext = b
159159
happyReq2.SecondaryInterfacesExist = false
160160

161-
_, respCode, err = middleware.validateIPConfigsRequest(context.TODO(), happyReq2)
161+
_, respCode, _, err = middleware.GetPodInfoForIPConfigsRequest(context.TODO(), happyReq2)
162162
assert.Equal(t, err, "")
163163
assert.Equal(t, respCode, types.Success)
164164
assert.Equal(t, happyReq.SecondaryInterfacesExist, true)
@@ -172,7 +172,7 @@ func TestValidateMultitenantIPConfigsRequestSuccess(t *testing.T) {
172172
happyReq3.OrchestratorContext = b
173173
happyReq3.SecondaryInterfacesExist = false
174174

175-
_, respCode, err = middleware.validateIPConfigsRequest(context.TODO(), happyReq3)
175+
_, respCode, _, err = middleware.GetPodInfoForIPConfigsRequest(context.TODO(), happyReq3)
176176
assert.Equal(t, err, "")
177177
assert.Equal(t, respCode, types.Success)
178178
assert.Equal(t, happyReq3.SecondaryInterfacesExist, false)
@@ -188,7 +188,7 @@ func TestValidateMultitenantIPConfigsRequestFailure(t *testing.T) {
188188
InfraContainerID: testPod1Info.InfraContainerID(),
189189
}
190190
failReq.OrchestratorContext = []byte("invalid")
191-
_, respCode, _ := middleware.validateIPConfigsRequest(context.TODO(), failReq)
191+
_, respCode, _, _ := middleware.GetPodInfoForIPConfigsRequest(context.TODO(), failReq)
192192
assert.Equal(t, respCode, types.UnexpectedError)
193193

194194
// Pod doesn't exist in cache test
@@ -198,19 +198,19 @@ func TestValidateMultitenantIPConfigsRequestFailure(t *testing.T) {
198198
}
199199
b, _ := testPod2Info.OrchestratorContext()
200200
failReq.OrchestratorContext = b
201-
_, respCode, _ = middleware.validateIPConfigsRequest(context.TODO(), failReq)
201+
_, respCode, _, _ = middleware.GetPodInfoForIPConfigsRequest(context.TODO(), failReq)
202202
assert.Equal(t, respCode, types.UnexpectedError)
203203

204204
// Failed to get MTPNC
205205
b, _ = testPod3Info.OrchestratorContext()
206206
failReq.OrchestratorContext = b
207-
_, respCode, _ = middleware.validateIPConfigsRequest(context.TODO(), failReq)
207+
_, respCode, _, _ = middleware.GetPodInfoForIPConfigsRequest(context.TODO(), failReq)
208208
assert.Equal(t, respCode, types.UnexpectedError)
209209

210210
// MTPNC not ready
211211
b, _ = testPod4Info.OrchestratorContext()
212212
failReq.OrchestratorContext = b
213-
_, respCode, _ = middleware.validateIPConfigsRequest(context.TODO(), failReq)
213+
_, respCode, _, _ = middleware.GetPodInfoForIPConfigsRequest(context.TODO(), failReq)
214214
assert.Equal(t, respCode, types.UnexpectedError)
215215
}
216216

‎cns/middlewares/k8sSwiftV2_windows.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
package middlewares
22

33
import (
4+
"encoding/json"
5+
46
"github.com/Azure/azure-container-networking/cns"
57
"github.com/Azure/azure-container-networking/cns/middlewares/utils"
68
"github.com/Azure/azure-container-networking/crd/multitenancy/api/v1alpha1"
9+
"github.com/Azure/azure-container-networking/network/policy"
710
"github.com/pkg/errors"
811
)
912

@@ -58,3 +61,42 @@ func (k *K8sSWIFTv2Middleware) addDefaultRoute(podIPInfo *cns.PodIpInfo, gwIP st
5861
}
5962
podIPInfo.Routes = append(podIPInfo.Routes, route)
6063
}
64+
65+
// get policy of type endpoint policy given the params
66+
func getEndpointPolicy(policyType, action, direction string, priority int) (policy.Policy, error) {
67+
endpointPolicy, err := createEndpointPolicy(policyType, action, direction, priority)
68+
if err != nil {
69+
return policy.Policy{}, errors.Wrap(err, "failed to create endpoint policy")
70+
}
71+
72+
additionalArgs := policy.Policy{
73+
Type: policy.EndpointPolicy,
74+
Data: endpointPolicy,
75+
}
76+
77+
return additionalArgs, nil
78+
}
79+
80+
// create policy given the params
81+
func createEndpointPolicy(policyType, action, direction string, priority int) ([]byte, error) {
82+
type EndpointPolicy struct {
83+
Type string `json:"Type"`
84+
Action string `json:"Action"`
85+
Direction string `json:"Direction"`
86+
Priority int `json:"Priority"`
87+
}
88+
89+
endpointPolicy := EndpointPolicy{
90+
Type: policyType,
91+
Action: action,
92+
Direction: direction,
93+
Priority: priority,
94+
}
95+
96+
rawPolicy, err := json.Marshal(endpointPolicy)
97+
if err != nil {
98+
return nil, errors.Wrap(err, "error marshalling policy to json")
99+
}
100+
101+
return rawPolicy, nil
102+
}

‎cns/middlewares/k8sSwiftV2_windows_test.go‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
package middlewares
22

33
import (
4+
"encoding/json"
5+
"fmt"
46
"reflect"
57
"testing"
68

79
"github.com/Azure/azure-container-networking/cns"
810
"github.com/Azure/azure-container-networking/cns/middlewares/mock"
911
"github.com/Azure/azure-container-networking/crd/multitenancy/api/v1alpha1"
12+
"github.com/Azure/azure-container-networking/network/policy"
13+
"github.com/stretchr/testify/require"
1014
"gotest.tools/v3/assert"
1115
)
1216

@@ -100,3 +104,92 @@ func TestAddDefaultRoute(t *testing.T) {
100104
t.Errorf("got '%+v', expected '%+v'", ipInfo.Routes, expectedRoutes)
101105
}
102106
}
107+
108+
func TestAddDefaultDenyACL(t *testing.T) {
109+
const policyType = "ACL"
110+
const action = "Block"
111+
const ingressDir = "In"
112+
const egressDir = "Out"
113+
const priority = 10000
114+
115+
valueIn := []byte(fmt.Sprintf(`{
116+
"Type": "%s",
117+
"Action": "%s",
118+
"Direction": "%s",
119+
"Priority": %d
120+
}`,
121+
policyType,
122+
action,
123+
ingressDir,
124+
priority,
125+
))
126+
127+
valueOut := []byte(fmt.Sprintf(`{
128+
"Type": "%s",
129+
"Action": "%s",
130+
"Direction": "%s",
131+
"Priority": %d
132+
}`,
133+
policyType,
134+
action,
135+
egressDir,
136+
priority,
137+
))
138+
139+
expectedDefaultDenyEndpoint := []policy.Policy{
140+
{
141+
Type: policy.EndpointPolicy,
142+
Data: valueOut,
143+
},
144+
{
145+
Type: policy.EndpointPolicy,
146+
Data: valueIn,
147+
},
148+
}
149+
var allEndpoints []policy.Policy
150+
var defaultDenyEgressPolicy, defaultDenyIngressPolicy policy.Policy
151+
var err error
152+
153+
defaultDenyEgressPolicy, err = getEndpointPolicy("ACL", "Block", "Out", 10_000)
154+
if err != nil {
155+
fmt.Printf("failed to create endpoint policy")
156+
}
157+
defaultDenyIngressPolicy, err = getEndpointPolicy("ACL", "Block", "In", 10_000)
158+
if err != nil {
159+
fmt.Printf("failed to create endpoint policy")
160+
}
161+
162+
allEndpoints = append(allEndpoints, defaultDenyEgressPolicy, defaultDenyIngressPolicy)
163+
164+
// Normalize both slices so there is no extra spacing, new lines, etc
165+
normalizedExpected := normalizeKVPairs(t, expectedDefaultDenyEndpoint)
166+
normalizedActual := normalizeKVPairs(t, allEndpoints)
167+
if !reflect.DeepEqual(normalizedExpected, normalizedActual) {
168+
t.Errorf("got '%+v', expected '%+v'", normalizedActual, normalizedExpected)
169+
}
170+
assert.Equal(t, err, nil)
171+
}
172+
173+
// normalizeKVPairs normalizes the JSON values in the KV pairs by unmarshaling them into a map, then marshaling them back to compact JSON to remove any extra space, new lines, etc
174+
func normalizeKVPairs(t *testing.T, policies []policy.Policy) []policy.Policy {
175+
normalized := make([]policy.Policy, len(policies))
176+
177+
for i, kv := range policies {
178+
var unmarshaledValue map[string]interface{}
179+
// Unmarshal the Value into a map
180+
err := json.Unmarshal(kv.Data, &unmarshaledValue)
181+
require.NoError(t, err, "Failed to unmarshal JSON value")
182+
183+
// Marshal it back to compact JSON
184+
normalizedValue, err := json.Marshal(unmarshaledValue)
185+
require.NoError(t, err, "Failed to re-marshal JSON value")
186+
187+
// Replace Value with the normalized compact JSON
188+
normalized[i] = policy.Policy{
189+
Type: policy.EndpointPolicy,
190+
Data: normalizedValue,
191+
}
192+
}
193+
194+
return normalized
195+
}

0 commit comments

Comments
 (0)