Skip to content

Commit ce9e3e5

Browse files
santhoshmprabhusanthoshmprabhu
committed
Merge remote-tracking branch 'origin/master' into sanprabhu/iptables-block-binary
2 parents 6cc55d5 + ef97f2a commit ce9e3e5

File tree

10 files changed

+998
-60
lines changed

10 files changed

+998
-60
lines changed

‎.pipelines/cni/pipeline.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ stages:
2424
go version
2525
echo "##vso[task.setvariable variable=commitID;isOutput=true]$(echo $(make revision)-$(date "+%d%H%M"))"
2626
echo "##vso[task.setvariable variable=npmVersion;isOutput=true]$(make npm-version)"
27-
echo "##vso[task.setvariable variable=cnsVersion;isOutput=true]$(CNS_VERSION)"
2827
name: "SetEnvVars"
2928
displayName: "Set Environment Variables"
3029
condition: always()
@@ -55,6 +54,14 @@ stages:
5554
arch: amd64
5655
name: cni
5756
os: windows
57+
cns_linux_amd64:
58+
arch: amd64
59+
name: cns
60+
os: linux
61+
cns_windows_amd64:
62+
arch: amd64
63+
name: cns
64+
os: windows
5865
ipv6_hp_bpf_linux_amd64:
5966
arch: amd64
6067
name: ipv6-hp-bpf
@@ -87,6 +94,10 @@ stages:
8794
arch: arm64
8895
name: cni
8996
os: linux
97+
cns_linux_arm64:
98+
arch: arm64
99+
name: cns
100+
os: linux
90101
ipv6_hp_bpf_linux_arm64:
91102
arch: arm64
92103
name: ipv6-hp-bpf
@@ -151,6 +162,9 @@ stages:
151162
cni:
152163
name: cni
153164
platforms: linux/amd64 linux/arm64 windows/amd64
165+
cns:
166+
name: cns
167+
platforms: linux/amd64 linux/arm64 windows/amd64
154168
ipv6-hp-bpf:
155169
name: ipv6-hp-bpf
156170
platforms: linux/amd64 linux/arm64

‎Makefile‎

Lines changed: 97 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,23 @@ EXE_EXT = .exe
3030
endif
3131

3232
# Interrogate the git repo and set some variables
33-
REPO_ROOT ?= $(shell git rev-parse --show-toplevel)
34-
REVISION ?= $(shell git rev-parse --short HEAD)
35-
ACN_VERSION ?= $(shell git describe --exclude "azure-ip-masq-merger*" --exclude "azure-ipam*" --exclude "dropgz*" --exclude "zapai*" --exclude "ipv6-hp-bpf*" --exclude "block-iptables*" --tags --always)
36-
IPV6_HP_BPF_VERSION ?= $(notdir $(shell git describe --match "ipv6-hp-bpf*" --tags --always))
37-
BLOCK_IPTABLES_VERSION ?= $(notdir $(shell git describe --match "block-iptables*" --tags --always))
38-
AZURE_IPAM_VERSION ?= $(notdir $(shell git describe --match "azure-ipam*" --tags --always))
33+
REPO_ROOT ?= $(shell git rev-parse --show-toplevel)
34+
REVISION ?= $(shell git rev-parse --short HEAD)
35+
ACN_VERSION ?= $(shell git describe --exclude "azure-iptables-monitor*" --exclude "azure-ip-masq-merger*" --exclude "azure-ipam*" --exclude "dropgz*" --exclude "zapai*" --exclude "ipv6-hp-bpf*" --exclude "block-iptables*" --tags --always)
36+
IPV6_HP_BPF_VERSION ?= $(notdir $(shell git describe --match "ipv6-hp-bpf*" --tags --always))
37+
BLOCK_IPTABLES_VERSION ?= $(notdir $(shell git describe --match "block-iptables*" --tags --always))
38+
AZURE_IPAM_VERSION ?= $(notdir $(shell git describe --match "azure-ipam*" --tags --always))
3939
AZURE_IP_MASQ_MERGER_VERSION ?= $(notdir $(shell git describe --match "azure-ip-masq-merger*" --tags --always))
40-
CNI_VERSION ?= $(ACN_VERSION)
41-
CNS_VERSION ?= $(ACN_VERSION)
42-
NPM_VERSION ?= $(ACN_VERSION)
43-
ZAPAI_VERSION ?= $(notdir $(shell git describe --match "zapai*" --tags --always))
40+
AZURE_IPTABLES_MONITOR_VERSION ?= $(notdir $(shell git describe --match "azure-iptables-monitor*" --tags --always))
41+
CNI_VERSION ?= $(ACN_VERSION)
42+
CNS_VERSION ?= $(ACN_VERSION)
43+
NPM_VERSION ?= $(ACN_VERSION)
44+
ZAPAI_VERSION ?= $(notdir $(shell git describe --match "zapai*" --tags --always))
4445

4546
# Build directories.
4647
AZURE_IPAM_DIR = $(REPO_ROOT)/azure-ipam
4748
AZURE_IP_MASQ_MERGER_DIR = $(REPO_ROOT)/azure-ip-masq-merger
49+
AZURE_IPTABLES_MONITOR_DIR = $(REPO_ROOT)/azure-iptables-monitor
4850
IPV6_HP_BPF_DIR = $(REPO_ROOT)/bpf-prog/ipv6-hp-bpf
4951
BLOCK_IPTABLES_DIR = $(REPO_ROOT)/bpf-prog/block-iptables
5052

@@ -60,6 +62,7 @@ OUTPUT_DIR = $(REPO_ROOT)/output
6062
BUILD_DIR = $(OUTPUT_DIR)/$(GOOS)_$(GOARCH)
6163
AZURE_IPAM_BUILD_DIR = $(BUILD_DIR)/azure-ipam
6264
AZURE_IP_MASQ_MERGER_BUILD_DIR = $(BUILD_DIR)/azure-ip-masq-merger
65+
AZURE_IPTABLES_MONITOR_BUILD_DIR = $(BUILD_DIR)/azure-iptables-monitor
6366
IPV6_HP_BPF_BUILD_DIR = $(BUILD_DIR)/bpf-prog/ipv6-hp-bpf
6467
BLOCK_IPTABLES_BUILD_DIR = $(BUILD_DIR)/bpf-prog/block-iptables
6568
IMAGE_DIR = $(OUTPUT_DIR)/images
@@ -109,6 +112,7 @@ CNS_ARCHIVE_NAME = azure-cns-$(GOOS)-$(GOARCH)-$(CNS_VERSION).$(ARCHIVE_EXT)
109112
NPM_ARCHIVE_NAME = azure-npm-$(GOOS)-$(GOARCH)-$(NPM_VERSION).$(ARCHIVE_EXT)
110113
AZURE_IPAM_ARCHIVE_NAME = azure-ipam-$(GOOS)-$(GOARCH)-$(AZURE_IPAM_VERSION).$(ARCHIVE_EXT)
111114
AZURE_IP_MASQ_MERGER_ARCHIVE_NAME = azure-ip-masq-merger-$(GOOS)-$(GOARCH)-$(AZURE_IP_MASQ_MERGER_VERSION).$(ARCHIVE_EXT)
115+
AZURE_IPTABLES_MONITOR_ARCHIVE_NAME = azure-iptables-monitor-$(GOOS)-$(GOARCH)-$(AZURE_IPTABLES_MONITOR_VERSION).$(ARCHIVE_EXT)
112116
IPV6_HP_BPF_ARCHIVE_NAME = ipv6-hp-bpf-$(GOOS)-$(GOARCH)-$(IPV6_HP_BPF_VERSION).$(ARCHIVE_EXT)
113117
BLOCK_IPTABLES_ARCHIVE_NAME = block-iptables-$(GOOS)-$(GOARCH)-$(BLOCK_IPTABLES_VERSION).$(ARCHIVE_EXT)
114118

@@ -127,8 +131,8 @@ all-binaries-platforms: ## Make all platform binaries
127131

128132
# OS specific binaries/images
129133
ifeq ($(GOOS),linux)
130-
all-binaries: acncli azure-cni-plugin azure-cns azure-npm azure-ipam azure-ip-masq-merger ipv6-hp-bpf block-iptables
131-
all-images: npm-image cns-image cni-manager-image azure-ip-masq-merger-image ipv6-hp-bpf-image
134+
all-binaries: acncli azure-cni-plugin azure-cns azure-npm azure-ipam azure-ip-masq-merger azure-iptables-monitor ipv6-hp-bpf block-iptables
135+
all-images: npm-image cns-image cni-manager-image azure-ip-masq-merger-image azure-iptables-monitor-image ipv6-hp-bpf-image
132136
else
133137
all-binaries: azure-cni-plugin azure-cns azure-npm
134138
all-images:
@@ -144,6 +148,7 @@ azure-ipam: azure-ipam-binary azure-ipam-archive
144148
ipv6-hp-bpf: ipv6-hp-bpf-binary ipv6-hp-bpf-archive
145149
block-iptables: block-iptables-binary block-iptables-archive
146150
azure-ip-masq-merger: azure-ip-masq-merger-binary azure-ip-masq-merger-archive
151+
azure-iptables-monitor: azure-iptables-monitor-binary azure-iptables-monitor-archive
147152

148153

149154
##@ Versioning
@@ -162,6 +167,9 @@ azure-ipam-version: ## prints the azure-ipam version
162167
azure-ip-masq-merger-version: ## prints the azure-ip-masq-merger version
163168
@echo $(AZURE_IP_MASQ_MERGER_VERSION)
164169

170+
azure-iptables-monitor-version: ## prints the azure-iptables-monitor version
171+
@echo $(AZURE_IPTABLES_MONITOR_VERSION)
172+
165173
ipv6-hp-bpf-version: ## prints the ipv6-hp-bpf version
166174
@echo $(IPV6_HP_BPF_VERSION)
167175

@@ -253,6 +261,10 @@ azure-npm-binary:
253261
azure-ip-masq-merger-binary:
254262
cd $(AZURE_IP_MASQ_MERGER_DIR) && CGO_ENABLED=0 go build -v -o $(AZURE_IP_MASQ_MERGER_BUILD_DIR)/azure-ip-masq-merger$(EXE_EXT) -ldflags "-X main.version=$(AZURE_IP_MASQ_MERGER_VERSION)" -gcflags="-dwarflocationlists=true"
255263

264+
# Build the azure-iptables-monitor binary.
265+
azure-iptables-monitor-binary:
266+
cd $(AZURE_IPTABLES_MONITOR_DIR) && CGO_ENABLED=0 go build -v -o $(AZURE_IPTABLES_MONITOR_BUILD_DIR)/azure-iptables-monitor$(EXE_EXT) -ldflags "-X main.version=$(AZURE_IPTABLES_MONITOR_VERSION)" -gcflags="-dwarflocationlists=true"
267+
256268
##@ Containers
257269

258270
## Common variables for all containers.
@@ -291,26 +303,28 @@ CONTAINER_TRANSPORT = docker
291303
endif
292304

293305
## Image name definitions.
294-
ACNCLI_IMAGE = acncli
295-
AZURE_IPAM_IMAGE = azure-ipam
296-
IPV6_HP_BPF_IMAGE = ipv6-hp-bpf
297-
CNI_IMAGE = azure-cni
298-
CNS_IMAGE = azure-cns
299-
NPM_IMAGE = azure-npm
300-
AZURE_IP_MASQ_MERGER_IMAGE = azure-ip-masq-merger
306+
ACNCLI_IMAGE = acncli
307+
AZURE_IPAM_IMAGE = azure-ipam
308+
IPV6_HP_BPF_IMAGE = ipv6-hp-bpf
309+
CNI_IMAGE = azure-cni
310+
CNS_IMAGE = azure-cns
311+
NPM_IMAGE = azure-npm
312+
AZURE_IP_MASQ_MERGER_IMAGE = azure-ip-masq-merger
313+
AZURE_IPTABLES_MONITOR_IMAGE = azure-iptables-monitor
301314

302315
## Image platform tags.
303-
ACNCLI_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(ACN_VERSION)
304-
AZURE_IPAM_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(AZURE_IPAM_VERSION)
305-
AZURE_IPAM_WINDOWS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(AZURE_IPAM_VERSION)-$(OS_SKU_WIN)
306-
IPV6_HP_BPF_IMAGE_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(IPV6_HP_BPF_VERSION)
316+
ACNCLI_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(ACN_VERSION)
317+
AZURE_IPAM_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(AZURE_IPAM_VERSION)
318+
AZURE_IPAM_WINDOWS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(AZURE_IPAM_VERSION)-$(OS_SKU_WIN)
319+
IPV6_HP_BPF_IMAGE_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(IPV6_HP_BPF_VERSION)
320+
CNI_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNI_VERSION)
321+
CNI_WINDOWS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNI_VERSION)-$(OS_SKU_WIN)
322+
CNS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNS_VERSION)
323+
CNS_WINDOWS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNS_VERSION)-$(OS_SKU_WIN)
324+
NPM_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(NPM_VERSION)
307325
BLOCK_IPTABLES_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(BLOCK_IPTABLES_VERSION)
308-
CNI_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNI_VERSION)
309-
CNI_WINDOWS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNI_VERSION)-$(OS_SKU_WIN)
310-
CNS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNS_VERSION)
311-
CNS_WINDOWS_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(CNS_VERSION)-$(OS_SKU_WIN)
312-
NPM_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(NPM_VERSION)
313326
AZURE_IP_MASQ_MERGER_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(AZURE_IP_MASQ_MERGER_VERSION)
327+
AZURE_IPTABLES_MONITOR_PLATFORM_TAG ?= $(subst /,-,$(PLATFORM))-$(AZURE_IPTABLES_MONITOR_VERSION)
314328

315329

316330
qemu-user-static: ## Set up the host to run qemu multiplatform container builds.
@@ -448,6 +462,32 @@ azure-ip-masq-merger-image-pull: ## pull azure-ip-masq-merger container image.
448462
IMAGE=$(AZURE_IP_MASQ_MERGER_IMAGE) \
449463
TAG=$(AZURE_IP_MASQ_MERGER_PLATFORM_TAG)
450464

465+
# azure-iptables-monitor
466+
azure-iptables-monitor-image-name: # util target to print the azure-iptables-monitor image name.
467+
@echo $(AZURE_IPTABLES_MONITOR_IMAGE)
468+
469+
azure-iptables-monitor-image-name-and-tag: # util target to print the azure-iptables-monitor image name and tag.
470+
@echo $(IMAGE_REGISTRY)/$(AZURE_IPTABLES_MONITOR_IMAGE):$(AZURE_IPTABLES_MONITOR_PLATFORM_TAG)
471+
472+
azure-iptables-monitor-image: ## build azure-iptables-monitor container image.
473+
$(MAKE) container \
474+
DOCKERFILE=azure-iptables-monitor/Dockerfile \
475+
IMAGE=$(AZURE_IPTABLES_MONITOR_IMAGE) \
476+
PLATFORM=$(PLATFORM) \
477+
TAG=$(AZURE_IPTABLES_MONITOR_PLATFORM_TAG) \
478+
TARGET=$(OS) \
479+
OS=$(OS) \
480+
ARCH=$(ARCH)
481+
482+
azure-iptables-monitor-image-push: ## push azure-iptables-monitor container image.
483+
$(MAKE) container-push \
484+
IMAGE=$(AZURE_IPTABLES_MONITOR_IMAGE) \
485+
TAG=$(AZURE_IPTABLES_MONITOR_PLATFORM_TAG)
486+
487+
azure-iptables-monitor-image-pull: ## pull azure-iptables-monitor container image.
488+
$(MAKE) container-pull \
489+
IMAGE=$(AZURE_IPTABLES_MONITOR_IMAGE) \
490+
TAG=$(AZURE_IPTABLES_MONITOR_PLATFORM_TAG)
451491

452492
# ipv6-hp-bpf
453493

@@ -641,6 +681,22 @@ azure-ip-masq-merger-skopeo-archive: ## export tar archive of azure-ip-masq-merg
641681
IMAGE=$(AZURE_IP_MASQ_MERGER_IMAGE) \
642682
TAG=$(AZURE_IP_MASQ_MERGER_VERSION)
643683

684+
azure-iptables-monitor-manifest-build: ## build azure-iptables-monitor multiplat container manifest.
685+
$(MAKE) manifest-build \
686+
PLATFORMS="$(PLATFORMS)" \
687+
IMAGE=$(AZURE_IPTABLES_MONITOR_IMAGE) \
688+
TAG=$(AZURE_IPTABLES_MONITOR_VERSION)
689+
690+
azure-iptables-monitor-manifest-push: ## push azure-iptables-monitor multiplat container manifest
691+
$(MAKE) manifest-push \
692+
IMAGE=$(AZURE_IPTABLES_MONITOR_IMAGE) \
693+
TAG=$(AZURE_IPTABLES_MONITOR_VERSION)
694+
695+
azure-iptables-monitor-skopeo-archive: ## export tar archive of azure-iptables-monitor multiplat container manifest.
696+
$(MAKE) manifest-skopeo-archive \
697+
IMAGE=$(AZURE_IPTABLES_MONITOR_IMAGE) \
698+
TAG=$(AZURE_IPTABLES_MONITOR_VERSION)
699+
644700
ipv6-hp-bpf-manifest-build: ## build ipv6-hp-bpf multiplat container manifest.
645701
$(MAKE) manifest-build \
646702
PLATFORMS="$(PLATFORMS)" \
@@ -799,6 +855,14 @@ ifeq ($(GOOS),linux)
799855
cd $(AZURE_IP_MASQ_MERGER_BUILD_DIR) && $(ARCHIVE_CMD) $(AZURE_IP_MASQ_MERGER_ARCHIVE_NAME) azure-ip-masq-merger$(EXE_EXT)
800856
endif
801857

858+
# Create a azure-iptables-monitor archive for the target platform.
859+
.PHONY: azure-iptables-monitor-archive
860+
azure-iptables-monitor-archive: azure-iptables-monitor-binary
861+
ifeq ($(GOOS),linux)
862+
$(MKDIR) $(AZURE_IPTABLES_MONITOR_BUILD_DIR)
863+
cd $(AZURE_IPTABLES_MONITOR_BUILD_DIR) && $(ARCHIVE_CMD) $(AZURE_IPTABLES_MONITOR_ARCHIVE_NAME) azure-iptables-monitor$(EXE_EXT)
864+
endif
865+
802866
# Create a ipv6-hp-bpf archive for the target platform.
803867
.PHONY: ipv6-hp-bpf-archive
804868
ipv6-hp-bpf-archive: ipv6-hp-bpf-binary
@@ -843,6 +907,7 @@ workspace: ## Set up the Go workspace.
843907
go work use .
844908
go work use ./azure-ipam
845909
go work use ./azure-ip-masq-merger
910+
go work use ./azure-iptables-monitor
846911
go work use ./build/tools
847912
go work use ./dropgz
848913
go work use ./zapai
@@ -855,7 +920,7 @@ RESTART_CASE ?= false
855920
# CNI type is a key to direct the types of state validation done on a cluster.
856921
CNI_TYPE ?= cilium
857922

858-
test-all: test-azure-ipam test-azure-ip-masq-merger test-main ## run all unit tests.
923+
test-all: test-azure-ipam test-azure-ip-masq-merger test-azure-iptables-monitor test-main ## run all unit tests.
859924

860925
test-main:
861926
go test -mod=readonly -buildvcs=false -tags "unit" --skip 'TestE2E*' -race -covermode atomic -coverprofile=coverage-main.out $(COVER_PKG)/...
@@ -895,6 +960,9 @@ test-azure-ipam: ## run the unit test for azure-ipam
895960
test-azure-ip-masq-merger: ## run the unit test for azure-ip-masq-merger
896961
cd $(AZURE_IP_MASQ_MERGER_DIR) && go test -race -covermode atomic -coverprofile=../coverage-azure-ip-masq-merger.out && go tool cover -func=../coverage-azure-ip-masq-merger.out
897962

963+
test-azure-iptables-monitor: ## run the unit test for azure-iptables-monitor
964+
cd $(AZURE_IPTABLES_MONITOR_DIR) && go test -race -covermode atomic -coverprofile=../coverage-azure-iptables-monitor.out && go tool cover -func=../coverage-azure-iptables-monitor.out
965+
898966
kind:
899967
kind create cluster --config ./test/kind/kind.yaml
900968

‎azure-iptables-monitor/Dockerfile‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
ARG ARCH
2+
3+
# mcr.microsoft.com/azurelinux/base/core:3.0
4+
FROM mcr.microsoft.com/azurelinux/base/core@sha256:9948138108a3d69f1dae62104599ac03132225c3b7a5ac57b85a214629c8567d AS mariner-core
5+
6+
# mcr.microsoft.com/azurelinux/distroless/minimal:3.0
7+
FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0801b80a0927309572b9adc99bd1813bc680473175f6e8175cd4124d95dbd50c AS mariner-distroless
8+
9+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.23.2-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
10+
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f1f0cbd464ae4cd9d41176d47f1f9fe16a6965425871f817587314e3a04576ec AS go
11+
12+
13+
FROM go AS azure-iptables-monitor
14+
ARG OS
15+
ARG VERSION
16+
WORKDIR /azure-iptables-monitor
17+
COPY ./azure-iptables-monitor .
18+
RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
19+
20+
FROM mariner-core AS iptables
21+
RUN tdnf install -y iptables
22+
23+
FROM mariner-distroless AS linux
24+
COPY --from=iptables /usr/sbin/*tables* /usr/sbin/
25+
COPY --from=iptables /usr/lib /usr/lib
26+
COPY --from=azure-iptables-monitor /go/bin/iptables-monitor azure-iptables-monitor
27+
28+
ENTRYPOINT ["/azure-iptables-monitor"]

‎azure-iptables-monitor/README.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# azure-iptables-monitor
2+
3+
`azure-iptables-monitor` is a utility for monitoring iptables rules on Kubernetes nodes and labeling a ciliumnode resource based on whether the corresponding node contains user-defined iptables rules.
4+
5+
## Description
6+
7+
The goal of this program is to periodically scan iptables rules across all tables (nat, mangle, filter, raw, security) and determine if any rules exist that don't match expected patterns. When unexpected rules are found, the ciliumnode resource is labeled to indicate the presence of user-defined iptables rules.
8+
9+
## Usage
10+
11+
Follow the steps below to build and run the program:
12+
13+
1. Build the binary using `make`:
14+
```bash
15+
make azure-iptables-monitor
16+
```
17+
or make an image:
18+
```bash
19+
make azure-iptables-monitor-image
20+
```
21+
22+
2. Deploy or copy the binary to your node(s).
23+
24+
3. Prepare your allowed pattern files in the input directory. Each file should be named after an iptables table (`nat`, `mangle`, `filter`, `raw`, `security`) or `global` and contain regex patterns that match expected iptables rules. You may want to mount a configmap for this purpose.
25+
26+
4. Start the program with:
27+
```bash
28+
./azure-iptables-monitor --input=/etc/config/ --interval=300
29+
```
30+
- The `--input` flag specifies the directory containing allowed regex pattern files. Default: `/etc/config/`
31+
- The `--interval` flag specifies how often to check iptables rules in seconds. Default: `300`
32+
- The `--events` flag enables Kubernetes event creation for rule violations. Default: `false`
33+
- The program must be in a k8s environment and `NODE_NAME` must be a set environment variable with the current node.
34+
35+
5. The program will set the `user-iptables-rules` label to `true` on the specified ciliumnode resource if unexpected rules are found, or `false` if all rules match expected patterns. Proper RBAC is required for patching (patch for ciliumnodes, create for events, get for nodes).
36+
37+
38+
## Pattern File Format
39+
40+
Each pattern file should contain one regex pattern per line:
41+
```
42+
^-A INPUT -i lo -j ACCEPT$
43+
^-A FORWARD -j DOCKER.*
44+
^-A POSTROUTING -s 10\.0\.0\.0/8 -j MASQUERADE$
45+
```
46+
47+
- `global`: Patterns that can match rules in any iptables table
48+
- `nat`, `mangle`, `filter`, `raw`, `security`: Patterns specific to each iptables table
49+
- Empty lines are ignored
50+
- Each line should be a valid Go regex pattern
51+
52+
## Debugging
53+
54+
Logs are output to standard error. Increase verbosity with the `-v` flag:
55+
```bash
56+
./azure-iptables-monitor -v 3
57+
```
58+
59+
## Development
60+
61+
To run tests at the repository level:
62+
```bash
63+
make test-azure-iptables-monitor
64+
```

0 commit comments

Comments
 (0)