Skip to content

Commit ff7b9c0

Browse files
Yongli Chenjaer-tsun
Yongli Chen
authored and
jaer-tsun
committed
clear stale states on creation (#411)
* clear stale states on creation * log first UninitNpmChains() call * adding kube system namespace after reboot
1 parent df4f226 commit ff7b9c0

File tree

4 files changed

+53
-38
lines changed

4 files changed

+53
-38
lines changed

‎npm/iptm/iptm.go‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ import (
2121
)
2222

2323
const (
24-
defaultlockWaitTimeInSeconds = "60"
24+
defaultlockWaitTimeInSeconds string = "60"
25+
iptablesErrDoesNotExist int = 1
2526
)
2627

2728
// IptEntry represents an iptables rule.
@@ -212,6 +213,12 @@ func (iptMgr *IptablesManager) UninitNpmChains() error {
212213
util.IptablesAzureEgressPortChain,
213214
util.IptablesAzureEgressToChain,
214215
util.IptablesAzureTargetSetsChain,
216+
// Below chains exists only for before Azure-NPM:v1.0.27
217+
// and should be removed after a baking period.
218+
util.IptablesAzureIngressFromNsChain,
219+
util.IptablesAzureIngressFromPodChain,
220+
util.IptablesAzureEgressToNsChain,
221+
util.IptablesAzureEgressToPodChain,
215222
}
216223

217224
// Remove AZURE-NPM chain from FORWARD chain.
@@ -224,7 +231,7 @@ func (iptMgr *IptablesManager) UninitNpmChains() error {
224231
}
225232
iptMgr.OperationFlag = util.IptablesDeletionFlag
226233
errCode, err := iptMgr.Run(entry)
227-
if errCode != 1 && err != nil {
234+
if errCode != iptablesErrDoesNotExist && err != nil {
228235
log.Errorf("Error: failed to remove default rule from FORWARD chain.")
229236
return err
230237
}
@@ -234,7 +241,8 @@ func (iptMgr *IptablesManager) UninitNpmChains() error {
234241
entry := &IptEntry{
235242
Chain: chain,
236243
}
237-
if _, err := iptMgr.Run(entry); err != nil {
244+
errCode, err := iptMgr.Run(entry)
245+
if errCode != iptablesErrDoesNotExist && err != nil {
238246
log.Errorf("Error: failed to flush iptables chain %s.", chain)
239247
}
240248
}
@@ -257,7 +265,7 @@ func (iptMgr *IptablesManager) Exists(entry *IptEntry) (bool, error) {
257265
return true, nil
258266
}
259267

260-
if returnCode == 1 {
268+
if returnCode == iptablesErrDoesNotExist {
261269
log.Printf("Rule doesn't exist. %+v.", entry)
262270
return false, nil
263271
}
@@ -273,7 +281,7 @@ func (iptMgr *IptablesManager) AddChain(chain string) error {
273281
iptMgr.OperationFlag = util.IptablesChainCreationFlag
274282
errCode, err := iptMgr.Run(entry)
275283
if err != nil {
276-
if errCode == 1 {
284+
if errCode == iptablesErrDoesNotExist {
277285
log.Printf("Chain already exists %s.", entry.Chain)
278286
return nil
279287
}
@@ -293,7 +301,7 @@ func (iptMgr *IptablesManager) DeleteChain(chain string) error {
293301
iptMgr.OperationFlag = util.IptablesDestroyFlag
294302
errCode, err := iptMgr.Run(entry)
295303
if err != nil {
296-
if errCode == 1 {
304+
if errCode == iptablesErrDoesNotExist {
297305
log.Printf("Chain doesn't exist %s.", entry.Chain)
298306
return nil
299307
}

‎npm/namespace.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func (npMgr *NetworkPolicyManager) UninitAllNsList() error {
8686
return nil
8787
}
8888

89-
// AddNamespace handles adding namespace to ipset.
89+
// AddNamespace handles adding namespace to ipset.
9090
func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
9191
npMgr.Lock()
9292
defer npMgr.Unlock()

‎npm/npm.go‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@ type NetworkPolicyManager struct {
4545
nsInformer coreinformers.NamespaceInformer
4646
npInformer networkinginformers.NetworkPolicyInformer
4747

48-
nodeName string
49-
nsMap map[string]*namespace
50-
isAzureNpmChainCreated bool
48+
nodeName string
49+
nsMap map[string]*namespace
50+
isAzureNpmChainCreated bool
5151
isSafeToCleanUpAzureNpmChain bool
5252

5353
clusterState telemetry.ClusterState
@@ -169,11 +169,6 @@ func (npMgr *NetworkPolicyManager) Start(stopCh <-chan struct{}) error {
169169
// Starts all informers manufactured by npMgr's informerFactory.
170170
npMgr.informerFactory.Start(stopCh)
171171

172-
// Failure detected. Needs to restore Azure-NPM related iptables entries.
173-
if util.Exists(util.IptablesConfigFile) {
174-
npMgr.restore()
175-
}
176-
177172
// Wait for the initial sync of local cache.
178173
if !cache.WaitForCacheSync(stopCh, npMgr.podInformer.Informer().HasSynced) {
179174
return fmt.Errorf("Pod informer failed to sync")
@@ -194,6 +189,10 @@ func (npMgr *NetworkPolicyManager) Start(stopCh <-chan struct{}) error {
194189

195190
// NewNetworkPolicyManager creates a NetworkPolicyManager
196191
func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory informers.SharedInformerFactory, npmVersion string) *NetworkPolicyManager {
192+
// Clear out left over iptables states
193+
log.Logf("Azure-NPM creating, cleaning iptables")
194+
iptMgr := iptm.NewIptablesManager()
195+
iptMgr.UninitNpmChains()
197196

198197
podInformer := informerFactory.Core().V1().Pods()
199198
nsInformer := informerFactory.Core().V1().Namespaces()
@@ -212,14 +211,14 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
212211
}
213212

214213
npMgr := &NetworkPolicyManager{
215-
clientset: clientset,
216-
informerFactory: informerFactory,
217-
podInformer: podInformer,
218-
nsInformer: nsInformer,
219-
npInformer: npInformer,
220-
nodeName: os.Getenv("HOSTNAME"),
221-
nsMap: make(map[string]*namespace),
222-
isAzureNpmChainCreated: false,
214+
clientset: clientset,
215+
informerFactory: informerFactory,
216+
podInformer: podInformer,
217+
nsInformer: nsInformer,
218+
npInformer: npInformer,
219+
nodeName: os.Getenv("HOSTNAME"),
220+
nsMap: make(map[string]*namespace),
221+
isAzureNpmChainCreated: false,
223222
isSafeToCleanUpAzureNpmChain: false,
224223
clusterState: telemetry.ClusterState{
225224
PodCount: 0,
@@ -243,13 +242,15 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
243242
clusterState := npMgr.GetClusterState()
244243
npMgr.reportManager.Report.(*telemetry.NPMReport).GetReport(clusterID, npMgr.nodeName, npmVersion, serverVersion.GitVersion, clusterState)
245244

246-
allNs, err := newNs(util.KubeAllNamespacesFlag)
247-
if err != nil {
248-
log.Logf("Error: failed to create all-namespace.")
249-
panic(err.Error)
250-
}
245+
allNs, _ := newNs(util.KubeAllNamespacesFlag)
251246
npMgr.nsMap[util.KubeAllNamespacesFlag] = allNs
252247

248+
// Create ipset for the namespace.
249+
kubeSystemNs := "ns-" + util.KubeSystemFlag
250+
if err := allNs.ipsMgr.CreateSet(kubeSystemNs); err != nil {
251+
log.Logf("Error: failed to create ipset for namespace %s.", kubeSystemNs)
252+
}
253+
253254
podInformer.Informer().AddEventHandler(
254255
// Pod event handlers
255256
cache.ResourceEventHandlerFuncs{

‎npm/util/const.go‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ const (
4747
IptablesSFlag string = "-s"
4848
IptablesDFlag string = "-d"
4949
IptablesDstPortFlag string = "--dport"
50-
IptablesModuleFlag string = "-m"
50+
IptablesModuleFlag string = "-m"
5151
IptablesSetModuleFlag string = "set"
5252
IptablesMatchSetFlag string = "--match-set"
5353
IptablesStateModuleFlag string = "state"
@@ -60,15 +60,21 @@ const (
6060
IptablesCommentModuleFlag string = "comment"
6161
IptablesCommentFlag string = "--comment"
6262
IptablesAddCommentFlag
63-
IptablesAzureChain string = "AZURE-NPM"
64-
IptablesAzureKubeSystemChain string = "AZURE-NPM-KUBE-SYSTEM"
65-
IptablesAzureIngressPortChain string = "AZURE-NPM-INGRESS-PORT"
66-
IptablesAzureIngressFromChain string = "AZURE-NPM-INGRESS-FROM"
67-
IptablesAzureEgressPortChain string = "AZURE-NPM-EGRESS-PORT"
68-
IptablesAzureEgressToChain string = "AZURE-NPM-EGRESS-TO"
69-
IptablesAzureTargetSetsChain string = "AZURE-NPM-TARGET-SETS"
70-
IptablesForwardChain string = "FORWARD"
71-
IptablesInputChain string = "INPUT"
63+
IptablesAzureChain string = "AZURE-NPM"
64+
IptablesAzureKubeSystemChain string = "AZURE-NPM-KUBE-SYSTEM"
65+
IptablesAzureIngressPortChain string = "AZURE-NPM-INGRESS-PORT"
66+
IptablesAzureIngressFromChain string = "AZURE-NPM-INGRESS-FROM"
67+
IptablesAzureEgressPortChain string = "AZURE-NPM-EGRESS-PORT"
68+
IptablesAzureEgressToChain string = "AZURE-NPM-EGRESS-TO"
69+
IptablesAzureTargetSetsChain string = "AZURE-NPM-TARGET-SETS"
70+
IptablesForwardChain string = "FORWARD"
71+
IptablesInputChain string = "INPUT"
72+
// Below chains exists only for before Azure-NPM:v1.0.27
73+
// and should be removed after a baking period.
74+
IptablesAzureIngressFromNsChain string = "AZURE-NPM-INGRESS-FROM-NS"
75+
IptablesAzureIngressFromPodChain string = "AZURE-NPM-INGRESS-FROM-POD"
76+
IptablesAzureEgressToNsChain string = "AZURE-NPM-EGRESS-TO-NS"
77+
IptablesAzureEgressToPodChain string = "AZURE-NPM-EGRESS-TO-POD"
7278
)
7379

7480
//ipset related constants.

0 commit comments

Comments
 (0)