Skip to content

Commit 3f2d10e

Browse files
aojeaaojea
committed
ClusterNetworkPolicy
1 parent 91fa332 commit 3f2d10e

File tree

4 files changed

+691
-7
lines changed

4 files changed

+691
-7
lines changed

‎cmd/main.go

Lines changed: 44 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,12 @@ import (
1717
"sigs.k8s.io/kube-network-policies/pkg/dns"
1818
"sigs.k8s.io/kube-network-policies/pkg/networkpolicy"
1919
"sigs.k8s.io/kube-network-policies/pkg/podinfo"
20+
21+
npav1alpha2 "sigs.k8s.io/network-policy-api/apis/v1alpha2"
2022
npaclient "sigs.k8s.io/network-policy-api/pkg/client/clientset/versioned"
2123
npainformers "sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions"
22-
"sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions/apis/v1alpha1"
24+
npainformersv1alpha1 "sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions/apis/v1alpha1"
25+
npainformersv1alpha2 "sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions/apis/v1alpha2"
2326

2427
"k8s.io/apimachinery/pkg/api/meta"
2528
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -39,6 +42,7 @@ var (
3942
failOpen bool
4043
adminNetworkPolicy bool // AdminNetworkPolicy is alpha so keep it feature gated behind a flag
4144
baselineAdminNetworkPolicy bool // BaselineAdminNetworkPolicy is alpha so keep it feature gated behind a flag
45+
clusterNetworkPolicy bool // ClusterNetworkPolicy is alpha so keep it feature gated behind a flag
4246
queueID int
4347
metricsBindAddress string
4448
hostnameOverride string
@@ -50,6 +54,7 @@ func init() {
5054
flag.BoolVar(&failOpen, "fail-open", false, "If set, don't drop packets if the controller is not running")
5155
flag.BoolVar(&adminNetworkPolicy, "admin-network-policy", false, "If set, enable Admin Network Policy API")
5256
flag.BoolVar(&baselineAdminNetworkPolicy, "baseline-admin-network-policy", false, "If set, enable Baseline Admin Network Policy API")
57+
flag.BoolVar(&clusterNetworkPolicy, "cluster-network-policy", false, "If set, enable Cluster-network-policy")
5358
flag.IntVar(&queueID, "nfqueue-id", 100, "Number of the nfqueue used")
5459
flag.StringVar(&metricsBindAddress, "metrics-bind-address", ":9080", "The IP address and port for the metrics server to serve on")
5560
flag.StringVar(&hostnameOverride, "hostname-override", "", "If non-empty, will be used as the name of the Node that kube-network-policies is running on. If unset, the node name is assumed to be the same as the node's hostname.")
@@ -91,6 +96,10 @@ func run() int {
9196
logger.Info("flag", "name", flag.Name, "value", flag.Value)
9297
})
9398

99+
if clusterNetworkPolicy && (adminNetworkPolicy || baselineAdminNetworkPolicy) {
100+
klog.Fatal("clusterNetworkPolicy cannot be enabled with adminNetworkPolicy or baselineAdminNetworkPolicy")
101+
}
102+
94103
if _, _, err := net.SplitHostPort(metricsBindAddress); err != nil {
95104
logger.Error(err, "parsing metrics bind address", "address", metricsBindAddress)
96105
return 1
@@ -129,7 +138,8 @@ func run() int {
129138
var npaClient *npaclient.Clientset
130139
var npaInformerFactory npainformers.SharedInformerFactory
131140
var nodeInformer coreinformers.NodeInformer
132-
if adminNetworkPolicy || baselineAdminNetworkPolicy {
141+
142+
if adminNetworkPolicy || baselineAdminNetworkPolicy || clusterNetworkPolicy {
133143
nodeInformer = informersFactory.Core().V1().Nodes()
134144
npaClient, err = npaclient.NewForConfig(npaConfig)
135145
if err != nil {
@@ -138,14 +148,18 @@ func run() int {
138148
npaInformerFactory = npainformers.NewSharedInformerFactory(npaClient, 0)
139149
}
140150

141-
var anpInformer v1alpha1.AdminNetworkPolicyInformer
151+
var anpInformer npainformersv1alpha1.AdminNetworkPolicyInformer
142152
if adminNetworkPolicy {
143153
anpInformer = npaInformerFactory.Policy().V1alpha1().AdminNetworkPolicies()
144154
}
145-
var banpInformer v1alpha1.BaselineAdminNetworkPolicyInformer
155+
var banpInformer npainformersv1alpha1.BaselineAdminNetworkPolicyInformer
146156
if baselineAdminNetworkPolicy {
147157
banpInformer = npaInformerFactory.Policy().V1alpha1().BaselineAdminNetworkPolicies()
148158
}
159+
var cnpInformer npainformersv1alpha2.ClusterNetworkPolicyInformer
160+
if clusterNetworkPolicy {
161+
cnpInformer = npaInformerFactory.Policy().V1alpha2().ClusterNetworkPolicies()
162+
}
149163

150164
nsInformer := informersFactory.Core().V1().Namespaces()
151165
networkPolicyInfomer := informersFactory.Networking().V1().NetworkPolicies()
@@ -201,25 +215,40 @@ func run() int {
201215
evaluators = append(evaluators, networkpolicy.NewLoggingPolicy())
202216
}
203217

204-
if adminNetworkPolicy {
218+
var domainResolver api.DomainResolver
219+
// If AdminNetworkPolicy or ClusterNetworkPolicy are enabled, we need a domain resolver.
220+
if adminNetworkPolicy || clusterNetworkPolicy {
221+
klog.Infof("AdminNetworkPolicy or ClusterNetworkPolicy enabled, starting domain cache")
205222
// Admin Network Policy need to associate IP addresses to Domains
206223
// NewDomainCache implements the interface DomainResolver using
207224
// nftables to create a cache with the resolved IP addresses from the
208225
// Pod domain queries.
209-
domainResolver := dns.NewDomainCache(queueID + 1)
226+
domainCache := dns.NewDomainCache(queueID + 1)
210227
go func() {
211-
err := domainResolver.Run(ctx)
228+
err := domainCache.Run(ctx)
212229
if err != nil {
213230
klog.Infof("domain cache controller exited: %v", err)
214231
}
215232
}()
233+
domainResolver = domainCache
234+
235+
}
216236

237+
if adminNetworkPolicy {
217238
evaluators = append(evaluators, networkpolicy.NewAdminNetworkPolicy(
218239
anpInformer,
219240
domainResolver,
220241
))
221242
}
222243

244+
if clusterNetworkPolicy {
245+
evaluators = append(evaluators, networkpolicy.NewClusterNetworkPolicy(
246+
npav1alpha2.AdminTier,
247+
cnpInformer,
248+
domainResolver,
249+
))
250+
}
251+
223252
// Standard Network Policy goes after AdminNetworkPolicy and before BaselineAdminNetworkPolicy
224253
evaluators = append(evaluators, networkpolicy.NewStandardNetworkPolicy(
225254
nodeName,
@@ -234,6 +263,14 @@ func run() int {
234263
))
235264
}
236265

266+
if clusterNetworkPolicy {
267+
evaluators = append(evaluators, networkpolicy.NewClusterNetworkPolicy(
268+
npav1alpha2.BaselineTier,
269+
cnpInformer,
270+
domainResolver,
271+
))
272+
}
273+
237274
http.Handle("/metrics", promhttp.Handler())
238275
go func() {
239276
err := http.ListenAndServe(metricsBindAddress, nil)

‎install-cnp.yaml

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
kind: ClusterRole
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
metadata:
5+
name: kube-network-policies
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- pods
11+
- namespaces
12+
- nodes
13+
verbs:
14+
- list
15+
- watch
16+
- apiGroups:
17+
- "networking.k8s.io"
18+
resources:
19+
- networkpolicies
20+
verbs:
21+
- list
22+
- watch
23+
- apiGroups:
24+
- "policy.networking.k8s.io"
25+
resources:
26+
- clusternetworkpolicies
27+
verbs:
28+
- list
29+
- watch
30+
---
31+
kind: ClusterRoleBinding
32+
apiVersion: rbac.authorization.k8s.io/v1
33+
metadata:
34+
name: kube-network-policies
35+
roleRef:
36+
apiGroup: rbac.authorization.k8s.io
37+
kind: ClusterRole
38+
name: kube-network-policies
39+
subjects:
40+
- kind: ServiceAccount
41+
name: kube-network-policies
42+
namespace: kube-system
43+
---
44+
apiVersion: v1
45+
kind: ServiceAccount
46+
metadata:
47+
name: kube-network-policies
48+
namespace: kube-system
49+
---
50+
apiVersion: apps/v1
51+
kind: DaemonSet
52+
metadata:
53+
name: kube-network-policies
54+
namespace: kube-system
55+
labels:
56+
tier: node
57+
app: kube-network-policies
58+
k8s-app: kube-network-policies
59+
spec:
60+
selector:
61+
matchLabels:
62+
app: kube-network-policies
63+
template:
64+
metadata:
65+
labels:
66+
tier: node
67+
app: kube-network-policies
68+
k8s-app: kube-network-policies
69+
spec:
70+
hostNetwork: true
71+
dnsPolicy: ClusterFirst
72+
nodeSelector:
73+
kubernetes.io/os: linux
74+
tolerations:
75+
- operator: Exists
76+
effect: NoSchedule
77+
serviceAccountName: kube-network-policies
78+
containers:
79+
- name: kube-network-policies
80+
image: registry.k8s.io/networking/kube-network-policies:v0.8.0
81+
args:
82+
- /bin/netpol
83+
- --hostname-override=$(MY_NODE_NAME)
84+
- --cluster-network-policy=true
85+
- --v=4
86+
- --nfqueue-id=89
87+
volumeMounts:
88+
- name: nri-plugin
89+
mountPath: /var/run/nri
90+
- name: netns
91+
mountPath: /var/run/netns
92+
mountPropagation: HostToContainer
93+
resources:
94+
requests:
95+
cpu: "100m"
96+
memory: "50Mi"
97+
securityContext:
98+
privileged: true
99+
capabilities:
100+
add: ["NET_ADMIN"]
101+
env:
102+
- name: MY_NODE_NAME
103+
valueFrom:
104+
fieldRef:
105+
fieldPath: spec.nodeName
106+
volumes:
107+
- name: nri-plugin
108+
hostPath:
109+
path: /var/run/nri
110+
- name: netns
111+
hostPath:
112+
path: /var/run/netns
113+
---

0 commit comments

Comments
 (0)