Skip to content

Commit df8223e

Browse files
aojeaaojea
committed
ClusterNetworkPolicy
1 parent f3ab703 commit df8223e

File tree

4 files changed

+668
-7
lines changed

4 files changed

+668
-7
lines changed

‎cmd/main.go

Lines changed: 40 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,12 @@ import (
1616
"sigs.k8s.io/kube-network-policies/pkg/dns"
1717
"sigs.k8s.io/kube-network-policies/pkg/networkpolicy"
1818
"sigs.k8s.io/kube-network-policies/pkg/podinfo"
19+
20+
npav1alpha2 "sigs.k8s.io/network-policy-api/apis/v1alpha2"
1921
npaclient "sigs.k8s.io/network-policy-api/pkg/client/clientset/versioned"
2022
npainformers "sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions"
21-
"sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions/apis/v1alpha1"
23+
npainformersv1alpha1 "sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions/apis/v1alpha1"
24+
npainformersv1alpha2 "sigs.k8s.io/network-policy-api/pkg/client/informers/externalversions/apis/v1alpha2"
2225

2326
"k8s.io/apimachinery/pkg/api/meta"
2427
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -38,6 +41,7 @@ var (
3841
failOpen bool
3942
adminNetworkPolicy bool // AdminNetworkPolicy is alpha so keep it feature gated behind a flag
4043
baselineAdminNetworkPolicy bool // BaselineAdminNetworkPolicy is alpha so keep it feature gated behind a flag
44+
clusterNetworkPolicy bool // ClusterNetworkPolicy is alpha so keep it feature gated behind a flag
4145
queueID int
4246
metricsBindAddress string
4347
hostnameOverride string
@@ -49,6 +53,7 @@ func init() {
4953
flag.BoolVar(&failOpen, "fail-open", false, "If set, don't drop packets if the controller is not running")
5054
flag.BoolVar(&adminNetworkPolicy, "admin-network-policy", false, "If set, enable Admin Network Policy API")
5155
flag.BoolVar(&baselineAdminNetworkPolicy, "baseline-admin-network-policy", false, "If set, enable Baseline Admin Network Policy API")
56+
flag.BoolVar(&clusterNetworkPolicy, "cluster-network-policy", false, "If set, enable Cluster-network-policy")
5257
flag.IntVar(&queueID, "nfqueue-id", 100, "Number of the nfqueue used")
5358
flag.StringVar(&metricsBindAddress, "metrics-bind-address", ":9080", "The IP address and port for the metrics server to serve on")
5459
flag.StringVar(&hostnameOverride, "hostname-override", "", "If non-empty, will be used as the name of the Node that kube-network-policies is running on. If unset, the node name is assumed to be the same as the node's hostname.")
@@ -131,7 +136,8 @@ func run() int {
131136
var npaClient *npaclient.Clientset
132137
var npaInformerFactory npainformers.SharedInformerFactory
133138
var nodeInformer coreinformers.NodeInformer
134-
if adminNetworkPolicy || baselineAdminNetworkPolicy {
139+
140+
if adminNetworkPolicy || baselineAdminNetworkPolicy || clusterNetworkPolicy {
135141
nodeInformer = informersFactory.Core().V1().Nodes()
136142
npaClient, err = npaclient.NewForConfig(npaConfig)
137143
if err != nil {
@@ -140,14 +146,18 @@ func run() int {
140146
npaInformerFactory = npainformers.NewSharedInformerFactory(npaClient, 0)
141147
}
142148

143-
var anpInformer v1alpha1.AdminNetworkPolicyInformer
149+
var anpInformer npainformersv1alpha1.AdminNetworkPolicyInformer
144150
if adminNetworkPolicy {
145151
anpInformer = npaInformerFactory.Policy().V1alpha1().AdminNetworkPolicies()
146152
}
147-
var banpInformer v1alpha1.BaselineAdminNetworkPolicyInformer
153+
var banpInformer npainformersv1alpha1.BaselineAdminNetworkPolicyInformer
148154
if baselineAdminNetworkPolicy {
149155
banpInformer = npaInformerFactory.Policy().V1alpha1().BaselineAdminNetworkPolicies()
150156
}
157+
var cnpInformer npainformersv1alpha2.ClusterNetworkPolicyInformer
158+
if clusterNetworkPolicy {
159+
cnpInformer = npaInformerFactory.Policy().V1alpha2().ClusterNetworkPolicies()
160+
}
151161

152162
nsInformer := informersFactory.Core().V1().Namespaces()
153163
networkPolicyInfomer := informersFactory.Networking().V1().NetworkPolicies()
@@ -203,25 +213,40 @@ func run() int {
203213
evaluators = append(evaluators, networkpolicy.NewLoggingPolicy())
204214
}
205215

206-
if adminNetworkPolicy {
216+
var domainResolver networkpolicy.DomainResolver
217+
// If AdminNetworkPolicy or ClusterNetworkPolicy are enabled, we need a domain resolver.
218+
if adminNetworkPolicy || clusterNetworkPolicy {
219+
klog.Infof("AdminNetworkPolicy or ClusterNetworkPolicy enabled, starting domain cache")
207220
// Admin Network Policy need to associate IP addresses to Domains
208221
// NewDomainCache implements the interface DomainResolver using
209222
// nftables to create a cache with the resolved IP addresses from the
210223
// Pod domain queries.
211-
domainResolver := dns.NewDomainCache(queueID + 1)
224+
domainCache := dns.NewDomainCache(queueID + 1)
212225
go func() {
213-
err := domainResolver.Run(ctx)
226+
err := domainCache.Run(ctx)
214227
if err != nil {
215228
klog.Infof("domain cache controller exited: %v", err)
216229
}
217230
}()
231+
domainResolver = domainCache
232+
233+
}
218234

235+
if adminNetworkPolicy {
219236
evaluators = append(evaluators, networkpolicy.NewAdminNetworkPolicy(
220237
anpInformer,
221238
domainResolver,
222239
))
223240
}
224241

242+
if clusterNetworkPolicy {
243+
evaluators = append(evaluators, networkpolicy.NewClusterNetworkPolicy(
244+
npav1alpha2.AdminTier,
245+
cnpInformer,
246+
domainResolver,
247+
))
248+
}
249+
225250
// Standard Network Policy goes after AdminNetworkPolicy and before BaselineAdminNetworkPolicy
226251
evaluators = append(evaluators, networkpolicy.NewStandardNetworkPolicy(
227252
networkPolicyInfomer,
@@ -233,6 +258,14 @@ func run() int {
233258
))
234259
}
235260

261+
if clusterNetworkPolicy {
262+
evaluators = append(evaluators, networkpolicy.NewClusterNetworkPolicy(
263+
npav1alpha2.BaselineTier,
264+
cnpInformer,
265+
nil,
266+
))
267+
}
268+
236269
http.Handle("/metrics", promhttp.Handler())
237270
go func() {
238271
err := http.ListenAndServe(metricsBindAddress, nil)

‎install-cnp.yaml

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
kind: ClusterRole
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
metadata:
5+
name: kube-network-policies
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- pods
11+
- namespaces
12+
- nodes
13+
verbs:
14+
- list
15+
- watch
16+
- apiGroups:
17+
- "networking.k8s.io"
18+
resources:
19+
- networkpolicies
20+
verbs:
21+
- list
22+
- watch
23+
- apiGroups:
24+
- "policy.networking.k8s.io"
25+
resources:
26+
- clusternetworkpolicies
27+
verbs:
28+
- list
29+
- watch
30+
---
31+
kind: ClusterRoleBinding
32+
apiVersion: rbac.authorization.k8s.io/v1
33+
metadata:
34+
name: kube-network-policies
35+
roleRef:
36+
apiGroup: rbac.authorization.k8s.io
37+
kind: ClusterRole
38+
name: kube-network-policies
39+
subjects:
40+
- kind: ServiceAccount
41+
name: kube-network-policies
42+
namespace: kube-system
43+
---
44+
apiVersion: v1
45+
kind: ServiceAccount
46+
metadata:
47+
name: kube-network-policies
48+
namespace: kube-system
49+
---
50+
apiVersion: apps/v1
51+
kind: DaemonSet
52+
metadata:
53+
name: kube-network-policies
54+
namespace: kube-system
55+
labels:
56+
tier: node
57+
app: kube-network-policies
58+
k8s-app: kube-network-policies
59+
spec:
60+
selector:
61+
matchLabels:
62+
app: kube-network-policies
63+
template:
64+
metadata:
65+
labels:
66+
tier: node
67+
app: kube-network-policies
68+
k8s-app: kube-network-policies
69+
spec:
70+
hostNetwork: true
71+
dnsPolicy: ClusterFirst
72+
nodeSelector:
73+
kubernetes.io/os: linux
74+
tolerations:
75+
- operator: Exists
76+
effect: NoSchedule
77+
serviceAccountName: kube-network-policies
78+
containers:
79+
- name: kube-network-policies
80+
image: registry.k8s.io/networking/kube-network-policies:v0.8.0
81+
args:
82+
- /bin/netpol
83+
- --hostname-override=$(MY_NODE_NAME)
84+
- --cluster-network-policy=true
85+
- --v=4
86+
- --nfqueue-id=89
87+
volumeMounts:
88+
- name: nri-plugin
89+
mountPath: /var/run/nri
90+
- name: netns
91+
mountPath: /var/run/netns
92+
mountPropagation: HostToContainer
93+
resources:
94+
requests:
95+
cpu: "100m"
96+
memory: "50Mi"
97+
securityContext:
98+
privileged: true
99+
capabilities:
100+
add: ["NET_ADMIN"]
101+
env:
102+
- name: MY_NODE_NAME
103+
valueFrom:
104+
fieldRef:
105+
fieldPath: spec.nodeName
106+
volumes:
107+
- name: nri-plugin
108+
hostPath:
109+
path: /var/run/nri
110+
- name: netns
111+
hostPath:
112+
path: /var/run/netns
113+
---

0 commit comments

Comments
 (0)