Skip to content

Commit f2e23af

Browse files
mattcarymattcary
committed
Adds filtering of hosts to DialContexts.
The provided DialContext wraps existing clients' DialContext in an attempt to preserve any existing timeout configuration. In some cases, we may replace infinite timeouts with golang defaults. - scaleio: tcp connect/keepalive values changed from 0/15 to 30/30 - storageos: no change
1 parent 74dbf27 commit f2e23af

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+346
-65
lines changed

‎api/api-rules/violation_exceptions.list‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,7 @@ API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,Po
370370
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,Verbs
371371
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,GarbageCollectorControllerConfiguration,GCIgnoredResources
372372
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,GenericControllerManagerConfiguration,Controllers
373+
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeHostCIDRDenylist
373374
API rule violation: list_type_missing,k8s.io/kube-proxy/config/v1alpha1,KubeProxyConfiguration,NodePortAddresses
374375
API rule violation: list_type_missing,k8s.io/kube-proxy/config/v1alpha1,KubeProxyIPVSConfiguration,ExcludeCIDRs
375376
API rule violation: list_type_missing,k8s.io/kube-scheduler/config/v1,ExtenderTLSConfig,CAData
@@ -569,6 +570,8 @@ API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,N
569570
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,NodeLifecycleControllerConfiguration,UnhealthyZoneThreshold
570571
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,PVClaimBinderSyncPeriod
571572
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeConfiguration
573+
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeHostAllowLocalLoopback
574+
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeHostCIDRDenylist
572575
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeRecyclerConfiguration,IncrementTimeoutHostPath
573576
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeRecyclerConfiguration,IncrementTimeoutNFS
574577
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeRecyclerConfiguration,MaximumRetry

‎cmd/kube-controller-manager/app/core.go‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ import (
4343
servicecontroller "k8s.io/cloud-provider/controllers/service"
4444
"k8s.io/component-base/metrics/prometheus/ratelimiter"
4545
csitrans "k8s.io/csi-translation-lib"
46+
"k8s.io/kubernetes/cmd/kube-controller-manager/app/options"
4647
"k8s.io/kubernetes/pkg/controller"
4748
endpointcontroller "k8s.io/kubernetes/pkg/controller/endpoint"
4849
"k8s.io/kubernetes/pkg/controller/garbagecollector"
@@ -285,6 +286,12 @@ func startPersistentVolumeBinderController(ctx ControllerContext) (http.Handler,
285286
if err != nil {
286287
return nil, true, fmt.Errorf("failed to probe volume plugins when starting persistentvolume controller: %v", err)
287288
}
289+
filteredDialOptions, err := options.ParseVolumeHostFilters(
290+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostCIDRDenylist,
291+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostAllowLocalLoopback)
292+
if err != nil {
293+
return nil, true, err
294+
}
288295
params := persistentvolumecontroller.ControllerParameters{
289296
KubeClient: ctx.ClientBuilder.ClientOrDie("persistent-volume-binder"),
290297
SyncPeriod: ctx.ComponentConfig.PersistentVolumeBinderController.PVClaimBinderSyncPeriod.Duration,
@@ -297,6 +304,7 @@ func startPersistentVolumeBinderController(ctx ControllerContext) (http.Handler,
297304
PodInformer: ctx.InformerFactory.Core().V1().Pods(),
298305
NodeInformer: ctx.InformerFactory.Core().V1().Nodes(),
299306
EnableDynamicProvisioning: ctx.ComponentConfig.PersistentVolumeBinderController.VolumeConfiguration.EnableDynamicProvisioning,
307+
FilteredDialOptions: filteredDialOptions,
300308
}
301309
volumeController, volumeControllerErr := persistentvolumecontroller.NewController(params)
302310
if volumeControllerErr != nil {
@@ -324,6 +332,13 @@ func startAttachDetachController(ctx ControllerContext) (http.Handler, bool, err
324332
return nil, true, fmt.Errorf("failed to probe volume plugins when starting attach/detach controller: %v", err)
325333
}
326334

335+
filteredDialOptions, err := options.ParseVolumeHostFilters(
336+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostCIDRDenylist,
337+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostAllowLocalLoopback)
338+
if err != nil {
339+
return nil, true, err
340+
}
341+
327342
attachDetachController, attachDetachControllerErr :=
328343
attachdetach.NewAttachDetachController(
329344
ctx.ClientBuilder.ClientOrDie("attachdetach-controller"),
@@ -340,6 +355,7 @@ func startAttachDetachController(ctx ControllerContext) (http.Handler, bool, err
340355
ctx.ComponentConfig.AttachDetachController.DisableAttachDetachReconcilerSync,
341356
ctx.ComponentConfig.AttachDetachController.ReconcilerSyncLoopPeriod.Duration,
342357
attachdetach.DefaultTimerConfig,
358+
filteredDialOptions,
343359
)
344360
if attachDetachControllerErr != nil {
345361
return nil, true, fmt.Errorf("failed to start attach/detach controller: %v", attachDetachControllerErr)
@@ -355,6 +371,12 @@ func startVolumeExpandController(ctx ControllerContext) (http.Handler, bool, err
355371
return nil, true, fmt.Errorf("failed to probe volume plugins when starting volume expand controller: %v", err)
356372
}
357373
csiTranslator := csitrans.New()
374+
filteredDialOptions, err := options.ParseVolumeHostFilters(
375+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostCIDRDenylist,
376+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostAllowLocalLoopback)
377+
if err != nil {
378+
return nil, true, err
379+
}
358380
expandController, expandControllerErr := expand.NewExpandController(
359381
ctx.ClientBuilder.ClientOrDie("expand-controller"),
360382
ctx.InformerFactory.Core().V1().PersistentVolumeClaims(),
@@ -363,7 +385,9 @@ func startVolumeExpandController(ctx ControllerContext) (http.Handler, bool, err
363385
ctx.Cloud,
364386
plugins,
365387
csiTranslator,
366-
csimigration.NewPluginManager(csiTranslator))
388+
csimigration.NewPluginManager(csiTranslator),
389+
filteredDialOptions,
390+
)
367391

368392
if expandControllerErr != nil {
369393
return nil, true, fmt.Errorf("failed to start volume expand controller: %v", expandControllerErr)

‎cmd/kube-controller-manager/app/options/BUILD‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ go_library(
6363
"//pkg/controller/volume/attachdetach/config:go_default_library",
6464
"//pkg/controller/volume/persistentvolume/config:go_default_library",
6565
"//pkg/features:go_default_library",
66+
"//pkg/proxy/util:go_default_library",
6667
"//staging/src/k8s.io/api/core/v1:go_default_library",
6768
"//staging/src/k8s.io/apimachinery/pkg/util/errors:go_default_library",
6869
"//staging/src/k8s.io/apiserver/pkg/server/options:go_default_library",
@@ -78,6 +79,7 @@ go_library(
7879
"//staging/src/k8s.io/component-base/metrics:go_default_library",
7980
"//staging/src/k8s.io/kube-controller-manager/config/v1alpha1:go_default_library",
8081
"//vendor/github.com/spf13/pflag:go_default_library",
82+
"//vendor/k8s.io/utils/net:go_default_library",
8183
],
8284
)
8385

‎cmd/kube-controller-manager/app/options/options_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,8 @@ var args = []string{
100100
"--enable-taint-manager=false",
101101
"--cluster-signing-duration=10h",
102102
"--flex-volume-plugin-dir=/flex-volume-plugin",
103+
"--volume-host-cidr-denylist=127.0.0.1/28,feed::/16",
104+
"--volume-host-allow-local-loopback=false",
103105
"--horizontal-pod-autoscaler-downscale-delay=2m",
104106
"--horizontal-pod-autoscaler-sync-period=45s",
105107
"--horizontal-pod-autoscaler-upscale-delay=1m",
@@ -350,6 +352,8 @@ func TestAddFlags(t *testing.T) {
350352
IncrementTimeoutHostPath: 45,
351353
},
352354
},
355+
VolumeHostCIDRDenylist: []string{"127.0.0.1/28", "feed::/16"},
356+
VolumeHostAllowLocalLoopback: false,
353357
},
354358
},
355359
PodGCController: &PodGCControllerOptions{
@@ -589,6 +593,8 @@ func TestApplyTo(t *testing.T) {
589593
IncrementTimeoutHostPath: 45,
590594
},
591595
},
596+
VolumeHostCIDRDenylist: []string{"127.0.0.1/28", "feed::/16"},
597+
VolumeHostAllowLocalLoopback: false,
592598
},
593599
PodGCController: podgcconfig.PodGCControllerConfiguration{
594600
TerminatedPodGCThreshold: 12000,

‎cmd/kube-controller-manager/app/options/persistentvolumebindercontroller.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,13 @@ limitations under the License.
1717
package options
1818

1919
import (
20+
"fmt"
21+
2022
"github.com/spf13/pflag"
2123

2224
persistentvolumeconfig "k8s.io/kubernetes/pkg/controller/volume/persistentvolume/config"
25+
proxyutil "k8s.io/kubernetes/pkg/proxy/util"
26+
netutils "k8s.io/utils/net"
2327
)
2428

2529
// PersistentVolumeBinderControllerOptions holds the PersistentVolumeBinderController options.
@@ -43,6 +47,8 @@ func (o *PersistentVolumeBinderControllerOptions) AddFlags(fs *pflag.FlagSet) {
4347
fs.BoolVar(&o.VolumeConfiguration.EnableHostPathProvisioning, "enable-hostpath-provisioner", o.VolumeConfiguration.EnableHostPathProvisioning, "Enable HostPath PV provisioning when running without a cloud provider. This allows testing and development of provisioning features. HostPath provisioning is not supported in any way, won't work in a multi-node cluster, and should not be used for anything other than testing or development.")
4448
fs.BoolVar(&o.VolumeConfiguration.EnableDynamicProvisioning, "enable-dynamic-provisioning", o.VolumeConfiguration.EnableDynamicProvisioning, "Enable dynamic provisioning for environments that support it.")
4549
fs.StringVar(&o.VolumeConfiguration.FlexVolumePluginDir, "flex-volume-plugin-dir", o.VolumeConfiguration.FlexVolumePluginDir, "Full path of the directory in which the flex volume plugin should search for additional third party volume plugins.")
50+
fs.StringSliceVar(&o.VolumeHostCIDRDenylist, "volume-host-cidr-denylist", o.VolumeHostCIDRDenylist, "A comma-separated list of CIDR ranges to avoid from volume plugins.")
51+
fs.BoolVar(&o.VolumeHostAllowLocalLoopback, "volume-host-allow-local-loopback", o.VolumeHostAllowLocalLoopback, "If false, deny local loopback IPs in addition to any CIDR ranges in --volume-host-cidr-denylist")
4652
}
4753

4854
// ApplyTo fills up PersistentVolumeBinderController config with options.
@@ -53,6 +59,8 @@ func (o *PersistentVolumeBinderControllerOptions) ApplyTo(cfg *persistentvolumec
5359

5460
cfg.PVClaimBinderSyncPeriod = o.PVClaimBinderSyncPeriod
5561
cfg.VolumeConfiguration = o.VolumeConfiguration
62+
cfg.VolumeHostCIDRDenylist = o.VolumeHostCIDRDenylist
63+
cfg.VolumeHostAllowLocalLoopback = o.VolumeHostAllowLocalLoopback
5664

5765
return nil
5866
}
@@ -64,5 +72,17 @@ func (o *PersistentVolumeBinderControllerOptions) Validate() []error {
6472
}
6573

6674
errs := []error{}
75+
if _, err := ParseVolumeHostFilters(o.VolumeHostCIDRDenylist, o.VolumeHostAllowLocalLoopback); err != nil {
76+
errs = append(errs, fmt.Errorf("Bad --volume-host-ip-denylist/--volume-host-allow-local-loopback %w", err))
77+
}
6778
return errs
6879
}
80+
81+
// ParseVolumeHostFilters process the --volume-host-ip-denylist and --volume-host-allow-local-loopback flags.
82+
func ParseVolumeHostFilters(denylist []string, allowLocalLoopback bool) (*proxyutil.FilteredDialOptions, error) {
83+
denyCIDRs, err := netutils.ParseCIDRs(denylist)
84+
if err != nil {
85+
return nil, err
86+
}
87+
return &proxyutil.FilteredDialOptions{DialHostCIDRDenylist: denyCIDRs, AllowLocalLoopback: allowLocalLoopback}, nil
88+
}

‎pkg/controller/apis/config/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/controller/volume/attachdetach/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ go_library(
1919
"//pkg/controller/volume/attachdetach/util:go_default_library",
2020
"//pkg/controller/volume/common:go_default_library",
2121
"//pkg/features:go_default_library",
22+
"//pkg/proxy/util:go_default_library",
2223
"//pkg/volume:go_default_library",
2324
"//pkg/volume/csimigration:go_default_library",
2425
"//pkg/volume/util:go_default_library",

‎pkg/controller/volume/attachdetach/attach_detach_controller.go‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ import (
5555
"k8s.io/kubernetes/pkg/controller/volume/attachdetach/util"
5656
"k8s.io/kubernetes/pkg/controller/volume/common"
5757
"k8s.io/kubernetes/pkg/features"
58+
proxyutil "k8s.io/kubernetes/pkg/proxy/util"
5859
"k8s.io/kubernetes/pkg/volume"
5960
"k8s.io/kubernetes/pkg/volume/csimigration"
6061
volumeutil "k8s.io/kubernetes/pkg/volume/util"
@@ -117,21 +118,23 @@ func NewAttachDetachController(
117118
prober volume.DynamicPluginProber,
118119
disableReconciliationSync bool,
119120
reconcilerSyncDuration time.Duration,
120-
timerConfig TimerConfig) (AttachDetachController, error) {
121+
timerConfig TimerConfig,
122+
filteredDialOptions *proxyutil.FilteredDialOptions) (AttachDetachController, error) {
121123

122124
adc := &attachDetachController{
123-
kubeClient: kubeClient,
124-
pvcLister: pvcInformer.Lister(),
125-
pvcsSynced: pvcInformer.Informer().HasSynced,
126-
pvLister: pvInformer.Lister(),
127-
pvsSynced: pvInformer.Informer().HasSynced,
128-
podLister: podInformer.Lister(),
129-
podsSynced: podInformer.Informer().HasSynced,
130-
podIndexer: podInformer.Informer().GetIndexer(),
131-
nodeLister: nodeInformer.Lister(),
132-
nodesSynced: nodeInformer.Informer().HasSynced,
133-
cloud: cloud,
134-
pvcQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "pvcs"),
125+
kubeClient: kubeClient,
126+
pvcLister: pvcInformer.Lister(),
127+
pvcsSynced: pvcInformer.Informer().HasSynced,
128+
pvLister: pvInformer.Lister(),
129+
pvsSynced: pvInformer.Informer().HasSynced,
130+
podLister: podInformer.Lister(),
131+
podsSynced: podInformer.Informer().HasSynced,
132+
podIndexer: podInformer.Informer().GetIndexer(),
133+
nodeLister: nodeInformer.Lister(),
134+
nodesSynced: nodeInformer.Informer().HasSynced,
135+
cloud: cloud,
136+
pvcQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "pvcs"),
137+
filteredDialOptions: filteredDialOptions,
135138
}
136139

137140
if utilfeature.DefaultFeatureGate.Enabled(features.CSIMigration) &&
@@ -313,6 +316,9 @@ type attachDetachController struct {
313316

314317
// intreeToCSITranslator translates from in-tree volume specs to CSI
315318
intreeToCSITranslator csimigration.InTreeToCSITranslator
319+
320+
// filteredDialOptions configures any dialing done by the controller.
321+
filteredDialOptions *proxyutil.FilteredDialOptions
316322
}
317323

318324
func (adc *attachDetachController) Run(stopCh <-chan struct{}) {
@@ -813,6 +819,10 @@ func (adc *attachDetachController) GetSubpather() subpath.Interface {
813819
return nil
814820
}
815821

822+
func (adc *attachDetachController) GetFilteredDialOptions() *proxyutil.FilteredDialOptions {
823+
return adc.filteredDialOptions
824+
}
825+
816826
func (adc *attachDetachController) GetCSIDriverLister() storagelistersv1.CSIDriverLister {
817827
return adc.csiDriverLister
818828
}

‎pkg/controller/volume/attachdetach/attach_detach_controller_test.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ func Test_NewAttachDetachController_Positive(t *testing.T) {
5555
false,
5656
5*time.Second,
5757
DefaultTimerConfig,
58+
nil, /* filteredDialOptions */
5859
)
5960

6061
// Assert
@@ -175,7 +176,9 @@ func attachDetachRecoveryTestCase(t *testing.T, extraPods1 []*v1.Pod, extraPods2
175176
prober,
176177
false,
177178
1*time.Second,
178-
DefaultTimerConfig)
179+
DefaultTimerConfig,
180+
nil, /* filteredDialOptions */
181+
)
179182

180183
if err != nil {
181184
t.Fatalf("Run failed with error. Expected: <no error> Actual: <%v>", err)

‎pkg/controller/volume/expand/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ go_library(
99
deps = [
1010
"//pkg/apis/core/v1/helper:go_default_library",
1111
"//pkg/controller/volume/events:go_default_library",
12+
"//pkg/proxy/util:go_default_library",
1213
"//pkg/volume:go_default_library",
1314
"//pkg/volume/csimigration:go_default_library",
1415
"//pkg/volume/util:go_default_library",

0 commit comments

Comments
 (0)