Skip to content

clear stale states on creation #411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 30, 2019
Merged

clear stale states on creation #411

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0999758
clear stale states on creation
Sep 26, 2019
9ccdd5e
log first UninitNpmChains() call
Sep 27, 2019
fd85a6a
adding kube system namespace after reboot
jaer-tsun Sep 30, 2019
7750ebf
Merge remote-tracking branch 'upstream/master' into resetIptablesOnCr…
jaer-tsun Sep 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions npm/iptm/iptm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,8 @@ import (
)

const (
defaultlockWaitTimeInSeconds = "60"
defaultlockWaitTimeInSeconds string = "60"
iptablesErrDoesNotExist int = 1
)

// IptEntry represents an iptables rule.
Expand Down Expand Up @@ -212,6 +213,12 @@ func (iptMgr *IptablesManager) UninitNpmChains() error {
util.IptablesAzureEgressPortChain,
util.IptablesAzureEgressToChain,
util.IptablesAzureTargetSetsChain,
// Below chains exists only for before Azure-NPM:v1.0.27
// and should be removed after a baking period.
util.IptablesAzureIngressFromNsChain,
util.IptablesAzureIngressFromPodChain,
util.IptablesAzureEgressToNsChain,
util.IptablesAzureEgressToPodChain,
}

// Remove AZURE-NPM chain from FORWARD chain.
Expand All @@ -224,7 +231,7 @@ func (iptMgr *IptablesManager) UninitNpmChains() error {
}
iptMgr.OperationFlag = util.IptablesDeletionFlag
errCode, err := iptMgr.Run(entry)
if errCode != 1 && err != nil {
if errCode != iptablesErrDoesNotExist && err != nil {
log.Errorf("Error: failed to remove default rule from FORWARD chain.")
return err
}
Expand All @@ -234,7 +241,8 @@ func (iptMgr *IptablesManager) UninitNpmChains() error {
entry := &IptEntry{
Chain: chain,
}
if _, err := iptMgr.Run(entry); err != nil {
errCode, err := iptMgr.Run(entry)
if errCode != iptablesErrDoesNotExist && err != nil {
log.Errorf("Error: failed to flush iptables chain %s.", chain)
}
}
Expand All @@ -257,7 +265,7 @@ func (iptMgr *IptablesManager) Exists(entry *IptEntry) (bool, error) {
return true, nil
}

if returnCode == 1 {
if returnCode == iptablesErrDoesNotExist {
log.Printf("Rule doesn't exist. %+v.", entry)
return false, nil
}
Expand All @@ -273,7 +281,7 @@ func (iptMgr *IptablesManager) AddChain(chain string) error {
iptMgr.OperationFlag = util.IptablesChainCreationFlag
errCode, err := iptMgr.Run(entry)
if err != nil {
if errCode == 1 {
if errCode == iptablesErrDoesNotExist {
log.Printf("Chain already exists %s.", entry.Chain)
return nil
}
Expand All @@ -293,7 +301,7 @@ func (iptMgr *IptablesManager) DeleteChain(chain string) error {
iptMgr.OperationFlag = util.IptablesDestroyFlag
errCode, err := iptMgr.Run(entry)
if err != nil {
if errCode == 1 {
if errCode == iptablesErrDoesNotExist {
log.Printf("Chain doesn't exist %s.", entry.Chain)
return nil
}
Expand Down
2 changes: 1 addition & 1 deletion npm/namespace.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ func (npMgr *NetworkPolicyManager) UninitAllNsList() error {
return nil
}

// AddNamespace handles adding namespace to ipset.
// AddNamespace handles adding namespace to ipset.
func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
npMgr.Lock()
defer npMgr.Unlock()
Expand Down
43 changes: 22 additions & 21 deletions npm/npm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,9 +45,9 @@ type NetworkPolicyManager struct {
nsInformer coreinformers.NamespaceInformer
npInformer networkinginformers.NetworkPolicyInformer

nodeName string
nsMap map[string]*namespace
isAzureNpmChainCreated bool
nodeName string
nsMap map[string]*namespace
isAzureNpmChainCreated bool
isSafeToCleanUpAzureNpmChain bool

clusterState telemetry.ClusterState
Expand Down Expand Up @@ -169,11 +169,6 @@ func (npMgr *NetworkPolicyManager) Start(stopCh <-chan struct{}) error {
// Starts all informers manufactured by npMgr's informerFactory.
npMgr.informerFactory.Start(stopCh)

// Failure detected. Needs to restore Azure-NPM related iptables entries.
if util.Exists(util.IptablesConfigFile) {
npMgr.restore()
}

// Wait for the initial sync of local cache.
if !cache.WaitForCacheSync(stopCh, npMgr.podInformer.Informer().HasSynced) {
return fmt.Errorf("Pod informer failed to sync")
Expand All @@ -194,6 +189,10 @@ func (npMgr *NetworkPolicyManager) Start(stopCh <-chan struct{}) error {

// NewNetworkPolicyManager creates a NetworkPolicyManager
func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory informers.SharedInformerFactory, npmVersion string) *NetworkPolicyManager {
// Clear out left over iptables states
log.Logf("Azure-NPM creating, cleaning iptables")
iptMgr := iptm.NewIptablesManager()
iptMgr.UninitNpmChains()

podInformer := informerFactory.Core().V1().Pods()
nsInformer := informerFactory.Core().V1().Namespaces()
Expand All @@ -212,14 +211,14 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
}

npMgr := &NetworkPolicyManager{
clientset: clientset,
informerFactory: informerFactory,
podInformer: podInformer,
nsInformer: nsInformer,
npInformer: npInformer,
nodeName: os.Getenv("HOSTNAME"),
nsMap: make(map[string]*namespace),
isAzureNpmChainCreated: false,
clientset: clientset,
informerFactory: informerFactory,
podInformer: podInformer,
nsInformer: nsInformer,
npInformer: npInformer,
nodeName: os.Getenv("HOSTNAME"),
nsMap: make(map[string]*namespace),
isAzureNpmChainCreated: false,
isSafeToCleanUpAzureNpmChain: false,
clusterState: telemetry.ClusterState{
PodCount: 0,
Expand All @@ -243,13 +242,15 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
clusterState := npMgr.GetClusterState()
npMgr.reportManager.Report.(*telemetry.NPMReport).GetReport(clusterID, npMgr.nodeName, npmVersion, serverVersion.GitVersion, clusterState)

allNs, err := newNs(util.KubeAllNamespacesFlag)
if err != nil {
log.Logf("Error: failed to create all-namespace.")
panic(err.Error)
}
allNs, _ := newNs(util.KubeAllNamespacesFlag)
npMgr.nsMap[util.KubeAllNamespacesFlag] = allNs

// Create ipset for the namespace.
kubeSystemNs := "ns-" + util.KubeSystemFlag
if err := allNs.ipsMgr.CreateSet(kubeSystemNs); err != nil {
log.Logf("Error: failed to create ipset for namespace %s.", kubeSystemNs)
}

podInformer.Informer().AddEventHandler(
// Pod event handlers
cache.ResourceEventHandlerFuncs{
Expand Down
26 changes: 16 additions & 10 deletions npm/util/const.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ const (
IptablesSFlag string = "-s"
IptablesDFlag string = "-d"
IptablesDstPortFlag string = "--dport"
IptablesModuleFlag string = "-m"
IptablesModuleFlag string = "-m"
IptablesSetModuleFlag string = "set"
IptablesMatchSetFlag string = "--match-set"
IptablesStateModuleFlag string = "state"
Expand All @@ -60,15 +60,21 @@ const (
IptablesCommentModuleFlag string = "comment"
IptablesCommentFlag string = "--comment"
IptablesAddCommentFlag
IptablesAzureChain string = "AZURE-NPM"
IptablesAzureKubeSystemChain string = "AZURE-NPM-KUBE-SYSTEM"
IptablesAzureIngressPortChain string = "AZURE-NPM-INGRESS-PORT"
IptablesAzureIngressFromChain string = "AZURE-NPM-INGRESS-FROM"
IptablesAzureEgressPortChain string = "AZURE-NPM-EGRESS-PORT"
IptablesAzureEgressToChain string = "AZURE-NPM-EGRESS-TO"
IptablesAzureTargetSetsChain string = "AZURE-NPM-TARGET-SETS"
IptablesForwardChain string = "FORWARD"
IptablesInputChain string = "INPUT"
IptablesAzureChain string = "AZURE-NPM"
IptablesAzureKubeSystemChain string = "AZURE-NPM-KUBE-SYSTEM"
IptablesAzureIngressPortChain string = "AZURE-NPM-INGRESS-PORT"
IptablesAzureIngressFromChain string = "AZURE-NPM-INGRESS-FROM"
IptablesAzureEgressPortChain string = "AZURE-NPM-EGRESS-PORT"
IptablesAzureEgressToChain string = "AZURE-NPM-EGRESS-TO"
IptablesAzureTargetSetsChain string = "AZURE-NPM-TARGET-SETS"
IptablesForwardChain string = "FORWARD"
IptablesInputChain string = "INPUT"
// Below chains exists only for before Azure-NPM:v1.0.27
// and should be removed after a baking period.
IptablesAzureIngressFromNsChain string = "AZURE-NPM-INGRESS-FROM-NS"
IptablesAzureIngressFromPodChain string = "AZURE-NPM-INGRESS-FROM-POD"
IptablesAzureEgressToNsChain string = "AZURE-NPM-EGRESS-TO-NS"
IptablesAzureEgressToPodChain string = "AZURE-NPM-EGRESS-TO-POD"
)

//ipset related constants.
Expand Down