Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handle audit mode in cilium endpoint list and kubectl get cep #11011

Merged
merged 1 commit into from Apr 24, 2020
Merged

Handle audit mode in cilium endpoint list and kubectl get cep #11011

merged 1 commit into from Apr 24, 2020

Conversation

ap4y
Copy link
Contributor

@ap4y ap4y commented Apr 16, 2020 •
edited

This patch improve enforcement status reporting for
'cilium endpoint list' and 'kubectl get cep'. Former will have a new
audit status and later will show Enforcing=false when policy audit
mode is enabled.

cilium endpoint list:

ENDPOINT   POLICY (ingress)   POLICY (egress)   IDENTITY   LABELS (source:key[=value])                                                                   IPv6   IPv4           STATUS   
           ENFORCEMENT        ENFORCEMENT                                                                                                                                      
144        Audit              Disabled          52972      k8s:app=review-with-maste-d9llml                                                                     10.111.0.90    ready   
                                                           k8s:io.cilium.k8s.namespace.labels.app.gitlab.com/app=gitlab-org-defend-network-policy-demo                                 
                                                           k8s:io.cilium.k8s.namespace.labels.app.gitlab.com/env=review-with-maste-d9llml                                              
                                                           k8s:io.cilium.k8s.policy.cluster=default                                                                                    
                                                           k8s:io.cilium.k8s.policy.serviceaccount=default                                                                             
                                                           k8s:io.kubernetes.pod.namespace=network-policy-demo-15787276-review-with-maste-d9llml                                       
                                                           k8s:release=review-with-maste-d9llml                                                                                        
                                                           k8s:tier=web                                                                                                                
                                                           k8s:track=stable

kubectl get cep:

NAME                                        ENDPOINT ID   IDENTITY ID   INGRESS ENFORCEMENT   EGRESS ENFORCEMENT   VISIBILITY POLICY   ENDPOINT STATE   IPV4          IPV6
review-with-maste-d9llml-769d6d66d5-vvqx4   144           52972         false                 false                                    ready            10.111.0.90

@ap4y ap4y requested review from a team as code owners April 16, 2020 02:10
@maintainer-s-little-helper
Copy link

Please set the appropriate release note label.

@maintainer-s-little-helper maintainer-s-little-helper bot added this to In progress in 1.8.0 Apr 16, 2020
@coveralls
Copy link

coveralls commented Apr 16, 2020 •
edited

Coverage Status

Coverage decreased (-0.007%) to 44.689% when pulling 983b4bd on ap4y:endpoint-audit-status into fff6d6c on cilium:master.

@aanm aanm added pending-review release-note/minor This PR changes functionality that users may find relevant to operating Cilium. labels Apr 16, 2020
aanm
aanm reviewed Apr 16, 2020
View reviewed changes
Copy link
Member

@aanm aanm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you clarify the PR description a little bit? You're saying the if audit mode is set the cilium endpoint list will show Ingress/Egress policy as "Disabled"?

@aanm
Copy link
Member

aanm commented Apr 16, 2020

test-me-please

@ap4y
Copy link
Contributor Author

ap4y commented Apr 16, 2020

@aanm I have updated description with examples of both commands to make it more clear.

joestringer
joestringer approved these changes Apr 16, 2020
View reviewed changes
Copy link
Member

@joestringer joestringer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CLI LGTM.

aanm
aanm requested changes Apr 20, 2020
View reviewed changes
Copy link
Member

@aanm aanm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From a usability PoV it is not clear to me what "Audit" means, it's not clear if a policy is being enforced or not. I would prefer to see "Disabled (audit)"

@ap4y
Copy link
Contributor Author

ap4y commented Apr 21, 2020

Updated state label from Audit to Disabled (Audit).

@ap4y ap4y requested a review from aanm April 21, 2020 03:16
@aanm aanm requested a review from joestringer April 21, 2020 19:05
@aanm
Copy link
Member

aanm commented Apr 21, 2020

test-me-please

@joestringer
Copy link
Member

CI (Ginkgo) failure seems related to the latest change, GKE looks more like a flake. PTAL.

Handle audit mode in cilium endpoint list and kubectl get cep
983b4bd 
This patch improve enforcement status reporting for
'cilium endpoint list' and 'kubectl get cep'. Former will have a new
audit status and later will show Enforcing=false when policy audit
mode is enabled.

Signed-off-by: Arthur Evstifeev <aevstifeev@gitlab.com>
@ap4y
Copy link
Contributor Author

ap4y commented Apr 22, 2020

@joestringer Fixed regex escaping in the Gingko spec

@aanm
Copy link
Member

aanm commented Apr 22, 2020

test-me-please

@aanm aanm merged commit 514a38b into cilium:master Apr 24, 2020
1.8.0 automation moved this from In progress to Merged Apr 24, 2020
@ap4y ap4y deleted the endpoint-audit-status branch April 24, 2020 21:25
tklauser added a commit that referenced this pull request Jul 24, 2020
@tklauser
api: add missing audit mode enum values for EndpointPolicyEnabled
0e80b72 
PR  #11011 added only the generated APIs, but not the changes to
openapi.yaml and embedded_spec.go. Otherwise the respective consts are
removed when regenerating the API. Add them to api/v1/openapi.yaml now.

Fixes: 514a38b ("Handle audit mode in cilium endpoint list and kubectl get cep")
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
@tklauser tklauser mentioned this pull request Jul 24, 2020
Merged
aanm pushed a commit that referenced this pull request Jul 25, 2020
@tklauser @aanm
api: add missing audit mode enum values for EndpointPolicyEnabled
0a173dc 
PR  #11011 added only the generated APIs, but not the changes to
openapi.yaml and embedded_spec.go. Otherwise the respective consts are
removed when regenerating the API. Add them to api/v1/openapi.yaml now.

Fixes: 514a38b ("Handle audit mode in cilium endpoint list and kubectl get cep")
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
christarazi pushed a commit that referenced this pull request Jul 29, 2020
@tklauser @christarazi
api: add missing audit mode enum values for EndpointPolicyEnabled
ecf288f 
[ upstream commit 0a173dc ]

PR  #11011 added only the generated APIs, but not the changes to
openapi.yaml and embedded_spec.go. Otherwise the respective consts are
removed when regenerating the API. Add them to api/v1/openapi.yaml now.

Fixes: 514a38b ("Handle audit mode in cilium endpoint list and kubectl get cep")
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Chris Tarazi <chris@isovalent.com>
gandro pushed a commit that referenced this pull request Jul 29, 2020
@tklauser @gandro
api: add missing audit mode enum values for EndpointPolicyEnabled
8059b03 
[ upstream commit 0a173dc ]

PR  #11011 added only the generated APIs, but not the changes to
openapi.yaml and embedded_spec.go. Otherwise the respective consts are
removed when regenerating the API. Add them to api/v1/openapi.yaml now.

Fixes: 514a38b ("Handle audit mode in cilium endpoint list and kubectl get cep")
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Chris Tarazi <chris@isovalent.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tklauser tklauser tklauser left review comments

@joestringer joestringer joestringer approved these changes

@aanm aanm aanm approved these changes

Assignees
No one assigned
Labels
release-note/minor This PR changes functionality that users may find relevant to operating Cilium.
Projects
No open projects
1.8.0
  
Merged
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@ap4y @coveralls @aanm @joestringer @tklauser