cilium: Add encryption mode to `cilium status` #15833

gandro · 2021-04-22T17:55:46Z

This adds a new section for transparent encryption to the cilium status and cilium debug command.

cilium status can currently can take on of the three following forms:

Encryption:	Disabled
Encryption:	IPsec
Encryption:	Wireguard	[cilium_wg0 (Pubkey: GsIGt1Juo6p8gR93driyMD5FwFu2uOBBYGVsZtfQxho=, Port: 51871, Peers: 1)]

Details about IPsec may be added in a subsequent PR, as I'm not too familiar with what information should be provided.

This PR here focuses on Wireguard, as for troubleshooting purposes it will be crucial to dump the state of the cilium_wg0 device via cilium debuginfo:

The new section in cilium debuginfo is basically equivalent to executing wg show (with a minor difference being that the latest handshake timestamp is absolute, not relative):

#### Cilium encryption

##### Wireguard

```
interface: cilium_wg0
  public key: GsIGt1Juo6p8gR93driyMD5FwFu2uOBBYGVsZtfQxho=
  listening port: 51871

peer: 6gdyrnQ9ahwDNv0Q7gj2UI2h9MUITh+O7xb2wdacKQA=
  endpoint: 192.168.33.12:51871
  allowed ips: fd00::1:30b9/128, fd00::1:647e/128, 10.17.227.163/32, fd00::1:d6f/128, 10.17.202.94/32, 10.17.242.225/32
  latest handshake: 2021-04-22T17:48:01Z
  transfer: 123 B received, 456 B sent
```

gandro · 2021-04-22T19:40:20Z

test-me-please

rolinh

nit: I think that the value for encryption would be a bit more clear this way:

Encryption:	Disabled
Encryption:	Enabled via IPsec
Encryption:	Enabled via Wireguard	[cilium_wg0 (Pubkey: GsIGt1Juo6p8gR93driyMD5FwFu2uOBBYGVsZtfQxho=, Port: 51871, Peers: 1)]

pkg/wireguard/agent/agent.go

pkg/client/client.go

gandro · 2021-04-23T08:47:10Z

nit: I think that the value for encryption would be a bit more clear this way:
Encryption:	Disabled
Encryption:	Enabled via IPsec
Encryption:	Enabled via Wireguard	[cilium_wg0 (Pubkey: GsIGt1Juo6p8gR93driyMD5FwFu2uOBBYGVsZtfQxho=, Port: 51871, Peers: 1)]

Thanks, I think I'll leave as is though. Other multi-mode features we have in cilium status such as e.g. KubeProxyReplacement also just use "Disabled" or one of the modes and I personally prefer the brevity of it, especially if we also want to add more information to IPsec later on (which I believe we do), the line will get overly long.

gandro · 2021-04-23T08:47:33Z

retest-1.20-4.19

Previous failure seems like a unrelated flake (NodePort failure with exit code 42): https://jenkins.cilium.io/job/Cilium-PR-K8s-1.20-kernel-4.19/276/

gandro · 2021-04-23T08:47:48Z

retest-1.21-4.9

Previous failure is a flake #15775 https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-4.9/295/

jibi

Just a small correction, otherwise looks good 🚀

api/v1/openapi.yaml

This adds a new `Encryption` field to both the `CiliumStatus` and `DebugInfo` models. While both models share the same underlying `WireguardStatus` type, the array of peers will only be populated when `DebugInfo` is requested. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit adds a `Status()` method to the Wireguard agent which dumps the current status of the Wiregaurd tunnel device. The resulting information is similar to what a user can obtain via `wg show cilium_wg0`. The list of peers is optional, as it contains the IP address of each node and endpoint in the cluster and therefore does not need to be populated for a simple `cilium status` request. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit populates the API responses for the `CiliumStatus` and `DebugInfo` requests. The `DebugInfo` request contains more details about each Wireguard peer. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This adds a new section for transparent encryption to the `cilium status` command. It currently can take on of the three following forms: ``` Encryption: Disabled Encryption: IPsec Encryption: Wireguard [cilium_wg0 (Pubkey: GsIGt1Juo6p8gR93driyMD5FwFu2uOBBYGVsZtfQxho=, Port: 51871, Peers: 1)] ``` Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This adds a new section to the `cilium debuginfo` output which provides additional debugging information for Wireguard. It's output is basically equivalent to `wg show`: #### Cilium encryption ##### Wireguard ``` interface: cilium_wg0 public key: GsIGt1Juo6p8gR93driyMD5FwFu2uOBBYGVsZtfQxho= listening port: 51871 peer: 6gdyrnQ9ahwDNv0Q7gj2UI2h9MUITh+O7xb2wdacKQA= endpoint: 192.168.33.12:51871 allowed ips: fd00::1:30b9/128, fd00::1:647e/128, 10.17.227.163/32, fd00::1:d6f/128, 10.17.202.94/32, 10.17.242.225/32 latest handshake: 2021-04-22T17:48:01Z transfer: 123 B received, 456 B sent ``` Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

gandro · 2021-04-23T13:45:49Z

test-me-please

brb

🚀

gandro · 2021-04-23T16:54:57Z

CI seems to have issues, all of the three pipelines failed with error: unable to upgrade connection: Authorization error?

Looks like: #15455

https://jenkins.cilium.io/job/Cilium-PR-K8s-1.16-net-next/355/
https://jenkins.cilium.io/job/Cilium-PR-K8s-1.20-kernel-4.19/284/
https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-4.9/303/

GKE failed to provision cluster: https://jenkins.cilium.io/job/Cilium-PR-K8s-GKE/5238/

gandro · 2021-04-23T16:56:39Z

test-1.16-netnext

gandro · 2021-04-23T16:56:45Z

test-1.20-4.19

gandro · 2021-04-23T16:57:02Z

test-1.21-4.9

gandro · 2021-04-23T16:57:26Z

test-gke

gandro · 2021-04-23T17:33:05Z

test-gke

gandro · 2021-04-24T09:12:59Z

test-me-please

gandro · 2021-04-26T08:45:03Z

test-1.21-4.9 hit #15455 again (https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-4.9/312/)

GKE hit an K8s API error Unable to continue with install: could not get information about the resource: an error on the server ("Internal Server Error: \"/apis/apps/v1/namespaces/kube-system/daemonsets/cilium-node-init\": the server is currently unable to handle the request") has prevented the request from succeeding (get daemonsets.apps cilium-node-init)

https://jenkins.cilium.io/job/Cilium-PR-K8s-GKE/5253

gandro · 2021-04-26T08:46:41Z

retest-1.21-4.9

gandro · 2021-04-26T08:46:47Z

retest-gke

gandro · 2021-04-26T09:25:14Z

retest-gke

gandro · 2021-04-26T12:18:05Z

CI is finally green (except for GKE, which is currently known to be always broken, see #15861), marking as ready to merge.

gandro added release-note/minor This PR changes functionality that users may find relevant to operating Cilium. area/cli Impacts the command line interface of any command in the repository. area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. labels Apr 22, 2021

gandro requested a review from a team April 22, 2021 17:55

gandro requested a review from a team as a code owner April 22, 2021 17:55

gandro requested a review from a team April 22, 2021 17:55

gandro requested review from a team as code owners April 22, 2021 17:55

maintainer-s-little-helper bot added this to In progress in 1.10.0 Apr 22, 2021

gandro requested review from jibi, rolinh and brb April 22, 2021 17:55

maintainer-s-little-helper bot assigned jibi, rolinh and brb Apr 22, 2021

gandro added the release-blocker/1.10 label Apr 22, 2021

gandro force-pushed the pr/gandro/wireguard-cilium-status branch 3 times, most recently from 85f0b55 to 0df2176 Compare April 22, 2021 18:57

aanm approved these changes Apr 22, 2021

View reviewed changes

rolinh approved these changes Apr 23, 2021

View reviewed changes

pkg/wireguard/agent/agent.go Show resolved Hide resolved

pkg/client/client.go Show resolved Hide resolved

jibi approved these changes Apr 23, 2021

View reviewed changes

api/v1/openapi.yaml Outdated Show resolved Hide resolved

gandro added 4 commits April 23, 2021 15:44

daemon: Populate encryption fields in /healthz and /debuginfo

1f36258

This commit populates the API responses for the `CiliumStatus` and `DebugInfo` requests. The `DebugInfo` request contains more details about each Wireguard peer. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

gandro force-pushed the pr/gandro/wireguard-cilium-status branch from 0df2176 to d64d9f8 Compare April 23, 2021 13:44

brb approved these changes Apr 23, 2021

View reviewed changes

gandro mentioned this pull request Apr 26, 2021

Wireguard integration follow-up #15462

Closed

24 tasks

gandro added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Apr 26, 2021

aanm merged commit 69ead9a into cilium:master Apr 26, 2021

1.10.0 automation moved this from In progress to Done Apr 26, 2021

This was referenced Apr 28, 2021

Prepare for release v1.10.0-rc1 #15896

Closed

Prepare for release v1.10.0-rc1 #15897

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cilium: Add encryption mode to `cilium status` #15833

cilium: Add encryption mode to `cilium status` #15833

gandro commented Apr 22, 2021

gandro commented Apr 22, 2021

rolinh left a comment

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021 •

edited

gandro commented Apr 23, 2021 •

edited

jibi left a comment

gandro commented Apr 23, 2021

brb left a comment

gandro commented Apr 23, 2021 •

edited

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 24, 2021

gandro commented Apr 26, 2021 •

edited

gandro commented Apr 26, 2021

gandro commented Apr 26, 2021

gandro commented Apr 26, 2021

gandro commented Apr 26, 2021 •

edited

cilium: Add encryption mode to cilium status #15833

cilium: Add encryption mode to cilium status #15833

Conversation

gandro commented Apr 22, 2021

gandro commented Apr 22, 2021

rolinh left a comment

Choose a reason for hiding this comment

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021 • edited

gandro commented Apr 23, 2021 • edited

jibi left a comment

Choose a reason for hiding this comment

gandro commented Apr 23, 2021

brb left a comment

Choose a reason for hiding this comment

gandro commented Apr 23, 2021 • edited

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 23, 2021

gandro commented Apr 24, 2021

gandro commented Apr 26, 2021 • edited

gandro commented Apr 26, 2021

gandro commented Apr 26, 2021

gandro commented Apr 26, 2021

gandro commented Apr 26, 2021 • edited

cilium: Add encryption mode to `cilium status` #15833

cilium: Add encryption mode to `cilium status` #15833

gandro commented Apr 23, 2021 •

edited

gandro commented Apr 23, 2021 •

edited

gandro commented Apr 23, 2021 •

edited

gandro commented Apr 26, 2021 •

edited

gandro commented Apr 26, 2021 •

edited