Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add EnableDefaultDeny field to Network Policy #30572

Merged
merged 4 commits into from
Mar 14, 2024
Merged

Add EnableDefaultDeny field to Network Policy #30572

merged 4 commits into from
Mar 14, 2024

Commits on Mar 11, 2024

  1. policy/api: add EnableDefaultDeny field 

    This adds a new field, EnableDefaultDeny, to CiliumNetworkPolicy and
CiliumClusterwideNetworkPolicy, that controls whether or not the subject
endpoints of this policy should drop unselected peer traffic.

By default, endpoints are in a default-allow mode. When the first policy
applies to an endpoint, it flips it to a default-deny mode. This option
allows disabling that behavior. If not specified, the existing behavior
remains: for each direction, traffic is allowed unless at least one
policy rule applies to that endpoint. If multiple policies select an
endpoint, then default-deny takes precedence.

It is useful in heterogeneous environments, it may not be desirable to
implicitly drop all non-matching traffic. Consider, for example, the
case where an administrator wishes to ensure a monitoring service can
access all namespaces. If they create a cluster-wide policy allowing
access from the monitoring service, it may create a deny policy where
none was previously; unexpectedly dropping traffic.

See: https://github.com/cilium/design-cfps/blob/main/cilium/CFP-30572-non-default-deny-policies.md

This commit contains only the API changes; a subsequent commit will
introduce the implementation.

Signed-off-by: Casey Callendrello <cdc@isovalent.com>
    @squeed
    squeed committed Mar 11, 2024
    Configuration menu
    Copy the full SHA
    a87df07 View commit details
    Browse the repository at this point in the history

  2. policy/api: change Rule.Sanitize() to pointer receiver 

    Methods called by Sanitize() may alter the underlying structures. For
example. selectors are aggregated and address families are upper-cased.
However, top-level fields can't be written by Sanitize. In the future,
we'd like to do that. So, give it a pointer receiver.

Signed-off-by: Casey Callendrello <cdc@isovalent.com>
    @squeed
    squeed committed Mar 11, 2024
    Configuration menu
    Copy the full SHA
    155a39e View commit details
    Browse the repository at this point in the history

  3. policy: implement non-default-deny policies 

    This adjust the policy rule generation to take in to account
non-default-deny policies.

As before, an endpoint is normally in a policy-disabled state. If any
policies select this endpoint, then policy is enabled and all
non-allowed traffic is dropped.

If, however, an endpoint is only selected by default-allow policies,
then policy is enabled, but a special wildcard allow policy is inserted.
Since wildcard polcies have very low precedence, this ensures that any
Deny or L7-proxy rules will still take effect.

This commit also fixes tests that incorrectly failed to sanitize rules
before adding to the policy repository, leading to a nil pointer
exception. Production code *always* sanitizes rules before adding.

Signed-off-by: Casey Callendrello <cdc@isovalent.com>
    @squeed
    squeed committed Mar 11, 2024
    Configuration menu
    Copy the full SHA
    e57528f View commit details
    Browse the repository at this point in the history

  4. test: add ginkgo default-allow tests 

    Add some tests that create various mixtures of default-allow and
default-deny policies. It is important that default-deny policies always
take precedence over default-allow. It is also important that Deny rules
take precedence over default-allow.

These need to be integration tests, since they rely on specific
interactions between the userspace and bpf policy engines.

Signed-off-by: Casey Callendrello <cdc@isovalent.com>
    @squeed
    squeed committed Mar 11, 2024
    Configuration menu
    Copy the full SHA
    8c7d8ff View commit details
    Browse the repository at this point in the history