Skip to content

Commit

Permalink
fix: add node to pod allow acl
Browse files Browse the repository at this point in the history
If this acl not exists and networkpolicy is added, probe will failed as is not allowed.
If no networkpolicy exists, this allow acl may increase performance burden. So only add
this acl if any networkpolicy exists

(cherry picked from commit c1d3fc3)
  • Loading branch information
oilbeater committed May 30, 2021
1 parent 91d43e0 commit 04fc67f
Show file tree
Hide file tree
Showing 3 changed files with 64 additions and 5 deletions.
1 change: 1 addition & 0 deletions pkg/controller/controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -449,4 +449,5 @@ func (c *Controller) startWorkers(stopCh <-chan struct{}) {
}, 30*time.Second, stopCh)

go wait.Until(c.resyncSubnetMetrics, 30*time.Second, stopCh)
go wait.Until(c.resyncNodeACL, 10*time.Second, stopCh)
}
24 changes: 24 additions & 0 deletions pkg/controller/network_policy.go
Original file line number Diff line number Diff line change
Expand Up @@ -664,3 +664,27 @@ func isNamespaceMatchNetworkPolicy(ns *corev1.Namespace, policy *netv1.NetworkPo
}
return false
}

func (c *Controller) resyncNodeACL() {
np, _ := c.npsLister.List(labels.Everything())
networkPolicyExists := len(np) != 0

subnets, _ := c.subnetsLister.List(labels.Everything())
for _, subnet := range subnets {
if subnet.Spec.Provider == util.OvnProvider || subnet.Spec.Provider == "" {
if subnet.Name == c.config.NodeSwitch {
continue
}

if networkPolicyExists {
if err := c.ovnClient.SetNodeSwitchAcl(subnet.Name); err != nil {
klog.Errorf("failed to set node acl, %v", err)
}
} else {
if err := c.ovnClient.RemoveNodeSwitchAcl(subnet.Name); err != nil {
klog.Errorf("failed to set node acl, %v", err)
}
}
}
}
}
44 changes: 39 additions & 5 deletions pkg/ovs/ovn-nbctl.go
Original file line number Diff line number Diff line change
Expand Up @@ -704,6 +704,40 @@ func (c Client) CleanLogicalSwitchAcl(ls string) error {
return err
}

func (c Client) SetNodeSwitchAcl(ls string) error {
cidrs := strings.Split(c.NodeSwitchCIDR, ",")
for _, cidr := range cidrs {
var err error
if util.CheckProtocol(cidr) == kubeovnv1.ProtocolIPv4 {
_, err = c.ovnNbCommand(MayExist, "acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip4.src==%s", c.NodeSwitchCIDR), "allow-related")
} else {
_, err = c.ovnNbCommand(MayExist, "acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip6.src==%s", c.NodeSwitchCIDR), "allow-related")
}
if err != nil {
klog.Errorf("failed to add node switch acl")
return err
}
}
return nil
}

func (c Client) RemoveNodeSwitchAcl(ls string) error {
cidrs := strings.Split(c.NodeSwitchCIDR, ",")
for _, cidr := range cidrs {
var err error
if util.CheckProtocol(cidr) == kubeovnv1.ProtocolIPv4 {
_, err = c.ovnNbCommand("acl-del", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip4.src==%s", c.NodeSwitchCIDR))
} else {
_, err = c.ovnNbCommand("acl-del", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip6.src==%s", c.NodeSwitchCIDR))
}
if err != nil {
klog.Errorf("failed to delete node switch acl")
return err
}
}
return nil
}

// ResetLogicalSwitchAcl reset acl of a switch
func (c Client) ResetLogicalSwitchAcl(ls string) error {
_, err := c.ovnNbCommand("acl-del", ls)
Expand All @@ -717,12 +751,12 @@ func (c Client) SetPrivateLogicalSwitch(ls, protocol, cidr string, allow []strin
var dropArgs []string
if protocol == kubeovnv1.ProtocolIPv4 {
dropArgs = []string{"--", "--log", fmt.Sprintf("--name=%s", ls), fmt.Sprintf("--severity=%s", "warning"), "acl-add", ls, "to-lport", util.DefaultDropPriority, "ip", "drop"}
allowArgs = append(allowArgs, "--", "acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip4.src==%s", c.NodeSwitchCIDR), "allow-related")
allowArgs = append(allowArgs, "--", "acl-add", ls, "to-lport", util.SubnetAllowPriority, fmt.Sprintf(`ip4.src==%s && ip4.dst==%s`, cidr, cidr), "allow-related")
allowArgs = append(allowArgs, "--", MayExist, "acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip4.src==%s", c.NodeSwitchCIDR), "allow-related")
allowArgs = append(allowArgs, "--", MayExist, "acl-add", ls, "to-lport", util.SubnetAllowPriority, fmt.Sprintf(`ip4.src==%s && ip4.dst==%s`, cidr, cidr), "allow-related")
} else {
dropArgs = []string{"--", "--log", fmt.Sprintf("--name=%s", ls), fmt.Sprintf("--severity=%s", "warning"), "acl-add", ls, "to-lport", util.DefaultDropPriority, "ip", "drop"}
allowArgs = append(allowArgs, "--", "acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip6.src==%s", c.NodeSwitchCIDR), "allow-related")
allowArgs = append(allowArgs, "--", "acl-add", ls, "to-lport", util.SubnetAllowPriority, fmt.Sprintf(`ip6.src==%s && ip6.dst==%s`, cidr, cidr), "allow-related")
allowArgs = append(allowArgs, "--", MayExist, "acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip6.src==%s", c.NodeSwitchCIDR), "allow-related")
allowArgs = append(allowArgs, "--", MayExist, "acl-add", ls, "to-lport", util.SubnetAllowPriority, fmt.Sprintf(`ip6.src==%s && ip6.dst==%s`, cidr, cidr), "allow-related")
}
ovnArgs := append(delArgs, dropArgs...)

Expand All @@ -736,7 +770,7 @@ func (c Client) SetPrivateLogicalSwitch(ls, protocol, cidr string, allow []strin
match = fmt.Sprintf("(ip6.src==%s && ip6.dst==%s) || (ip6.src==%s && ip6.dst==%s)", strings.TrimSpace(subnet), cidr, cidr, strings.TrimSpace(subnet))
}

allowArgs = append(allowArgs, "--", "acl-add", ls, "to-lport", util.SubnetAllowPriority, match, "allow-related")
allowArgs = append(allowArgs, "--", MayExist, "acl-add", ls, "to-lport", util.SubnetAllowPriority, match, "allow-related")
}
}
ovnArgs = append(ovnArgs, allowArgs...)
Expand Down

0 comments on commit 04fc67f

Please sign in to comment.