fix: pod should be accessed from node when acl applied

kubeovn · Aug 28, 2019 · 38be68d · 38be68d
1 parent bb63f8c
commit 38be68d
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 6 deletions.
diff --git a/pkg/controller/subnet.go b/pkg/controller/subnet.go
@@ -382,11 +382,11 @@ func (c *Controller) handleAddSubnet(key string) error {
 		return err
 	}
 
-	err = c.ovnClient.CleanLogicalSwitchAcl(subnet.Name)
+	err = c.ovnClient.ResetLogicalSwitchAcl(subnet.Name, subnet.Spec.Protocol)
 	if err != nil {
-		subnet.Status.SetError("CleanLogicalSwitchAclFailed", err.Error())
+		subnet.Status.SetError("ResetLogicalSwitchAclFailed", err.Error())
 	} else {
-		subnet.Status.Ready("CleanLogicalSwitchAclSuccess", "")
+		subnet.Status.Ready("ResetLogicalSwitchAclSuccess", "")
 	}
 	bytes, err1 := subnet.Status.Bytes()
 	if err1 != nil {
@@ -491,11 +491,11 @@ func (c *Controller) handleUpdateSubnet(key string) error {
 		}
 		return err
 	}
-	err = c.ovnClient.CleanLogicalSwitchAcl(subnet.Name)
+	err = c.ovnClient.ResetLogicalSwitchAcl(subnet.Name, subnet.Spec.Protocol)
 	if err != nil {
-		subnet.Status.SetError("CleanLogicalSwitchAclFailed", err.Error())
+		subnet.Status.SetError("ResetLogicalSwitchAclFailed", err.Error())
 	} else {
-		subnet.Status.Ready("CleanLogicalSwitchAclSuccess", "")
+		subnet.Status.Ready("ResetLogicalSwitchAclSuccess", "")
 	}
 	bytes, err1 := subnet.Status.Bytes()
 	if err1 != nil {

diff --git a/pkg/ovs/ovn-nbctl.go b/pkg/ovs/ovn-nbctl.go
@@ -303,6 +303,19 @@ func (c Client) CleanLogicalSwitchAcl(ls string) error {
 	return err
 }
 
+// ResetLogicalSwitchAcl reset acl of a switch
+func (c Client) ResetLogicalSwitchAcl(ls, protocol string) error {
+	var err error
+	if protocol == kubeovnv1.ProtocolIPv6 {
+		_, err = c.ovnNbCommand("acl-del", ls, "--",
+			"acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip6.src==%s", c.NodeSwitchCIDR), "allow-related")
+	} else {
+		_, err = c.ovnNbCommand("acl-del", ls, "--",
+			"acl-add", ls, "to-lport", util.NodeAllowPriority, fmt.Sprintf("ip4.src==%s", c.NodeSwitchCIDR), "allow-related")
+	}
+	return err
+}
+
 // SetPrivateLogicalSwitch will drop all ingress traffic except allow subnets
 func (c Client) SetPrivateLogicalSwitch(ls, protocol, cidr string, allow []string) error {
 	delArgs := []string{"acl-del", ls}