Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NETOBSERV-1426: detect external workloads / openshift subnets #559

Merged
merged 1 commit into from
Apr 3, 2024
Merged

NETOBSERV-1426: detect external workloads / openshift subnets #559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
27 changes: 27 additions & 0 deletions apis/flowcollector/v1beta1/flowcollector_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -505,6 +505,10 @@ type FlowCollectorFLP struct {
// This feature requires the "topology.kubernetes.io/zone" label to be set on nodes.
AddZone *bool `json:"addZone,omitempty"`

//+optional
// `subnetLabels` allows to define custom labels on subnets and IPs or to enable automatic labelling of recognized subnets in OpenShift.
SubnetLabels SubnetLabels `json:"subnetLabels,omitempty"`

// `debug` allows setting some aspects of the internal configuration of the flow processor.
// This section is aimed exclusively for debugging and fine-grained performance optimizations,
// such as `GOGC` and `GOMAXPROCS` env vars. Set these values at your own risk.
Expand Down Expand Up @@ -844,6 +848,29 @@ type DebugConfig struct {
Env map[string]string `json:"env,omitempty"`
}

// `SubnetLabels` allows to define custom labels on subnets and IPs or to enable automatic labelling of recognized subnets in OpenShift.
type SubnetLabels struct {
// `openShiftAutoDetect` allows, when set to `true`, to detect automatically the machines, pods and services subnets based on the
// OpenShift install configuration and the Cluster Network Operator configuration.
//+optional
OpenShiftAutoDetect *bool `json:"openShiftAutoDetect,omitempty"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a default ? false

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

keeping nil as a default makes it more flexible, imagine if in the future we want to enable it by default, then we'll be able to tell "if it's nil => enabled" .. which will also work for folks upgrading from a previous version.
If we set a default "false", and we later change the default, people upgrading will still have their old default


// `customLabels` allows to customize subnets and IPs labelling, such as to identify cluster-external workloads or web services.
jotak marked this conversation as resolved.
Show resolved Hide resolved
// If you enable `openShiftAutoDetect`, `customLabels` can override the detected subnets in case they overlap.
//+optional
CustomLabels []SubnetLabel `json:"customLabels,omitempty"`
}

// SubnetLabel allows to label subnets and IPs, such as to identify cluster-external workloads or web services.
type SubnetLabel struct {
// List of CIDRs, such as `["1.2.3.4/32"]`.
//+required
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do u need CIDR api verification here ? this is an example
https://github.com/openshift/api/blob/master/network/v1/types.go#L34

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks yeah I'll look into it

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually this pattern only matches IPv4, and we allow IPv6 here. Adding regex for ipv6 is quite more complicated; I'd rather go with a validation webhook (there is a future task to implement that)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this the check for the resource u read to pull cidrs from in CNO, I remember there were extension to verify IP CIDR that was under dev I will see if that is already there in such case that will be very light weight compared to verification webhook

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there is new cel check for CIDR pls check this slack thread
https://redhat-internal.slack.com/archives/C3VS0LV41/p1708517668688849

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as discussed on slack, using the CIDR check would break compatibility on older k8s/ocp. We need to wait that our last supported version has it

CIDRs []string `json:"cidrs,omitempty"` // Note, starting with k8s 1.31 / ocp 4.16 there's a new way to validate CIDR such as `+kubebuilder:validation:XValidation:rule="isCIDR(self)",message="field should be in CIDR notation format"`. But older versions would reject the CRD so we cannot implement it now to maintain compatibility.
// Label name, used to flag matching flows.
//+required
Name string `json:"name,omitempty"`
}

// Add more exporter types below
type ExporterType string

Expand Down
70 changes: 70 additions & 0 deletions apis/flowcollector/v1beta1/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

48 changes: 48 additions & 0 deletions apis/flowcollector/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

27 changes: 27 additions & 0 deletions apis/flowcollector/v1beta2/flowcollector_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -462,6 +462,10 @@ type FlowCollectorFLP struct {
// This feature requires the "topology.kubernetes.io/zone" label to be set on nodes.
AddZone *bool `json:"addZone,omitempty"`

//+optional
// `SubnetLabels` allows to define custom labels on subnets and IPs or to enable automatic labelling of recognized subnets in OpenShift.
SubnetLabels SubnetLabels `json:"subnetLabels,omitempty"`

// `advanced` allows setting some aspects of the internal configuration of the flow processor.
// This section is aimed mostly for debugging and fine-grained performance optimizations,
// such as `GOGC` and `GOMAXPROCS` env vars. Set these values at your own risk.
Expand Down Expand Up @@ -1055,6 +1059,29 @@ type AdvancedPluginConfig struct {
PriorityClassName string `json:"priorityClassName,omitempty"`
}

// `SubnetLabels` allows to define custom labels on subnets and IPs or to enable automatic labelling of recognized subnets in OpenShift.
type SubnetLabels struct {
// `openShiftAutoDetect` allows, when set to `true`, to detect automatically the machines, pods and services subnets based on the
// OpenShift install configuration and the Cluster Network Operator configuration.
//+optional
OpenShiftAutoDetect *bool `json:"openShiftAutoDetect,omitempty"`

// `customLabels` allows to customize subnets and IPs labelling, such as to identify cluster-external workloads or web services.
// If you enable `openShiftAutoDetect`, `customLabels` can override the detected subnets in case they overlap.
//+optional
CustomLabels []SubnetLabel `json:"customLabels,omitempty"`
}

// SubnetLabel allows to label subnets and IPs, such as to identify cluster-external workloads or web services.
type SubnetLabel struct {
// List of CIDRs, such as `["1.2.3.4/32"]`.
//+required
CIDRs []string `json:"cidrs,omitempty"` // Note, starting with k8s 1.31 / ocp 4.16 there's a new way to validate CIDR such as `+kubebuilder:validation:XValidation:rule="isCIDR(self)",message="field should be in CIDR notation format"`. But older versions would reject the CRD so we cannot implement it now to maintain compatibility.
// Label name, used to flag matching flows.
//+required
Name string `json:"name,omitempty"`
}

// Add more exporter types below
type ExporterType string

Expand Down
48 changes: 48 additions & 0 deletions apis/flowcollector/v1beta2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

64 changes: 64 additions & 0 deletions bundle/manifests/flows.netobserv.io_flowcollectors.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2272,6 +2272,38 @@ spec:
Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
type: object
subnetLabels:
description: '`subnetLabels` allows to define custom labels on
subnets and IPs or to enable automatic labelling of recognized
subnets in OpenShift.'
properties:
customLabels:
description: '`customLabels` allows to customize subnets and
IPs labelling, such as to identify cluster-external workloads
or web services. If you enable `openShiftAutoDetect`, `customLabels`
can override the detected subnets in case they overlap.'
items:
description: SubnetLabel allows to label subnets and IPs,
such as to identify cluster-external workloads or web
services.
properties:
cidrs:
description: List of CIDRs, such as `["1.2.3.4/32"]`.
items:
type: string
type: array
name:
description: Label name, used to flag matching flows.
type: string
type: object
type: array
openShiftAutoDetect:
description: '`openShiftAutoDetect` allows, when set to `true`,
to detect automatically the machines, pods and services
subnets based on the OpenShift install configuration and
the Cluster Network Operator configuration.'
type: boolean
type: object
type: object
type: object
status:
Expand Down Expand Up @@ -6104,6 +6136,38 @@ spec:
Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
type: object
subnetLabels:
description: '`SubnetLabels` allows to define custom labels on
subnets and IPs or to enable automatic labelling of recognized
subnets in OpenShift.'
properties:
customLabels:
description: '`customLabels` allows to customize subnets and
IPs labelling, such as to identify cluster-external workloads
or web services. If you enable `openShiftAutoDetect`, `customLabels`
can override the detected subnets in case they overlap.'
items:
description: SubnetLabel allows to label subnets and IPs,
such as to identify cluster-external workloads or web
services.
properties:
cidrs:
description: List of CIDRs, such as `["1.2.3.4/32"]`.
items:
type: string
type: array
name:
description: Label name, used to flag matching flows.
type: string
type: object
type: array
openShiftAutoDetect:
description: '`openShiftAutoDetect` allows, when set to `true`,
to detect automatically the machines, pods and services
subnets based on the OpenShift install configuration and
the Cluster Network Operator configuration.'
type: boolean
type: object
type: object
type: object
status:
Expand Down
7 changes: 7 additions & 0 deletions bundle/manifests/netobserv-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -752,6 +752,12 @@ spec:
path: processor.metrics.includeList
- displayName: Port
path: processor.metrics.server.port
- displayName: Subnet labels
path: processor.subnetLabels
- displayName: Custom labels
path: processor.subnetLabels.customLabels
- displayName: Open shift auto detect
path: processor.subnetLabels.openShiftAutoDetect
statusDescriptors:
- description: Namespace where console plugin and flowlogs-pipeline have been
deployed.
Expand Down Expand Up @@ -904,6 +910,7 @@ spec:
- config.openshift.io
resources:
- clusterversions
- networks
verbs:
- get
- list
Expand Down