-
Notifications
You must be signed in to change notification settings - Fork 34
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Integration of policy-based-routing example with nse-composition #9865
Comments
@NikitaSkrynnik Could you have a look? |
@isZams Hello, Policy Based Routing can be used only with kernel interfaces. In nse-composition example we have |
@NikitaSkrynnik hi, thanks for your reply. Actually i managed to create a composition of endpoints where the pods in the middle of the chain have 2 kernel interfaces (in order to handle the incoming traffic, passing it to another container which performs some security function, and also the outgoing traffic to the next endpoint of the chain). |
@isZams it's theoretically possible to integrate PBR with kernel interfaces, but we haven't considered this scenario yet. If you could contribute this case it would be great. |
Hello, @denis-tingaikin, @NikitaSkrynnik, @glazychev-art . I was trying to implement this example as described above. Basically I added a third pod, in the middle, so that it creates two kernel interfaces. I then configured the configMaps to route incoming traffic from the client to the final endpoint (gateway). nsc --> firewall-endpoint --> endpoint Inside the pod in the middle (firewall-endpoint), I added a third container with "tcpdump" to monitor the traffic between the interfaces so that I could see whether or not the routing actually worked. Here there are all the files i'm using. Thank you very much for your help and availability! |
Hello, @isZams! ---
apiVersion: v1
kind: ConfigMap
metadata:
name: policies-config-file
data:
config.yaml: |
- from: 172.16.0.31/31
routes:
- prefix: 172.16.1.100/31
nexthop: 172.16.1.101/32 You should also use this config only in There are more issues here:
![]()
To make it work it's required to set routes on alpine and nse-kernel too and change them dynamically if the addresses change. I think in your case it would be better to use You can try to use |
Hi @NikitaSkrynnik, first of all thanks for reply and for your time. Furthermore, since this annotation is used, for example, - name: NSM_CIDR_PREFIX the available IP addresses turn out to be only 2, why do I need to change them dynamically? Finally, since from the alpine pod I would ping the first element in the chain (which in this case is the firewall-endpoint) why do I need to set the rules in the alpine pod as well? Forgive me for asking all these questions, but I would like to clarify a few things. |
Hi @NikitaSkrynnik
In this way, the interfaces are not destroyed and recreated for the healing issue. |
Question
II would like to know if it is possible to integrate the policy based routing example within nse-composition one, to be able to specify policies so that routing can be done.
If it is possible , I would also like to understand if this can be applied individually to containers and not just to the pod.
The text was updated successfully, but these errors were encountered: