From b0d836713094e7f3571bd154450c6c8051a25b51 Mon Sep 17 00:00:00 2001 From: zhangzujian Date: Wed, 21 Aug 2024 02:39:10 +0000 Subject: [PATCH] netpol: add allow acl rules for u2o logical gateway (#4420) Signed-off-by: zhangzujian --- go.mod | 2 +- go.sum | 3 ++- pkg/controller/network_policy.go | 2 +- pkg/controller/subnet.go | 12 ++++++++++++ pkg/ovs/ovn-nbctl-legacy.go | 10 ++++++++-- 5 files changed, 24 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 7ff556a602f..630d5a2ee4a 100644 --- a/go.mod +++ b/go.mod @@ -39,6 +39,7 @@ require ( k8s.io/client-go v12.0.0+incompatible k8s.io/klog/v2 v2.120.1 k8s.io/sample-controller v0.23.17 + k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 kubevirt.io/client-go v0.50.0 sigs.k8s.io/controller-runtime v0.11.0 ) @@ -134,7 +135,6 @@ require ( k8s.io/apiextensions-apiserver v0.23.17 // indirect k8s.io/component-base v0.23.17 // indirect k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect - k8s.io/utils v0.0.0-20211116205334-6203023598ed // indirect kubevirt.io/api v0.50.0 // indirect kubevirt.io/containerized-data-importer-api v1.42.0 // indirect kubevirt.io/controller-lifecycle-operator-sdk v0.2.1 // indirect diff --git a/go.sum b/go.sum index 36931d73c08..f81c4ab328e 100644 --- a/go.sum +++ b/go.sum @@ -1866,8 +1866,9 @@ k8s.io/utils v0.0.0-20191114200735-6ca3b61696b6/go.mod h1:sZAwmy6armz5eXlNoLmJcl k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= k8s.io/utils v0.0.0-20210111153108-fddb29f9d009/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= -k8s.io/utils v0.0.0-20211116205334-6203023598ed h1:ck1fRPWPJWsMd8ZRFsWc6mh/zHp5fZ/shhbrgPUxDAE= k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= kubevirt.io/api v0.50.0 h1:UEL3Y19DP2bKn6OjL155CBhnwPpMCXSSEMGMandJUBg= kubevirt.io/api v0.50.0/go.mod h1:RPYFWI69OVi7i6YtW5gHN3fjYsjlRfRilKVNcpxEMmM= kubevirt.io/client-go v0.50.0 h1:4UvADLkbNGGc9MmRbLyXNe4qxhedTQQkT3242WoINjo= diff --git a/pkg/controller/network_policy.go b/pkg/controller/network_policy.go index 42b97184c3e..75713c68e77 100644 --- a/pkg/controller/network_policy.go +++ b/pkg/controller/network_policy.go @@ -509,7 +509,7 @@ func (c *Controller) handleUpdateNp(key string) error { } } - if err = c.ovnLegacyClient.CreateGatewayACL(pgName, subnet.Spec.Gateway, subnet.Spec.CIDRBlock); err != nil { + if err = c.ovnLegacyClient.CreateGatewayACL(pgName, subnet.Spec.Gateway, subnet.Status.U2OInterconnectionIP, subnet.Spec.CIDRBlock); err != nil { klog.Errorf("failed to create gateway acl, %v", err) return err } diff --git a/pkg/controller/subnet.go b/pkg/controller/subnet.go index d7ba055429a..2b6714673b9 100644 --- a/pkg/controller/subnet.go +++ b/pkg/controller/subnet.go @@ -71,6 +71,18 @@ func (c *Controller) enqueueUpdateSubnet(old, new interface{}) { return } + if newSubnet.Spec.Gateway != oldSubnet.Spec.Gateway || + newSubnet.Status.U2OInterconnectionIP != oldSubnet.Status.U2OInterconnectionIP { + policies, err := c.npsLister.List(labels.Everything()) + if err != nil { + klog.Errorf("failed to list network policies: %v", err) + } else { + for _, np := range policies { + c.enqueueAddNp(np) + } + } + } + var usingIPs float64 if newSubnet.Spec.Protocol == kubeovnv1.ProtocolIPv6 { usingIPs = newSubnet.Status.V6UsingIPs diff --git a/pkg/ovs/ovn-nbctl-legacy.go b/pkg/ovs/ovn-nbctl-legacy.go index 96401a90476..c41a1a66657 100644 --- a/pkg/ovs/ovn-nbctl-legacy.go +++ b/pkg/ovs/ovn-nbctl-legacy.go @@ -16,6 +16,7 @@ import ( netv1 "k8s.io/api/networking/v1" "k8s.io/klog/v2" + "k8s.io/utils/set" kubeovnv1 "github.com/kubeovn/kube-ovn/pkg/apis/kubeovn/v1" "github.com/kubeovn/kube-ovn/pkg/util" @@ -1624,9 +1625,14 @@ func (c LegacyClient) DeleteACL(pgName, direction string) (err error) { return } -func (c LegacyClient) CreateGatewayACL(pgName, gateway, cidr string) error { +func (c LegacyClient) CreateGatewayACL(pgName, gateway, u2oInterconnectionIP, cidr string) error { for _, cidrBlock := range strings.Split(cidr, ",") { - for _, gw := range strings.Split(gateway, ",") { + gateways := set.New(strings.Split(gateway, ",")...) + if u2oInterconnectionIP != "" { + gateways.Insert(strings.Split(u2oInterconnectionIP, ",")...) + } + + for gw := range gateways { if util.CheckProtocol(cidrBlock) != util.CheckProtocol(gw) { continue }