Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add acl log annotation #4414

Merged
merged 1 commit into from
Aug 16, 2024
Merged

add acl log annotation #4414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions mocks/pkg/ovs/interface.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

19 changes: 15 additions & 4 deletions pkg/controller/network_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (

kubeovnv1 "github.com/kubeovn/kube-ovn/pkg/apis/kubeovn/v1"
"github.com/kubeovn/kube-ovn/pkg/ovs"
"github.com/kubeovn/kube-ovn/pkg/ovsdb/ovnnb"
"github.com/kubeovn/kube-ovn/pkg/util"
)

Expand Down Expand Up @@ -160,6 +161,12 @@ func (c *Controller) handleUpdateNp(key string) error {
if np.Annotations[util.NetworkPolicyLogAnnotation] == "true" {
logEnable = true
}
var logActions []string
if np.Annotations[util.ACLActionsLogAnnotation] != "" {
logActions = strings.Split(np.Annotations[util.ACLActionsLogAnnotation], ",")
} else {
logActions = []string{ovnnb.ACLActionDrop}
}

npName := np.Name
if nameArray := []rune(np.Name); !unicode.IsLetter(nameArray[0]) {
Expand Down Expand Up @@ -259,6 +266,7 @@ func (c *Controller) handleUpdateNp(key string) error {
// A single address set must contain addresses of the same type and the name must be unique within table, so IPv4 and IPv6 address set should be different
ingressAllowAsName := fmt.Sprintf("%s.%s.%d", ingressAllowAsNamePrefix, protocol, idx)
ingressExceptAsName := fmt.Sprintf("%s.%s.%d", ingressExceptAsNamePrefix, protocol, idx)
aclName := fmt.Sprintf("np/%s.%s/ingress/%s/%d", npName, np.Namespace, protocol, idx)

var allows, excepts []string
if len(npr.From) == 0 {
Expand Down Expand Up @@ -309,7 +317,7 @@ func (c *Controller) handleUpdateNp(key string) error {
npp = npr.Ports
}

ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, npp, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, npp, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
return err
Expand All @@ -321,6 +329,7 @@ func (c *Controller) handleUpdateNp(key string) error {
ingressAllowAsName := fmt.Sprintf("%s.%s.all", ingressAllowAsNamePrefix, protocol)
ingressExceptAsName := fmt.Sprintf("%s.%s.all", ingressExceptAsNamePrefix, protocol)

aclName := fmt.Sprintf("np/%s.%s/ingress/%s/all", npName, np.Namespace, protocol)
if err = c.OVNNbClient.CreateAddressSet(ingressAllowAsName, map[string]string{
networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"),
}); err != nil {
Expand All @@ -335,7 +344,7 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}

ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
return err
Expand Down Expand Up @@ -411,6 +420,7 @@ func (c *Controller) handleUpdateNp(key string) error {
// A single address set must contain addresses of the same type and the name must be unique within table, so IPv4 and IPv6 address set should be different
egressAllowAsName := fmt.Sprintf("%s.%s.%d", egressAllowAsNamePrefix, protocol, idx)
egressExceptAsName := fmt.Sprintf("%s.%s.%d", egressExceptAsNamePrefix, protocol, idx)
aclName := fmt.Sprintf("np/%s.%s/egress/%s/%d", npName, np.Namespace, protocol, idx)

var allows, excepts []string
if len(npr.To) == 0 {
Expand Down Expand Up @@ -457,7 +467,7 @@ func (c *Controller) handleUpdateNp(key string) error {
}

if len(allows) != 0 || len(excepts) != 0 {
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, npr.Ports, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, npr.Ports, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
return err
Expand All @@ -470,6 +480,7 @@ func (c *Controller) handleUpdateNp(key string) error {
egressAllowAsName := fmt.Sprintf("%s.%s.all", egressAllowAsNamePrefix, protocol)
egressExceptAsName := fmt.Sprintf("%s.%s.all", egressExceptAsNamePrefix, protocol)

aclName := fmt.Sprintf("np/%s.%s/egress/%s/all", npName, np.Namespace, protocol)
if err = c.OVNNbClient.CreateAddressSet(egressAllowAsName, map[string]string{
networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"),
}); err != nil {
Expand All @@ -484,7 +495,7 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}

ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
return err
Expand Down
4 changes: 2 additions & 2 deletions pkg/ovs/interface.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,8 +117,8 @@ type PortGroup interface {
}

type ACL interface {
UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
CreateGatewayACL(lsName, pgName, gateway string) error
CreateNodeACL(pgName, nodeIPStr, joinIPStr string) error
CreateSgDenyAllACL(sgName string) error
Expand Down
17 changes: 14 additions & 3 deletions pkg/ovs/ovn-nb-acl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (

"github.com/ovn-org/libovsdb/model"
"github.com/ovn-org/libovsdb/ovsdb"
"golang.org/x/exp/slices"
netv1 "k8s.io/api/networking/v1"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/klog/v2"
Expand All @@ -19,7 +20,7 @@ import (
)

// UpdateIngressACLOps return operation that creates an ingress ACL
func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
acls := make([]*ovnnb.ACL, 0)

if strings.HasSuffix(asIngressName, ".0") || strings.HasSuffix(asIngressName, ".all") {
Expand Down Expand Up @@ -47,7 +48,13 @@ func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, p
/* allow acl */
matches := newNetworkPolicyACLMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, namedPortMap)
for _, m := range matches {
allowACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressAllowPriority, m, ovnnb.ACLActionAllowRelated)
options := func(acl *ovnnb.ACL) {
if logEnable && slices.Contains(logACLActions, ovnnb.ACLActionAllow) {
acl.Name = &aclName
acl.Log = true
}
}
allowACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressAllowPriority, m, ovnnb.ACLActionAllowRelated, options)
if err != nil {
return nil, fmt.Errorf("new allow ingress acl for port group %s: %v", pgName, err)
}
Expand All @@ -64,7 +71,7 @@ func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, p
}

// UpdateEgressACLOps return operation that creates an egress ACL
func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
acls := make([]*ovnnb.ACL, 0)

if strings.HasSuffix(asEgressName, ".0") || strings.HasSuffix(asEgressName, ".all") {
Expand Down Expand Up @@ -103,6 +110,10 @@ func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, pro
acl.Options = make(map[string]string)
}
acl.Options["apply-after-lb"] = "true"
if logEnable && slices.Contains(logACLActions, ovnnb.ACLActionAllow) {
acl.Name = &aclName
acl.Log = true
}
})
if err != nil {
klog.Error(err)
Expand Down
12 changes: 8 additions & 4 deletions pkg/ovs/ovn-nb-acl_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,13 +84,14 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
asIngressName := "test.default.ingress.allow.ipv4.all"
asExceptName := "test.default.ingress.except.ipv4.all"
protocol := kubeovnv1.ProtocolIPv4
aclName := "test_create_v4_ingress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

npp := mockNetworkPolicyPort()

ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, npp, true, nil)
ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, npp, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 4)

Expand All @@ -112,11 +113,12 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
asIngressName := "test.default.ingress.allow.ipv6.all"
asExceptName := "test.default.ingress.except.ipv6.all"
protocol := kubeovnv1.ProtocolIPv6
aclName := "test_create_v6_ingress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, nil, true, nil)
ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 3)

Expand Down Expand Up @@ -154,13 +156,14 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
asEgressName := "test.default.egress.allow.ipv4.all"
asExceptName := "test.default.egress.except.ipv4.all"
protocol := kubeovnv1.ProtocolIPv4
aclName := "test_create_v4_egress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

npp := mockNetworkPolicyPort()

ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, npp, true, nil)
ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, npp, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 4)

Expand All @@ -182,11 +185,12 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
asEgressName := "test.default.egress.allow.ipv6.all"
asExceptName := "test.default.egress.except.ipv6.all"
protocol := kubeovnv1.ProtocolIPv6
aclName := "test_create_v6_egress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, nil, true, nil)
ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 3)

Expand Down
1 change: 1 addition & 0 deletions pkg/util/const.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,7 @@ const (
QoSLabel = "ovn.kubernetes.io/qos"
NodeNameLabel = "ovn.kubernetes.io/node-name"
NetworkPolicyLogAnnotation = "ovn.kubernetes.io/enable_log"
ACLActionsLogAnnotation = "ovn.kubernetes.io/log_acl_actions"

VpcLastName = "ovn.kubernetes.io/last_vpc_name"
VpcLastPolicies = "ovn.kubernetes.io/last_policies"
Expand Down
Loading