Skip to content

Commit

Permalink
add acl log annotation
Browse files Browse the repository at this point in the history 
Signed-off-by: 马洪贞 <[email protected]>
  • Loading branch information
@hongzhen-ma
hongzhen-ma committed Aug 16, 2024
1 parent 6d06664 commit c844d82
Show file tree
Hide file tree
Showing 5 changed files with 40 additions and 13 deletions.
19 changes: 15 additions & 4 deletions pkg/controller/network_policy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (

kubeovnv1 "github.com/kubeovn/kube-ovn/pkg/apis/kubeovn/v1"
"github.com/kubeovn/kube-ovn/pkg/ovs"
"github.com/kubeovn/kube-ovn/pkg/ovsdb/ovnnb"
"github.com/kubeovn/kube-ovn/pkg/util"
)

Expand Down Expand Up @@ -160,6 +161,12 @@ func (c *Controller) handleUpdateNp(key string) error {
if np.Annotations[util.NetworkPolicyLogAnnotation] == "true" {
logEnable = true
}
var logActions []string
if np.Annotations[util.ACLActionsLogAnnotation] != "" {
logActions = strings.Split(np.Annotations[util.ACLActionsLogAnnotation], ",")
} else {
logActions = []string{ovnnb.ACLActionDrop}
}

npName := np.Name
if nameArray := []rune(np.Name); !unicode.IsLetter(nameArray[0]) {
Expand Down Expand Up @@ -259,6 +266,7 @@ func (c *Controller) handleUpdateNp(key string) error {
// A single address set must contain addresses of the same type and the name must be unique within table, so IPv4 and IPv6 address set should be different
ingressAllowAsName := fmt.Sprintf("%s.%s.%d", ingressAllowAsNamePrefix, protocol, idx)
ingressExceptAsName := fmt.Sprintf("%s.%s.%d", ingressExceptAsNamePrefix, protocol, idx)
aclName := fmt.Sprintf("np/%s.%s/ingress/%s/%d", npName, np.Namespace, protocol, idx)

var allows, excepts []string
if len(npr.From) == 0 {
Expand Down Expand Up @@ -309,7 +317,7 @@ func (c *Controller) handleUpdateNp(key string) error {
npp = npr.Ports
}

ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, npp, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, npp, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
return err
Expand All @@ -321,6 +329,7 @@ func (c *Controller) handleUpdateNp(key string) error {
ingressAllowAsName := fmt.Sprintf("%s.%s.all", ingressAllowAsNamePrefix, protocol)
ingressExceptAsName := fmt.Sprintf("%s.%s.all", ingressExceptAsNamePrefix, protocol)

aclName := fmt.Sprintf("np/%s.%s/ingress/%s/all", npName, np.Namespace, protocol)
if err = c.OVNNbClient.CreateAddressSet(ingressAllowAsName, map[string]string{
networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"),
}); err != nil {
Expand All @@ -335,7 +344,7 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}

ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
return err
Expand Down Expand Up @@ -411,6 +420,7 @@ func (c *Controller) handleUpdateNp(key string) error {
// A single address set must contain addresses of the same type and the name must be unique within table, so IPv4 and IPv6 address set should be different
egressAllowAsName := fmt.Sprintf("%s.%s.%d", egressAllowAsNamePrefix, protocol, idx)
egressExceptAsName := fmt.Sprintf("%s.%s.%d", egressExceptAsNamePrefix, protocol, idx)
aclName := fmt.Sprintf("np/%s.%s/egress/%s/%d", npName, np.Namespace, protocol, idx)

var allows, excepts []string
if len(npr.To) == 0 {
Expand Down Expand Up @@ -457,7 +467,7 @@ func (c *Controller) handleUpdateNp(key string) error {
}

if len(allows) != 0 || len(excepts) != 0 {
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, npr.Ports, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, npr.Ports, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
return err
Expand All @@ -470,6 +480,7 @@ func (c *Controller) handleUpdateNp(key string) error {
egressAllowAsName := fmt.Sprintf("%s.%s.all", egressAllowAsNamePrefix, protocol)
egressExceptAsName := fmt.Sprintf("%s.%s.all", egressExceptAsNamePrefix, protocol)

aclName := fmt.Sprintf("np/%s.%s/egress/%s/all", npName, np.Namespace, protocol)
if err = c.OVNNbClient.CreateAddressSet(egressAllowAsName, map[string]string{
networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"),
}); err != nil {
Expand All @@ -484,7 +495,7 @@ func (c *Controller) handleUpdateNp(key string) error {
return err
}

ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, []netv1.NetworkPolicyPort{}, logEnable, namedPortMap)
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
if err != nil {
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
return err
Expand Down
4 changes: 2 additions & 2 deletions pkg/ovs/interface.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,8 +117,8 @@ type PortGroup interface {
}

type ACL interface {
UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
CreateGatewayACL(lsName, pgName, gateway string) error
CreateNodeACL(pgName, nodeIPStr, joinIPStr string) error
CreateSgDenyAllACL(sgName string) error
Expand Down
17 changes: 14 additions & 3 deletions pkg/ovs/ovn-nb-acl.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (

"github.com/ovn-org/libovsdb/model"
"github.com/ovn-org/libovsdb/ovsdb"
"golang.org/x/exp/slices"
netv1 "k8s.io/api/networking/v1"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/klog/v2"
Expand All @@ -19,7 +20,7 @@ import (
)

// UpdateIngressACLOps return operation that creates an ingress ACL
func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
acls := make([]*ovnnb.ACL, 0)

if strings.HasSuffix(asIngressName, ".0") || strings.HasSuffix(asIngressName, ".all") {
Expand Down Expand Up @@ -47,7 +48,13 @@ func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, p
/* allow acl */
matches := newNetworkPolicyACLMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, namedPortMap)
for _, m := range matches {
allowACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressAllowPriority, m, ovnnb.ACLActionAllowRelated)
options := func(acl *ovnnb.ACL) {
if logEnable && slices.Contains(logACLActions, ovnnb.ACLActionAllow) {
acl.Name = &aclName
acl.Log = true
}
}
allowACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressAllowPriority, m, ovnnb.ACLActionAllowRelated, options)
if err != nil {
return nil, fmt.Errorf("new allow ingress acl for port group %s: %v", pgName, err)
}
Expand All @@ -64,7 +71,7 @@ func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, p
}

// UpdateEgressACLOps return operation that creates an egress ACL
func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
acls := make([]*ovnnb.ACL, 0)

if strings.HasSuffix(asEgressName, ".0") || strings.HasSuffix(asEgressName, ".all") {
Expand Down Expand Up @@ -103,6 +110,10 @@ func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, pro
acl.Options = make(map[string]string)
}
acl.Options["apply-after-lb"] = "true"
if logEnable && slices.Contains(logACLActions, ovnnb.ACLActionAllow) {
acl.Name = &aclName
acl.Log = true
}
})
if err != nil {
klog.Error(err)
Expand Down
12 changes: 8 additions & 4 deletions pkg/ovs/ovn-nb-acl_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,13 +84,14 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
asIngressName := "test.default.ingress.allow.ipv4.all"
asExceptName := "test.default.ingress.except.ipv4.all"
protocol := kubeovnv1.ProtocolIPv4
aclName := "test_create_v4_ingress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

npp := mockNetworkPolicyPort()

ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, npp, true, nil)
ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, npp, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 4)

Expand All @@ -112,11 +113,12 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
asIngressName := "test.default.ingress.allow.ipv6.all"
asExceptName := "test.default.ingress.except.ipv6.all"
protocol := kubeovnv1.ProtocolIPv6
aclName := "test_create_v6_ingress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, nil, true, nil)
ops, err := ovnClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 3)

Expand Down Expand Up @@ -154,13 +156,14 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
asEgressName := "test.default.egress.allow.ipv4.all"
asExceptName := "test.default.egress.except.ipv4.all"
protocol := kubeovnv1.ProtocolIPv4
aclName := "test_create_v4_egress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

npp := mockNetworkPolicyPort()

ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, npp, true, nil)
ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, npp, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 4)

Expand All @@ -182,11 +185,12 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
asEgressName := "test.default.egress.allow.ipv6.all"
asExceptName := "test.default.egress.except.ipv6.all"
protocol := kubeovnv1.ProtocolIPv6
aclName := "test_create_v6_egress_acl_pg"

err := ovnClient.CreatePortGroup(pgName, nil)
require.NoError(t, err)

ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, nil, true, nil)
ops, err := ovnClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
require.NoError(t, err)
require.Len(t, ops, 3)

Expand Down
1 change: 1 addition & 0 deletions pkg/util/const.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,7 @@ const (
QoSLabel = "ovn.kubernetes.io/qos"
NodeNameLabel = "ovn.kubernetes.io/node-name"
NetworkPolicyLogAnnotation = "ovn.kubernetes.io/enable_log"
ACLActionsLogAnnotation = "ovn.kubernetes.io/log_acl_actions"

VpcLastName = "ovn.kubernetes.io/last_vpc_name"
VpcLastPolicies = "ovn.kubernetes.io/last_policies"
Expand Down

0 comments on commit c844d82

Please sign in to comment.