Skip to content

Commit

Permalink
Pushing Latest Changes
Browse files Browse the repository at this point in the history
  • Loading branch information
arunvelayutham committed Oct 28, 2022
1 parent 950d93b commit aa2da53
Show file tree
Hide file tree
Showing 97 changed files with 9,017 additions and 279 deletions.
2 changes: 1 addition & 1 deletion .github/workflows/cancel_workflows.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.event == 'pull_request' }}
steps:
- uses: styfle/cancel-workflow-action@0.10.0
- uses: styfle/cancel-workflow-action@0.10.1
with:
all_but_latest: true
workflow_id: ${{ github.event.workflow.id }}
6 changes: 3 additions & 3 deletions .golangci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,13 @@ linters-settings:
ignore-generated-header: false
severity: warning
confidence: 0.8
# errorf, var-declaration temporarily disabled because of https://github.com/golangci/golangci-lint/issues/2997
rules:
- name: unreachable-code
# - name: errorf
- name: errorf
- name: range
- name: superfluous-else
# - name: var-declaration
- name: var-declaration
- name: duplicated-imports

linters:
disable-all: true
Expand Down
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,7 @@ fmt:

.golangci-bin:
@echo "===> Installing Golangci-lint <==="
@curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $@ v1.48.0
@curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $@ v1.50.0

.PHONY: golangci
golangci: .golangci-bin
Expand Down
28 changes: 16 additions & 12 deletions docs/antrea-network-policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -636,7 +636,7 @@ to select Pods. More details can be found in the [ServiceAccountSelector](#servi
**Note**: The order in which the egress rules are specified matters, i.e., rules will
be enforced in the order in which they are written.

**enableLogging**: A ClusterNetworkPolicy ingress or egress rule can be
**enableLogging**: Antrea-native policy ingress or egress rules can be
audited by enabling its logging field. When `enableLogging` field is set to
true, the first packet of any connection that matches this rule will be logged
to a separate file (`/var/log/antrea/networkpolicy/np.log`) on the Node on
Expand All @@ -645,16 +645,19 @@ analysis. By default, rules are not logged. The example policy logs all
traffic that matches the "DropToThirdParty" egress rule, while the rule
"AllowFromFrontend" is not logged. Specifically for drop and reject rules,
deduplication is applied to reduce duplicated logs, and duplication buffer
length is set to 1 second. The rules are logged in the following format:
length is set to 1 second. If a rule name is not provided, an identifiable
name will be generated for the rule and displayed in the log.
The rules are logged in the following format:

```text
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length>
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <rule-name> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length>
Deduplication:
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> [<num of packets> packets in <duplicate duration>]
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <rule-name> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> [<num of packets> packets in <duplicate duration>]
Examples:
2020/11/02 22:21:21.148395 AntreaPolicyAppTierIngressRule AntreaNetworkPolicy:default/test-anp Allow 61800 10.10.1.65 35402 10.0.0.5 80 TCP 60
2021/06/24 23:56:41.346165 AntreaPolicyEgressRule AntreaNetworkPolicy:default/test-anp Drop 44900 10.10.1.65 35402 10.0.0.5 80 TCP 60 [3 packets in 1.011379442s]
2020/11/02 22:21:21.148395 AntreaPolicyAppTierIngressRule AntreaNetworkPolicy:default/test-anp test-rule Allow 61800 10.10.1.65 35402 10.0.0.5 80 TCP 60
2021/06/24 23:56:41.346165 AntreaPolicyEgressRule AntreaNetworkPolicy:default/test-anp test-rule Drop 44900 10.10.1.65 35402 10.0.0.5 80 TCP 60 [3 packets in 1.011379442s]
2022/09/20 02:21:25.879364 AntreaPolicyIngressRule AntreaNetworkPolicy:default/test-anp ingress-drop-1cffec1 Drop 44900 10.10.1.14 <nil> 10.10.1.15 <nil> ICMP 84
```

Kubernetes NetworkPolicies can also be audited using Antrea logging to the same file
Expand All @@ -663,17 +666,18 @@ Kubernetes NetworkPolicies can also be audited using Antrea logging to the same
for all NetworkPolicies in the Namespace. Packets of any connection that match
a NetworkPolicy rule will be logged with a reference to the NetworkPolicy name,
but packets dropped by the implicit "default drop" (not allowed by any NetworkPolicy)
will only be logged with consistent name `K8sNetworkPolicy` for reference.
The rules are logged in the following format:
will only be logged with consistent name `K8sNetworkPolicy` for reference. When
using Antrea logging for Kubernetes NetworkPolicies, the rule name field is not
set and defaults to `<nil>` value. The rules are logged in the following format:

```text
<yyyy/mm/dd> <time> <ovs-table-name> <k8s-network-policy-reference> Allow <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length>
<yyyy/mm/dd> <time> <ovs-table-name> <k8s-network-policy-reference> <nil> Allow <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length>
Default dropped traffic:
<yyyy/mm/dd> <time> <ovs-table-name> K8sNetworkPolicy Drop -1 <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> [<num of packets> packets in <duplicate duration>]
<yyyy/mm/dd> <time> <ovs-table-name> K8sNetworkPolicy <nil> Drop <nil> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length> [<num of packets> packets in <duplicate duration>]
Examples:
2022/07/26 06:55:56.170456 IngressRule K8sNetworkPolicy:default/test-np-log Allow 190 10.10.1.82 49518 10.10.1.84 80 TCP 60
2022/07/26 06:55:57.142206 IngressDefaultRule K8sNetworkPolicy Drop -1 10.10.1.83 38608 10.10.1.84 80 TCP 60
2022/07/26 06:55:56.170456 IngressRule K8sNetworkPolicy:default/test-np-log <nil> Allow 190 10.10.1.82 49518 10.10.1.84 80 TCP 60
2022/07/26 06:55:57.142206 IngressDefaultRule K8sNetworkPolicy <nil> Drop <nil> 10.10.1.83 38608 10.10.1.84 80 TCP 60
```

Fluentd can be used to assist with collecting and analyzing the logs. Refer to the
Expand Down
8 changes: 4 additions & 4 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ require (
github.com/golang/protobuf v1.5.2
github.com/google/btree v1.1.2
github.com/google/uuid v1.3.0
github.com/hashicorp/memberlist v0.4.0
github.com/hashicorp/memberlist v0.5.0
github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.1.1
github.com/k8snetworkplumbingwg/sriov-cni v2.1.0+incompatible
github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd
Expand All @@ -42,7 +42,7 @@ require (
github.com/miekg/dns v1.1.50
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
github.com/onsi/ginkgo v1.16.5
github.com/onsi/gomega v1.20.2
github.com/onsi/gomega v1.21.1
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.13.0
github.com/prometheus/common v0.37.0
Expand All @@ -61,8 +61,9 @@ require (
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8
golang.org/x/tools v0.1.10-0.20220218145154-897bd77cd717
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5
google.golang.org/grpc v1.49.0
google.golang.org/grpc v1.50.0
google.golang.org/protobuf v1.28.1
gopkg.in/natefinch/lumberjack.v2 v2.0.0
gopkg.in/yaml.v2 v2.4.0
Expand Down Expand Up @@ -197,7 +198,6 @@ require (
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
golang.org/x/text v0.3.7 // indirect
golang.org/x/tools v0.1.10-0.20220218145154-897bd77cd717 // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
golang.zx2c4.com/wireguard v0.0.0-20210427022245-097af6e1351b // indirect
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
Expand Down
12 changes: 6 additions & 6 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -559,8 +559,8 @@ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T
github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
github.com/hashicorp/memberlist v0.4.0 h1:k3uda5gZcltmafuFF+UFqNEl5PrH+yPZ4zkjp1f/H/8=
github.com/hashicorp/memberlist v0.4.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4mHgHUZ8lrOI0=
github.com/hashicorp/memberlist v0.5.0 h1:EtYPN8DpAURiapus508I4n9CzHs2W+8NZGbmmR/prTM=
github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4mHgHUZ8lrOI0=
github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
Expand Down Expand Up @@ -748,8 +748,8 @@ github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1Cpa
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.20.2 h1:8uQq0zMgLEfa0vRrrBgaJF2gyW9Da9BmfGV+OyUzfkY=
github.com/onsi/gomega v1.20.2/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
github.com/onsi/gomega v1.21.1 h1:OB/euWYIExnPBohllTicTHmGTrMaqJ67nIu80j0/uEM=
github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
Expand Down Expand Up @@ -1486,8 +1486,8 @@ google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAG
google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
google.golang.org/grpc v1.49.0 h1:WTLtQzmQori5FUH25Pq4WT22oCsv8USpQ+F6rqtsmxw=
google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
google.golang.org/grpc v1.50.0 h1:fPVVDxY9w++VjTZsYvXWqEf9Rqar/e+9zYfxKK+W+YU=
google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
Expand Down
2 changes: 2 additions & 0 deletions multicluster/apis/multicluster/v1alpha1/gateway_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ type ClusterInfo struct {
ServiceCIDR string `json:"serviceCIDR,omitempty"`
// GatewayInfos has information of Gateways
GatewayInfos []GatewayInfo `json:"gatewayInfos,omitempty"`
// PodCIDRs is the Pod IP address CIDRs.
PodCIDRs []string `json:"podCIDRs,omitempty"`
}

//+kubebuilder:object:root=true
Expand Down
61 changes: 61 additions & 0 deletions multicluster/apis/multicluster/v1alpha1/labelidentity_types.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
/*
Copyright 2022 Antrea Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package v1alpha1

import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

// +genclient
// +genclient:nonNamespaced
// +kubebuilder:object:root=true
// +kubebuilder:resource:path=labelidentities,scope=Cluster

// +kubebuilder:printcolumn:name="Label",type=string,JSONPath=`.spec.label`,description="Normalized string of a label identity"
// +kubebuilder:printcolumn:name="ID",type=string,JSONPath=`.spec.id`,description="ID allocated for the label identity by the leader cluster"
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=`.metadata.creationTimestamp`
// LabelIdentity is an imported label identity from the ClusterSet.
// For each unique label identity, a LabelIdentity will be created in the member cluster.
type LabelIdentity struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`

Spec LabelIdentitySpec `json:"spec,omitempty"`
}

type LabelIdentitySpec struct {
// Label is the normalized string of a label identity.
// The format of normalized label identity is `ns:(?P<nslabels>(.)*)&pod:(?P<podlabels>(.)*)`
// E.g., `ns:kubernetes.io/metadata.name=kube-system&pod:app=db`
Label string `json:"label,omitempty"`
// ID is the ID allocated for the label identity by the leader cluster.
ID uint32 `json:"id,omitempty"`
}

// +kubebuilder:object:root=true

// LabelIdentityList contains a list of LabelIdentity.
type LabelIdentityList struct {
metav1.TypeMeta `json:",inline"`
metav1.ListMeta `json:"metadata,omitempty"`
Items []LabelIdentity `json:"items"`
}

func init() {
SchemeBuilder.Register(
&LabelIdentity{},
&LabelIdentityList{},
)
}
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@ type MultiClusterConfig struct {
config.ControllerManagerConfigurationSpec `json:",inline"`
// ServiceCIDR allows user to set the ClusterIP range of the cluster manually.
ServiceCIDR string `json:"serviceCIDR,omitempty"`
// PodCIDRs is the Pod IP address CIDRs.
PodCIDRs []string `json:"podCIDRs,omitempty"`
// The precedence about which IP address (internal or external IP) of Node is preferred to
// be used as the cross-cluster tunnel endpoint. if not specified, internal IP will be chosen.
GatewayIPPrecedence Precedence `json:"gatewayIPPrecedence,omitempty"`
Expand Down
12 changes: 9 additions & 3 deletions multicluster/apis/multicluster/v1alpha1/resourceexport_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@ type ExternalEntityExport struct {
ExternalEntitySpec v1alpha2.ExternalEntitySpec `json:"externalEntitySpec,omitempty"`
}

type LabelIdentityExport struct {
NormalizedLabel string `json:"normalizedLabel,omitempty"`
}

// RawResourceExport exports opaque resources.
type RawResourceExport struct {
Data []byte `json:"data,omitempty"`
Expand All @@ -65,6 +69,8 @@ type ResourceExportSpec struct {
ExternalEntity *ExternalEntityExport `json:"externalEntity,omitempty"`
// If exported resource is AntreaClusterNetworkPolicy.
ClusterNetworkPolicy *v1alpha1.ClusterNetworkPolicySpec `json:"clusterNetworkPolicy,omitempty"`
// If exported resource is LabelIdentity of a cluster.
LabelIdentity *LabelIdentityExport `json:"labelIdentity,omitempty"`
// If exported resource kind is unknown.
Raw *RawResourceExport `json:"raw,omitempty"`
}
Expand Down Expand Up @@ -102,8 +108,8 @@ type ResourceExportStatus struct {
}

// +genclient
//+kubebuilder:object:root=true
//+kubebuilder:subresource:status
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status

// +kubebuilder:printcolumn:name="Cluster ID",type=string,JSONPath=`.spec.clusterID`,description="Cluster ID of the exporting cluster"
// +kubebuilder:printcolumn:name="Kind",type=string,JSONPath=`.spec.kind`,description="Kind of the exported resource"
Expand All @@ -119,7 +125,7 @@ type ResourceExport struct {
Status ResourceExportStatus `json:"status,omitempty"`
}

//+kubebuilder:object:root=true
// +kubebuilder:object:root=true

// ResourceExportList contains a list of ResourceExport.
type ResourceExportList struct {
Expand Down
17 changes: 9 additions & 8 deletions multicluster/apis/multicluster/v1alpha1/resourceimport_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -62,10 +62,8 @@ type ResourceImportSpec struct {
ExternalEntity *ExternalEntityImport `json:"externalentity,omitempty"`
// If imported resource is AntreaClusterNetworkPolicy.
ClusterNetworkPolicy *v1alpha1.ClusterNetworkPolicySpec `json:"clusternetworkpolicy,omitempty"`
// If imported resource is ANP.
// TODO:
// ANP uses float64 as priority. Type float64 is discouraged by k8s, and is not supported by controller-gen tools.
// NetworkPolicy *v1alpha1.NetworkPolicySpec `json:"networkpolicy,omitempty"`
// If imported resource kind is LabelIdentity.
LabelIdentity *LabelIdentitySpec `json:"labelIdentity,omitempty"`
// If imported resource kind is unknown.
Raw *RawResourceImport `json:"raw,omitempty"`
}
Expand Down Expand Up @@ -105,8 +103,8 @@ type ResourceImportStatus struct {
}

// +genclient
//+kubebuilder:object:root=true
//+kubebuilder:subresource:status
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status

// +kubebuilder:printcolumn:name="Kind",type=string,JSONPath=`.spec.kind`,description="Kind of the imported resource"
// +kubebuilder:printcolumn:name="Namespace",type=string,JSONPath=`.spec.namespace`,description="Namespace of the imported resource"
Expand All @@ -121,7 +119,7 @@ type ResourceImport struct {
Status ResourceImportStatus `json:"status,omitempty"`
}

//+kubebuilder:object:root=true
// +kubebuilder:object:root=true

// ResourceImportList contains a list of ResourceImport.
type ResourceImportList struct {
Expand All @@ -131,5 +129,8 @@ type ResourceImportList struct {
}

func init() {
SchemeBuilder.Register(&ResourceImport{}, &ResourceImportList{})
SchemeBuilder.Register(
&ResourceImport{},
&ResourceImportList{},
)
}
Loading

0 comments on commit aa2da53

Please sign in to comment.