Skip to content

Commit 389dbe8

Browse files
Pearl1594nvazquez
Pearl1594
and
nvazquez
authored
NSX: Add CKS Support & Firewall rules for Isolated Networks (#8189)
* NSX: Add ALL LB IP to the list of route advertisements in tier1 * NSX: Support Source NAT on NSX Isolated networks * NSX: Cks Support * NSX: Create segment group on segment creation * Add unit tests * Remove group for segment before removing segment * Create Distributed Firewall rules * Remove distributed firewall policy on segment deletion * Fix policy rule ID and add more unit tests * Add support for routed NSX Isolated networks \n and non RFC 1918 compliant IPs * Add support for routed NSX Isolated networks \n and non RFC 1918 compliant IPs * Add Firewall rules * build failure - fix unit test * fix npes * Add support to delete firewall rules * update nsx cks offering * add license * update order of ports in PF & FW rules * fix filter for getting transport zones * CKS support changed - MTU updated, etc * add LB for CKS on VPC * address comments * adapt upstream cks logic for vpc * rever mtu hack * update UI changes as per upstream fix * change display test for CKS n/w offerings for isolated and VPC tiers * add extra line for linter * address comment * revert list change --------- Co-authored-by: nvazquez <nicovazquez90@gmail.com>
1 parent c42c616 commit 389dbe8

File tree

30 files changed

+403
-141
lines changed

30 files changed

+403
-141
lines changed

‎api/src/main/java/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,7 @@ public class ApiConstants {
298298
public static final String MEMORY = "memory";
299299
public static final String MODE = "mode";
300300
public static final String NSX_MODE = "nsxmode";
301+
public static final String NSX_ENABLED = "isnsxenabled";
301302
public static final String NAME = "name";
302303
public static final String METHOD_NAME = "methodname";
303304
public static final String NETWORK_DOMAIN = "networkdomain";

‎api/src/main/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@
5959
import static com.cloud.network.Network.Service.PortForwarding;
6060
import static com.cloud.network.Network.Service.NetworkACL;
6161
import static com.cloud.network.Network.Service.UserData;
62+
import static com.cloud.network.Network.Service.Firewall;
6263

6364
@APICommand(name = "createNetworkOffering", description = "Creates a network offering.", responseObject = NetworkOfferingResponse.class, since = "3.0.0",
6465
requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
@@ -251,7 +252,8 @@ public List<String> getSupportedServices() {
251252
));
252253
if (Boolean.TRUE.equals(forVpc)) {
253254
services.add(NetworkACL.getName());
254-
return services;
255+
} else {
256+
services.add(Firewall.getName());
255257
}
256258
return services;
257259
}
@@ -338,10 +340,15 @@ public Map<String, List<String>> getServiceProviders() {
338340
private void getServiceProviderMapForNsx(Map<String, List<String>> serviceProviderMap) {
339341
String routerProvider = Boolean.TRUE.equals(getForVpc()) ? VirtualRouterProvider.Type.VPCVirtualRouter.name() :
340342
VirtualRouterProvider.Type.VirtualRouter.name();
341-
List<String> unsupportedServices = List.of("Vpn", "SecurityGroup", "Connectivity",
342-
"Gateway", "Firewall", "BaremetalPxeService");
343+
List<String> unsupportedServices = new ArrayList<>(List.of("Vpn", "SecurityGroup", "Connectivity",
344+
"Gateway", "BaremetalPxeService"));
343345
List<String> routerSupported = List.of("Dhcp", "Dns", "UserData");
344346
List<String> allServices = Service.listAllServices().stream().map(Service::getName).collect(Collectors.toList());
347+
if (routerProvider.equals(VirtualRouterProvider.Type.VPCVirtualRouter.name())) {
348+
unsupportedServices.add("Firewall");
349+
} else {
350+
unsupportedServices.add("NetworkACL");
351+
}
345352
for (String service : allServices) {
346353
if (unsupportedServices.contains(service))
347354
continue;

‎api/src/main/java/org/apache/cloudstack/api/response/ZoneResponse.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,10 @@ public class ZoneResponse extends BaseResponseWithAnnotations implements SetReso
145145
@Param(description = "the type of the zone - core or edge", since = "4.18.0")
146146
String type;
147147

148+
@SerializedName(ApiConstants.NSX_ENABLED)
149+
@Param(description = "true, if zone is NSX enabled", since = "4.20.0")
150+
private boolean nsxEnabled = false;
151+
148152
public ZoneResponse() {
149153
tags = new LinkedHashSet<ResourceTagResponse>();
150154
}
@@ -368,4 +372,8 @@ public void setType(String type) {
368372
public String getType() {
369373
return type;
370374
}
375+
376+
public void setNsxEnabled(boolean nsxEnabled) {
377+
this.nsxEnabled = nsxEnabled;
378+
}
371379
}

‎engine/components-api/src/main/java/com/cloud/configuration/ConfigurationManager.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ public interface ConfigurationManager {
6363
static final String VM_USERDATA_MAX_LENGTH_STRING = "vm.userdata.max.length";
6464
static final ConfigKey<Integer> VM_USERDATA_MAX_LENGTH = new ConfigKey<>("Advanced", Integer.class, VM_USERDATA_MAX_LENGTH_STRING, "32768",
6565
"Max length of vm userdata after base64 decoding. Default is 32768 and maximum is 1048576", true);
66+
public static final ConfigKey<Boolean> AllowNonRFC1918CompliantIPs = new ConfigKey<Boolean>(Boolean.class,
67+
"allow.non.rfc1918.compliant.ips", "Advanced", "false",
68+
"Allows non-compliant RFC 1918 IPs for Shared, Isolated networks and VPCs", true);
6669

6770
/**
6871
* @param offering

‎engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2862,7 +2862,7 @@ private Network createGuestNetwork(final long networkOfferingId, final String na
28622862

28632863
// Check if cidr is RFC1918 compliant if the network is Guest Isolated for IPv4
28642864
if (cidr != null && ntwkOff.getGuestType() == Network.GuestType.Isolated && ntwkOff.getTrafficType() == TrafficType.Guest) {
2865-
if (!NetUtils.validateGuestCidr(cidr)) {
2865+
if (!NetUtils.validateGuestCidr(cidr, !ConfigurationManager.AllowNonRFC1918CompliantIPs.value())) {
28662866
throw new InvalidParameterValueException("Virtual Guest Cidr " + cidr + " is not RFC 1918 or 6598 compliant");
28672867
}
28682868
}

‎engine/schema/src/main/resources/META-INF/db/views/cloud.vpc_offering_view.sql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,4 +58,4 @@ FROM
5858
LEFT JOIN
5959
`cloud`.`vpc_offering_details` AS `offering_details` ON `offering_details`.`offering_id` = `vpc_offerings`.`id` AND `offering_details`.`name`='internetprotocol'
6060
GROUP BY
61-
`vpc_offerings`.`id`;
61+
`vpc_offerings`.`id`;

‎plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java‎

Lines changed: 46 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,11 @@ public class KubernetesClusterManagerImpl extends ManagerBase implements Kuberne
184184

185185
private static final Logger LOGGER = Logger.getLogger(KubernetesClusterManagerImpl.class);
186186
private static final String DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNetworkOfferingforKubernetesService";
187+
private static final String DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering used for CloudStack Kubernetes service";
188+
private static final String DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNSXNetworkOfferingforKubernetesService";
189+
private static final String DEFAULT_NSX_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNSXVPCNetworkOfferingforKubernetesService";
190+
private static final String DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for NSX CloudStack Kubernetes Service";
191+
private static final String DEFAULT_NSX_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for NSX CloudStack Kubernetes service on VPC";
187192

188193
protected StateMachine2<KubernetesCluster.State, KubernetesCluster.Event, KubernetesCluster> _stateMachine = KubernetesCluster.State.getStateMachine();
189194

@@ -1885,26 +1890,54 @@ boolean isClusterVMsInDesiredState(KubernetesCluster kubernetesCluster, VirtualM
18851890

18861891
@Override
18871892
public boolean start() {
1893+
createNetworkOfferingForKubernetes(DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
1894+
DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT, false, false);
1895+
1896+
createNetworkOfferingForKubernetes(DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
1897+
DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT, true, false);
1898+
1899+
createNetworkOfferingForKubernetes(DEFAULT_NSX_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
1900+
DEFAULT_NSX_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT , true, true);
1901+
1902+
_gcExecutor.scheduleWithFixedDelay(new KubernetesClusterGarbageCollector(), 300, 300, TimeUnit.SECONDS);
1903+
_stateScanner.scheduleWithFixedDelay(new KubernetesClusterStatusScanner(), 300, 30, TimeUnit.SECONDS);
1904+
1905+
return true;
1906+
}
1907+
1908+
private void createNetworkOfferingForKubernetes(String offeringName, String offeringDesc, boolean forNsx, boolean forVpc) {
18881909
final Map<Network.Service, Network.Provider> defaultKubernetesServiceNetworkOfferingProviders = new HashMap<Service, Network.Provider>();
1889-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Dhcp, Network.Provider.VirtualRouter);
1890-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Dns, Network.Provider.VirtualRouter);
1891-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.UserData, Network.Provider.VirtualRouter);
1892-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, Network.Provider.VirtualRouter);
1893-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Gateway, Network.Provider.VirtualRouter);
1894-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Lb, Network.Provider.VirtualRouter);
1895-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.SourceNat, Network.Provider.VirtualRouter);
1896-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.StaticNat, Network.Provider.VirtualRouter);
1897-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.PortForwarding, Network.Provider.VirtualRouter);
1898-
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Vpn, Network.Provider.VirtualRouter);
1910+
Network.Provider provider = forVpc ? Network.Provider.VPCVirtualRouter : Network.Provider.VirtualRouter;
1911+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Dhcp, provider);
1912+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Dns, provider);
1913+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.UserData, provider);
1914+
if (forVpc) {
1915+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.NetworkACL, forNsx ? Network.Provider.Nsx : provider);
1916+
} else {
1917+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, forNsx ? Network.Provider.Nsx : provider);
1918+
}
1919+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Lb, forNsx ? Network.Provider.Nsx : provider);
1920+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.SourceNat, forNsx ? Network.Provider.Nsx : provider);
1921+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.StaticNat, forNsx ? Network.Provider.Nsx : provider);
1922+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.PortForwarding, forNsx ? Network.Provider.Nsx : provider);
1923+
1924+
if (!forNsx) {
1925+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Gateway, Network.Provider.VirtualRouter);
1926+
defaultKubernetesServiceNetworkOfferingProviders.put(Service.Vpn, Network.Provider.VirtualRouter);
1927+
}
18991928

19001929
NetworkOfferingVO defaultKubernetesServiceNetworkOffering =
1901-
new NetworkOfferingVO(DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
1902-
"Network Offering used for CloudStack Kubernetes service", Networks.TrafficType.Guest,
1930+
new NetworkOfferingVO(offeringName,
1931+
offeringDesc, Networks.TrafficType.Guest,
19031932
false, false, null, null, true,
19041933
NetworkOffering.Availability.Required, null, Network.GuestType.Isolated, true,
19051934
true, false, false, false, false,
19061935
false, false, false, true, true, false,
1907-
false, true, false, false);
1936+
forVpc, true, false, false);
1937+
if (forNsx) {
1938+
defaultKubernetesServiceNetworkOffering.setNsxMode(NetworkOffering.NsxMode.NATTED.name());
1939+
defaultKubernetesServiceNetworkOffering.setForNsx(true);
1940+
}
19081941
defaultKubernetesServiceNetworkOffering.setSupportsVmAutoScaling(true);
19091942
defaultKubernetesServiceNetworkOffering.setState(NetworkOffering.State.Enabled);
19101943
defaultKubernetesServiceNetworkOffering = networkOfferingDao.persistDefaultNetworkOffering(defaultKubernetesServiceNetworkOffering);
@@ -1916,11 +1949,6 @@ public boolean start() {
19161949
networkOfferingServiceMapDao.persist(offService);
19171950
LOGGER.trace("Added service for the network offering: " + offService);
19181951
}
1919-
1920-
_gcExecutor.scheduleWithFixedDelay(new KubernetesClusterGarbageCollector(), 300, 300, TimeUnit.SECONDS);
1921-
_stateScanner.scheduleWithFixedDelay(new KubernetesClusterStatusScanner(), 300, 30, TimeUnit.SECONDS);
1922-
1923-
return true;
19241952
}
19251953

19261954
@Override

‎plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131

3232
import javax.inject.Inject;
3333

34+
import com.cloud.offering.NetworkOffering;
35+
import com.cloud.offerings.dao.NetworkOfferingDao;
3436
import org.apache.cloudstack.api.ApiConstants;
3537
import org.apache.cloudstack.api.BaseCmd;
3638
import org.apache.cloudstack.api.command.user.firewall.CreateFirewallRuleCmd;
@@ -149,6 +151,8 @@ public class KubernetesClusterResourceModifierActionWorker extends KubernetesClu
149151
protected VolumeApiService volumeService;
150152
@Inject
151153
protected VolumeDao volumeDao;
154+
@Inject
155+
protected NetworkOfferingDao networkOfferingDao;
152156

153157
protected String kubernetesClusterNodeNamePrefix;
154158

@@ -738,12 +742,24 @@ protected void removeVpcTierAclRules(Network network) throws ManagementServerExc
738742
protected void setupKubernetesClusterVpcTierRules(IpAddress publicIp, Network network, List<Long> clusterVMIds) throws ManagementServerException {
739743
// Create ACL rules
740744
createVpcTierAclRules(network);
741-
// Add port forwarding for API access
742-
try {
743-
provisionPublicIpPortForwardingRule(publicIp, network, owner, clusterVMIds.get(0), CLUSTER_API_PORT, CLUSTER_API_PORT);
744-
} catch (ResourceUnavailableException | NetworkRuleConflictException e) {
745-
throw new ManagementServerException(String.format("Failed to activate API port forwarding rules for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
745+
746+
NetworkOffering offering = networkOfferingDao.findById(network.getNetworkOfferingId());
747+
if (offering.isConserveMode()) {
748+
// Add load balancing for API access
749+
try {
750+
provisionLoadBalancerRule(publicIp, network, owner, clusterVMIds, CLUSTER_API_PORT);
751+
} catch (InsufficientAddressCapacityException e) {
752+
throw new ManagementServerException(String.format("Failed to activate API load balancing rules for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
753+
}
754+
} else {
755+
// Add port forwarding for API access
756+
try {
757+
provisionPublicIpPortForwardingRule(publicIp, network, owner, clusterVMIds.get(0), CLUSTER_API_PORT, CLUSTER_API_PORT);
758+
} catch (ResourceUnavailableException | NetworkRuleConflictException e) {
759+
throw new ManagementServerException(String.format("Failed to activate API port forwarding rules for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
760+
}
746761
}
762+
747763
// Add port forwarding rule for SSH access on each node VM
748764
try {
749765
provisionSshPortForwardingRules(publicIp, network, owner, clusterVMIds);

‎plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/CreateNsxLoadBalancerRuleCommand.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
public class CreateNsxLoadBalancerRuleCommand extends NsxNetworkCommand {
2424

2525
private final String publicPort;
26+
private final String privatePort;
2627
private final String algorithm;
2728
private final String protocol;
2829
List<NsxLoadBalancerMember> memberList;
@@ -31,11 +32,12 @@ public class CreateNsxLoadBalancerRuleCommand extends NsxNetworkCommand {
3132
public CreateNsxLoadBalancerRuleCommand(long domainId, long accountId, long zoneId, Long networkResourceId,
3233
String networkResourceName, boolean isResourceVpc,
3334
List<NsxLoadBalancerMember> memberList, long lbId, String publicPort,
34-
String algorithm, String protocol) {
35+
String privatePort, String algorithm, String protocol) {
3536
super(domainId, accountId, zoneId, networkResourceId, networkResourceName, isResourceVpc);
3637
this.lbId = lbId;
3738
this.memberList = memberList;
3839
this.publicPort = publicPort;
40+
this.privatePort = privatePort;
3941
this.algorithm = algorithm;
4042
this.protocol = protocol;
4143
}
@@ -49,6 +51,10 @@ public String getPublicPort() {
4951
return publicPort;
5052
}
5153

54+
public String getPrivatePort() {
55+
return privatePort;
56+
}
57+
5258
public List<NsxLoadBalancerMember> getMemberList() {
5359
return memberList;
5460
}

plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/DeletedNsxDistributedFirewallRulesCommand.java renamed to plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/DeleteNsxDistributedFirewallRulesCommand.java

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
// Licensed to the Apache Software Foundation (ASF) under one
32
// or more contributor license agreements. See the NOTICE file
43
// distributed with this work for additional information
@@ -21,8 +20,8 @@
2120

2221
import java.util.List;
2322

24-
public class DeletedNsxDistributedFirewallRulesCommand extends CreateNsxDistributedFirewallRulesCommand {
25-
public DeletedNsxDistributedFirewallRulesCommand(long domainId, long accountId, long zoneId, Long vpcId, long networkId, List<NsxNetworkRule> rules) {
23+
public class DeleteNsxDistributedFirewallRulesCommand extends CreateNsxDistributedFirewallRulesCommand {
24+
public DeleteNsxDistributedFirewallRulesCommand(long domainId, long accountId, long zoneId, Long vpcId, long networkId, List<NsxNetworkRule> rules) {
2625
super(domainId, accountId, zoneId, vpcId, networkId, rules);
2726
}
28-
}
27+
}

0 commit comments

Comments
 (0)