Skip to content

Commit 67c76e8

Browse files
smirasmira
committed
fix: always update firewall rules (kubespan)
Fixes #8498 Before KubeSpan was reimplemented to use resources for firewall rules, the update was happening always, but it got moved to a wrong section of the controller which gets executed on resource updates, but ignores updates of the peer statuses. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit e7d8041)
1 parent 65a9275 commit 67c76e8

File tree

1 file changed

+95
-94
lines changed
  • internal/app/machined/pkg/controllers/kubespan

1 file changed

+95
-94
lines changed

‎internal/app/machined/pkg/controllers/kubespan/manager.go

Lines changed: 95 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,101 @@ func (ctrl *ManagerController) Run(ctx context.Context, r controller.Runtime, lo
356356
}
357357
}
358358

359+
mtu := cfgSpec.MTU
360+
361+
// always update the firewall rules, as allowedIPsSet might change at any moment due to peer up/down events
362+
if err = safe.WriterModify(ctx, r,
363+
network.NewNfTablesChain(
364+
network.NamespaceName,
365+
"kubespan_prerouting",
366+
),
367+
func(r *network.NfTablesChain) error {
368+
spec := r.TypedSpec()
369+
370+
spec.Type = nethelpers.ChainTypeFilter
371+
spec.Hook = nethelpers.ChainHookPrerouting
372+
spec.Priority = nethelpers.ChainPriorityFilter
373+
spec.Policy = nethelpers.VerdictAccept
374+
375+
spec.Rules = []network.NfTablesRule{
376+
{
377+
MatchMark: &network.NfTablesMark{
378+
Mask: constants.KubeSpanDefaultFirewallMask,
379+
Value: constants.KubeSpanDefaultFirewallMark,
380+
},
381+
Verdict: pointer.To(nethelpers.VerdictAccept),
382+
},
383+
{
384+
MatchDestinationAddress: &network.NfTablesAddressMatch{
385+
IncludeSubnets: allowedIPsSet.Prefixes(),
386+
},
387+
SetMark: &network.NfTablesMark{
388+
Mask: ^uint32(constants.KubeSpanDefaultFirewallMask),
389+
Xor: constants.KubeSpanDefaultForceFirewallMark,
390+
},
391+
Verdict: pointer.To(nethelpers.VerdictAccept),
392+
},
393+
}
394+
395+
return nil
396+
},
397+
); err != nil {
398+
return fmt.Errorf("error modifying nftables chain: %w", err)
399+
}
400+
401+
if err = safe.WriterModify(ctx, r,
402+
network.NewNfTablesChain(
403+
network.NamespaceName,
404+
"kubespan_outgoing",
405+
),
406+
func(r *network.NfTablesChain) error {
407+
spec := r.TypedSpec()
408+
409+
spec.Type = nethelpers.ChainTypeRoute
410+
spec.Hook = nethelpers.ChainHookOutput
411+
spec.Priority = nethelpers.ChainPriorityFilter
412+
spec.Policy = nethelpers.VerdictAccept
413+
414+
spec.Rules = []network.NfTablesRule{
415+
{
416+
MatchMark: &network.NfTablesMark{
417+
Mask: constants.KubeSpanDefaultFirewallMask,
418+
Value: constants.KubeSpanDefaultFirewallMark,
419+
},
420+
Verdict: pointer.To(nethelpers.VerdictAccept),
421+
},
422+
{
423+
MatchOIfName: &network.NfTablesIfNameMatch{
424+
InterfaceNames: []string{"lo"},
425+
},
426+
Verdict: pointer.To(nethelpers.VerdictAccept),
427+
},
428+
{
429+
MatchDestinationAddress: &network.NfTablesAddressMatch{
430+
IncludeSubnets: allowedIPsSet.Prefixes(),
431+
},
432+
ClampMSS: &network.NfTablesClampMSS{
433+
MTU: uint16(mtu),
434+
},
435+
},
436+
{
437+
MatchDestinationAddress: &network.NfTablesAddressMatch{
438+
IncludeSubnets: allowedIPsSet.Prefixes(),
439+
},
440+
SetMark: &network.NfTablesMark{
441+
Mask: ^uint32(constants.KubeSpanDefaultFirewallMask),
442+
Xor: constants.KubeSpanDefaultForceFirewallMark,
443+
},
444+
Verdict: pointer.To(nethelpers.VerdictAccept),
445+
},
446+
}
447+
448+
return nil
449+
},
450+
); err != nil {
451+
return fmt.Errorf("error modifying nftables chain: %w", err)
452+
}
453+
359454
if !updateSpecs {
360455
// micro-optimization: skip updating specs if there are no changes to the incoming resources and no endpoint changes
361456
r.ResetRestartBackoff()
@@ -384,8 +479,6 @@ func (ctrl *ManagerController) Run(ctx context.Context, r controller.Runtime, lo
384479
return fmt.Errorf("error modifying address: %w", err)
385480
}
386481

387-
mtu := cfgSpec.MTU
388-
389482
for _, spec := range []network.RouteSpecSpec{
390483
{
391484
Family: nethelpers.FamilyInet4,
@@ -465,98 +558,6 @@ func (ctrl *ManagerController) Run(ctx context.Context, r controller.Runtime, lo
465558
return fmt.Errorf("error modifying link spec: %w", err)
466559
}
467560

468-
if err = safe.WriterModify(ctx, r,
469-
network.NewNfTablesChain(
470-
network.NamespaceName,
471-
"kubespan_prerouting",
472-
),
473-
func(r *network.NfTablesChain) error {
474-
spec := r.TypedSpec()
475-
476-
spec.Type = nethelpers.ChainTypeFilter
477-
spec.Hook = nethelpers.ChainHookPrerouting
478-
spec.Priority = nethelpers.ChainPriorityFilter
479-
spec.Policy = nethelpers.VerdictAccept
480-
481-
spec.Rules = []network.NfTablesRule{
482-
{
483-
MatchMark: &network.NfTablesMark{
484-
Mask: constants.KubeSpanDefaultFirewallMask,
485-
Value: constants.KubeSpanDefaultFirewallMark,
486-
},
487-
Verdict: pointer.To(nethelpers.VerdictAccept),
488-
},
489-
{
490-
MatchDestinationAddress: &network.NfTablesAddressMatch{
491-
IncludeSubnets: allowedIPsSet.Prefixes(),
492-
},
493-
SetMark: &network.NfTablesMark{
494-
Mask: ^uint32(constants.KubeSpanDefaultFirewallMask),
495-
Xor: constants.KubeSpanDefaultForceFirewallMark,
496-
},
497-
Verdict: pointer.To(nethelpers.VerdictAccept),
498-
},
499-
}
500-
501-
return nil
502-
},
503-
); err != nil {
504-
return fmt.Errorf("error modifying nftables chain: %w", err)
505-
}
506-
507-
if err = safe.WriterModify(ctx, r,
508-
network.NewNfTablesChain(
509-
network.NamespaceName,
510-
"kubespan_outgoing",
511-
),
512-
func(r *network.NfTablesChain) error {
513-
spec := r.TypedSpec()
514-
515-
spec.Type = nethelpers.ChainTypeRoute
516-
spec.Hook = nethelpers.ChainHookOutput
517-
spec.Priority = nethelpers.ChainPriorityFilter
518-
spec.Policy = nethelpers.VerdictAccept
519-
520-
spec.Rules = []network.NfTablesRule{
521-
{
522-
MatchMark: &network.NfTablesMark{
523-
Mask: constants.KubeSpanDefaultFirewallMask,
524-
Value: constants.KubeSpanDefaultFirewallMark,
525-
},
526-
Verdict: pointer.To(nethelpers.VerdictAccept),
527-
},
528-
{
529-
MatchOIfName: &network.NfTablesIfNameMatch{
530-
InterfaceNames: []string{"lo"},
531-
},
532-
Verdict: pointer.To(nethelpers.VerdictAccept),
533-
},
534-
{
535-
MatchDestinationAddress: &network.NfTablesAddressMatch{
536-
IncludeSubnets: allowedIPsSet.Prefixes(),
537-
},
538-
ClampMSS: &network.NfTablesClampMSS{
539-
MTU: uint16(mtu),
540-
},
541-
},
542-
{
543-
MatchDestinationAddress: &network.NfTablesAddressMatch{
544-
IncludeSubnets: allowedIPsSet.Prefixes(),
545-
},
546-
SetMark: &network.NfTablesMark{
547-
Mask: ^uint32(constants.KubeSpanDefaultFirewallMask),
548-
Xor: constants.KubeSpanDefaultForceFirewallMark,
549-
},
550-
Verdict: pointer.To(nethelpers.VerdictAccept),
551-
},
552-
}
553-
554-
return nil
555-
},
556-
); err != nil {
557-
return fmt.Errorf("error modifying nftables chain: %w", err)
558-
}
559-
560561
if rulesMgr == nil {
561562
rulesMgr = ctrl.RulesManagerFactory(constants.KubeSpanDefaultRoutingTable, constants.KubeSpanDefaultForceFirewallMark, constants.KubeSpanDefaultFirewallMask)
562563

0 commit comments

Comments
 (0)