Skip to content

Commit 14dde14

Browse files
p2pdkivenkosmira
p2pdkivenko
authored and
smira
committed
feat: add filter for KubeSpan advertised networks
Add advertisedNetworks filter to KubeSpan configuration that allows filtering which additional networks (e.g., pod CIDRs) are advertised over KubeSpan when advertiseKubernetesNetworks is enabled. Signed-off-by: Daniil Kivenko <daniil.kivenko@p2p.org> Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 70c6c21)
1 parent c277d01 commit 14dde14

File tree

63 files changed

+571
-144
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+571
-144
lines changed

‎api/resource/definitions/cluster/cluster.proto‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ message KubeSpanAffiliateSpec {
5656
common.NetIP address = 2;
5757
repeated common.NetIPPrefix additional_addresses = 3;
5858
repeated common.NetIPPort endpoints = 4;
59+
repeated common.NetIPPrefix exclude_advertised_networks = 5;
5960
}
6061

6162
// MemberSpec describes Member state.

‎api/resource/definitions/kubespan/kubespan.proto‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ message ConfigSpec {
2020
repeated string endpoint_filters = 7;
2121
bool harvest_extra_endpoints = 8;
2222
repeated common.NetIPPort extra_endpoints = 9;
23+
repeated common.NetIPPrefix exclude_advertised_networks = 10;
2324
}
2425

2526
// EndpointSpec describes Endpoint state.

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ require (
135135
github.com/safchain/ethtool v0.7.0
136136
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35
137137
github.com/siderolabs/crypto v0.6.4
138-
github.com/siderolabs/discovery-api v0.1.6
138+
github.com/siderolabs/discovery-api v0.1.8
139139
github.com/siderolabs/discovery-client v0.1.13
140140
github.com/siderolabs/gen v0.8.6
141141
github.com/siderolabs/go-api-signature v0.3.12

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -610,8 +610,8 @@ github.com/siderolabs/coredns v1.12.54 h1:TmTrcxDpseGlm4sWzdlYY0Eof7+6erY/0gYoe+
610610
github.com/siderolabs/coredns v1.12.54/go.mod h1:0fWNl9qBEgoWH3YEqyQEwG+Vm2sCMsCLEJ21NG9UWZw=
611611
github.com/siderolabs/crypto v0.6.4 h1:uMoe/X/mABOv6yOgvKcjmjIMdv6U8JegBXlPKtyjn3g=
612612
github.com/siderolabs/crypto v0.6.4/go.mod h1:39B7Mdrd8qTfEYOjsWPQOk7gLTWrEI30isAW+YYj9nk=
613-
github.com/siderolabs/discovery-api v0.1.6 h1:/LhsF1ytqFEfWwV0UKfUgn90k9fk5+rhYMJ9yeUB2yc=
614-
github.com/siderolabs/discovery-api v0.1.6/go.mod h1:s5CnTyRMGid/vJNSJs8Jw9I4tnKHu/2SGqP2ytTaePQ=
613+
github.com/siderolabs/discovery-api v0.1.8 h1:Hq/Si0fFQICvdT+P/I81fRf9t5I+J6vaJNBvgehv8GE=
614+
github.com/siderolabs/discovery-api v0.1.8/go.mod h1:JN8aBpnsArIeLNLbqt3HIYHyFR14Qfwr4etAB2ZfygA=
615615
github.com/siderolabs/discovery-client v0.1.13 h1:s0iK2ixopCFFgQ5zZmzsQ8xf8Hd+SygrUdlhE+um6iQ=
616616
github.com/siderolabs/discovery-client v0.1.13/go.mod h1:kojlX4Kk0o9wsbJU1XOy4BH0W6RMg2I2d8WJ4ciK3qU=
617617
github.com/siderolabs/ethtool v0.4.0-sidero h1:Ls/M4bFUjfcB1RDVviPZlL3kWcXaEVVSbKke+EZ2A9U=

‎hack/release.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,15 @@ preface = """
2121
Linux: 6.18.9
2222
2323
Talos is built with Go 1.25.7.
24+
"""
25+
26+
[notes.kubespan-filters]
27+
title = "KubeSpan Advertised Network Filters"
28+
description = """\
29+
KubeSpan now supports filtering of advertised networks using the `excludeAdvertisedNetworks` field in the `KubeSpanConfig` document.
30+
This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
31+
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
32+
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.
2433
"""
2534

2635
[make_deps]

‎internal/app/machined/pkg/controllers/block/internal/volumes/volumeconfig/user_volumes.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
// License, v. 2.0. If a copy of the MPL was not distributed with this
33
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
44

5+
//nolint:dupl
56
package volumeconfig
67

78
import (

‎internal/app/machined/pkg/controllers/cluster/discovery_service.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,12 @@ func pbAffiliate(affiliate *cluster.AffiliateSpec) *pb.Affiliate {
355355
Ip: takeResult(address.Addr().MarshalBinary()),
356356
}
357357
}),
358+
ExcludeAdvertisedAddresses: xslices.Map(affiliate.KubeSpan.ExcludeAdvertisedNetworks, func(address netip.Prefix) *pb.IPPrefix {
359+
return &pb.IPPrefix{
360+
Bits: uint32(address.Bits()),
361+
Ip: takeResult(address.Addr().MarshalBinary()),
362+
}
363+
}),
358364
}
359365
}
360366

@@ -498,6 +504,16 @@ func specAffiliate(affiliate *pb.Affiliate, endpoints []*pb.Endpoint) cluster.Af
498504
result.KubeSpan.Endpoints = append(result.KubeSpan.Endpoints, netip.AddrPortFrom(ip, uint16(endpoints[i].Port)))
499505
}
500506
}
507+
508+
result.KubeSpan.ExcludeAdvertisedNetworks = make([]netip.Prefix, 0, len(affiliate.Kubespan.ExcludeAdvertisedAddresses))
509+
510+
for i := range affiliate.Kubespan.ExcludeAdvertisedAddresses {
511+
var ip netip.Addr
512+
513+
if err := ip.UnmarshalBinary(affiliate.Kubespan.ExcludeAdvertisedAddresses[i].Ip); err == nil {
514+
result.KubeSpan.ExcludeAdvertisedNetworks = append(result.KubeSpan.ExcludeAdvertisedNetworks, netip.PrefixFrom(ip, int(affiliate.Kubespan.ExcludeAdvertisedAddresses[i].Bits)))
515+
}
516+
}
501517
}
502518

503519
return result

‎internal/app/machined/pkg/controllers/cluster/discovery_service_test.go‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,11 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
8383
MachineType: machine.TypeControlPlane,
8484
Addresses: []netip.Addr{netip.MustParseAddr("192.168.3.4")},
8585
KubeSpan: cluster.KubeSpanAffiliateSpec{
86-
PublicKey: "PLPNBddmTgHJhtw0vxltq1ZBdPP9RNOEUd5JjJZzBRY=",
87-
Address: netip.MustParseAddr("fd50:8d60:4238:6302:f857:23ff:fe21:d1e0"),
88-
AdditionalAddresses: []netip.Prefix{netip.MustParsePrefix("10.244.3.1/24")},
89-
Endpoints: []netip.AddrPort{netip.MustParseAddrPort("10.0.0.2:51820"), netip.MustParseAddrPort("192.168.3.4:51820")},
86+
PublicKey: "PLPNBddmTgHJhtw0vxltq1ZBdPP9RNOEUd5JjJZzBRY=",
87+
Address: netip.MustParseAddr("fd50:8d60:4238:6302:f857:23ff:fe21:d1e0"),
88+
AdditionalAddresses: []netip.Prefix{netip.MustParsePrefix("10.244.3.1/24")},
89+
Endpoints: []netip.AddrPort{netip.MustParseAddrPort("10.0.0.2:51820"), netip.MustParseAddrPort("192.168.3.4:51820")},
90+
ExcludeAdvertisedNetworks: []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
9091
},
9192
ControlPlane: &cluster.ControlPlane{APIServerPort: 6443},
9293
}
@@ -141,6 +142,12 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
141142
Bits: 24,
142143
},
143144
},
145+
ExcludeAdvertisedAddresses: []*pb.IPPrefix{
146+
{
147+
Ip: []byte("\x00\x00\x00\x00"),
148+
Bits: 0,
149+
},
150+
},
144151
},
145152
ControlPlane: &pb.ControlPlane{ApiServerPort: 6443},
146153
}, affiliates[0].Affiliate))
@@ -179,6 +186,12 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
179186
Bits: 24,
180187
},
181188
},
189+
ExcludeAdvertisedAddresses: []*pb.IPPrefix{
190+
{
191+
Ip: []byte("\x01\x01\x01\x01"),
192+
Bits: 32,
193+
},
194+
},
182195
},
183196
},
184197
Endpoints: []*pb.Endpoint{
@@ -204,6 +217,7 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
204217
suite.Assert().Equal(netip.MustParseAddr("fd50:8d60:4238:6302:f857:23ff:fe21:d1e1"), spec.KubeSpan.Address)
205218
suite.Assert().Equal("1CXkdhWBm58c36kTpchR8iGlXHG1ruHa5W8gsFqD8Qs=", spec.KubeSpan.PublicKey)
206219
suite.Assert().Equal([]netip.Prefix{netip.MustParsePrefix("10.244.4.1/24")}, spec.KubeSpan.AdditionalAddresses)
220+
suite.Assert().Equal([]netip.Prefix{netip.MustParsePrefix("1.1.1.1/32")}, spec.KubeSpan.ExcludeAdvertisedNetworks)
207221
suite.Assert().Equal([]netip.AddrPort{netip.MustParseAddrPort("192.168.3.5:51820")}, spec.KubeSpan.Endpoints)
208222
suite.Assert().Zero(spec.ControlPlane)
209223
},

‎internal/app/machined/pkg/controllers/cluster/local_affiliate.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,8 @@ func (ctrl *LocalAffiliateController) Run(ctx context.Context, r controller.Runt
256256
spec.KubeSpan.AdditionalAddresses = nil
257257
}
258258

259+
spec.KubeSpan.ExcludeAdvertisedNetworks = kubespanConfig.TypedSpec().ExcludeAdvertisedNetworks
260+
259261
endpointIPs := xslices.Filter(currentNodeIPs, func(ip netip.Addr) bool {
260262
if ip == spec.KubeSpan.Address {
261263
// skip kubespan local address

‎internal/app/machined/pkg/controllers/cluster/local_affiliate_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ func (suite *LocalAffiliateSuite) TestGeneration() {
7676
ksConfig.TypedSpec().EndpointFilters = []string{"0.0.0.0/0", "!192.168.0.0/16", "2001::/16"}
7777
ksConfig.TypedSpec().AdvertiseKubernetesNetworks = true
7878
ksConfig.TypedSpec().ExtraEndpoints = []netip.AddrPort{netip.MustParseAddrPort("10.5.0.1:51820"), netip.MustParseAddrPort("1.2.3.4:5678")}
79+
ksConfig.TypedSpec().ExcludeAdvertisedNetworks = []netip.Prefix{netip.MustParsePrefix("2001:123:4567::/64")}
7980
suite.Require().NoError(suite.state.Create(suite.ctx, ksConfig))
8081

8182
// add KS address to the list of node addresses, it should be ignored in the endpoints
@@ -115,6 +116,7 @@ func (suite *LocalAffiliateSuite) TestGeneration() {
115116

116117
asrt.NotZero(spec.KubeSpan.PublicKey)
117118
asrt.NotZero(spec.KubeSpan.AdditionalAddresses)
119+
asrt.Len(spec.KubeSpan.ExcludeAdvertisedNetworks, 1)
118120

119121
asrt.Equal(ksIdentity.TypedSpec().Address.Addr(), spec.KubeSpan.Address)
120122
asrt.Equal(ksIdentity.TypedSpec().PublicKey, spec.KubeSpan.PublicKey)

0 commit comments

Comments
 (0)