Skip to content

Commit 70c6c21

Browse files
p2pdkivenkosmira
p2pdkivenko
authored and
smira
committed
feat: add filter for KubeSpan advertised networks
Add advertisedNetworks filter to KubeSpan configuration that allows filtering which additional networks (e.g., pod CIDRs) are advertised over KubeSpan when advertiseKubernetesNetworks is enabled. Signed-off-by: Daniil Kivenko <daniil.kivenko@p2p.org> Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
1 parent daf18ab commit 70c6c21

40 files changed

Lines changed: 596 additions & 171 deletions

‎api/resource/definitions/cluster/cluster.proto‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ message KubeSpanAffiliateSpec {
5656
common.NetIP address = 2;
5757
repeated common.NetIPPrefix additional_addresses = 3;
5858
repeated common.NetIPPort endpoints = 4;
59+
repeated common.NetIPPrefix exclude_advertised_networks = 5;
5960
}
6061

6162
// MemberSpec describes Member state.

‎api/resource/definitions/kubespan/kubespan.proto‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ message ConfigSpec {
2020
repeated string endpoint_filters = 7;
2121
bool harvest_extra_endpoints = 8;
2222
repeated common.NetIPPort extra_endpoints = 9;
23+
repeated common.NetIPPrefix exclude_advertised_networks = 10;
2324
}
2425

2526
// EndpointSpec describes Endpoint state.

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ require (
137137
github.com/safchain/ethtool v0.7.0
138138
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36
139139
github.com/siderolabs/crypto v0.6.4
140-
github.com/siderolabs/discovery-api v0.1.6
140+
github.com/siderolabs/discovery-api v0.1.8
141141
github.com/siderolabs/discovery-client v0.1.13
142142
github.com/siderolabs/gen v0.8.6
143143
github.com/siderolabs/go-api-signature v0.3.12

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -634,8 +634,8 @@ github.com/siderolabs/coredns v1.14.53 h1:rwWyicwWFcu+i8OV0WT1u2W46J/iIReqzm+pSv
634634
github.com/siderolabs/coredns v1.14.53/go.mod h1:KAGRTpTbhrScGMhiLsgnzo30OgiBBut1Y5XTuG1V+BQ=
635635
github.com/siderolabs/crypto v0.6.4 h1:uMoe/X/mABOv6yOgvKcjmjIMdv6U8JegBXlPKtyjn3g=
636636
github.com/siderolabs/crypto v0.6.4/go.mod h1:39B7Mdrd8qTfEYOjsWPQOk7gLTWrEI30isAW+YYj9nk=
637-
github.com/siderolabs/discovery-api v0.1.6 h1:/LhsF1ytqFEfWwV0UKfUgn90k9fk5+rhYMJ9yeUB2yc=
638-
github.com/siderolabs/discovery-api v0.1.6/go.mod h1:s5CnTyRMGid/vJNSJs8Jw9I4tnKHu/2SGqP2ytTaePQ=
637+
github.com/siderolabs/discovery-api v0.1.8 h1:Hq/Si0fFQICvdT+P/I81fRf9t5I+J6vaJNBvgehv8GE=
638+
github.com/siderolabs/discovery-api v0.1.8/go.mod h1:JN8aBpnsArIeLNLbqt3HIYHyFR14Qfwr4etAB2ZfygA=
639639
github.com/siderolabs/discovery-client v0.1.13 h1:s0iK2ixopCFFgQ5zZmzsQ8xf8Hd+SygrUdlhE+um6iQ=
640640
github.com/siderolabs/discovery-client v0.1.13/go.mod h1:kojlX4Kk0o9wsbJU1XOy4BH0W6RMg2I2d8WJ4ciK3qU=
641641
github.com/siderolabs/ethtool v0.4.0-sidero h1:Ls/M4bFUjfcB1RDVviPZlL3kWcXaEVVSbKke+EZ2A9U=

‎hack/release.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,15 @@ cluster:
204204
```
205205
206206
(If the cluster is already running, sync the bootstrap manifests after applying the patch to deploy the new CNI configuration.)
207+
"""
208+
209+
[notes.kubespan-filters]
210+
title = "KubeSpan Advertised Network Filters"
211+
description = """\
212+
KubeSpan now supports filtering of advertised networks using the `excludeAdvertisedNetworks` field in the `KubeSpanConfig` document.
213+
This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
214+
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
215+
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.
207216
"""
208217

209218
[make_deps]

‎internal/app/machined/pkg/controllers/cluster/discovery_service.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,12 @@ func pbAffiliate(affiliate *cluster.AffiliateSpec) *pb.Affiliate {
355355
Ip: takeResult(address.Addr().MarshalBinary()),
356356
}
357357
}),
358+
ExcludeAdvertisedAddresses: xslices.Map(affiliate.KubeSpan.ExcludeAdvertisedNetworks, func(address netip.Prefix) *pb.IPPrefix {
359+
return &pb.IPPrefix{
360+
Bits: uint32(address.Bits()),
361+
Ip: takeResult(address.Addr().MarshalBinary()),
362+
}
363+
}),
358364
}
359365
}
360366

@@ -498,6 +504,16 @@ func specAffiliate(affiliate *pb.Affiliate, endpoints []*pb.Endpoint) cluster.Af
498504
result.KubeSpan.Endpoints = append(result.KubeSpan.Endpoints, netip.AddrPortFrom(ip, uint16(endpoints[i].Port)))
499505
}
500506
}
507+
508+
result.KubeSpan.ExcludeAdvertisedNetworks = make([]netip.Prefix, 0, len(affiliate.Kubespan.ExcludeAdvertisedAddresses))
509+
510+
for i := range affiliate.Kubespan.ExcludeAdvertisedAddresses {
511+
var ip netip.Addr
512+
513+
if err := ip.UnmarshalBinary(affiliate.Kubespan.ExcludeAdvertisedAddresses[i].Ip); err == nil {
514+
result.KubeSpan.ExcludeAdvertisedNetworks = append(result.KubeSpan.ExcludeAdvertisedNetworks, netip.PrefixFrom(ip, int(affiliate.Kubespan.ExcludeAdvertisedAddresses[i].Bits)))
515+
}
516+
}
501517
}
502518

503519
return result

‎internal/app/machined/pkg/controllers/cluster/discovery_service_test.go‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,11 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
8383
MachineType: machine.TypeControlPlane,
8484
Addresses: []netip.Addr{netip.MustParseAddr("192.168.3.4")},
8585
KubeSpan: cluster.KubeSpanAffiliateSpec{
86-
PublicKey: "PLPNBddmTgHJhtw0vxltq1ZBdPP9RNOEUd5JjJZzBRY=",
87-
Address: netip.MustParseAddr("fd50:8d60:4238:6302:f857:23ff:fe21:d1e0"),
88-
AdditionalAddresses: []netip.Prefix{netip.MustParsePrefix("10.244.3.1/24")},
89-
Endpoints: []netip.AddrPort{netip.MustParseAddrPort("10.0.0.2:51820"), netip.MustParseAddrPort("192.168.3.4:51820")},
86+
PublicKey: "PLPNBddmTgHJhtw0vxltq1ZBdPP9RNOEUd5JjJZzBRY=",
87+
Address: netip.MustParseAddr("fd50:8d60:4238:6302:f857:23ff:fe21:d1e0"),
88+
AdditionalAddresses: []netip.Prefix{netip.MustParsePrefix("10.244.3.1/24")},
89+
Endpoints: []netip.AddrPort{netip.MustParseAddrPort("10.0.0.2:51820"), netip.MustParseAddrPort("192.168.3.4:51820")},
90+
ExcludeAdvertisedNetworks: []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
9091
},
9192
ControlPlane: &cluster.ControlPlane{APIServerPort: 6443},
9293
}
@@ -141,6 +142,12 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
141142
Bits: 24,
142143
},
143144
},
145+
ExcludeAdvertisedAddresses: []*pb.IPPrefix{
146+
{
147+
Ip: []byte("\x00\x00\x00\x00"),
148+
Bits: 0,
149+
},
150+
},
144151
},
145152
ControlPlane: &pb.ControlPlane{ApiServerPort: 6443},
146153
}, affiliates[0].Affiliate))
@@ -179,6 +186,12 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
179186
Bits: 24,
180187
},
181188
},
189+
ExcludeAdvertisedAddresses: []*pb.IPPrefix{
190+
{
191+
Ip: []byte("\x01\x01\x01\x01"),
192+
Bits: 32,
193+
},
194+
},
182195
},
183196
},
184197
Endpoints: []*pb.Endpoint{
@@ -204,6 +217,7 @@ func (suite *DiscoveryServiceSuite) TestReconcile() {
204217
suite.Assert().Equal(netip.MustParseAddr("fd50:8d60:4238:6302:f857:23ff:fe21:d1e1"), spec.KubeSpan.Address)
205218
suite.Assert().Equal("1CXkdhWBm58c36kTpchR8iGlXHG1ruHa5W8gsFqD8Qs=", spec.KubeSpan.PublicKey)
206219
suite.Assert().Equal([]netip.Prefix{netip.MustParsePrefix("10.244.4.1/24")}, spec.KubeSpan.AdditionalAddresses)
220+
suite.Assert().Equal([]netip.Prefix{netip.MustParsePrefix("1.1.1.1/32")}, spec.KubeSpan.ExcludeAdvertisedNetworks)
207221
suite.Assert().Equal([]netip.AddrPort{netip.MustParseAddrPort("192.168.3.5:51820")}, spec.KubeSpan.Endpoints)
208222
suite.Assert().Zero(spec.ControlPlane)
209223
},

‎internal/app/machined/pkg/controllers/cluster/local_affiliate.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,8 @@ func (ctrl *LocalAffiliateController) Run(ctx context.Context, r controller.Runt
256256
spec.KubeSpan.AdditionalAddresses = nil
257257
}
258258

259+
spec.KubeSpan.ExcludeAdvertisedNetworks = kubespanConfig.TypedSpec().ExcludeAdvertisedNetworks
260+
259261
endpointIPs := xslices.Filter(currentNodeIPs, func(ip netip.Addr) bool {
260262
if ip == spec.KubeSpan.Address {
261263
// skip kubespan local address

‎internal/app/machined/pkg/controllers/cluster/local_affiliate_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ func (suite *LocalAffiliateSuite) TestGeneration() {
7676
ksConfig.TypedSpec().EndpointFilters = []string{"0.0.0.0/0", "!192.168.0.0/16", "2001::/16"}
7777
ksConfig.TypedSpec().AdvertiseKubernetesNetworks = true
7878
ksConfig.TypedSpec().ExtraEndpoints = []netip.AddrPort{netip.MustParseAddrPort("10.5.0.1:51820"), netip.MustParseAddrPort("1.2.3.4:5678")}
79+
ksConfig.TypedSpec().ExcludeAdvertisedNetworks = []netip.Prefix{netip.MustParsePrefix("2001:123:4567::/64")}
7980
suite.Require().NoError(suite.state.Create(suite.ctx, ksConfig))
8081

8182
// add KS address to the list of node addresses, it should be ignored in the endpoints
@@ -115,6 +116,7 @@ func (suite *LocalAffiliateSuite) TestGeneration() {
115116

116117
asrt.NotZero(spec.KubeSpan.PublicKey)
117118
asrt.NotZero(spec.KubeSpan.AdditionalAddresses)
119+
asrt.Len(spec.KubeSpan.ExcludeAdvertisedNetworks, 1)
118120

119121
asrt.Equal(ksIdentity.TypedSpec().Address.Addr(), spec.KubeSpan.Address)
120122
asrt.Equal(ksIdentity.TypedSpec().PublicKey, spec.KubeSpan.PublicKey)

‎internal/app/machined/pkg/controllers/kubespan/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ func NewConfigController() *ConfigController {
5252

5353
if c.NetworkKubeSpanConfig().Filters() != nil {
5454
res.TypedSpec().EndpointFilters = c.NetworkKubeSpanConfig().Filters().Endpoints()
55+
res.TypedSpec().ExcludeAdvertisedNetworks = c.NetworkKubeSpanConfig().Filters().ExcludeAdvertisedNetworks()
5556
}
5657
}
5758

0 commit comments

Comments
 (0)