[Multicast] add Multicast networkpolicy support #3660

liu4480 · 2022-04-19T02:58:34Z

implement network policy for multicast

For multicast traffic, we support ingress rules for IGMP, and egress rules for multicast data traffic.
And apply NetworkPolicy to real traffic for both. Ingress for multicast traffic is not supported now.
While egress for IGMP only supports IGMP report, which is handled by packetIn. This patch
maintains a rule map for each group address to fetch the rule which matches the member and also
has the highest priority. And packetIn will decide to allow or drop the IGMP report traffic
based on the matched rule.

lgtm-com · 2022-05-04T06:46:09Z

This pull request introduces 2 alerts when merging fc991e9 into f08aecd - view on LGTM.com

new alerts:

2 for Useless assignment to local variable

lgtm-com · 2022-05-05T02:00:47Z

This pull request introduces 2 alerts when merging 8d29a75 into 8f451f7 - view on LGTM.com

new alerts:

2 for Useless assignment to local variable

lgtm-com · 2022-05-05T03:40:53Z

This pull request introduces 2 alerts when merging 089d394 into 8f451f7 - view on LGTM.com

new alerts:

2 for Useless assignment to local variable

codecov-commenter · 2022-05-05T06:31:20Z

Codecov Report

Merging #3660 (faae27b) into main (8c9ba64) will increase coverage by 28.73%.
The diff coverage is 40.03%.

@@             Coverage Diff             @@
##             main    #3660       +/-   ##
===========================================
+ Coverage   35.72%   64.46%   +28.73%     
===========================================
  Files         121      288      +167     
  Lines       16894    41710    +24816     
===========================================
+ Hits         6035    26887    +20852     
- Misses      10366    12665     +2299     
- Partials      493     2158     +1665

Flag	Coverage Δ
e2e-tests	`44.85% <16.88%> (?)`
integration-tests	`?`
kind-e2e-tests	`51.26% <18.21%> (?)`
unit-tests	`44.19% <38.02%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/agent/openflow/multicast.go	`0.00% <0.00%> (ø)`
pkg/agent/route/route_linux.go	`48.08% <0.00%> (ø)`
pkg/agent/types/networkpolicy.go	`81.08% <ø> (ø)`
pkg/apis/controlplane/types.go	`0.00% <ø> (ø)`
pkg/util/ip/ip.go	`78.76% <0.00%> (ø)`
pkg/agent/openflow/client.go	`70.12% <14.28%> (ø)`
pkg/controller/networkpolicy/validate.go	`48.84% <17.39%> (ø)`
pkg/agent/openflow/network_policy.go	`83.74% <20.00%> (ø)`
pkg/agent/openflow/pipeline.go	`72.28% <22.58%> (ø)`
pkg/agent/controller/networkpolicy/reconciler.go	`68.90% <29.54%> (ø)`
... and 417 more

lgtm-com · 2022-05-05T06:48:24Z

This pull request introduces 2 alerts when merging f96b372 into 8f451f7 - view on LGTM.com

new alerts:

2 for Useless assignment to local variable

lgtm-com · 2022-05-05T14:52:46Z

This pull request introduces 2 alerts when merging 18b52b9 into 09d11e9 - view on LGTM.com

new alerts:

2 for Useless assignment to local variable

lgtm-com · 2022-05-06T07:14:02Z

This pull request introduces 2 alerts when merging 60eb770 into 50d33be - view on LGTM.com

new alerts:

2 for Useless assignment to local variable

liu4480 · 2022-06-02T23:35:30Z

/test-conformance
/test-e2e
/test-networkpolicy
/test-multicast-e2e

liu4480 · 2022-06-03T04:48:28Z

/test-multicast-e2e

wenyingd

LGTM

pkg/agent/multicast/mcast_discovery.go

pkg/agent/openflow/pipeline.go

pkg/agent/openflow/client.go

pkg/agent/openflow/pipeline.go

liu4480 · 2022-06-07T03:14:12Z

/test-conformance
/test-e2e
/test-networkpolicy
/test-multicast-e2e

build/yamls/antrea-aks.yml

pkg/agent/controller/networkpolicy/cache.go

pkg/agent/controller/networkpolicy/networkpolicy_controller.go

pkg/agent/multicast/mcast_controller.go

pkg/agent/openflow/pipeline.go

pkg/controller/networkpolicy/validate.go

pkg/agent/openflow/client.go

pkg/controller/networkpolicy/validate.go

1. For multicast traffic, we support ingress rules for IGMP, and egress rules for multicast data traffic. And apply NetworkPolicy to real traffic for both. Ingress for multicast traffic is not supported now. 2. While egress for IGMP only supports IGMP report, which is handled by packetIn. This patch maintainsvrule map for each group address to fetch the rule which matches the member and also has the highest priority. And packetIn will decide to allow or drop the IGMP report traffic based on the matched rule. Signed-off-by: Bin Liu <[email protected]>

tnqn

LGTM

liu4480 · 2022-06-08T23:04:39Z

/test-conformance
/test-e2e
/test-networkpolicy
/test-multicast-e2e

tnqn · 2022-06-09T06:28:45Z

/test-ipv6-e2e
/test-ipv6-only-e2e

tnqn · 2022-06-09T07:03:29Z

/test-ipv6-e2e

tnqn · 2022-06-09T09:57:16Z

In commit message:

This patch maintainsvrule map for each group address

I suppose you want to say "This patch maintains a rule map for each group address", right? If yes, please update PR description directly. I will update commit message when merging.

liu4480 mentioned this pull request Apr 19, 2022

Multicast Support in Antrea #2251

Closed

12 tasks

liu4480 changed the title ~~WIP: Multicast np~~ [WIP Multicast]: add Multicast networkpolicy support Apr 19, 2022

liu4480 force-pushed the multicast_flexible_pipeline_np branch from 34f8bb0 to 54591a5 Compare April 19, 2022 07:52

liu4480 force-pushed the multicast_flexible_pipeline_np branch 2 times, most recently from 0320e30 to fc991e9 Compare May 4, 2022 06:23

liu4480 changed the title ~~[WIP Multicast]: add Multicast networkpolicy support~~ add Multicast networkpolicy support May 5, 2022

liu4480 changed the title ~~add Multicast networkpolicy support~~ [Multicast] add Multicast networkpolicy support May 5, 2022

liu4480 requested review from wenyingd, tnqn, ceclinux, hongliangl and Dyanngg and removed request for ceclinux, wenyingd, tnqn, Dyanngg and hongliangl May 5, 2022 01:53

liu4480 changed the title ~~[Multicast] add Multicast networkpolicy support~~ WIP: [Multicast] add Multicast networkpolicy support May 5, 2022

liu4480 force-pushed the multicast_flexible_pipeline_np branch 2 times, most recently from 3ab626e to 18b52b9 Compare May 5, 2022 14:27

liu4480 force-pushed the multicast_flexible_pipeline_np branch 3 times, most recently from cc2c9cd to 60eb770 Compare May 6, 2022 06:50

liu4480 requested review from wenyingd and tnqn June 4, 2022 04:47

wenyingd previously approved these changes Jun 6, 2022

View reviewed changes

tnqn reviewed Jun 6, 2022

View reviewed changes

liu4480 dismissed wenyingd’s stale review via 82772cf June 7, 2022 03:12

liu4480 force-pushed the multicast_flexible_pipeline_np branch from 03cd705 to 82772cf Compare June 7, 2022 03:12

liu4480 requested a review from tnqn June 7, 2022 07:03

ceclinux reviewed Jun 7, 2022

View reviewed changes

build/yamls/antrea-aks.yml Show resolved Hide resolved

ceclinux reviewed Jun 7, 2022

View reviewed changes

pkg/agent/controller/networkpolicy/cache.go Outdated Show resolved Hide resolved

liu4480 force-pushed the multicast_flexible_pipeline_np branch from dc24b07 to a69eb21 Compare June 7, 2022 12:39

tnqn reviewed Jun 7, 2022

View reviewed changes

liu4480 force-pushed the multicast_flexible_pipeline_np branch from a69eb21 to 20b0d80 Compare June 8, 2022 01:05

liu4480 requested review from tnqn and ceclinux June 8, 2022 01:55

tnqn reviewed Jun 8, 2022

View reviewed changes

pkg/agent/openflow/client.go Outdated Show resolved Hide resolved

pkg/controller/networkpolicy/validate.go Show resolved Hide resolved

liu4480 force-pushed the multicast_flexible_pipeline_np branch from 20b0d80 to faae27b Compare June 8, 2022 06:22

liu4480 requested a review from tnqn June 8, 2022 09:36

tnqn approved these changes Jun 8, 2022

View reviewed changes

tnqn merged commit 5a7e5c3 into antrea-io:main Jun 9, 2022

liu4480 deleted the multicast_flexible_pipeline_np branch June 10, 2022 02:12

liu4480 mentioned this pull request Jul 15, 2022

support for multicast networkpolicy #3323

Closed

ceclinux mentioned this pull request Jul 27, 2022

Support Multicast statistics #3294

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Multicast] add Multicast networkpolicy support #3660

[Multicast] add Multicast networkpolicy support #3660

liu4480 commented Apr 19, 2022 •

edited

Loading

lgtm-com bot commented May 4, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

codecov-commenter commented May 5, 2022 •

edited

Loading

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 6, 2022

liu4480 commented Jun 2, 2022

liu4480 commented Jun 3, 2022

wenyingd left a comment

liu4480 commented Jun 7, 2022

tnqn left a comment

liu4480 commented Jun 8, 2022

tnqn commented Jun 9, 2022

tnqn commented Jun 9, 2022

tnqn commented Jun 9, 2022

[Multicast] add Multicast networkpolicy support #3660

[Multicast] add Multicast networkpolicy support #3660

Conversation

liu4480 commented Apr 19, 2022 • edited Loading

lgtm-com bot commented May 4, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

codecov-commenter commented May 5, 2022 • edited Loading

Codecov Report

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 6, 2022

liu4480 commented Jun 2, 2022

liu4480 commented Jun 3, 2022

wenyingd left a comment

Choose a reason for hiding this comment

liu4480 commented Jun 7, 2022

tnqn left a comment

Choose a reason for hiding this comment

liu4480 commented Jun 8, 2022

tnqn commented Jun 9, 2022

tnqn commented Jun 9, 2022

tnqn commented Jun 9, 2022

liu4480 commented Apr 19, 2022 •

edited

Loading

codecov-commenter commented May 5, 2022 •

edited

Loading