Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block a Pod's IP packets until its NetworkPolicies are realized #5698

Closed
wants to merge 1 commit into from
Closed

Block a Pod's IP packets until its NetworkPolicies are realized #5698

wants to merge 1 commit into from

Commits on Nov 15, 2023

  1. Block a Pod's IP packets until its NetworkPolicies are realized 

    In the previous implementation, traffic from/to a Pod may bypass
NetworkPolicies applied to the Pod in a short time window when the agent
restarts because realizing NetworkPolicies and enabling forwarding are
asynchronous.

However, we can't wait for all NetworkPolicies to be realized before
enabling forwarding of OVS because there are some cases the former
depends on the latter, for example, when proxyAll is enabled, or when
it's a Windows Node, in which cases control-plane communication relies
on the forwarding of OVS.

This patch takes a more fine-grained approach: block a Pod's IP packets
in NetworkPolicy's entry tables until its NetworkPolicies are realized.
This granularity leaves the Node and the hostNetwork Pods' traffic
untouched and makes the realization issue of a Pod's NetworkPolicies
affect the Pod's IP packets only.

The following changes are made to implement the approach:
1. EgressSecurityClassifierTable is now always required. (Previously
   it's only required for ExternalNode, not K8sNode).
2. One flow with low priority dropping traffic from local Pods is
   installed in EgressSecurityClassifierTable, and one flow with low
   priority dropping traffic to local Pods is installed in
   IngressSecurityClassifierTable.
3. When a Pod's NetworkPolicies are fully realized the first time, one
   flow with normal priority allowing traffic from this Pod is installed
   in EgressSecurityClassifierTable to override the above drop action,
   one flow in IngressSecurityClassifierTable did the same for traffic
   to this Pod.

Signed-off-by: Quan Tian <[email protected]>
    @tnqn
    tnqn committed Nov 15, 2023
    Configuration menu
    Copy the full SHA
    f8f0271 View commit details
    Browse the repository at this point in the history