Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCPBUGS-34067: Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.17 #54

Conversation

openshift-bot
Copy link
Contributor

Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.17
TLDR:
Product builds by ART can be configured for different base and builder images than corresponding CI
builds. This automated PR requests a change to CI configuration to align with ART's configuration;
please take steps to merge it quickly or contact ART to coordinate changes.

The configuration in the following ART component metadata is driving this alignment request:
multus-networkpolicy.yml.

Detail:

This repository is out of sync with the downstream product builds for this component. The CI
configuration for at least one image differs from ART's expected product configuration. This should
be addressed to ensure that the component's CI testing accurate reflects what customers will
experience.

Most of these PRs are opened as an ART-driven proposal to migrate base image or builder(s) to a
different version, usually prior to GA. The intent is to effect changes in both configurations
simultaneously without breaking either CI or ART builds, so usually ART builds are configured to
consider CI as canonical and attempt to match CI config until the PR merges to align both. ART may
also configure changes in GA releases with CI remaining canonical for a brief grace period to enable
CI to succeed and the alignment PR to merge. In either case, ART configuration will be made
canonical at some point (typically at branch-cut before GA or release dev-cut after GA), so it is
important to align CI configuration as soon as possible.

PRs are also triggered when CI configuration changes without ART coordination, for instance to
change the number of builder images or to use a different golang version. These changes should be
coordinated with ART; whether ART configuration is canonical or not, preferably it would be updated
first to enable the changes to occur simultaneously in both CI and ART at the same time. This also
gives ART a chance to validate the intended changes first. For instance, ART compiles most
components with the Golang version being used by the control plane for a given OpenShift release.
Exceptions to this convention (i.e. you believe your component must be compiled with a Golang
version independent from the control plane) must be granted by the OpenShift staff engineers and
communicated to the ART team.

Roles & Responsibilities:

  • Component owners are responsible for ensuring these alignment PRs merge with passing
    tests OR that necessary metadata changes are reported to the ART team: @release-artists
    in #forum-ocp-art on Slack. If necessary, the changes required by this pull request can be
    introduced with a separate PR opened by the component team. Once the repository is aligned,
    this PR will be closed automatically.
  • Patch-manager or those with sufficient privileges within this repository may add
    any required labels to ensure the PR merges once tests are passing. In cases where ART config is
    canonical, downstream builds are already being built with these changes, and merging this PR
    only improves the fidelity of our CI. In cases where ART config is not canonical, this provides
    a grace period for the component team to align their CI with ART's configuration before it becomes
    canonical in product builds.

ART has been configured to reconcile your CI build root image (see https://docs.ci.openshift.org/docs/architecture/ci-operator/#build-root-image).
In order for your upstream .ci-operator.yaml configuration to be honored, you must set the following in your openshift/release ci-operator configuration file:

build_root:
  from_repository: true

Change behavior of future PRs:

  • In case you just want to follow the base images that ART suggests, you can configure additional labels to be
    set up automatically. This means that such a PR would merge without human intervention (and awareness!) in the future.
    To do so, open a PR to set the auto_label attribute in the image configuration. Example
  • You can set a commit prefix, like UPSTREAM: <carry>: . An example.

If you have any questions about this pull request, please reach out to @release-artists in the #forum-ocp-art coreos slack channel.

@openshift-bot openshift-bot force-pushed the art-consistency-openshift-4.17-multus-networkpolicy branch from 8771fe0 to 7498a6f Compare May 21, 2024 17:48
@openshift-bot
Copy link
Contributor Author

@openshift-bot openshift-bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. labels May 21, 2024
@openshift-bot openshift-bot changed the title Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.17 OCPBUGS-34067: Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.17 May 21, 2024
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels May 21, 2024
@openshift-ci-robot
Copy link
Contributor

@openshift-bot: This pull request references Jira Issue OCPBUGS-34067, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.17.0) matches configured target version for branch (4.17.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.17
TLDR:
Product builds by ART can be configured for different base and builder images than corresponding CI
builds. This automated PR requests a change to CI configuration to align with ART's configuration;
please take steps to merge it quickly or contact ART to coordinate changes.

The configuration in the following ART component metadata is driving this alignment request:
multus-networkpolicy.yml.

Detail:

This repository is out of sync with the downstream product builds for this component. The CI
configuration for at least one image differs from ART's expected product configuration. This should
be addressed to ensure that the component's CI testing accurate reflects what customers will
experience.

Most of these PRs are opened as an ART-driven proposal to migrate base image or builder(s) to a
different version, usually prior to GA. The intent is to effect changes in both configurations
simultaneously without breaking either CI or ART builds, so usually ART builds are configured to
consider CI as canonical and attempt to match CI config until the PR merges to align both. ART may
also configure changes in GA releases with CI remaining canonical for a brief grace period to enable
CI to succeed and the alignment PR to merge. In either case, ART configuration will be made
canonical at some point (typically at branch-cut before GA or release dev-cut after GA), so it is
important to align CI configuration as soon as possible.

PRs are also triggered when CI configuration changes without ART coordination, for instance to
change the number of builder images or to use a different golang version. These changes should be
coordinated with ART; whether ART configuration is canonical or not, preferably it would be updated
first to enable the changes to occur simultaneously in both CI and ART at the same time. This also
gives ART a chance to validate the intended changes first. For instance, ART compiles most
components with the Golang version being used by the control plane for a given OpenShift release.
Exceptions to this convention (i.e. you believe your component must be compiled with a Golang
version independent from the control plane) must be granted by the OpenShift staff engineers and
communicated to the ART team.

Roles & Responsibilities:

  • Component owners are responsible for ensuring these alignment PRs merge with passing
    tests OR that necessary metadata changes are reported to the ART team: @release-artists
    in #forum-ocp-art on Slack. If necessary, the changes required by this pull request can be
    introduced with a separate PR opened by the component team. Once the repository is aligned,
    this PR will be closed automatically.
  • Patch-manager or those with sufficient privileges within this repository may add
    any required labels to ensure the PR merges once tests are passing. In cases where ART config is
    canonical, downstream builds are already being built with these changes, and merging this PR
    only improves the fidelity of our CI. In cases where ART config is not canonical, this provides
    a grace period for the component team to align their CI with ART's configuration before it becomes
    canonical in product builds.

ART has been configured to reconcile your CI build root image (see https://docs.ci.openshift.org/docs/architecture/ci-operator/#build-root-image).
In order for your upstream .ci-operator.yaml configuration to be honored, you must set the following in your openshift/release ci-operator configuration file:

build_root:
 from_repository: true

Change behavior of future PRs:

  • In case you just want to follow the base images that ART suggests, you can configure additional labels to be
    set up automatically. This means that such a PR would merge without human intervention (and awareness!) in the future.
    To do so, open a PR to set the auto_label attribute in the image configuration. Example
  • You can set a commit prefix, like UPSTREAM: <carry>: . An example.

If you have any questions about this pull request, please reach out to @release-artists in the #forum-ocp-art coreos slack channel.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link

openshift-ci bot commented May 21, 2024

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

1 similar comment
Copy link

openshift-ci bot commented May 21, 2024

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copy link

openshift-ci bot commented May 21, 2024

@openshift-bot: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit d04f22f into openshift:master May 21, 2024
4 checks passed
@openshift-ci-robot
Copy link
Contributor

@openshift-bot: Jira Issue OCPBUGS-34067: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-34067 has been moved to the MODIFIED state.

In response to this:

Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.17
TLDR:
Product builds by ART can be configured for different base and builder images than corresponding CI
builds. This automated PR requests a change to CI configuration to align with ART's configuration;
please take steps to merge it quickly or contact ART to coordinate changes.

The configuration in the following ART component metadata is driving this alignment request:
multus-networkpolicy.yml.

Detail:

This repository is out of sync with the downstream product builds for this component. The CI
configuration for at least one image differs from ART's expected product configuration. This should
be addressed to ensure that the component's CI testing accurate reflects what customers will
experience.

Most of these PRs are opened as an ART-driven proposal to migrate base image or builder(s) to a
different version, usually prior to GA. The intent is to effect changes in both configurations
simultaneously without breaking either CI or ART builds, so usually ART builds are configured to
consider CI as canonical and attempt to match CI config until the PR merges to align both. ART may
also configure changes in GA releases with CI remaining canonical for a brief grace period to enable
CI to succeed and the alignment PR to merge. In either case, ART configuration will be made
canonical at some point (typically at branch-cut before GA or release dev-cut after GA), so it is
important to align CI configuration as soon as possible.

PRs are also triggered when CI configuration changes without ART coordination, for instance to
change the number of builder images or to use a different golang version. These changes should be
coordinated with ART; whether ART configuration is canonical or not, preferably it would be updated
first to enable the changes to occur simultaneously in both CI and ART at the same time. This also
gives ART a chance to validate the intended changes first. For instance, ART compiles most
components with the Golang version being used by the control plane for a given OpenShift release.
Exceptions to this convention (i.e. you believe your component must be compiled with a Golang
version independent from the control plane) must be granted by the OpenShift staff engineers and
communicated to the ART team.

Roles & Responsibilities:

  • Component owners are responsible for ensuring these alignment PRs merge with passing
    tests OR that necessary metadata changes are reported to the ART team: @release-artists
    in #forum-ocp-art on Slack. If necessary, the changes required by this pull request can be
    introduced with a separate PR opened by the component team. Once the repository is aligned,
    this PR will be closed automatically.
  • Patch-manager or those with sufficient privileges within this repository may add
    any required labels to ensure the PR merges once tests are passing. In cases where ART config is
    canonical, downstream builds are already being built with these changes, and merging this PR
    only improves the fidelity of our CI. In cases where ART config is not canonical, this provides
    a grace period for the component team to align their CI with ART's configuration before it becomes
    canonical in product builds.

ART has been configured to reconcile your CI build root image (see https://docs.ci.openshift.org/docs/architecture/ci-operator/#build-root-image).
In order for your upstream .ci-operator.yaml configuration to be honored, you must set the following in your openshift/release ci-operator configuration file:

build_root:
 from_repository: true

Change behavior of future PRs:

  • In case you just want to follow the base images that ART suggests, you can configure additional labels to be
    set up automatically. This means that such a PR would merge without human intervention (and awareness!) in the future.
    To do so, open a PR to set the auto_label attribute in the image configuration. Example
  • You can set a commit prefix, like UPSTREAM: <carry>: . An example.

If you have any questions about this pull request, please reach out to @release-artists in the #forum-ocp-art coreos slack channel.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot
Copy link
Contributor Author

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-multus-networkpolicy-container-v4.17.0-202405212243.p0.gd04f22f.assembly.stream.el9 for distgit multus-networkpolicy.
All builds following this will include this PR.

zeeke pushed a commit to zeeke/multus-networkpolicy that referenced this pull request Sep 10, 2024
zeeke added a commit to zeeke/multus-networkpolicy that referenced this pull request Sep 10, 2024
* Add pod-iptables option to store pod iptables

This change introduces pod-iptables option to store iptables-rules
in pod's network namespace. This helps administrator/engineer to
troubleshooting.

* Fix owners file

* Update CI pipeline

* Add label to Dockerfile

* Update github action to simplify

* Use GITHUB_TOKEN for push packages

* Update slack URL in README

* fix workflows

* Fix some timing issue and change memory limit

* Add namespace check between pod and multi-networkpolicy

* Use TCP as default for Port.Protocol

Add ginkgo test to the suite with only default values.
Add `renderProtocol` function with fallback logic.

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix to work namespacveSelector policy, without labelSelector

* Support for `NamespaceSelector` (openshift#16)

* Add test case for namespace selector

The case is about having two namespaces with pods
and net-attach-def and a multi networkpolicy that
goes through namespace borders.

Signed-off-by: Andrea Panattoni <[email protected]>

* Add test case with net-attach-def in other ns

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve logging in server.go (openshift#19)

* Add object information to update events

This should make it clearer what k8s object the
daemon is working on.

Increase verbosity threshlod for invoke handlers logs.

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve error logging

Signed-off-by: Andrea Panattoni <[email protected]>

* Add IPv6 support in TODO list

* Set specific version for `revive` tool (openshift#20)

"go getting" github.com/mgechev/revive can lead to unreproducible
builds, as it download the latest "dev" version. Stick to the latest
(v1.2.1) version.

Signed-off-by: Andrea Panattoni <[email protected]>

* Log filter rules (openshift#23)

* Log filter rules

Logging iptables rules before applying them
can be useful to debug complex scenarios.
Setting verbosity level to 6 as they can be
quite cumbersome.

Signed-off-by: Andrea Panattoni <[email protected]>

* Clean up logging code

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine policy generation routine to support multiple policies

This change refines policy rule generation to introduce conntrack
and support multiple policies in a pod. Fix openshift#17 and openshift#18

* Fix capabilities (openshift#25)

fix openshift#24

* Update github action to fit to latest golang

* Remove docker from support runtime due to obsolated

* Bump github.com/containernetworking/cni from 0.7.1 to 0.8.1 (openshift#31)

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump vendor packages.

* Graceful shutdown for daemonset (openshift#32)

* Remove unused errCh

`server.Run()` is not a blocking function and returns always `nil`.
There is no need for a struct field channel.

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow stopping the server

Add signal handler for SIGTERM and SIGINT to main.go.
Add Stop() method to Options to forward os signals.
Add a channel to stop `syncRunner` and clean iptables afterward.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add sync-period option for fast sync

* Remove deprecated parameters in deploy.yml

* Add e2e test

* e2e-test: Add script to update server image (openshift#35)

Add a script to redeploy the server in the kind cluster. It is
useful to quickly test new changes without tearing down the
cluster and bringing it up again.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix yaml syntax error in GH workflow (openshift#36)

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add CodeQL workflow for GitHub code scanning (openshift#38)

Co-authored-by: LGTM Migrator <[email protected]>

* Add NOTICE file for Apache license 2.0 (openshift#39)

This change adds NOTICE file in repository as [1].

[1]: https://infra.apache.org/apply-license.html#new

* IPv6 support in multi-networkpolicy-iptables (openshift#40)

* Support IPv6 networks (openshift#27)

Make Server generates rules for both IP family.
Make iptableBuffer aware of the IP family it is managing, in
order to skip wrong addresses.

Add unit and e2e tests for IPv6 and dual stack networks.

Remove IPv6 item from TODO

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* fix merge-conflict to rebase

* Add e2e ipv6 ingress tests

* IPv6 fix  for NDP and DHCPv6 (openshift#37)

* Add Requirements section to README

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow ipv6 Neighbor Discovery Protocol

NDP leverages icmpv6 packets to discover hosts
IPv6 addresses. This kind of packet must be allowed
between hosts, otherwise some policy-allowed traffic
may get blocked.

Adjust unit tests expected output strings.

See https://www.rfc-editor.org/rfc/rfc2373

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow DHCPv6 traffic

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine icmp/dhcpv6 code

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Tomofumi Hayashi <[email protected]>

* Use string instead of byte in unit-test cases

In real code, use bytes for performance, however, we don't care
about performance for unit-test, hence change bytes to string
for ease of troubleshooting.

* Make INGRESS/EGRESS-COMMON configurable by command line option

This change makes MULTI-{INGRESS,EGRESS}-COMMON chain configurable
to provide a way to support various v4/v6 network.

* Fix CodeQL warnings

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Wait for sync between policy/iptables in e2e tests

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>

* Fix github action

* Avoid using cri-api `v1alpha2` (openshift#43)

As of v1.26.0 kubernetes removed support for api cri-api
v1alpha2
kubernetes/kubernetes#110618

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix typo in container registry domain (openshift#44)

* Update go mod to security vulnerability

Update golang.org/x/text to v0.3.8 for vulnerability.

* Fix github action

* Update vendors to fix dependabot alerts

* Add ipblock bat tests in e2e (openshift#48)

This change introduces ipblock tests in e2e and enables v6
ingress tests in e2e as well.

* Fix iptables rules in multiple items in ingress/egress (openshift#49)

This change fixes iptables rules for multiple items
in ingress/egress. It also adds e2e tests for that.
fix openshift#45

* Update golang to 1.20

* Fix end2end tests (openshift#53)

* e2e: Save kind logs as artifacts

Saving `kind export logs` output when
end-to-end job fails helps debugging flakes
and test failures.

Signed-off-by: Andrea Panattoni <[email protected]>

* build: set CGO_ENABLED=0

Setting CGO_ENABLED=0 for go builds
produces GLIBC independant binaries.

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Infer PolicyTypes if missing (openshift#50)

* Infer PolicyTypes if missing

In cases where Spec.PolicyTypes is not specified, it should
default to the existence of Ingress or Egress rules.

Updating end2end tests to cover also this scenario.

Signed-off-by: Andrea Panattoni <[email protected]>

* e2e: Wait for policy sync during setup

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Bump google.golang.org/grpc from 1.38.0 to 1.53.0 (openshift#52)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.38.0 to 1.53.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.38.0...v1.53.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update e2e environments (openshift#54)

* Fix linter warning (openshift#55)

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Doug Smith <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lgtm-com[bot] <43144390+lgtm-com[bot]@users.noreply.github.com>
Co-authored-by: LGTM Migrator <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>
Co-authored-by: Peter Stöckli <[email protected]>
zeeke added a commit to zeeke/multus-networkpolicy that referenced this pull request Sep 10, 2024
* Add pod-iptables option to store pod iptables

This change introduces pod-iptables option to store iptables-rules
in pod's network namespace. This helps administrator/engineer to
troubleshooting.

* Fix owners file

* Update CI pipeline

* Add label to Dockerfile

* Update github action to simplify

* Use GITHUB_TOKEN for push packages

* Update slack URL in README

* fix workflows

* Fix some timing issue and change memory limit

* Add namespace check between pod and multi-networkpolicy

* Use TCP as default for Port.Protocol

Add ginkgo test to the suite with only default values.
Add `renderProtocol` function with fallback logic.

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix to work namespacveSelector policy, without labelSelector

* Support for `NamespaceSelector` (openshift#16)

* Add test case for namespace selector

The case is about having two namespaces with pods
and net-attach-def and a multi networkpolicy that
goes through namespace borders.

Signed-off-by: Andrea Panattoni <[email protected]>

* Add test case with net-attach-def in other ns

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve logging in server.go (openshift#19)

* Add object information to update events

This should make it clearer what k8s object the
daemon is working on.

Increase verbosity threshlod for invoke handlers logs.

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve error logging

Signed-off-by: Andrea Panattoni <[email protected]>

* Add IPv6 support in TODO list

* Set specific version for `revive` tool (openshift#20)

"go getting" github.com/mgechev/revive can lead to unreproducible
builds, as it download the latest "dev" version. Stick to the latest
(v1.2.1) version.

Signed-off-by: Andrea Panattoni <[email protected]>

* Log filter rules (openshift#23)

* Log filter rules

Logging iptables rules before applying them
can be useful to debug complex scenarios.
Setting verbosity level to 6 as they can be
quite cumbersome.

Signed-off-by: Andrea Panattoni <[email protected]>

* Clean up logging code

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine policy generation routine to support multiple policies

This change refines policy rule generation to introduce conntrack
and support multiple policies in a pod. Fix openshift#17 and openshift#18

* Fix capabilities (openshift#25)

fix openshift#24

* Update github action to fit to latest golang

* Remove docker from support runtime due to obsolated

* Bump github.com/containernetworking/cni from 0.7.1 to 0.8.1 (openshift#31)

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump vendor packages.

* Graceful shutdown for daemonset (openshift#32)

* Remove unused errCh

`server.Run()` is not a blocking function and returns always `nil`.
There is no need for a struct field channel.

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow stopping the server

Add signal handler for SIGTERM and SIGINT to main.go.
Add Stop() method to Options to forward os signals.
Add a channel to stop `syncRunner` and clean iptables afterward.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add sync-period option for fast sync

* Remove deprecated parameters in deploy.yml

* Add e2e test

* e2e-test: Add script to update server image (openshift#35)

Add a script to redeploy the server in the kind cluster. It is
useful to quickly test new changes without tearing down the
cluster and bringing it up again.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix yaml syntax error in GH workflow (openshift#36)

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add CodeQL workflow for GitHub code scanning (openshift#38)

Co-authored-by: LGTM Migrator <[email protected]>

* Add NOTICE file for Apache license 2.0 (openshift#39)

This change adds NOTICE file in repository as [1].

[1]: https://infra.apache.org/apply-license.html#new

* IPv6 support in multi-networkpolicy-iptables (openshift#40)

* Support IPv6 networks (openshift#27)

Make Server generates rules for both IP family.
Make iptableBuffer aware of the IP family it is managing, in
order to skip wrong addresses.

Add unit and e2e tests for IPv6 and dual stack networks.

Remove IPv6 item from TODO

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* fix merge-conflict to rebase

* Add e2e ipv6 ingress tests

* IPv6 fix  for NDP and DHCPv6 (openshift#37)

* Add Requirements section to README

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow ipv6 Neighbor Discovery Protocol

NDP leverages icmpv6 packets to discover hosts
IPv6 addresses. This kind of packet must be allowed
between hosts, otherwise some policy-allowed traffic
may get blocked.

Adjust unit tests expected output strings.

See https://www.rfc-editor.org/rfc/rfc2373

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow DHCPv6 traffic

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine icmp/dhcpv6 code

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Tomofumi Hayashi <[email protected]>

* Use string instead of byte in unit-test cases

In real code, use bytes for performance, however, we don't care
about performance for unit-test, hence change bytes to string
for ease of troubleshooting.

* Make INGRESS/EGRESS-COMMON configurable by command line option

This change makes MULTI-{INGRESS,EGRESS}-COMMON chain configurable
to provide a way to support various v4/v6 network.

* Fix CodeQL warnings

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Wait for sync between policy/iptables in e2e tests

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>

* Fix github action

* Avoid using cri-api `v1alpha2` (openshift#43)

As of v1.26.0 kubernetes removed support for api cri-api
v1alpha2
kubernetes/kubernetes#110618

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix typo in container registry domain (openshift#44)

* Update go mod to security vulnerability

Update golang.org/x/text to v0.3.8 for vulnerability.

* Fix github action

* Update vendors to fix dependabot alerts

* Add ipblock bat tests in e2e (openshift#48)

This change introduces ipblock tests in e2e and enables v6
ingress tests in e2e as well.

* Fix iptables rules in multiple items in ingress/egress (openshift#49)

This change fixes iptables rules for multiple items
in ingress/egress. It also adds e2e tests for that.
fix openshift#45

* Update golang to 1.20

* Fix end2end tests (openshift#53)

* e2e: Save kind logs as artifacts

Saving `kind export logs` output when
end-to-end job fails helps debugging flakes
and test failures.

Signed-off-by: Andrea Panattoni <[email protected]>

* build: set CGO_ENABLED=0

Setting CGO_ENABLED=0 for go builds
produces GLIBC independant binaries.

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Infer PolicyTypes if missing (openshift#50)

* Infer PolicyTypes if missing

In cases where Spec.PolicyTypes is not specified, it should
default to the existence of Ingress or Egress rules.

Updating end2end tests to cover also this scenario.

Signed-off-by: Andrea Panattoni <[email protected]>

* e2e: Wait for policy sync during setup

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Bump google.golang.org/grpc from 1.38.0 to 1.53.0 (openshift#52)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.38.0 to 1.53.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.38.0...v1.53.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update e2e environments (openshift#54)

* Fix linter warning (openshift#55)

* Bump gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0 (openshift#57)

Bumps gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0.

---
updated-dependencies:
- dependency-name: gopkg.in/yaml.v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/containernetworking/plugins from 0.8.5 to 0.8.6 (openshift#56)

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/containernetworking/plugins/releases)
- [Commits](containernetworking/plugins@v0.8.5...v0.8.6)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/plugins
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor and golang version (openshift#58)

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Doug Smith <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lgtm-com[bot] <43144390+lgtm-com[bot]@users.noreply.github.com>
Co-authored-by: LGTM Migrator <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>
Co-authored-by: Peter Stöckli <[email protected]>
zeeke added a commit to zeeke/multus-networkpolicy that referenced this pull request Sep 10, 2024
* Add pod-iptables option to store pod iptables

This change introduces pod-iptables option to store iptables-rules
in pod's network namespace. This helps administrator/engineer to
troubleshooting.

* Fix owners file

* Update CI pipeline

* Add label to Dockerfile

* Update github action to simplify

* Use GITHUB_TOKEN for push packages

* Update slack URL in README

* fix workflows

* Fix some timing issue and change memory limit

* Add namespace check between pod and multi-networkpolicy

* Use TCP as default for Port.Protocol

Add ginkgo test to the suite with only default values.
Add `renderProtocol` function with fallback logic.

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix to work namespacveSelector policy, without labelSelector

* Support for `NamespaceSelector` (openshift#16)

* Add test case for namespace selector

The case is about having two namespaces with pods
and net-attach-def and a multi networkpolicy that
goes through namespace borders.

Signed-off-by: Andrea Panattoni <[email protected]>

* Add test case with net-attach-def in other ns

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve logging in server.go (openshift#19)

* Add object information to update events

This should make it clearer what k8s object the
daemon is working on.

Increase verbosity threshlod for invoke handlers logs.

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve error logging

Signed-off-by: Andrea Panattoni <[email protected]>

* Add IPv6 support in TODO list

* Set specific version for `revive` tool (openshift#20)

"go getting" github.com/mgechev/revive can lead to unreproducible
builds, as it download the latest "dev" version. Stick to the latest
(v1.2.1) version.

Signed-off-by: Andrea Panattoni <[email protected]>

* Log filter rules (openshift#23)

* Log filter rules

Logging iptables rules before applying them
can be useful to debug complex scenarios.
Setting verbosity level to 6 as they can be
quite cumbersome.

Signed-off-by: Andrea Panattoni <[email protected]>

* Clean up logging code

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine policy generation routine to support multiple policies

This change refines policy rule generation to introduce conntrack
and support multiple policies in a pod. Fix openshift#17 and openshift#18

* Fix capabilities (openshift#25)

fix openshift#24

* Update github action to fit to latest golang

* Remove docker from support runtime due to obsolated

* Bump github.com/containernetworking/cni from 0.7.1 to 0.8.1 (openshift#31)

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump vendor packages.

* Graceful shutdown for daemonset (openshift#32)

* Remove unused errCh

`server.Run()` is not a blocking function and returns always `nil`.
There is no need for a struct field channel.

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow stopping the server

Add signal handler for SIGTERM and SIGINT to main.go.
Add Stop() method to Options to forward os signals.
Add a channel to stop `syncRunner` and clean iptables afterward.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add sync-period option for fast sync

* Remove deprecated parameters in deploy.yml

* Add e2e test

* e2e-test: Add script to update server image (openshift#35)

Add a script to redeploy the server in the kind cluster. It is
useful to quickly test new changes without tearing down the
cluster and bringing it up again.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix yaml syntax error in GH workflow (openshift#36)

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add CodeQL workflow for GitHub code scanning (openshift#38)

Co-authored-by: LGTM Migrator <[email protected]>

* Add NOTICE file for Apache license 2.0 (openshift#39)

This change adds NOTICE file in repository as [1].

[1]: https://infra.apache.org/apply-license.html#new

* IPv6 support in multi-networkpolicy-iptables (openshift#40)

* Support IPv6 networks (openshift#27)

Make Server generates rules for both IP family.
Make iptableBuffer aware of the IP family it is managing, in
order to skip wrong addresses.

Add unit and e2e tests for IPv6 and dual stack networks.

Remove IPv6 item from TODO

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* fix merge-conflict to rebase

* Add e2e ipv6 ingress tests

* IPv6 fix  for NDP and DHCPv6 (openshift#37)

* Add Requirements section to README

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow ipv6 Neighbor Discovery Protocol

NDP leverages icmpv6 packets to discover hosts
IPv6 addresses. This kind of packet must be allowed
between hosts, otherwise some policy-allowed traffic
may get blocked.

Adjust unit tests expected output strings.

See https://www.rfc-editor.org/rfc/rfc2373

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow DHCPv6 traffic

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine icmp/dhcpv6 code

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Tomofumi Hayashi <[email protected]>

* Use string instead of byte in unit-test cases

In real code, use bytes for performance, however, we don't care
about performance for unit-test, hence change bytes to string
for ease of troubleshooting.

* Make INGRESS/EGRESS-COMMON configurable by command line option

This change makes MULTI-{INGRESS,EGRESS}-COMMON chain configurable
to provide a way to support various v4/v6 network.

* Fix CodeQL warnings

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Wait for sync between policy/iptables in e2e tests

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>

* Fix github action

* Avoid using cri-api `v1alpha2` (openshift#43)

As of v1.26.0 kubernetes removed support for api cri-api
v1alpha2
kubernetes/kubernetes#110618

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix typo in container registry domain (openshift#44)

* Update go mod to security vulnerability

Update golang.org/x/text to v0.3.8 for vulnerability.

* Fix github action

* Update vendors to fix dependabot alerts

* Add ipblock bat tests in e2e (openshift#48)

This change introduces ipblock tests in e2e and enables v6
ingress tests in e2e as well.

* Fix iptables rules in multiple items in ingress/egress (openshift#49)

This change fixes iptables rules for multiple items
in ingress/egress. It also adds e2e tests for that.
fix openshift#45

* Update golang to 1.20

* Fix end2end tests (openshift#53)

* e2e: Save kind logs as artifacts

Saving `kind export logs` output when
end-to-end job fails helps debugging flakes
and test failures.

Signed-off-by: Andrea Panattoni <[email protected]>

* build: set CGO_ENABLED=0

Setting CGO_ENABLED=0 for go builds
produces GLIBC independant binaries.

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Infer PolicyTypes if missing (openshift#50)

* Infer PolicyTypes if missing

In cases where Spec.PolicyTypes is not specified, it should
default to the existence of Ingress or Egress rules.

Updating end2end tests to cover also this scenario.

Signed-off-by: Andrea Panattoni <[email protected]>

* e2e: Wait for policy sync during setup

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Bump google.golang.org/grpc from 1.38.0 to 1.53.0 (openshift#52)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.38.0 to 1.53.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.38.0...v1.53.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update e2e environments (openshift#54)

* Fix linter warning (openshift#55)

* Bump gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0 (openshift#57)

Bumps gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0.

---
updated-dependencies:
- dependency-name: gopkg.in/yaml.v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/containernetworking/plugins from 0.8.5 to 0.8.6 (openshift#56)

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/containernetworking/plugins/releases)
- [Commits](containernetworking/plugins@v0.8.5...v0.8.6)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/plugins
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor and golang version (openshift#58)

* Bump google.golang.org/grpc from 1.53.0 to 1.56.3 (openshift#59)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.53.0 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.53.0...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor packages (openshift#60)

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Doug Smith <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lgtm-com[bot] <43144390+lgtm-com[bot]@users.noreply.github.com>
Co-authored-by: LGTM Migrator <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>
Co-authored-by: Peter Stöckli <[email protected]>
zeeke added a commit to zeeke/multus-networkpolicy that referenced this pull request Sep 10, 2024
* Add pod-iptables option to store pod iptables

This change introduces pod-iptables option to store iptables-rules
in pod's network namespace. This helps administrator/engineer to
troubleshooting.

* Fix owners file

* Update CI pipeline

* Add label to Dockerfile

* Update github action to simplify

* Use GITHUB_TOKEN for push packages

* Update slack URL in README

* fix workflows

* Fix some timing issue and change memory limit

* Add namespace check between pod and multi-networkpolicy

* Use TCP as default for Port.Protocol

Add ginkgo test to the suite with only default values.
Add `renderProtocol` function with fallback logic.

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix to work namespacveSelector policy, without labelSelector

* Support for `NamespaceSelector` (openshift#16)

* Add test case for namespace selector

The case is about having two namespaces with pods
and net-attach-def and a multi networkpolicy that
goes through namespace borders.

Signed-off-by: Andrea Panattoni <[email protected]>

* Add test case with net-attach-def in other ns

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve logging in server.go (openshift#19)

* Add object information to update events

This should make it clearer what k8s object the
daemon is working on.

Increase verbosity threshlod for invoke handlers logs.

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve error logging

Signed-off-by: Andrea Panattoni <[email protected]>

* Add IPv6 support in TODO list

* Set specific version for `revive` tool (openshift#20)

"go getting" github.com/mgechev/revive can lead to unreproducible
builds, as it download the latest "dev" version. Stick to the latest
(v1.2.1) version.

Signed-off-by: Andrea Panattoni <[email protected]>

* Log filter rules (openshift#23)

* Log filter rules

Logging iptables rules before applying them
can be useful to debug complex scenarios.
Setting verbosity level to 6 as they can be
quite cumbersome.

Signed-off-by: Andrea Panattoni <[email protected]>

* Clean up logging code

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine policy generation routine to support multiple policies

This change refines policy rule generation to introduce conntrack
and support multiple policies in a pod. Fix openshift#17 and openshift#18

* Fix capabilities (openshift#25)

fix openshift#24

* Update github action to fit to latest golang

* Remove docker from support runtime due to obsolated

* Bump github.com/containernetworking/cni from 0.7.1 to 0.8.1 (openshift#31)

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump vendor packages.

* Graceful shutdown for daemonset (openshift#32)

* Remove unused errCh

`server.Run()` is not a blocking function and returns always `nil`.
There is no need for a struct field channel.

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow stopping the server

Add signal handler for SIGTERM and SIGINT to main.go.
Add Stop() method to Options to forward os signals.
Add a channel to stop `syncRunner` and clean iptables afterward.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add sync-period option for fast sync

* Remove deprecated parameters in deploy.yml

* Add e2e test

* e2e-test: Add script to update server image (openshift#35)

Add a script to redeploy the server in the kind cluster. It is
useful to quickly test new changes without tearing down the
cluster and bringing it up again.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix yaml syntax error in GH workflow (openshift#36)

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add CodeQL workflow for GitHub code scanning (openshift#38)

Co-authored-by: LGTM Migrator <[email protected]>

* Add NOTICE file for Apache license 2.0 (openshift#39)

This change adds NOTICE file in repository as [1].

[1]: https://infra.apache.org/apply-license.html#new

* IPv6 support in multi-networkpolicy-iptables (openshift#40)

* Support IPv6 networks (openshift#27)

Make Server generates rules for both IP family.
Make iptableBuffer aware of the IP family it is managing, in
order to skip wrong addresses.

Add unit and e2e tests for IPv6 and dual stack networks.

Remove IPv6 item from TODO

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* fix merge-conflict to rebase

* Add e2e ipv6 ingress tests

* IPv6 fix  for NDP and DHCPv6 (openshift#37)

* Add Requirements section to README

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow ipv6 Neighbor Discovery Protocol

NDP leverages icmpv6 packets to discover hosts
IPv6 addresses. This kind of packet must be allowed
between hosts, otherwise some policy-allowed traffic
may get blocked.

Adjust unit tests expected output strings.

See https://www.rfc-editor.org/rfc/rfc2373

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow DHCPv6 traffic

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine icmp/dhcpv6 code

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Tomofumi Hayashi <[email protected]>

* Use string instead of byte in unit-test cases

In real code, use bytes for performance, however, we don't care
about performance for unit-test, hence change bytes to string
for ease of troubleshooting.

* Make INGRESS/EGRESS-COMMON configurable by command line option

This change makes MULTI-{INGRESS,EGRESS}-COMMON chain configurable
to provide a way to support various v4/v6 network.

* Fix CodeQL warnings

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Wait for sync between policy/iptables in e2e tests

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>

* Fix github action

* Avoid using cri-api `v1alpha2` (openshift#43)

As of v1.26.0 kubernetes removed support for api cri-api
v1alpha2
kubernetes/kubernetes#110618

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix typo in container registry domain (openshift#44)

* Update go mod to security vulnerability

Update golang.org/x/text to v0.3.8 for vulnerability.

* Fix github action

* Update vendors to fix dependabot alerts

* Add ipblock bat tests in e2e (openshift#48)

This change introduces ipblock tests in e2e and enables v6
ingress tests in e2e as well.

* Fix iptables rules in multiple items in ingress/egress (openshift#49)

This change fixes iptables rules for multiple items
in ingress/egress. It also adds e2e tests for that.
fix openshift#45

* Update golang to 1.20

* Fix end2end tests (openshift#53)

* e2e: Save kind logs as artifacts

Saving `kind export logs` output when
end-to-end job fails helps debugging flakes
and test failures.

Signed-off-by: Andrea Panattoni <[email protected]>

* build: set CGO_ENABLED=0

Setting CGO_ENABLED=0 for go builds
produces GLIBC independant binaries.

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Infer PolicyTypes if missing (openshift#50)

* Infer PolicyTypes if missing

In cases where Spec.PolicyTypes is not specified, it should
default to the existence of Ingress or Egress rules.

Updating end2end tests to cover also this scenario.

Signed-off-by: Andrea Panattoni <[email protected]>

* e2e: Wait for policy sync during setup

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Bump google.golang.org/grpc from 1.38.0 to 1.53.0 (openshift#52)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.38.0 to 1.53.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.38.0...v1.53.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update e2e environments (openshift#54)

* Fix linter warning (openshift#55)

* Bump gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0 (openshift#57)

Bumps gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0.

---
updated-dependencies:
- dependency-name: gopkg.in/yaml.v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/containernetworking/plugins from 0.8.5 to 0.8.6 (openshift#56)

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/containernetworking/plugins/releases)
- [Commits](containernetworking/plugins@v0.8.5...v0.8.6)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/plugins
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor and golang version (openshift#58)

* Bump google.golang.org/grpc from 1.53.0 to 1.56.3 (openshift#59)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.53.0 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.53.0...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor packages (openshift#60)

* Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 (openshift#61)

Bumps google.golang.org/protobuf from 1.30.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix github workflow and deploy yaml

* Fix e2e

* Bump k8s API version (openshift#63)

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Doug Smith <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lgtm-com[bot] <43144390+lgtm-com[bot]@users.noreply.github.com>
Co-authored-by: LGTM Migrator <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>
Co-authored-by: Peter Stöckli <[email protected]>
openshift-merge-bot bot pushed a commit that referenced this pull request Oct 31, 2024
* Add pod-iptables option to store pod iptables

This change introduces pod-iptables option to store iptables-rules
in pod's network namespace. This helps administrator/engineer to
troubleshooting.

* Fix owners file

* Update CI pipeline

* Add label to Dockerfile

* Update github action to simplify

* Use GITHUB_TOKEN for push packages

* Update slack URL in README

* fix workflows

* Fix some timing issue and change memory limit

* Add namespace check between pod and multi-networkpolicy

* Use TCP as default for Port.Protocol

Add ginkgo test to the suite with only default values.
Add `renderProtocol` function with fallback logic.

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix to work namespacveSelector policy, without labelSelector

* Support for `NamespaceSelector` (#16)

* Add test case for namespace selector

The case is about having two namespaces with pods
and net-attach-def and a multi networkpolicy that
goes through namespace borders.

Signed-off-by: Andrea Panattoni <[email protected]>

* Add test case with net-attach-def in other ns

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve logging in server.go (#19)

* Add object information to update events

This should make it clearer what k8s object the
daemon is working on.

Increase verbosity threshlod for invoke handlers logs.

Signed-off-by: Andrea Panattoni <[email protected]>

* Improve error logging

Signed-off-by: Andrea Panattoni <[email protected]>

* Add IPv6 support in TODO list

* Set specific version for `revive` tool (#20)

"go getting" github.com/mgechev/revive can lead to unreproducible
builds, as it download the latest "dev" version. Stick to the latest
(v1.2.1) version.

Signed-off-by: Andrea Panattoni <[email protected]>

* Log filter rules (#23)

* Log filter rules

Logging iptables rules before applying them
can be useful to debug complex scenarios.
Setting verbosity level to 6 as they can be
quite cumbersome.

Signed-off-by: Andrea Panattoni <[email protected]>

* Clean up logging code

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine policy generation routine to support multiple policies

This change refines policy rule generation to introduce conntrack
and support multiple policies in a pod. Fix #17 and #18

* Fix capabilities (#25)

fix #24

* Update github action to fit to latest golang

* Remove docker from support runtime due to obsolated

* Bump github.com/containernetworking/cni from 0.7.1 to 0.8.1 (#31)

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump vendor packages.

* Graceful shutdown for daemonset (#32)

* Remove unused errCh

`server.Run()` is not a blocking function and returns always `nil`.
There is no need for a struct field channel.

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow stopping the server

Add signal handler for SIGTERM and SIGINT to main.go.
Add Stop() method to Options to forward os signals.
Add a channel to stop `syncRunner` and clean iptables afterward.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add sync-period option for fast sync

* Remove deprecated parameters in deploy.yml

* Add e2e test

* e2e-test: Add script to update server image (#35)

Add a script to redeploy the server in the kind cluster. It is
useful to quickly test new changes without tearing down the
cluster and bringing it up again.

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix yaml syntax error in GH workflow (#36)

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* Add CodeQL workflow for GitHub code scanning (#38)

Co-authored-by: LGTM Migrator <[email protected]>

* Add NOTICE file for Apache license 2.0 (#39)

This change adds NOTICE file in repository as [1].

[1]: https://infra.apache.org/apply-license.html#new

* IPv6 support in multi-networkpolicy-iptables (#40)

* Support IPv6 networks (#27)

Make Server generates rules for both IP family.
Make iptableBuffer aware of the IP family it is managing, in
order to skip wrong addresses.

Add unit and e2e tests for IPv6 and dual stack networks.

Remove IPv6 item from TODO

Signed-off-by: Andrea Panattoni <[email protected]>

Signed-off-by: Andrea Panattoni <[email protected]>

* fix merge-conflict to rebase

* Add e2e ipv6 ingress tests

* IPv6 fix  for NDP and DHCPv6 (#37)

* Add Requirements section to README

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow ipv6 Neighbor Discovery Protocol

NDP leverages icmpv6 packets to discover hosts
IPv6 addresses. This kind of packet must be allowed
between hosts, otherwise some policy-allowed traffic
may get blocked.

Adjust unit tests expected output strings.

See https://www.rfc-editor.org/rfc/rfc2373

Signed-off-by: Andrea Panattoni <[email protected]>

* Allow DHCPv6 traffic

Signed-off-by: Andrea Panattoni <[email protected]>

* Refine icmp/dhcpv6 code

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Tomofumi Hayashi <[email protected]>

* Use string instead of byte in unit-test cases

In real code, use bytes for performance, however, we don't care
about performance for unit-test, hence change bytes to string
for ease of troubleshooting.

* Make INGRESS/EGRESS-COMMON configurable by command line option

This change makes MULTI-{INGRESS,EGRESS}-COMMON chain configurable
to provide a way to support various v4/v6 network.

* Fix CodeQL warnings

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Update docs/configurations.md

Co-authored-by: Nikhil Simha <[email protected]>

* Wait for sync between policy/iptables in e2e tests

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Co-authored-by: Andrea Panattoni <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>

* Fix github action

* Avoid using cri-api `v1alpha2` (#43)

As of v1.26.0 kubernetes removed support for api cri-api
v1alpha2
kubernetes/kubernetes#110618

Signed-off-by: Andrea Panattoni <[email protected]>

* Fix typo in container registry domain (#44)

* Update go mod to security vulnerability

Update golang.org/x/text to v0.3.8 for vulnerability.

* Fix github action

* Update vendors to fix dependabot alerts

* Add ipblock bat tests in e2e (#48)

This change introduces ipblock tests in e2e and enables v6
ingress tests in e2e as well.

* Fix iptables rules in multiple items in ingress/egress (#49)

This change fixes iptables rules for multiple items
in ingress/egress. It also adds e2e tests for that.
fix #45

* Update golang to 1.20

* Fix end2end tests (#53)

* e2e: Save kind logs as artifacts

Saving `kind export logs` output when
end-to-end job fails helps debugging flakes
and test failures.

Signed-off-by: Andrea Panattoni <[email protected]>

* build: set CGO_ENABLED=0

Setting CGO_ENABLED=0 for go builds
produces GLIBC independant binaries.

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Infer PolicyTypes if missing (#50)

* Infer PolicyTypes if missing

In cases where Spec.PolicyTypes is not specified, it should
default to the existence of Ingress or Egress rules.

Updating end2end tests to cover also this scenario.

Signed-off-by: Andrea Panattoni <[email protected]>

* e2e: Wait for policy sync during setup

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>

* Bump google.golang.org/grpc from 1.38.0 to 1.53.0 (#52)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.38.0 to 1.53.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.38.0...v1.53.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update e2e environments (#54)

* Fix linter warning (#55)

* Bump gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0 (#57)

Bumps gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0.

---
updated-dependencies:
- dependency-name: gopkg.in/yaml.v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/containernetworking/plugins from 0.8.5 to 0.8.6 (#56)

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/containernetworking/plugins/releases)
- [Commits](containernetworking/plugins@v0.8.5...v0.8.6)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/plugins
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor and golang version (#58)

* Bump google.golang.org/grpc from 1.53.0 to 1.56.3 (#59)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.53.0 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.53.0...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update vendor packages (#60)

* Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 (#61)

Bumps google.golang.org/protobuf from 1.30.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix github workflow and deploy yaml

* Fix e2e

* Bump k8s API version (#63)

* Make sure that policies with no valid peers are enforced

If a policy rule has a `from` (or `to`) selector that matches no pods,
the subject pod has to not be reached by  (or has to not reach) any pods.

The following example helps clarify the reasons behind these:
Given a scenario  with 3 pods (A, B, C) and a rule like:
```
podSelector:
    matchLabels:
      name: A
  ingress:
  - from:
    - podSelector:
        matchLabels:
          name: B
  policyTypes:
  - Ingress
```
Pod A can be reached only by pod B. Pod C can't reach A, and this has to be
ensured even if pod B is deleted.

Add an end-to-end test case to validate this scenario and adjust unit
tests accordingly.

Signed-off-by: Andrea Panattoni <[email protected]>

* Run all e2e tests in `./e2e/tests/*.bats`

Signed-off-by: Andrea Panattoni <[email protected]>

* ds: Remove mpty lines in Dockerfile

Signed-off-by: Andrea Panattoni <[email protected]>

---------

Signed-off-by: Andrea Panattoni <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Tomofumi Hayashi <[email protected]>
Co-authored-by: Doug Smith <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lgtm-com[bot] <43144390+lgtm-com[bot]@users.noreply.github.com>
Co-authored-by: LGTM Migrator <[email protected]>
Co-authored-by: Nikhil Simha <[email protected]>
Co-authored-by: Peter Stöckli <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.