Kindnet network policies

images/kindnetd/Dockerfile

@@ -34,7 +34,7 @@ RUN eval "$(gimme "${GO_VERSION}")" \
     && GOARCH=$TARGETARCH go-licenses save --save_path=/_LICENSES ./cmd/kindnetd
 
 # build real kindnetd image
-FROM registry.k8s.io/build-image/distroless-iptables:v0.2.3
+FROM registry.k8s.io/build-image/distroless-iptables:v0.5.5
 COPY --from=0 --chown=root:root ./go/src/kindnetd /bin/kindnetd
 COPY --from=0 /_LICENSES/* /LICENSES/
 COPY --chmod=0644 files/LICENSES/* /LICENSES/*

images/kindnetd/cmd/kindnetd/cni.go

@@ -38,7 +38,7 @@ type CNIConfigInputs struct {
 }
 
 // ComputeCNIConfigInputs computes the template inputs for CNIConfigWriter
-func ComputeCNIConfigInputs(node corev1.Node) CNIConfigInputs {
+func ComputeCNIConfigInputs(node *corev1.Node) CNIConfigInputs {
 
 	defaultRoutes := []string{"0.0.0.0/0", "::/0"}
 	// check if is a dualstack cluster

images/kindnetd/cmd/kindnetd/main.go

@@ -22,17 +22,21 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"os/signal"
 	"strings"
 	"syscall"
 	"time"
 
-	"k8s.io/apimachinery/pkg/util/sets"
+	"golang.org/x/sys/unix"
 
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
+	"sigs.k8s.io/kube-network-policies/pkg/networkpolicy"
 )
 
 const (
@@ -75,6 +79,9 @@ func main() {
 	if err != nil {
 		panic(err.Error())
 	}
+	// use protobuf to improve performance
+	config.AcceptContentTypes = "application/vnd.kubernetes.protobuf,application/json"
+	config.ContentType = "application/vnd.kubernetes.protobuf"
 
 	// override the internal apiserver endpoint to avoid
 	// waiting for kube-proxy to install the services rules.
@@ -101,6 +108,31 @@ func main() {
 	}
 	klog.Infof("connected to apiserver: %s", config.Host)
 
+	// trap Ctrl+C and call cancel on the context
+	ctx := context.Background()
+	ctx, cancel := context.WithCancel(ctx)
+
+	// Enable signal handler
+	signalCh := make(chan os.Signal, 2)
+	defer func() {
+		close(signalCh)
+		cancel()
+	}()
+	signal.Notify(signalCh, os.Interrupt, unix.SIGINT)
+
+	go func() {
+		select {
+		case <-signalCh:
+			klog.Infof("Exiting: received signal")
+			cancel()
+		case <-ctx.Done():
+		}
+	}()
+
+	informersFactory := informers.NewSharedInformerFactory(clientset, 0)
+	nodeInformer := informersFactory.Core().V1().Nodes()
+	nodeLister := nodeInformer.Lister()
+
 	// obtain the host and pod ip addresses
 	// if both ips are different we are not using the host network
 	hostIP, podIP := os.Getenv("HOST_IP"), os.Getenv("POD_IP")
@@ -153,7 +185,7 @@ func main() {
 			panic(err.Error())
 		}
 		go func() {
-			if err := masqAgentIPv4.SyncRulesForever(time.Second * 60); err != nil {
+			if err := masqAgentIPv4.SyncRulesForever(ctx, time.Second*60); err != nil {
 				panic(err)
 			}
 		}()
@@ -168,7 +200,7 @@ func main() {
 		}
 
 		go func() {
-			if err := masqAgentIPv6.SyncRulesForever(time.Second * 60); err != nil {
+			if err := masqAgentIPv6.SyncRulesForever(ctx, time.Second*60); err != nil {
 				panic(err)
 			}
 		}()
@@ -177,14 +209,48 @@ func main() {
 	// setup nodes reconcile function, closes over arguments
 	reconcileNodes := makeNodesReconciler(cniConfigWriter, hostIP, ipFamily)
 
+	// network policies
+
+	// on kind nodes the hostname matches the node name
+	nodeName, err := os.Hostname()
+	if err != nil {
+		klog.Fatalf("couldn't determine hostname: %v", err)
+	}
+
+	cfg := networkpolicy.Config{
+		FailOpen: true,
+		QueueID:  100,
+		NodeName: nodeName,
+	}
+
+	networkPolicyController, err := networkpolicy.NewController(
+		clientset,
+		informersFactory.Networking().V1().NetworkPolicies(),
+		informersFactory.Core().V1().Namespaces(),
+		informersFactory.Core().V1().Pods(),
+		nodeInformer,
+		nil,
+		nil,
+		nil,
+		cfg)
+	if err != nil {
+		klog.Infof("Error creating network policy controller: %v, skipping network policies", err)
+	} else {
+		go func() {
+			_ = networkPolicyController.Run(ctx)
+		}()
+	}
+
 	// main control loop
+	informersFactory.Start(ctx.Done())
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
 	for {
-		// Gets the Nodes information from the API
-		// TODO: use a proper controller instead
-		var nodes *corev1.NodeList
+		var nodes []*corev1.Node
 		var err error
 		for i := 0; i < 5; i++ {
-			nodes, err = clientset.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
+			nodes, err = nodeLister.List(labels.Everything())
 			if err == nil {
 				break
 			}
@@ -209,14 +275,20 @@ func main() {
 		}
 
 		// rate limit
-		time.Sleep(10 * time.Second)
+		select {
+		case <-ctx.Done():
+			// grace period to cleanup resources
+			time.Sleep(1 * time.Second)
+			return
+		case <-ticker.C:
+		}
 	}
 }
 
 // nodeNodesReconciler returns a reconciliation func for nodes
-func makeNodesReconciler(cniConfig *CNIConfigWriter, hostIP string, ipFamily IPFamily) func(*corev1.NodeList) error {
+func makeNodesReconciler(cniConfig *CNIConfigWriter, hostIP string, ipFamily IPFamily) func([]*corev1.Node) error {
 	// reconciles a node
-	reconcileNode := func(node corev1.Node) error {
+	reconcileNode := func(node *corev1.Node) error {
 		// first get this node's IPs
 		// we don't support more than one IP address per IP family for simplification
 		nodeIPs := internalIPs(node)
@@ -252,7 +324,7 @@ func makeNodesReconciler(cniConfig *CNIConfigWriter, hostIP string, ipFamily IPF
 
 		// obtain the PodCIDR gateway
 		var nodeIPv4, nodeIPv6 string
-		for _, ip := range sets.List(nodeIPs) {
+		for _, ip := range nodeIPs.UnsortedList() {
 			if isIPv6String(ip) {
 				nodeIPv6 = ip
 			} else {
@@ -274,8 +346,8 @@ func makeNodesReconciler(cniConfig *CNIConfigWriter, hostIP string, ipFamily IPF
 	}
 
 	// return a reconciler for all the nodes
-	return func(nodes *corev1.NodeList) error {
-		for _, node := range nodes.Items {
+	return func(nodes []*corev1.Node) error {
+		for _, node := range nodes {
 			if err := reconcileNode(node); err != nil {
 				return err
 			}
@@ -285,7 +357,7 @@ func makeNodesReconciler(cniConfig *CNIConfigWriter, hostIP string, ipFamily IPF
 }
 
 // internalIPs returns the internal IP addresses for node
-func internalIPs(node corev1.Node) sets.Set[string] {
+func internalIPs(node *corev1.Node) sets.Set[string] {
 	ips := sets.New[string]()
 	// check the node.Status.Addresses
 	for _, address := range node.Status.Addresses {

images/kindnetd/cmd/kindnetd/masq.go

@@ -17,6 +17,7 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"fmt"
 	"time"
 
@@ -55,8 +56,11 @@ type IPMasqAgent struct {
 // these rules only needs to be installed once, but we run it periodically to check that are
 // not deleted by an external program. It fails if can't sync the rules during 3 iterations
 // TODO: aggregate errors
-func (ma *IPMasqAgent) SyncRulesForever(interval time.Duration) error {
+func (ma *IPMasqAgent) SyncRulesForever(ctx context.Context, interval time.Duration) error {
 	errs := 0
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
 	for {
 		if err := ma.SyncRules(); err != nil {
 			errs++
@@ -66,7 +70,10 @@ func (ma *IPMasqAgent) SyncRulesForever(interval time.Duration) error {
 		} else {
 			errs = 0
 		}
-		time.Sleep(interval)
+		select {
+		case <-ctx.Done():
+		case <-ticker.C:
+		}
 	}
 }
 

images/kindnetd/go.mod

@@ -1,49 +1,64 @@
 module sigs.k8s.io/kind/images/kindnetd
 
-go 1.21
+go 1.22.0
 
 require (
 	github.com/coreos/go-iptables v0.7.0
 	github.com/vishvananda/netlink v1.1.0
-	k8s.io/api v0.29.0
-	k8s.io/apimachinery v0.29.0
-	k8s.io/client-go v0.29.0
-	k8s.io/klog/v2 v2.110.1
+	golang.org/x/sys v0.22.0
+	k8s.io/api v0.30.2
+	k8s.io/apimachinery v0.30.2
+	k8s.io/client-go v0.30.2
+	k8s.io/klog/v2 v2.130.1
+	sigs.k8s.io/kube-network-policies v0.5.0
 )
 
 require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/go-logr/logr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/florianl/go-nfqueue v1.3.2 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/uuid v1.3.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.53.0 // indirect
+	github.com/prometheus/procfs v0.14.0 // indirect
 	github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/oauth2 v0.10.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	golang.org/x/net v0.24.0 // indirect
+	golang.org/x/oauth2 v0.19.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/term v0.19.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	k8s.io/kube-openapi v0.0.0-20240411171206-dc4e619f62f3 // indirect
+	k8s.io/utils v0.0.0-20240310230437-4693a0247e57 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/knftables v0.0.16 // indirect
+	sigs.k8s.io/network-policy-api v0.1.5 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )