mirror of
https://github.com/outbackdingo/kubernetes.git
synced 2026-02-25 04:10:43 +00:00
Update k8s.io/utils dependency and use ebtables from there
This commit is contained in:
Luigi Bitonti
@@ -27,7 +27,6 @@ go_library(
|
||||
"//pkg/kubelet/dockershim/network:go_default_library",
|
||||
"//pkg/kubelet/dockershim/network/hostport:go_default_library",
|
||||
"//pkg/util/bandwidth:go_default_library",
|
||||
"//pkg/util/ebtables:go_default_library",
|
||||
"//pkg/util/iptables:go_default_library",
|
||||
"//pkg/util/sysctl:go_default_library",
|
||||
"//staging/src/k8s.io/apimachinery/pkg/util/errors:go_default_library",
|
||||
@@ -42,6 +41,7 @@ go_library(
|
||||
"//vendor/k8s.io/klog/v2:go_default_library",
|
||||
"//vendor/k8s.io/utils/exec:go_default_library",
|
||||
"//vendor/k8s.io/utils/net:go_default_library",
|
||||
"//vendor/k8s.io/utils/net/ebtables:go_default_library",
|
||||
],
|
||||
"@io_bazel_rules_go//go/platform:darwin": [
|
||||
"//pkg/kubelet/apis/config:go_default_library",
|
||||
@@ -80,7 +80,6 @@ go_library(
|
||||
"//pkg/kubelet/dockershim/network:go_default_library",
|
||||
"//pkg/kubelet/dockershim/network/hostport:go_default_library",
|
||||
"//pkg/util/bandwidth:go_default_library",
|
||||
"//pkg/util/ebtables:go_default_library",
|
||||
"//pkg/util/iptables:go_default_library",
|
||||
"//pkg/util/sysctl:go_default_library",
|
||||
"//staging/src/k8s.io/apimachinery/pkg/util/errors:go_default_library",
|
||||
@@ -95,6 +94,7 @@ go_library(
|
||||
"//vendor/k8s.io/klog/v2:go_default_library",
|
||||
"//vendor/k8s.io/utils/exec:go_default_library",
|
||||
"//vendor/k8s.io/utils/net:go_default_library",
|
||||
"//vendor/k8s.io/utils/net/ebtables:go_default_library",
|
||||
],
|
||||
"@io_bazel_rules_go//go/platform:nacl": [
|
||||
"//pkg/kubelet/apis/config:go_default_library",
|
||||
|
||||
@@ -41,10 +41,10 @@ import (
|
||||
"k8s.io/kubernetes/pkg/kubelet/dockershim/network"
|
||||
"k8s.io/kubernetes/pkg/kubelet/dockershim/network/hostport"
|
||||
"k8s.io/kubernetes/pkg/util/bandwidth"
|
||||
utilebtables "k8s.io/kubernetes/pkg/util/ebtables"
|
||||
utiliptables "k8s.io/kubernetes/pkg/util/iptables"
|
||||
utilsysctl "k8s.io/kubernetes/pkg/util/sysctl"
|
||||
utilexec "k8s.io/utils/exec"
|
||||
utilebtables "k8s.io/utils/net/ebtables"
|
||||
|
||||
utilfeature "k8s.io/apiserver/pkg/util/feature"
|
||||
kubefeatures "k8s.io/kubernetes/pkg/features"
|
||||
|
||||
@@ -16,7 +16,6 @@ filegroup(
|
||||
"//pkg/util/config:all-srcs",
|
||||
"//pkg/util/conntrack:all-srcs",
|
||||
"//pkg/util/coverage:all-srcs",
|
||||
"//pkg/util/ebtables:all-srcs",
|
||||
"//pkg/util/env:all-srcs",
|
||||
"//pkg/util/filesystem:all-srcs",
|
||||
"//pkg/util/flag:all-srcs",
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
package(default_visibility = ["//visibility:public"])
|
||||
|
||||
load(
|
||||
"@io_bazel_rules_go//go:def.bzl",
|
||||
"go_library",
|
||||
"go_test",
|
||||
)
|
||||
|
||||
go_library(
|
||||
name = "go_default_library",
|
||||
srcs = ["ebtables.go"],
|
||||
importpath = "k8s.io/kubernetes/pkg/util/ebtables",
|
||||
deps = ["//vendor/k8s.io/utils/exec:go_default_library"],
|
||||
)
|
||||
|
||||
go_test(
|
||||
name = "go_default_test",
|
||||
srcs = ["ebtables_test.go"],
|
||||
embed = [":go_default_library"],
|
||||
deps = [
|
||||
"//vendor/k8s.io/utils/exec:go_default_library",
|
||||
"//vendor/k8s.io/utils/exec/testing:go_default_library",
|
||||
],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
)
|
||||
@@ -1,8 +0,0 @@
|
||||
# See the OWNERS docs at https://go.k8s.io/owners
|
||||
|
||||
reviewers:
|
||||
- sig-network-reviewers
|
||||
approvers:
|
||||
- sig-network-approvers
|
||||
labels:
|
||||
- sig/network
|
||||
@@ -1,213 +0,0 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package ebtables
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
utilexec "k8s.io/utils/exec"
|
||||
)
|
||||
|
||||
const (
|
||||
cmdebtables = "ebtables"
|
||||
|
||||
// Flag to show full mac in output. The default representation omits leading zeroes.
|
||||
fullMac = "--Lmac2"
|
||||
)
|
||||
|
||||
type RulePosition string
|
||||
|
||||
const (
|
||||
Prepend RulePosition = "-I"
|
||||
Append RulePosition = "-A"
|
||||
)
|
||||
|
||||
type Table string
|
||||
|
||||
const (
|
||||
TableNAT Table = "nat"
|
||||
TableFilter Table = "filter"
|
||||
TableBroute Table = "broute"
|
||||
)
|
||||
|
||||
type Chain string
|
||||
|
||||
const (
|
||||
ChainPostrouting Chain = "POSTROUTING"
|
||||
ChainPrerouting Chain = "PREROUTING"
|
||||
ChainOutput Chain = "OUTPUT"
|
||||
ChainInput Chain = "INPUT"
|
||||
ChainBrouting Chain = "BROUTING"
|
||||
)
|
||||
|
||||
type operation string
|
||||
|
||||
const (
|
||||
opCreateChain operation = "-N"
|
||||
opFlushChain operation = "-F"
|
||||
opDeleteChain operation = "-X"
|
||||
opListChain operation = "-L"
|
||||
opAppendRule operation = "-A"
|
||||
opPrependRule operation = "-I"
|
||||
opDeleteRule operation = "-D"
|
||||
)
|
||||
|
||||
// An injectable interface for running ebtables commands. Implementations must be goroutine-safe.
|
||||
type Interface interface {
|
||||
// GetVersion returns the "X.Y.Z" semver string for ebtables.
|
||||
GetVersion() (string, error)
|
||||
// EnsureRule checks if the specified rule is present and, if not, creates it. If the rule existed, return true.
|
||||
// WARNING: ebtables does not provide check operation like iptables do. Hence we have to do a string match of args.
|
||||
// Input args must follow the format and sequence of ebtables list output. Otherwise, EnsureRule will always create
|
||||
// new rules and causing duplicates.
|
||||
EnsureRule(position RulePosition, table Table, chain Chain, args ...string) (bool, error)
|
||||
// DeleteRule checks if the specified rule is present and, if so, deletes it.
|
||||
DeleteRule(table Table, chain Chain, args ...string) error
|
||||
// EnsureChain checks if the specified chain is present and, if not, creates it. If the rule existed, return true.
|
||||
EnsureChain(table Table, chain Chain) (bool, error)
|
||||
// DeleteChain deletes the specified chain. If the chain did not exist, return error.
|
||||
DeleteChain(table Table, chain Chain) error
|
||||
// FlushChain flush the specified chain. If the chain did not exist, return error.
|
||||
FlushChain(table Table, chain Chain) error
|
||||
}
|
||||
|
||||
// runner implements Interface in terms of exec("ebtables").
|
||||
type runner struct {
|
||||
exec utilexec.Interface
|
||||
}
|
||||
|
||||
// New returns a new Interface which will exec ebtables.
|
||||
func New(exec utilexec.Interface) Interface {
|
||||
runner := &runner{
|
||||
exec: exec,
|
||||
}
|
||||
return runner
|
||||
}
|
||||
|
||||
func makeFullArgs(table Table, op operation, chain Chain, args ...string) []string {
|
||||
return append([]string{"-t", string(table), string(op), string(chain)}, args...)
|
||||
}
|
||||
|
||||
// getEbtablesVersionString runs "ebtables --version" to get the version string
|
||||
// in the form "X.X.X"
|
||||
func getEbtablesVersionString(exec utilexec.Interface) (string, error) {
|
||||
// this doesn't access mutable state so we don't need to use the interface / runner
|
||||
bytes, err := exec.Command(cmdebtables, "--version").CombinedOutput()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
versionMatcher := regexp.MustCompile(`v([0-9]+\.[0-9]+\.[0-9]+)`)
|
||||
match := versionMatcher.FindStringSubmatch(string(bytes))
|
||||
if match == nil {
|
||||
return "", fmt.Errorf("no ebtables version found in string: %s", bytes)
|
||||
}
|
||||
return match[1], nil
|
||||
}
|
||||
|
||||
func (runner *runner) GetVersion() (string, error) {
|
||||
return getEbtablesVersionString(runner.exec)
|
||||
}
|
||||
|
||||
func (runner *runner) EnsureRule(position RulePosition, table Table, chain Chain, args ...string) (bool, error) {
|
||||
exist := true
|
||||
fullArgs := makeFullArgs(table, opListChain, chain, fullMac)
|
||||
out, err := runner.exec.Command(cmdebtables, fullArgs...).CombinedOutput()
|
||||
if err != nil {
|
||||
exist = false
|
||||
} else {
|
||||
exist = checkIfRuleExists(string(out), args...)
|
||||
}
|
||||
if !exist {
|
||||
fullArgs = makeFullArgs(table, operation(position), chain, args...)
|
||||
out, err := runner.exec.Command(cmdebtables, fullArgs...).CombinedOutput()
|
||||
if err != nil {
|
||||
return exist, fmt.Errorf("Failed to ensure rule: %v, output: %v", err, string(out))
|
||||
}
|
||||
}
|
||||
return exist, nil
|
||||
}
|
||||
|
||||
func (runner *runner) DeleteRule(table Table, chain Chain, args ...string) error {
|
||||
exist := true
|
||||
fullArgs := makeFullArgs(table, opListChain, chain, fullMac)
|
||||
out, err := runner.exec.Command(cmdebtables, fullArgs...).CombinedOutput()
|
||||
if err != nil {
|
||||
exist = false
|
||||
} else {
|
||||
exist = checkIfRuleExists(string(out), args...)
|
||||
}
|
||||
|
||||
if !exist {
|
||||
return nil
|
||||
}
|
||||
fullArgs = makeFullArgs(table, opDeleteRule, chain, args...)
|
||||
out, err = runner.exec.Command(cmdebtables, fullArgs...).CombinedOutput()
|
||||
if err != nil {
|
||||
return fmt.Errorf("Failed to delete rule: %v, output: %s", err, out)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (runner *runner) EnsureChain(table Table, chain Chain) (bool, error) {
|
||||
exist := true
|
||||
|
||||
args := makeFullArgs(table, opListChain, chain)
|
||||
_, err := runner.exec.Command(cmdebtables, args...).CombinedOutput()
|
||||
if err != nil {
|
||||
exist = false
|
||||
}
|
||||
if !exist {
|
||||
args = makeFullArgs(table, opCreateChain, chain)
|
||||
out, err := runner.exec.Command(cmdebtables, args...).CombinedOutput()
|
||||
if err != nil {
|
||||
return exist, fmt.Errorf("Failed to ensure %v chain: %v, output: %v", chain, err, string(out))
|
||||
}
|
||||
}
|
||||
return exist, nil
|
||||
}
|
||||
|
||||
// checkIfRuleExists takes the output of ebtables list chain and checks if the input rules exists
|
||||
// WARNING: checkIfRuleExists expects the input args matches the format and sequence of ebtables list output
|
||||
func checkIfRuleExists(listChainOutput string, args ...string) bool {
|
||||
rule := strings.Join(args, " ")
|
||||
for _, line := range strings.Split(listChainOutput, "\n") {
|
||||
if strings.TrimSpace(line) == rule {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (runner *runner) DeleteChain(table Table, chain Chain) error {
|
||||
fullArgs := makeFullArgs(table, opDeleteChain, chain)
|
||||
out, err := runner.exec.Command(cmdebtables, fullArgs...).CombinedOutput()
|
||||
if err != nil {
|
||||
return fmt.Errorf("Failed to delete %v chain %v: %v, output: %v", string(table), string(chain), err, string(out))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (runner *runner) FlushChain(table Table, chain Chain) error {
|
||||
fullArgs := makeFullArgs(table, opFlushChain, chain)
|
||||
out, err := runner.exec.Command(cmdebtables, fullArgs...).CombinedOutput()
|
||||
if err != nil {
|
||||
return fmt.Errorf("Failed to flush %v chain %v: %v, output: %v", string(table), string(chain), err, string(out))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -1,169 +0,0 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package ebtables
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"k8s.io/utils/exec"
|
||||
fakeexec "k8s.io/utils/exec/testing"
|
||||
)
|
||||
|
||||
func TestEnsureChain(t *testing.T) {
|
||||
fcmd := fakeexec.FakeCmd{
|
||||
CombinedOutputScript: []fakeexec.FakeAction{
|
||||
// Does not Exists
|
||||
func() ([]byte, []byte, error) { return nil, nil, &fakeexec.FakeExitError{Status: 1} },
|
||||
// Success
|
||||
func() ([]byte, []byte, error) { return []byte{}, nil, nil },
|
||||
// Exists
|
||||
func() ([]byte, []byte, error) { return nil, nil, nil },
|
||||
// Does not Exists
|
||||
func() ([]byte, []byte, error) { return nil, nil, &fakeexec.FakeExitError{Status: 1} },
|
||||
// Fail to create chain
|
||||
func() ([]byte, []byte, error) { return nil, nil, &fakeexec.FakeExitError{Status: 2} },
|
||||
},
|
||||
}
|
||||
fexec := fakeexec.FakeExec{
|
||||
CommandScript: []fakeexec.FakeCommandAction{
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
},
|
||||
}
|
||||
|
||||
runner := New(&fexec)
|
||||
exists, err := runner.EnsureChain(TableFilter, "TEST-CHAIN")
|
||||
if exists {
|
||||
t.Errorf("expected exists = false")
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("expected err = nil")
|
||||
}
|
||||
|
||||
exists, err = runner.EnsureChain(TableFilter, "TEST-CHAIN")
|
||||
if !exists {
|
||||
t.Errorf("expected exists = true")
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("expected err = nil")
|
||||
}
|
||||
|
||||
exists, err = runner.EnsureChain(TableFilter, "TEST-CHAIN")
|
||||
if exists {
|
||||
t.Errorf("expected exists = false")
|
||||
}
|
||||
errStr := "Failed to ensure TEST-CHAIN chain: exit 2, output:"
|
||||
if err == nil || !strings.Contains(err.Error(), errStr) {
|
||||
t.Errorf("expected error: %q", errStr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureRule(t *testing.T) {
|
||||
fcmd := fakeexec.FakeCmd{
|
||||
CombinedOutputScript: []fakeexec.FakeAction{
|
||||
// Exists
|
||||
func() ([]byte, []byte, error) {
|
||||
return []byte(`Bridge table: filter
|
||||
|
||||
Bridge chain: OUTPUT, entries: 4, policy: ACCEPT
|
||||
-j TEST
|
||||
`), nil, nil
|
||||
},
|
||||
// Does not Exists.
|
||||
func() ([]byte, []byte, error) {
|
||||
return []byte(`Bridge table: filter
|
||||
|
||||
Bridge chain: TEST, entries: 0, policy: ACCEPT`), nil, nil
|
||||
},
|
||||
// Fail to create
|
||||
func() ([]byte, []byte, error) { return nil, nil, &fakeexec.FakeExitError{Status: 2} },
|
||||
},
|
||||
}
|
||||
fexec := fakeexec.FakeExec{
|
||||
CommandScript: []fakeexec.FakeCommandAction{
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
},
|
||||
}
|
||||
|
||||
runner := New(&fexec)
|
||||
|
||||
exists, err := runner.EnsureRule(Append, TableFilter, ChainOutput, "-j", "TEST")
|
||||
if !exists {
|
||||
t.Errorf("expected exists = true")
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("expected err = nil")
|
||||
}
|
||||
|
||||
exists, err = runner.EnsureRule(Append, TableFilter, ChainOutput, "-j", "NEXT-TEST")
|
||||
if exists {
|
||||
t.Errorf("expected exists = false")
|
||||
}
|
||||
errStr := "Failed to ensure rule: exit 2, output: "
|
||||
if err == nil || err.Error() != errStr {
|
||||
t.Errorf("expected error: %q", errStr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteRule(t *testing.T) {
|
||||
fcmd := fakeexec.FakeCmd{
|
||||
CombinedOutputScript: []fakeexec.FakeAction{
|
||||
// Exists
|
||||
func() ([]byte, []byte, error) {
|
||||
return []byte(`Bridge table: filter
|
||||
|
||||
Bridge chain: OUTPUT, entries: 4, policy: ACCEPT
|
||||
-j TEST
|
||||
`), nil, nil
|
||||
},
|
||||
// Fail to delete
|
||||
func() ([]byte, []byte, error) { return nil, nil, &fakeexec.FakeExitError{Status: 2} },
|
||||
// Does not Exists.
|
||||
func() ([]byte, []byte, error) {
|
||||
return []byte(`Bridge table: filter
|
||||
|
||||
Bridge chain: TEST, entries: 0, policy: ACCEPT`), nil, nil
|
||||
},
|
||||
},
|
||||
}
|
||||
fexec := fakeexec.FakeExec{
|
||||
CommandScript: []fakeexec.FakeCommandAction{
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
|
||||
},
|
||||
}
|
||||
|
||||
runner := New(&fexec)
|
||||
|
||||
err := runner.DeleteRule(TableFilter, ChainOutput, "-j", "TEST")
|
||||
errStr := "Failed to delete rule: exit 2, output: "
|
||||
if err == nil || err.Error() != errStr {
|
||||
t.Errorf("expected error: %q", errStr)
|
||||
}
|
||||
|
||||
err = runner.DeleteRule(TableFilter, ChainOutput, "-j", "TEST")
|
||||
if err != nil {
|
||||
t.Errorf("expected err = nil")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user