Commits on Jan 10, 2024

1. Add support for NodeNetworkPolicy datapath …

   This PR introduces support for the NodeNetworkPolicy datapath, extending Antrea
   ClusterNetworkPolicy (ACNP). The implementation leverages iptables and ipset for
   enforcing rules, safeguarding Kubernetes Nodes.
   
   There are four key components to implement the data path:
   
   - Core iptables rule
     - Integrated into static chains ANTREA-POL-INGRESS-RULES (ingress) or
       ANTREA-POL-EGRESS-RULES (egress).
     - Matches an ipset that includes NodeNetworkPolicy rule source or
       destination IPs, or directly matches a single IP.
     - Targets an action or a service chain created for NodeNetworkPolicy
       rule with multiple services.
   - Service iptables chain
     - Created for NodeNetworkPolicy rule with multiple services.
   - Service iptables rules:
     - Added to the service chain for NodeNetworkPolicy rule, constructed from
       rule services.
   - From/To ipset:
     - Created for a NodeNetworkPolicy rule, containing source (ingress) or
      destination (egress) IPs.
   
   Example ingress or egress core iptables rules organized by priorities:
   
   ```
   :ANTREA-POL-INGRESS-RULES
   -A ANTREA-POL-INGRESS-RULES -m set --match-set ANTREA-POL-RULE1-4 src -j ANTREA-POL-RULE1 -m comment --comment "Antrea: for rule RULE1, policy AntreaClusterNetworkPolicy:name1"
   -A ANTREA-POL-INGRESS-RULES -m set --match-set ANTREA-POL-RULE2-4 src -p tcp --dport 8080 -j ACCEPT -m comment --comment "Antrea: for rule RULE2, policy AntreaClusterNetworkPolicy:name2"
   -A ANTREA-POL-INGRESS-RULES -s 3.3.3.3/32 src -j ANTREA-POL-RULE3 -m comment --comment "Antrea: for rule RULE3, policy AntreaClusterNetworkPolicy:name3"
   -A ANTREA-POL-INGRESS-RULES -s 4.4.4.4/32 -p tcp --dport 80 -j ACCEPT -m comment --comment "Antrea: for rule RULE4, policy AntreaClusterNetworkPolicy:name4"
   ```
   
   Example service chain (for rule with multiple services)::
   
   ```
   :ANTREA-POL-RULE1
   -A ANTREA-POL-RULE1 -j ACCEPT -p tcp --dport 80
   -A ANTREA-POL-RULE1 -j ACCEPT -p tcp --dport 443
   ```
   
   Example ipset (for rule with multiple source or destination IPs)
   
   ```
   Name: ANTREA-POL-RULE1-4
   Type: hash:net
   Revision: 6
   Header: family inet hashsize 1024 maxelem 65536
   Size in memory: 472
   References: 1
   Number of entries: 2
   Members:
   1.1.1.1
   1.1.1.2
   ```
   
   Signed-off-by: Hongliang Liu <[email protected]>

   

   hongliangl committed Jan 10, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 32e091b
   • Browse repository at this point

   Copy the full SHA

   32e091b View commit details

   Browse the repository at this point in the history