Skip to content

Commit 7fda7d5

Browse files
yokazeyokaze
authored
Support Cilium 1.17 (#65)
* Update Cilium version to 1.17 * Return consistent result from handleCIDRIdentities * Support Cilium 1.17 Signed-off-by: Daichi Sakaue <daichi-sakaue@cybozu.co.jp>
1 parent 5e07fff commit 7fda7d5

26 files changed

Lines changed: 1028 additions & 221 deletions

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ TOOLS_DIR := $(BIN_DIR)/download
33
CACHE_DIR := $(shell pwd)/cache
44

55
# Test tools
6-
CYBOZU_CILIUM_IMAGE := ghcr.io/cybozu/cilium@sha256:f9f1bcfe2bf0b54caf3d6de6549deccadfdc48ff7b1d6b351eb8c5f745addc70 # 1.16.19.3
6+
CYBOZU_CILIUM_IMAGE := ghcr.io/cybozu/cilium@sha256:4c04874591b4a9dd485c63e1a3baba5c18d84fa48bad3a46e9cc0b3823c6bf00 # 1.17.12.2
77
CILIUM_DBG_CLI := $(TOOLS_DIR)/cilium-dbg
88
CUSTOMCHECKER := $(TOOLS_DIR)/custom-checker
99
HELM := helm --repository-cache $(CACHE_DIR)/helm/repository --repository-config $(CACHE_DIR)/helm/repositories.yaml

‎cmd/cilium-agent-proxy/app/run.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package app
22

33
import (
44
"bytes"
5+
"cmp"
56
"context"
67
"encoding/json"
78
"fmt"
@@ -76,11 +77,14 @@ func handleCIDRIdentities(w http.ResponseWriter, r *http.Request) {
7677
// https://docs.cilium.io/en/stable/internals/security-identities/
7778
if (1<<24) <= i.ID && i.ID < (1<<25) {
7879
return !slices.ContainsFunc(i.Labels, func(l string) bool {
79-
return strings.HasPrefix(l, "cidr:")
80+
return strings.HasPrefix(l, "cidr:") || strings.HasPrefix(l, "cidrgroup:")
8081
})
8182
}
8283
return true
8384
})
85+
slices.SortFunc(ids, func(x, y Identity) int {
86+
return cmp.Compare(x.ID, y.ID)
87+
})
8488

8589
data, err := json.Marshal(ids)
8690
if err != nil {

‎cmd/npv/app/helper.go‎

Lines changed: 61 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66
"io"
77
"os"
8+
"reflect"
89
"slices"
910
"strings"
1011
"text/tabwriter"
@@ -41,33 +42,86 @@ func colored(color int, text string) string {
4142
return text
4243
}
4344

44-
func writeSimpleOrJson(w io.Writer, content any, header []string, count int, values func(index int) []any) error {
45-
expr := make([][]any, 0)
46-
for i := range count {
47-
expr = append(expr, values(i))
45+
// inflateRow expands a single row into multiple rows when some cells contain slices.
46+
func inflateRow(input []any, repeat []bool) [][]any {
47+
// Input:
48+
// a | [1, 2] | [100, 200, 300]
49+
//
50+
// Output:
51+
// a | 1 | 100
52+
// | 2 | 200
53+
// | | 300
54+
ncol := len(input)
55+
maxHeight := 1
56+
height := make([]int, ncol)
57+
inflate := make([]bool, ncol)
58+
for i := range ncol {
59+
if reflect.TypeOf(input[i]).Kind() == reflect.Slice {
60+
height[i] = reflect.ValueOf(input[i]).Len()
61+
maxHeight = max(maxHeight, height[i])
62+
inflate[i] = true
63+
}
4864
}
4965

66+
ret := make([][]any, maxHeight)
67+
for j := range maxHeight {
68+
entry := make([]any, ncol)
69+
for i := range ncol {
70+
switch {
71+
case repeat[i]:
72+
fallthrough
73+
case (j == 0) && !inflate[i]:
74+
entry[i] = input[i]
75+
case j < height[i]:
76+
v := reflect.ValueOf(input[i]).Index(j).Interface()
77+
entry[i] = v
78+
default:
79+
entry[i] = ""
80+
}
81+
}
82+
ret[j] = entry
83+
}
84+
return ret
85+
}
86+
87+
func writeSimpleOrJson(w io.Writer, content any, header []string, count int, values func(index int) []any) error {
88+
expr := make([][]any, 0)
5089
if rootOptions.output == OutputSimple {
90+
repeat := make([]bool, len(header))
91+
for i := range len(header) {
92+
repeat[i] = header[i] == "|"
93+
}
94+
95+
for i := range count {
96+
v := values(i)
97+
entries := inflateRow(v, repeat)
98+
expr = append(expr, entries...)
99+
}
100+
51101
header = slices.Clone(header)
52102
for j := 0; j < len(header); j++ {
53103
h := header[j]
54104
if strings.HasSuffix(h, ":") {
55105
h = h[:len(h)-1]
56106
header[j] = h
57107
width := len(h)
58-
for i := 0; i < count; i++ {
108+
for i := range len(expr) {
59109
v := fmt.Sprintf("%v", expr[i][j])
60110
width = max(width, len(v))
61111
expr[i][j] = v
62112
}
63113

64114
format := fmt.Sprintf("%%%ds", width)
65115
header[j] = fmt.Sprintf(format, header[j])
66-
for i := 0; i < count; i++ {
116+
for i := range len(expr) {
67117
expr[i][j] = fmt.Sprintf(format, expr[i][j])
68118
}
69119
}
70120
}
121+
} else {
122+
for i := range count {
123+
expr = append(expr, values(i))
124+
}
71125
}
72126

73127
switch rootOptions.output {
@@ -89,7 +143,7 @@ func writeSimpleOrJson(w io.Writer, content any, header []string, count int, val
89143
return err
90144
}
91145
}
92-
for i := range count {
146+
for i := range len(expr) {
93147
format := strings.Repeat("%v\t", len(header)-1) + "%v\n"
94148
if _, err := tw.Write([]byte(fmt.Sprintf(format, expr[i]...))); err != nil {
95149
return err

‎cmd/npv/app/inspect.go‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ var inspectCmd = &cobra.Command{
5858
}
5959

6060
// This command aims to show the result of "cilium bpf policy get" from a remote pod.
61-
// https://github.com/cilium/cilium/blob/v1.16.3/cilium-dbg/cmd/bpf_policy_get.go
61+
// https://github.com/cilium/cilium/blob/v1.17.16/cilium-dbg/cmd/bpf_policy_get.go
6262
type inspectEntry struct {
6363
Subject string `json:"subject"`
6464
Node string `json:"node"`
@@ -189,14 +189,18 @@ func runInspectOnPod(ctx context.Context, stderr io.Writer, clientset *kubernete
189189
return nil, err
190190
}
191191
if inspectOptions.maskCIDRs {
192+
private := cidr.PrivateCIDRSet.Overlaps(*c)
193+
public := cidr.PublicCIDRSet.Overlaps(*c)
192194
var expr string
193195
switch {
194-
case cidr.IsPrivateCIDR(c):
195-
expr = "private"
196-
case cidr.IsPublicCIDR(c):
196+
case private && public:
197+
expr = "unknown"
198+
case public:
197199
expr = "public"
200+
case private:
201+
expr = "private"
198202
default:
199-
expr = "unknown"
203+
expr = "none"
200204
}
201205
entry.Identity = uint32(identity.ReservedIdentityWorld)
202206
entry.Example = fmt.Sprintf("cidr:%s", expr)
@@ -272,10 +276,19 @@ func runInspect(ctx context.Context, stdout, stderr io.Writer, name string) erro
272276
} else {
273277
port = fmt.Sprint(p.Port)
274278
}
279+
var example any
280+
example = p.Example
281+
if (rootOptions.output == OutputSimple) && strings.HasPrefix(p.Example, "cidr:") {
282+
p.Example = strings.Replace(p.Example, "+", ", +", -1)
283+
p.Example = strings.Replace(p.Example, "-", ", -", -1)
284+
if strings.Contains(p.Example, ",") {
285+
example = strings.Split(p.Example, ",")
286+
}
287+
}
275288
avg := fmt.Sprintf("%.1f", computeAverage(p.Bytes, p.Requests))
276-
subValues := []any{p.Subject, "|"}
277-
values := []any{p.Policy, p.Direction, "|", p.Identity, p.Namespace, p.Example, "|", protocol, port, "|", formatWithUnits(p.Bytes), formatWithUnits(p.Requests), avg}
289+
values := []any{p.Policy, p.Direction, "|", p.Identity, p.Namespace, example, "|", protocol, port, "|", formatWithUnits(p.Bytes), formatWithUnits(p.Requests), avg}
278290
if subject.ShouldPrintSubject(name) {
291+
subValues := []any{p.Subject, "|"}
279292
values = append(subValues, values...)
280293
}
281294
return values

‎cmd/npv/app/reach.go‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"errors"
66
"fmt"
77
"io"
8+
"strings"
89

910
"github.com/cilium/cilium/pkg/u8proto"
1011
"github.com/spf13/cobra"
@@ -168,7 +169,16 @@ func runReach(ctx context.Context, stdout, stderr io.Writer) error {
168169
} else {
169170
port = fmt.Sprint(p.Port)
170171
}
172+
var example any
173+
example = p.Example
174+
if (rootOptions.output == OutputSimple) && strings.HasPrefix(p.Example, "cidr:") {
175+
p.Example = strings.Replace(p.Example, "+", ", +", -1)
176+
p.Example = strings.Replace(p.Example, "-", ", -", -1)
177+
if strings.Contains(p.Example, ",") {
178+
example = strings.Split(p.Example, ",")
179+
}
180+
}
171181
avg := fmt.Sprintf("%.1f", computeAverage(p.Bytes, p.Requests))
172-
return []any{p.Role, p.Direction, p.Policy, "|", p.Identity, p.Namespace, p.Example, "|", protocol, port, "|", formatWithUnits(p.Bytes), formatWithUnits(p.Requests), avg}
182+
return []any{p.Role, p.Direction, p.Policy, "|", p.Identity, p.Namespace, example, "|", protocol, port, "|", formatWithUnits(p.Bytes), formatWithUnits(p.Requests), avg}
173183
})
174184
}

‎cmd/npv/app/root.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -253,11 +253,11 @@ func parseCIDROptions(ingress, egress bool, prefix string, opts *cidrOptions) (p
253253
case 0:
254254
return nil, nil
255255
case 1:
256-
incl, excl, err := cidr.ParseCIDRExpression(expr)
256+
s, err := cidr.ParseCIDRExpression(expr)
257257
if err != nil {
258258
return nil, fmt.Errorf("failed to parse --%s-cidrs: %w", prefix, err)
259259
}
260-
return proxy.MakeCIDRFilter(ingress, egress, incl, excl), nil
260+
return proxy.MakeCIDRFilter(ingress, egress, *s), nil
261261
default:
262262
return nil, fmt.Errorf("one of --%s-cidrs, --%s-private-cidrs, --%s-public-cidrs can be specified", prefix, prefix, prefix)
263263
}

‎e2e/Makefile‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ HELM := helm --content-cache $(CACHE_DIR)/helm/content
99

1010
# Avoid using SHA here
1111
# https://github.com/kubernetes-sigs/kind/issues/4028
12-
CILIUM_IMAGE := quay.io/cilium/cilium:v1.16.19
13-
CILIUM_CHART := oci://quay.io/cilium/charts/cilium:1.16.19@sha256:7496a278401c221a30d023df4e40c4e97c3c203645b337d332da5f9e887acf06
12+
CILIUM_IMAGE := quay.io/cilium/cilium:v1.17.16
13+
CILIUM_CHART := oci://quay.io/cilium/charts/cilium:1.17.16@sha256:d707d52d83d4b33acfc3ce0aa3cc1296863249866f3d8cda48e78b7b3442d92b
1414

1515
DEPLOYMENT_REPLICAS ?= 1
1616

@@ -90,6 +90,7 @@ install-test-pod:
9090
$(MAKE) --no-print-directory DEPLOYMENT_REPLICAS=2 NAMESPACE=test-l3 run-test-pod-l3-ingress-explicit-allow-all
9191
$(MAKE) --no-print-directory wait-for-workloads
9292

93+
kubectl apply -f testdata/policy/cidr-group.yaml
9394
kubectl apply -f testdata/policy/l3.yaml
9495
kubectl apply -f testdata/policy/l4.yaml
9596

@@ -102,8 +103,10 @@ install-policy-viewer:
102103
kubectl exec $${PODNAME} -- /tmp/onboard; \
103104
kubectl cp $(POLICY_VIEWER) $${PODNAME}:/tmp/; \
104105
kubectl exec $${PODNAME} -- chmod +x /tmp/npv; \
105-
kubectl cp $$(aqua which kubectl) $${PODNAME}:/tmp/; \
106-
kubectl exec $${PODNAME} -- chmod +x /tmp/kubectl
106+
kubectl cp $$(aqua which kubectl) $${PODNAME}:/tmp/kubectl; \
107+
kubectl exec $${PODNAME} -- chmod +x /tmp/kubectl; \
108+
kubectl cp $$(aqua which yq) $${PODNAME}:/tmp/yq; \
109+
kubectl exec $${PODNAME} -- chmod +x /tmp/yq
107110

108111
.PHONY: pilot
109112
pilot:

0 commit comments

Comments
 (0)