Commit Graph

340 Commits

Author SHA1 Message Date
Lucas Servén Marín
24dd4b54bf
Merge pull request #154 from squat/docs_validating_hook
docs/peer-validation: add docs about peer validation
2021-05-12 14:16:44 +02:00
leonnicolas
60f0ccd8a2
docs/peer-validation: add docs about peer validation
Signed-off-by: leonnicolas <leonloechner@gmx.de>

Update docs/peer-validation.md

Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2021-05-12 14:11:10 +02:00
Lucas Servén Marín
2ba1376400
Merge pull request #159 from squat/update_install_docs
docs: note how to install precompiled kgctl
2021-05-11 18:25:55 +02:00
Julien Viard de Galbert
e51a8c92cf Drop intermediate REGISTRY_PREFIX variable and use FULLY_QUALIFIED_IMAGE more consistently
TODO: test this on docker hub
2021-05-11 16:17:25 +02:00
Julien Viard de Galbert
6301503095 Makefile: handle a private registry 2021-05-11 15:53:30 +02:00
Lucas Servén Marín
1d26921710
docs: clarify BoringTun
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-05-11 15:11:36 +02:00
Lucas Servén Marín
e232af1073
docs: note how to install precompiled kgctl
This commit updates the instructions for installing Kilo. It also fixes
the title-casing of a section on the README and makes a visual change to
the userspace doc to try to make the note clearer.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-05-11 14:23:56 +02:00
Lucas Servén Marín
a504fe7195
Merge pull request #158 from squat/clarify_cross_network_communication
README.md: mention pod network connectivity behind NAT
2021-05-08 18:24:27 +02:00
leonnicolas
4dc407f600
README.md: mention pod network connectivity behind NAT
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-05-08 18:08:53 +02:00
Lucas Servén Marín
bd7c4e04d4
Merge pull request #157 from squat/docker_pull_badge
README.md: add docker pulls badge
2021-05-07 13:02:14 +02:00
leonnicolas
4528e0c374
README.md: add docker pulls badges
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-05-07 12:40:57 +02:00
Lucas Servén Marín
d233d93cbf
Merge pull request #155 from squat/declare_metrics_port
manifests: declare metrics port
2021-05-07 08:31:20 +02:00
Lucas Servén Marín
8fce69d373
manifests: declare metrics port
This commit ammends all of the Kilo manifests so that the DaemonSets
declare the port they expose.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-05-06 19:30:43 +02:00
Lucas Servén Marín
e843262064
Merge pull request #152 from squat/check_netlink_events
pkg/route: correct route error check
2021-05-02 20:08:06 +02:00
Lucas Servén Marín
298a772d68
Merge pull request #151 from squat/improve-public-key-validation
pkg/k8s/apis/kilo/v1alpha1/types.go: add public key validation
2021-04-30 22:08:38 +02:00
leonnicolas
64ea86436f
pkg/k8s/apis/kilo/v1alpha1/types.go: add public key validation
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-04-30 22:03:34 +02:00
Lucas Servén Marín
19abddf1fe
pkg/route: correct route error check
Currently, when the route controller processes updates from netlink, it
checks if the routes in the table are nil or have no destination.
However, we control this and can guarantee that it's never the case.
Instead, we should check if the routes from netlink are valid.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-04-30 18:17:51 +02:00
Lucas Servén Marín
166094b5ad
Merge pull request #148 from JulienVdG/sync-not-ready
RFC: Remove syncNodes/syncPeers 'not Ready' special case
2021-04-21 19:49:12 +02:00
Julien Viard de Galbert
2ac000c68a
Nat to nat (#146)
* wireguard: export an Endpoint comparison method

* Record discovered endpoints in node

* Synchronize DiscoveredEndpoints in k8s backend

* Add discoveredEndpointsAreEqual

* Handle discovered Endpoints in topology to enable NAT 2 NAT

* Refactor to use Endpoint.Equal

Compare IP first by default and compare DNS name first when we know the Endpoint was resolved.

* Drop the shallow copies of nodes and peers

Now that updateNATEndpoints was updated to discoverNATEndpoints and that
the endpoints are overridden by topology instead of mutating the nodes and
peers object, we can safely drop this copy.
2021-04-21 19:47:29 +02:00
Julien Viard de Galbert
81f592de74 Remove syncNodes/syncPeers not Ready special case
First the comment "so remove it from the mesh" is wrong / missleading as
since 034c27ab78 the delete in that if is
not in there anymore.

Second the m.nodes map is not updated so setting `diff = true` will call `applyTopology` without any changes... which seams useless.

Third the rest of the code already checks for Ready so this special case
here should not be needed.
2021-04-21 11:33:37 +02:00
Lucas Servén Marín
863628ffaa
Merge pull request #145 from mrueg/Dockerfile
Dockerfile: Update CNI Plugins
2021-04-18 20:13:24 +02:00
Manuel Rüger
be1acb72ac Dockerfile: Update CNI Plugins
Also extract them into arguments so it is easier to update
2021-04-18 19:50:49 +02:00
leonnicolas
6684d5bca3
Merge pull request #144 from squat/fix_graph_newlines
pkg/mesh/graph.go: fix format
2021-04-12 00:41:25 +02:00
leonnicolas
a6fcab6878
pkg/mesh/graph.go: fix format
Previously the newlines were ignored by circo.
This lead to very flat ellipses.
Masked newlines "\\n" are correctly handeled.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-26 11:12:05 +01:00
leonnicolas
b59210ef48
Merge pull request #142 from squat/force_internal_ip_docs
docs/annotations.md: docs for disable private ip
2021-03-25 18:07:33 +01:00
leonnicolas
299fab7f2f
Update docs/annotations.md
Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-25 16:38:18 +01:00
leonnicolas
c1680372df
docs/annotations.md: docs for disable private ip
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-25 14:12:16 +01:00
Lucas Servén Marín
9a6ec98343
Merge pull request #141 from squat/fix_graph
pkg/mesh: fix panic in graph
2021-03-25 13:05:55 +01:00
Lucas Servén Marín
d1948acd77
pkg/mesh: fix panic in graph
Commit 4d00bc56fe introduced a bug in the
Kilo graph generation logic. This commit used the WireGuard CIDR from
the topology struct as the graph title, however this field is nil
whenever the selected node is not a leader, causing the program to
panic.

This commit changes the meaning of the topology struct's wireGuardCIDR
field so that the field is always defined and the normalized value will
always be equal to the Kilo subnet CIDR. When the selected node is a
leader node, then the field's IP will be the IP allocated to the node
within the subnet. This effectively prevents the program from panicking.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-25 02:59:54 +01:00
Lucas Servén Marín
dc34682909
Merge pull request #127 from squat/disable_private_ip
FEATURE: allow disabling private IPs
2021-03-24 21:09:35 +01:00
leonnicolas
9d10d4a3de
FEATURE: allow disabling private IPs
When forcing the internal IP to "" or "-", private IPs won't be used.
2021-03-13 23:33:18 +01:00
Lucas Servén Marín
3882d1baae
Merge pull request #139 from squat/bug_ipip_rule_reconciliation
pkg/encapsulation/ipip.go: fix order of flags
2021-03-13 22:36:44 +01:00
leonnicolas
50ba744e74
pkg/encapsulation/ipip.go: fix order of flags 2021-03-13 19:55:00 +01:00
Lucas Servén Marín
dc33521374
Merge pull request #138 from squat/bug_resync_period
pkg/mesh/mesh.go: actually add resync period
2021-03-13 16:37:17 +01:00
leonnicolas
db62b273c0
pkg/mesh/mesh.go: actually add resync period
resync period was not added to mesh struct.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-13 16:31:09 +01:00
leonnicolas
ba37d913e4
Merge pull request #136 from squat/ipip_protocol_name
pkg/encapsulation/ipip*: fix ipip iptables rules
2021-03-13 15:37:23 +01:00
Lucas Servén Marín
ede3118cc8
pkg/encapsulation/ipip*: fix ipip iptables rules
Since #116 implemented fragile comparisons of iptables rules to avoid
calling the iptables binary excessively during every reconciliation, the
iptables rules for IPIP encapsulation must be updated to match the
expected output. One complication is that rather than returning the
protocol number in the rule, iptables resolves the protocol number to a
name by looking up the number in the netd protocols database. This name
can vary depending on the host's environment. This commit adds two
solutions for resolving the protocol name:
1. a fixed mapping to the string `ipencap`, which should always work
for Kilo whenever it runs in the Alpine Linux container; and
2. a runtime lookup using the netd database, which only works if Kilo is
compiled with CGO and is meant to be used only if Kilo is not running in
the normal container environment.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-13 15:24:55 +01:00
Lucas Servén Marín
ce1b95251e
Merge pull request #124 from squat/update_docusaurus
website: update docusaurus
2021-03-10 14:41:56 +01:00
Lucas Servén Marín
259d2a3d8b
website: update docusaurus
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-10 14:31:55 +01:00
Lucas Servén Marín
c85fbde2ba
docs/vpn.md: add clarification
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-09 16:58:07 +01:00
Lucas Servén Marín
251e8fac40
Merge pull request #132 from squat/172-16-slash-12
pkg/mesh: correctly check 172.16/12 IP range
2021-03-06 01:06:36 +01:00
Lucas Servén Marín
39803cef66
pkg/mesh: correctly check 172.16/12 IP range
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-06 00:50:48 +01:00
Lucas Servén Marín
90a2540487
Merge pull request #131 from squat/172-16-slash-12
pkg/mesh: correctly idenitfy 172.16/12 IPs
2021-03-05 18:32:59 +01:00
Lucas Servén Marín
7cc707f335
pkg/mesh: correctly idenitfy 172.16/12 IPs
Currently Kilo incorrectly identifies the 172.16/12 private IP range.
This commit fixes the logic.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-05 18:27:12 +01:00
Lucas Servén Marín
4d1756c23a
Merge pull request #130 from squat/kubeamd_cni_path
manifests: fix kubeadm CNI path
2021-03-04 14:06:13 +01:00
Lucas Servén Marín
a408ce9f35
manifests: fix kubeadm CNI path
As discussed in
https://github.com/squat/kilo/issues/129#issuecomment-789651850,
the Kilo manifests for kubeadm install the CNI configuration in the
wrong directory. They are using /etc/kubernetes/cni/net.d [0] when they
should be using /etc/cni/net.d [1].

[0]
https://github.com/squat/kilo/blob/main/manifests/kilo-kubeadm.yaml#L163
[1]
https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#cni

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-04 12:53:46 +01:00
Lucas Servén Marín
2b959f7020
Merge pull request #125 from squat/resync-period
cmd/kg,pkg: add --resync-period flag
2021-03-02 13:18:49 +01:00
Lucas Servén Marín
7a74d87cc7
Merge pull request #126 from squat/dependabot/npm_and_yarn/website/prismjs-1.23.0
build(deps): bump prismjs from 1.21.0 to 1.23.0 in /website
2021-03-02 08:56:23 +01:00
dependabot[bot]
b0e670eb76
build(deps): bump prismjs from 1.21.0 to 1.23.0 in /website
Bumps [prismjs](https://github.com/PrismJS/prism) from 1.21.0 to 1.23.0.
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PrismJS/prism/compare/v1.21.0...v1.23.0)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-01 21:04:33 +00:00
Lucas Servén Marín
8dbbc636b5
cmd/kg,pkg: add --resync-period flag
This commit introduces a new `--resync-period` flag to control how often
the Kilo controllers should reconcile.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-01 18:20:06 +01:00