Commit Graph

77 Commits

Author SHA1 Message Date
Lucas Servén Marín
409d738124
pkg/mesh: fix segfault in #36
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-22 22:16:45 +01:00
Lucas Servén Marín
aa376ff0d1
pkg/mesh,pkg/wireguard: allow DNS name endpoints
This commit allows DNS names to be used when specifying the endpoint
for a node in the WireGuard mesh. This is useful in many scenarios, in
particular when operating an IoT device whose public IP is dynamic. This
change allows the administrator to use a dynamic DNS name in the node's
endpoint.

One of the side-effects of this change is that the WireGuard port can
now be specified individually for each node in the mesh, if the
administrator wishes to do so.

*Note*: this commit introduces a breaking change; the
`force-external-ip` node annotation has been removed; its functionality
has been ported over to the `force-endpoint` annotation. This annotation
is documented in the annotations.md file. The expected content of this
annotation is no longer a CIDR but rather a host:port. The host can be
either a DNS name or an IP.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-22 17:17:13 +01:00
Lucas Servén Marín
134cbe90be
pkg/route,pkg/mesh: replace NAT with ip rules
This commit entirely replaces NAT in Kilo with a few iproute2 rules.
Previously, Kilo would source-NAT the majority of packets in order to
avoid problems with strict source checks in cloud providers causing
packets to be considered martians. This source-NAT-ing made it
difficult to correctly apply Kuberenetes NetworkPolicies based on source
IPs.

This rewrite instead relies on a handful of iproute2 rules to ensure
that packets get encapsulated in certain scenarios based on the source
network and/or source interface.

This has the benefit of avoiding extra iptables bloat as well as
enabling better compatibility with NetworkPolicies.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-20 21:27:50 +01:00
Lucas Servén Marín
4857d10da1
pkg/iptables: clean up, remove NAT
This commit cleans up the iptables package to allow other packages to
create rules.

This commit also removes all NAT from Kilo.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-20 21:23:23 +01:00
Lucas Servén Marín
2603cd50db
pkg/mesh: fix ip allocator helper
This commit fixes the ip allocator `newAllocator` to produce IP
addresses with the original network mask. This is makes more sense. The
original functionality can be reproduced by wrapping the produced IP
address with the `oneAddressCIDR` helper.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-20 13:54:11 +01:00
Francis Nguyen
6de0f9805a
Define WireGuard PersistentKeepAlive via Annotation (#31)
* Add WireGuardPersistentKeepAlive to mesh.Node

* Connect to configuration

* Shorten keepalive key

* Fix casing on keepalive

* Add annotated keepalive value to peer functions
2020-02-13 10:16:55 +01:00
Lucas Servén Marín
3facc9f34f
cmd/kg: only delete iface if requested
This commit modifies the default behavior of Kilo so that the WireGuard
interface is only deleted on shutdown if explicitly requested.

Fixes: https://github.com/squat/kilo/issues/17#issuecomment-534658157
2019-09-25 13:45:31 +02:00
Lucas Servén Marín
20349de548
pkg/wireguard: allow specifying iface named
This commit makes it possible to specify the Kilo interface name. If the
specified interface exists, it will be used; if it does not exist, Kilo
will create it. If the interface already existed, then it will not be
deleted on shutdown; otherwise Kilo will destroy the interface.

Fixes: https://github.com/squat/kilo/issues/8
Addresses: 1/2 of https://github.com/squat/kilo/issues/17
2019-09-24 16:05:10 +02:00
Lucas Servén Marín
676007938e
pkg/mesh: add peers to graph 2019-09-23 17:54:16 +02:00
Lucas Servén Marín
8e755cf52e
pkg: allow overriding internal IP
This addresses the request for enhancement in
https://github.com/squat/kilo/issues/7.
2019-07-15 17:24:35 +02:00
Lucas Servén Marín
51df7fc4e3
pkg/mesh: don't let hostname resolution stop mesh
If the hostname fails to resolve, this should not be considered a
blocking error. Most likely, it means that the hostname is simply not
resolvable, which should not be a requirement to run Kilo. In this case,
simply try to find a valid IP from other sources.
2019-05-17 18:09:31 +02:00
Lucas Servén Marín
81d6077fc2
manifests,pkg/encapsulation: Flannel compatibility
This commit adds basic support to run in compatibility mode with
Flannel. This allows clusters running Flannel as their principal
networking solution to leverage some advances Kilo features. In certain
Flannel setups, the clusters can even leverage muti-cloud. For this, the
cluster needs to either run in a full mesh, or Flannel needs to use the
API server's external IP address.
2019-05-14 01:01:58 +02:00
Lucas Servén Marín
cd6eeeb1e7
pkg/{encapsulation,mesh}: abstract encapsulation
This commit abstracts away encapsulation to more easily allow for
different types of encapsulation or compatibility with other networking
solutions.
2019-05-13 18:30:03 +02:00
Lucas Servén Marín
d7ad946ff4
pkg/mesh: ignore CNI IP from private IPs
We need to ignore the CNI IP address from the searched IPs, as this will
not be a routable IP address.
2019-05-13 17:35:08 +02:00
Lucas Servén Marín
8ed1b549d1
pkg/mesh: edge case external = internal
Add an exception to the route generation rules for when the external IP
of a node equals the internal IP. In this case, we cannot route traffic
through a tunnel.
2019-05-13 17:25:56 +02:00
Lucas Servén Marín
e4ad7c29ec
manifests: keep private key between restarts
This commit ensures that the WireGuard private key is re-used between
container restarts. The result of this is that external peers can keep
using their configuration and don't need to be re-configured just
because the Kilo container restarted.
2019-05-10 22:21:56 +02:00
Lucas Servén Marín
35390054ba
pkg: deduplicate peer IP addresses
We need to defensively deduplicate peer allowed IPs.
If two peers claim the same IP, the WireGuard configuration
could flap, causing the interface to churn.
2019-05-10 02:07:42 +02:00
Lucas Servén Marín
4d9c203603
pkg/mesh,cmd: add WireGuard IP to Nodes
This allows admins or users to have some easy visibility into the
configuration of the Kilo cluster.
2019-05-10 02:06:02 +02:00
Lucas Servén Marín
034c27ab78
pkg: fix reconciling peer updates 2019-05-08 17:13:24 +02:00
Lucas Servén Marín
90e68c7735
cmd/kgctl: add output options for showconf
This commit adds several output options to the `showconf` command of the
`kgctl` binary:
* `--as-peer`: this can be used to generate a peer configuration, which
can be used to configure the selected resource as a peer of another
WireGuard interface
* `--output`: this can be used to select the desired output format of
the peer resource, available options are: WireGuard, YAML, and JSON.
2019-05-08 01:31:36 +02:00
Lucas Servén Marín
5914a9468f
docs: add topology docs and graphs 2019-05-07 16:36:02 +02:00
Lucas Servén Marín
9f30d8d1a1
pkg/mesh: rename mesh granularity types
This commit renames the mesh granularity types to make them more
intuitive. The functionality provided by them remains exactly the same.
2019-05-07 16:34:49 +02:00
Lucas Servén Marín
b3a3c37e0a
*: add complete CNI support
This commit enables Kilo to work as an independent networking provider.
This is done by leveraging CNI. Kilo brings the necessary CNI plugins to
operate and takes care of all networking.

Add-on compatibility for Calico, Flannel, etc, will be re-introduced
shortly.
2019-05-07 01:49:59 +02:00
Lucas Servén Marín
2425a06cd8
*: add peer VPN support
This commit adds support for defining arbitrary peers that should have
access to the VPN. In k8s, this is accomplished using the new Peer CRD.
2019-05-03 12:53:44 +02:00
Lucas Servén Marín
4cbc24128d
pkg/mesh: metric for reconcile attempts
This commit exposes a new Prometheus to track the number of
reconciliation attempts. This is important, as without this, the number
of errors it not too helpful. A more valuable statistic is the
proportion of reconciliations that result in an error.
2019-04-30 13:51:46 +02:00
Lucas Servén Marín
72bfb762b9
pkg/{k8s,mesh}: introduce liveness checks
This commit introduces liveness checks to Kilo. This allows the Kilo
daemons to take nodes with inactive or dead Kilo deamons out of the
topology until they are alive again.
2019-04-02 18:28:27 +02:00
Lucas Serven
e989f0a25f
init 2019-01-18 02:50:10 +01:00