Commit Graph

15 Commits

Author SHA1 Message Date
Lucas Servén Marín
d04da92a23
Dockerfile: support nftables
Currently, Kilo _only_ supports adding firewall rules via the legacy
iptables API. This means that on systems using nftables in the host
network namespace, the namespace will be polluted and both firewall
infrastructures will be used, causing unexpected and difficult
to predict interactions. In other words, networking may not work as
expected on nftables-based systems.

This PR fixes this by using the iptables-wrappers project [0] to install
run-time detection of the in-use iptables backend.

[0] https://github.com/kubernetes-sigs/iptables-wrappers

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2022-04-21 20:46:03 +02:00
Dave Allan
3e6818d0b3 bump CNI plugins version to 1.1.1 2022-04-19 08:27:35 -04:00
leonnicolas
6a696e03e7
migrate to golang.zx2c4.com/wireguard/wgctrl (#239)
* migrate to golang.zx2c4.com/wireguard/wgctrl

This commit introduces the usage of wgctrl.
It avoids the usage of exec calls of the wg command
and parsing the output of `wg show`.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* vendor wgctrl

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* apply suggestions from code review

Remove wireguard.Enpoint struct and use net.UDPAddr for the resolved
endpoint and addr string (dnsanme:port) if a DN was supplied.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/*: use wireguard.Enpoint

This commit introduces the wireguard.Enpoint struct.
It encapsulates a DN name with port and a net.UPDAddr.
The fields are private and only accessible over exported Methods
to avoid accidental modification.

Also iptables.GetProtocol is improved to avoid ipv4 rules being applied
by `ip6tables`.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/wireguard/conf_test.go: add tests for Endpoint

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kg/main.go: validate port range

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* add suggestions from review

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/mesh/mesh.go: use Equal func

Implement an Equal func for Enpoint and use it instead of comparing
strings.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kgctl/main.go: check port range

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* vendor

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2022-01-30 17:38:45 +01:00
Steffen Vogel
1b5ad035d9
kg: add new handler for rendering the topology graph
docker: add missing fonts for rasterized graphviz  output formats

add missing license header

kg: do not export handlers

use http package for status codes

keep checks for errors in a single line

simplify error message about failed invocation of dot

pass node hostname and subnet to graph handler

use SVG as default format for graph handler

register health handler with HandleFunc

add option for selecting layout to graph handler and using circo as new default

e2e: add tests for HTTP handlers

e2e: fix and simplify handler tests

add should comments to assertions

e2s: use assert_fail instead of assert _not

add missing mime-type header for graph handler

use switch/case statements for validating formats / layouts

e2e: fix handlers tests

Co-authored-by: leonnicolas <60091705+leonnicolas@users.noreply.github.com>

graph-handler: add missing font to Dockerfile

Dockerfile: remove unnecessary font

This commit leaves Noto as the only font package, as one font package is
sufficient for the container.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-08-18 14:04:44 +02:00
Julien Viard de Galbert
6301503095 Makefile: handle a private registry 2021-05-11 15:53:30 +02:00
Manuel Rüger
be1acb72ac Dockerfile: Update CNI Plugins
Also extract them into arguments so it is easier to update
2021-04-18 19:50:49 +02:00
Lucas Servén Marín
45cedbb84a
pkg/*: allow kgctl to compile for other OSes
This commit enables the compilation of kgctl when GOOS!=linux.
This fixes #56.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-11-14 12:16:07 +01:00
Lucas Servén Marín
ddab6930d8
Dockerfile: change Alpine pkg CDN
The current Alpine package CDN is timing out for aarch64. This commit
updates it to another mirror. This commit also changes the channel
Alpine channel from edge to v3.12. Note: the Dockerfile overrides the
Alpine CDN settings to ensure that a mirror with support for TLS is
used.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-06-03 20:09:50 +02:00
Lucas Servén Marín
b668c1ec3e
pkg/iptables: enable simultaneous ipv4 and ipv6
This commit enables simultaneously managing IPv4 and IPv6 iptables
rules. This makes it possible to have peers with IPv6 allowed IPs in an
otherwise IPv4 stack and vice versa.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-12 16:07:48 +01:00
Lucas Servén Marín
4b220b42c5
Dockerfile
The certificates for the alpine APK repositories expired today [0],
breaking builds. This switches the configured repos to ones that work.
It also changes the `main` repo to use HTTPS.

[0] uk.alpinelinux.org expired Nov 15 2019 at 02:00:31 UTC

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2019-11-15 14:59:41 +01:00
Lucas Servén Marín
c93fa1e5b1
Dockerfile: fix cni plugins for arm
This commit ensures that the architecture of the installed CNI plugins
corresponds to the architecture of the container.
2019-08-16 17:45:36 +02:00
Lucas Servén Marín
82fe418f89
Dockerfile: update alpine repo for wg 2019-05-22 10:26:20 +02:00
Lucas Servén Marín
adb09ce620
Makefile,Dockerfile: add multi-arch images
This commit changes the build-system for Kilo to create container images
for multiple architectures. This will enable running Kilo on Arm
devices, e.g. Raspberry Pis. This is accomplished using Docker
manifests.
2019-05-16 22:53:43 +02:00
Lucas Servén Marín
b3a3c37e0a
*: add complete CNI support
This commit enables Kilo to work as an independent networking provider.
This is done by leveraging CNI. Kilo brings the necessary CNI plugins to
operate and takes care of all networking.

Add-on compatibility for Calico, Flannel, etc, will be re-introduced
shortly.
2019-05-07 01:49:59 +02:00
Lucas Serven
e989f0a25f
init 2019-01-18 02:50:10 +01:00