Commit Graph

44 Commits

Author SHA1 Message Date
Lucas Servén Marín
7291a3bd71
cmd/kg: add pprof endpoints
This commit enhances the Kilo agent internal HTTP server to include
pprof endpoints. For simplicity, this commit migrates the internal
server creation to https://github.com/metalmatze/signal/internalserver,
which allows for easy registration of common internal server
observability endpoints.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2022-04-22 12:03:56 +02:00
leonnicolas
0dfb744630
kgctl connect (#269)
* kgctl connect

Use kgctl connect to connect your laptop to a cluster.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kgctl: finish connect command

This commit fixes some bugs and finishes the implementation of the
`kgctl connect` command.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>

* e2e: add tests for kgctl connect

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>

* docs: add documentation for `kgctl connect`

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>

* pkg/mesh: move peer route generation to mesh

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>

Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2022-04-08 13:42:13 +02:00
leonnicolas
6a696e03e7
migrate to golang.zx2c4.com/wireguard/wgctrl (#239)
* migrate to golang.zx2c4.com/wireguard/wgctrl

This commit introduces the usage of wgctrl.
It avoids the usage of exec calls of the wg command
and parsing the output of `wg show`.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* vendor wgctrl

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* apply suggestions from code review

Remove wireguard.Enpoint struct and use net.UDPAddr for the resolved
endpoint and addr string (dnsanme:port) if a DN was supplied.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/*: use wireguard.Enpoint

This commit introduces the wireguard.Enpoint struct.
It encapsulates a DN name with port and a net.UPDAddr.
The fields are private and only accessible over exported Methods
to avoid accidental modification.

Also iptables.GetProtocol is improved to avoid ipv4 rules being applied
by `ip6tables`.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/wireguard/conf_test.go: add tests for Endpoint

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kg/main.go: validate port range

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* add suggestions from review

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/mesh/mesh.go: use Equal func

Implement an Equal func for Enpoint and use it instead of comparing
strings.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kgctl/main.go: check port range

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* vendor

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2022-01-30 17:38:45 +01:00
leonnicolas
ee480dece4
cmd/kg/main.go: replace deprecated prom collectors (#255)
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-11-15 23:08:06 +01:00
leonnicolas
9b14c227a9
pkg/mesh/routes.go: add flag for generic ACCEPT in FORWARD chain (#244)
* pkg/mesh/routes.go: add flag for generic ACCEPT in FORWARD chain

Some linux distros or docker will set the default policy in the FORWARD
chain in the filter table to DROP. With the new ip-tables-forward-rules
flag a generic ACCEPT for all packages going from and to the pod subnet
is added to the FORWARD chain.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* Update cmd/kg/main.go

Co-authored-by: Lucas Servén Marín <lserven@gmail.com>

* Update cmd/kg/main.go

Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2021-09-30 14:39:06 +02:00
Sean Baildon
3174467751
pkg/mesh: optionally assign external IP to node's private IP (#232) 2021-09-24 10:02:51 +02:00
leonnicolas
b9823943e3
cmd/kgctl/main.go: suppress second error message
`cobra` automatically prints and error if `runE` returns an error.
Since we explicitly print the error, we need to silence cobra.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-09-07 11:07:03 +02:00
leonnicolas
086b2e1ddd
cmd/kg/*: sub command peer validation webhook
This commit adds a sub command `webhook` to Kilo.
It will start a https web server that answeres request from a Kubernetes
API server to validate updates and creations of Kilo peers.

It also updates the "Peer Validation" docs to enable users to
install the web hook server and generate the self signed certificates in
the cluster by only applying a manifest.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

Apply suggestions from code review

Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2021-09-06 21:14:44 +02:00
leonnicolas
2b4487ba9a
cmd/kg/main.go: use cobra
This commit uses cobra instead of pflags in kg to handle flags in preparation  to add a new subcommand
for the webhook server.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-08-30 16:59:26 +02:00
Steffen Vogel
1b5ad035d9
kg: add new handler for rendering the topology graph
docker: add missing fonts for rasterized graphviz  output formats

add missing license header

kg: do not export handlers

use http package for status codes

keep checks for errors in a single line

simplify error message about failed invocation of dot

pass node hostname and subnet to graph handler

use SVG as default format for graph handler

register health handler with HandleFunc

add option for selecting layout to graph handler and using circo as new default

e2e: add tests for HTTP handlers

e2e: fix and simplify handler tests

add should comments to assertions

e2s: use assert_fail instead of assert _not

add missing mime-type header for graph handler

use switch/case statements for validating formats / layouts

e2e: fix handlers tests

Co-authored-by: leonnicolas <60091705+leonnicolas@users.noreply.github.com>

graph-handler: add missing font to Dockerfile

Dockerfile: remove unnecessary font

This commit leaves Noto as the only font package, as one font package is
sufficient for the container.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-08-18 14:04:44 +02:00
Lucas Servén Marín
2c74a560c4
pkg/wireguard: allow configuring MTU (#215)
This commit makes it possible to configure the MTU for the WireGuard
interface created by Kilo.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-07-16 14:23:11 +02:00
Lucas Servén Marín
7756b5ce04
docs: use consistent notes
This commit standardizes how we display a `note` in our docs.
Previously, we used a mix of `_Note_:`, `__Note:__`, `> Note`, and `>
**Note**:` among others. Now, all notes appear as `> **Note**:`.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-07-08 12:15:17 +02:00
leonnicolas
088578b055
pkg/ cmd/: kgctl autodetect mesh granularity
Addes granularity annotation to auto detect the mesh granularity when
using kubectl

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-06-18 15:59:25 +02:00
Lucas Servén Marín
311414e63a
Merge pull request #179 from squat/location_allowed_ips
pkg/: FEATURE: support allowed IPs outside a cluster
2021-06-15 23:07:22 +02:00
leonnicolas
31ffaa0e71
pkg/: FEATURE: support allowed IPs outside a cluster
Users can specify IPs with the annotation "allowed-location-ips".
It makes no difference which node of a location is annotated.
The IP should be routable from the particular location, e.g. a printer in
the same LAN.
This way these IPs become routable from other location.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2021-06-15 22:17:35 +02:00
Lucas Servén Marín
61b52ce4ae
cmd/kgctl: improve default kubeconfig
This commit adds better handling of the default kubeconfig location in
the kgctl binary for cases where the `$KUBECONFIG` environment variable
is not set. In these cases, kgctl will default to
`$HOME/.kube/config`, putting it in line with tools like `kubectl` and
`kind`.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-06-15 20:53:02 +02:00
Lucas Servén Marín
845df22a32
docs,README.md: clean up documentation
This commit cleans up some typos in the documentation, clarifies some
explanations, fixes a bash script that would not expand a variable, and
renames the API documentation generator command from gen-docs to
docs-gen to match the output binary name.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-05-20 12:45:02 +02:00
leonnicolas
51f1ae94ef
cmd/gen-docs/main.go: auto generate docs for CRD
The new make command `make gen-docs` is introduced.
It will build a markdown file from the CRD introduced by Kilo.

The generation of the docs is a requirement for building the website.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-05-17 13:54:56 +02:00
Lucas Servén Marín
8dbbc636b5
cmd/kg,pkg: add --resync-period flag
This commit introduces a new `--resync-period` flag to control how often
the Kilo controllers should reconcile.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-01 18:20:06 +01:00
leonnicolas
e30cff5293
FEATURE: user space wireguard
Add the possibility to use a user space implementation of wireguard. Specifically, the rust implementation boringtun.
2020-12-29 18:50:58 +01:00
Tadeuš Varnas
849449890d
Apply suggestions from code review
Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2020-12-14 10:20:53 +02:00
varnastadues
cb12666fc1 feat: add support for custom topology label 2020-12-11 16:44:20 +02:00
Lucas Servén Marín
116fb7337a
pkg/k8s: enable peers to use DNS names
This commit enables peers defined using the Peer CRD to declare their
endpoints using DNS names.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-09-17 14:48:38 +02:00
Lucas Servén Marín
0a10dc921c
pkg/k8s/apis: support for preshared keys in peers
This commit adds support for defining preshared keys when declaring a
new Peer CRD. This preshared key will be used whenever the nodes in the
Kilo mesh communicate with that peer.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-05-05 11:36:43 +02:00
Lucas Servén Marín
24d7c27901
pkg/mesh,docs: document and fix keepalive logic
This commit documents the use of the persistent-keepalive annotation and
corrects the implementation of keepalives.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-04 01:36:56 +01:00
Lucas Servén Marín
3facc9f34f
cmd/kg: only delete iface if requested
This commit modifies the default behavior of Kilo so that the WireGuard
interface is only deleted on shutdown if explicitly requested.

Fixes: https://github.com/squat/kilo/issues/17#issuecomment-534658157
2019-09-25 13:45:31 +02:00
Lucas Servén Marín
20349de548
pkg/wireguard: allow specifying iface named
This commit makes it possible to specify the Kilo interface name. If the
specified interface exists, it will be used; if it does not exist, Kilo
will create it. If the interface already existed, then it will not be
deleted on shutdown; otherwise Kilo will destroy the interface.

Fixes: https://github.com/squat/kilo/issues/8
Addresses: 1/2 of https://github.com/squat/kilo/issues/17
2019-09-24 16:05:10 +02:00
Lucas Servén Marín
3df87f0e71
cmd/kgctl: allow specifying port 2019-09-24 01:00:16 +02:00
Lucas Servén Marín
676007938e
pkg/mesh: add peers to graph 2019-09-23 17:54:16 +02:00
Lucas Servén Marín
81d6077fc2
manifests,pkg/encapsulation: Flannel compatibility
This commit adds basic support to run in compatibility mode with
Flannel. This allows clusters running Flannel as their principal
networking solution to leverage some advances Kilo features. In certain
Flannel setups, the clusters can even leverage muti-cloud. For this, the
cluster needs to either run in a full mesh, or Flannel needs to use the
API server's external IP address.
2019-05-14 01:01:58 +02:00
Lucas Servén Marín
cd6eeeb1e7
pkg/{encapsulation,mesh}: abstract encapsulation
This commit abstracts away encapsulation to more easily allow for
different types of encapsulation or compatibility with other networking
solutions.
2019-05-13 18:30:03 +02:00
Lucas Servén Marín
35390054ba
pkg: deduplicate peer IP addresses
We need to defensively deduplicate peer allowed IPs.
If two peers claim the same IP, the WireGuard configuration
could flap, causing the interface to churn.
2019-05-10 02:07:42 +02:00
Lucas Servén Marín
4d9c203603
pkg/mesh,cmd: add WireGuard IP to Nodes
This allows admins or users to have some easy visibility into the
configuration of the Kilo cluster.
2019-05-10 02:06:02 +02:00
Lucas Servén Marín
b04264ecc1
cmg/kgctl: fix peer as-peer 2019-05-09 17:18:45 +02:00
Lucas Servén Marín
545bc4186f
docs,README: document multi-cluster services 2019-05-08 17:13:20 +02:00
Lucas Servén Marín
90e68c7735
cmd/kgctl: add output options for showconf
This commit adds several output options to the `showconf` command of the
`kgctl` binary:
* `--as-peer`: this can be used to generate a peer configuration, which
can be used to configure the selected resource as a peer of another
WireGuard interface
* `--output`: this can be used to select the desired output format of
the peer resource, available options are: WireGuard, YAML, and JSON.
2019-05-08 01:31:36 +02:00
Lucas Servén Marín
9f30d8d1a1
pkg/mesh: rename mesh granularity types
This commit renames the mesh granularity types to make them more
intuitive. The functionality provided by them remains exactly the same.
2019-05-07 16:34:49 +02:00
Lucas Servén Marín
b3a3c37e0a
*: add complete CNI support
This commit enables Kilo to work as an independent networking provider.
This is done by leveraging CNI. Kilo brings the necessary CNI plugins to
operate and takes care of all networking.

Add-on compatibility for Calico, Flannel, etc, will be re-introduced
shortly.
2019-05-07 01:49:59 +02:00
Lucas Servén Marín
72991949ac
cmd/kgctl: use KUBECONFIG from env 2019-05-03 14:25:20 +02:00
Lucas Servén Marín
2425a06cd8
*: add peer VPN support
This commit adds support for defining arbitrary peers that should have
access to the VPN. In k8s, this is accomplished using the new Peer CRD.
2019-05-03 12:53:44 +02:00
Lucas Servén Marín
cf6ded1ae3
cmg/kg/main: small cleanup 2019-04-14 15:05:57 +02:00
Lucas Servén Marín
a8467f779e
cmd/kgctl: fix possible nil pointer dereference 2019-04-02 18:23:51 +02:00
Lucas Servén Marín
614f2e1c5d
cmd/kg: listen on all stacks without localhost
Today, net.Listen will only listen on 127.0.0.1 if localhost is passed
[0]. Listening on `:8080` will open a dualstack socket on OSs that
support it.
[0] https://github.com/golang/go/issues/9334
2019-04-02 18:17:51 +02:00
Lucas Serven
e989f0a25f
init 2019-01-18 02:50:10 +01:00