Commit Graph

332 Commits

Author SHA1 Message Date
Lucas Servén Marín
aa376ff0d1
pkg/mesh,pkg/wireguard: allow DNS name endpoints
This commit allows DNS names to be used when specifying the endpoint
for a node in the WireGuard mesh. This is useful in many scenarios, in
particular when operating an IoT device whose public IP is dynamic. This
change allows the administrator to use a dynamic DNS name in the node's
endpoint.

One of the side-effects of this change is that the WireGuard port can
now be specified individually for each node in the mesh, if the
administrator wishes to do so.

*Note*: this commit introduces a breaking change; the
`force-external-ip` node annotation has been removed; its functionality
has been ported over to the `force-endpoint` annotation. This annotation
is documented in the annotations.md file. The expected content of this
annotation is no longer a CIDR but rather a host:port. The host can be
either a DNS name or an IP.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-22 17:17:13 +01:00
Lucas Servén Marín
223b641ee1
manifests: set MTU for CNI bridge
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-22 16:57:01 +01:00
Lucas Servén Marín
134cbe90be
pkg/route,pkg/mesh: replace NAT with ip rules
This commit entirely replaces NAT in Kilo with a few iproute2 rules.
Previously, Kilo would source-NAT the majority of packets in order to
avoid problems with strict source checks in cloud providers causing
packets to be considered martians. This source-NAT-ing made it
difficult to correctly apply Kuberenetes NetworkPolicies based on source
IPs.

This rewrite instead relies on a handful of iproute2 rules to ensure
that packets get encapsulated in certain scenarios based on the source
network and/or source interface.

This has the benefit of avoiding extra iptables bloat as well as
enabling better compatibility with NetworkPolicies.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-20 21:27:50 +01:00
Lucas Servén Marín
4857d10da1
pkg/iptables: clean up, remove NAT
This commit cleans up the iptables package to allow other packages to
create rules.

This commit also removes all NAT from Kilo.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-20 21:23:23 +01:00
Lucas Servén Marín
2603cd50db
pkg/mesh: fix ip allocator helper
This commit fixes the ip allocator `newAllocator` to produce IP
addresses with the original network mask. This is makes more sense. The
original functionality can be reproduced by wrapping the produced IP
address with the `oneAddressCIDR` helper.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-20 13:54:11 +01:00
Francis Nguyen
6de0f9805a
Define WireGuard PersistentKeepAlive via Annotation (#31)
* Add WireGuardPersistentKeepAlive to mesh.Node

* Connect to configuration

* Shorten keepalive key

* Fix casing on keepalive

* Add annotated keepalive value to peer functions
2020-02-13 10:16:55 +01:00
Lucas Servén Marín
a6afc3247d
manifests: ensure kube-bridge uses latest CIDR
This commit ensures that the kube-bridge uses the latest CIDR assigned
by the Kubernetes API, rather than defaulting to a previously assigned
CIDR.

xref:
* https://github.com/containernetworking/plugins/tree/master/plugins/main/bridge#network-configuration-reference
* https://github.com/cloudnativelabs/kube-router/issues/689

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-10 16:04:44 +01:00
Lucas Servén Marín
63987713dd
pkg/k8s: update generated files 2020-01-09 00:15:36 +01:00
Lucas Servén Marín
aecc5ec73b
.travis: update multiarch emulation 2020-01-09 00:15:19 +01:00
Lucas Servén Marín
eb0500f994
Makefile: ensure repo is clean before testing 2020-01-08 18:05:27 +01:00
Lucas Servén Marín
4b2f6c6692
Makefile: use official alpine images for build
This commit modifies the build tooling so that we use the official
alipne build images rather than the images from the multiarch org. This
requires new logic to parse docker manifests but results in a cleaner
solution with fewer architecture definitions.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-01-08 17:38:47 +01:00
Lucas Servén Marín
5277ab5bad
docs,pkg: use new well-known region label
This commit updates the well-known label to determine the region of the
node to topology.kubernetes.io/region, which is the new standard as
defined by the Kubernetes documentation, now that
failure-domain.beta.kubernetes.io/region has been deprecated.
2020-01-07 18:41:55 +01:00
Lucas Servén Marín
0cbb316ec3
Makefile: bump alpine version 2020-01-07 15:08:05 +01:00
Lucas Servén Marín
4acdca89e5
Makefile: allow headers to have old years 2020-01-07 15:07:34 +01:00
Lucas Servén Marín
c9c2e9bc42
*: bump golang to 1.13.4
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2019-11-15 15:02:38 +01:00
Lucas Servén Marín
f135a16427
Makefile: bump to alpine 3.10
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2019-11-15 15:00:36 +01:00
Lucas Servén Marín
4b220b42c5
Dockerfile
The certificates for the alpine APK repositories expired today [0],
breaking builds. This switches the configured repos to ones that work.
It also changes the `main` repo to use HTTPS.

[0] uk.alpinelinux.org expired Nov 15 2019 at 02:00:31 UTC

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2019-11-15 14:59:41 +01:00
Lucas Servén Marín
4febbdbfe5
pkg/iptables: fix out of bounds err
This fixes two bugs in the iptables package that can cause out of bounds
errors.

Fixes: #22

Thanks to @SerialVelocity for reporting.
2019-09-27 11:10:55 +02:00
Lucas Servén Marín
3facc9f34f
cmd/kg: only delete iface if requested
This commit modifies the default behavior of Kilo so that the WireGuard
interface is only deleted on shutdown if explicitly requested.

Fixes: https://github.com/squat/kilo/issues/17#issuecomment-534658157
2019-09-25 13:45:31 +02:00
Lucas Servén Marín
e83db17d88
pkg/iptables: add rules in correct order
This commit takes a big step towards ensuring that iptables rules are
always kept in the correct order. Specifically, when re-setting a a
ruleset, any time a rule is missing, that rule and all following rules
are re-added to ensure that from that index onwards all rules are in the
right order. Similarly, when reconciling an existing ruleset against the
backend, if a rule is missing, that rule an all following rules are
re-added.

This change does not guarantee that the order of rules in the backend
is correct. Unless an actor is modifying the order of rules in iptables,
all rules created by Kilo should now be kept in the correct order.

Fixes: #19
2019-09-25 13:23:31 +02:00
Lucas Servén Marín
1265ce0cd5
pkg/route: filter invalid route updates
This commit fixes the underlying issue that caused crashes when
receiving a nil route update, as reported in
https://github.com/squat/kilo/issues/17.
2019-09-24 16:13:14 +02:00
Lucas Servén Marín
20349de548
pkg/wireguard: allow specifying iface named
This commit makes it possible to specify the Kilo interface name. If the
specified interface exists, it will be used; if it does not exist, Kilo
will create it. If the interface already existed, then it will not be
deleted on shutdown; otherwise Kilo will destroy the interface.

Fixes: https://github.com/squat/kilo/issues/8
Addresses: 1/2 of https://github.com/squat/kilo/issues/17
2019-09-24 16:05:10 +02:00
Lucas Servén Marín
9fda84ec05
docs,README: fix kubeconfig env var 2019-09-24 01:00:43 +02:00
Lucas Servén Marín
3df87f0e71
cmd/kgctl: allow specifying port 2019-09-24 01:00:16 +02:00
Lucas Servén Marín
676007938e
pkg/mesh: add peers to graph 2019-09-23 17:54:16 +02:00
Lucas Servén Marín
887806c7ce
Makefile: fix latest manifest 2019-09-20 00:56:25 +02:00
Lucas Servén Marín
f04944df4a
Makefile: fix arm image 2019-09-19 21:48:47 +02:00
Lucas Servén Marín
7c90a40c5a
Makefile: fix arm64 image 2019-09-08 12:02:34 +02:00
Lucas Servén Marín
c93fa1e5b1
Dockerfile: fix cni plugins for arm
This commit ensures that the architecture of the installed CNI plugins
corresponds to the architecture of the container.
2019-08-16 17:45:36 +02:00
sam
5fc13de6cb manifests: change the kubeconfig hostPath for k3s
Enhancement: change the kubeconfig hostPath for k3s agent nodes. This makes it easier to install Kilo on k3s as no manual kubeconfig copying is necessary. (#14)
2019-08-14 08:55:15 +02:00
Lucas Servén Marín
d385686fa9
manifests: add selector to daemonsets
Fixes #9
2019-08-01 16:51:03 +02:00
Lucas Servén Marín
b6b5974fbe
docs: update multi-cluster-svcs 2019-07-30 15:09:12 +02:00
Lucas Servén Marín
1d5e3685e3
manifests: update API groups
This commit updates the API group for DaemonSets to apps/v1
and the API version for ClusterRoles to v1.
2019-07-16 23:41:20 +02:00
Lucas Servén Marín
d299a8875f
README: clarify and fix grammar 2019-07-16 23:31:27 +02:00
Lucas Servén Marín
8e755cf52e
pkg: allow overriding internal IP
This addresses the request for enhancement in
https://github.com/squat/kilo/issues/7.
2019-07-15 17:24:35 +02:00
Lucas Servén Marín
82fe418f89
Dockerfile: update alpine repo for wg 2019-05-22 10:26:20 +02:00
Lucas Servén Marín
7d77f87ba0
docs: fix links 2019-05-18 02:43:07 +02:00
Lucas Servén Marín
55280ab09b
manifests: default hostname to spec.nodeName
Not all K8s installs will correctly match the node's hostname to the
node's name in the API. We can get around this by setting the name Kilo
uses to the node name in the API.
2019-05-17 22:29:55 +02:00
Lucas Servén Marín
51df7fc4e3
pkg/mesh: don't let hostname resolution stop mesh
If the hostname fails to resolve, this should not be considered a
blocking error. Most likely, it means that the hostname is simply not
resolvable, which should not be a requirement to run Kilo. In this case,
simply try to find a valid IP from other sources.
2019-05-17 18:09:31 +02:00
Lucas Servén Marín
c9969f5be9
Makefile: improve tooling
This commit improves the tooling for the repo and makes all go binaries
managed with go mod. This ensures all tooling is vendored.
2019-05-17 00:23:56 +02:00
Lucas Servén Marín
ca70fec14f
vendor: revendor 2019-05-17 00:23:05 +02:00
Lucas Servén Marín
adb09ce620
Makefile,Dockerfile: add multi-arch images
This commit changes the build-system for Kilo to create container images
for multiple architectures. This will enable running Kilo on Arm
devices, e.g. Raspberry Pis. This is accomplished using Docker
manifests.
2019-05-16 22:53:43 +02:00
Lucas Servén Marín
81d6077fc2
manifests,pkg/encapsulation: Flannel compatibility
This commit adds basic support to run in compatibility mode with
Flannel. This allows clusters running Flannel as their principal
networking solution to leverage some advances Kilo features. In certain
Flannel setups, the clusters can even leverage muti-cloud. For this, the
cluster needs to either run in a full mesh, or Flannel needs to use the
API server's external IP address.
2019-05-14 01:01:58 +02:00
Lucas Servén Marín
cd6eeeb1e7
pkg/{encapsulation,mesh}: abstract encapsulation
This commit abstracts away encapsulation to more easily allow for
different types of encapsulation or compatibility with other networking
solutions.
2019-05-13 18:30:03 +02:00
Lucas Servén Marín
d7ad946ff4
pkg/mesh: ignore CNI IP from private IPs
We need to ignore the CNI IP address from the searched IPs, as this will
not be a routable IP address.
2019-05-13 17:35:08 +02:00
Lucas Servén Marín
8ed1b549d1
pkg/mesh: edge case external = internal
Add an exception to the route generation rules for when the external IP
of a node equals the internal IP. In this case, we cannot route traffic
through a tunnel.
2019-05-13 17:25:56 +02:00
Lucas Servén Marín
459262326e
README: fix k3s capitalization 2019-05-13 14:31:55 +02:00
Lucas Servén Marín
ad29121b27
Merge pull request #2 from fire/master
Add k3s.
2019-05-13 14:26:06 +02:00
K. S. Ernest (iFIre) Lee
0f87547a26
README: add instructions to use k3s. 2019-05-13 14:10:37 +02:00
K. S. Ernest (iFIre) Lee
81ce93dab7
manifests: add support for k3s 2019-05-13 14:10:13 +02:00