Commit Graph

214 Commits

Author SHA1 Message Date
leonnicolas
c1680372df
docs/annotations.md: docs for disable private ip
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-25 14:12:16 +01:00
Lucas Servén Marín
9a6ec98343
Merge pull request from squat/fix_graph
pkg/mesh: fix panic in graph
2021-03-25 13:05:55 +01:00
Lucas Servén Marín
d1948acd77
pkg/mesh: fix panic in graph
Commit 4d00bc56fe introduced a bug in the
Kilo graph generation logic. This commit used the WireGuard CIDR from
the topology struct as the graph title, however this field is nil
whenever the selected node is not a leader, causing the program to
panic.

This commit changes the meaning of the topology struct's wireGuardCIDR
field so that the field is always defined and the normalized value will
always be equal to the Kilo subnet CIDR. When the selected node is a
leader node, then the field's IP will be the IP allocated to the node
within the subnet. This effectively prevents the program from panicking.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-25 02:59:54 +01:00
Lucas Servén Marín
dc34682909
Merge pull request from squat/disable_private_ip
FEATURE: allow disabling private IPs
2021-03-24 21:09:35 +01:00
leonnicolas
9d10d4a3de
FEATURE: allow disabling private IPs
When forcing the internal IP to "" or "-", private IPs won't be used.
2021-03-13 23:33:18 +01:00
Lucas Servén Marín
3882d1baae
Merge pull request from squat/bug_ipip_rule_reconciliation
pkg/encapsulation/ipip.go: fix order of flags
2021-03-13 22:36:44 +01:00
leonnicolas
50ba744e74
pkg/encapsulation/ipip.go: fix order of flags 2021-03-13 19:55:00 +01:00
Lucas Servén Marín
dc33521374
Merge pull request from squat/bug_resync_period
pkg/mesh/mesh.go: actually add resync period
2021-03-13 16:37:17 +01:00
leonnicolas
db62b273c0
pkg/mesh/mesh.go: actually add resync period
resync period was not added to mesh struct.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-13 16:31:09 +01:00
leonnicolas
ba37d913e4
Merge pull request from squat/ipip_protocol_name
pkg/encapsulation/ipip*: fix ipip iptables rules
2021-03-13 15:37:23 +01:00
Lucas Servén Marín
ede3118cc8
pkg/encapsulation/ipip*: fix ipip iptables rules
Since  implemented fragile comparisons of iptables rules to avoid
calling the iptables binary excessively during every reconciliation, the
iptables rules for IPIP encapsulation must be updated to match the
expected output. One complication is that rather than returning the
protocol number in the rule, iptables resolves the protocol number to a
name by looking up the number in the netd protocols database. This name
can vary depending on the host's environment. This commit adds two
solutions for resolving the protocol name:
1. a fixed mapping to the string `ipencap`, which should always work
for Kilo whenever it runs in the Alpine Linux container; and
2. a runtime lookup using the netd database, which only works if Kilo is
compiled with CGO and is meant to be used only if Kilo is not running in
the normal container environment.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-13 15:24:55 +01:00
Lucas Servén Marín
ce1b95251e
Merge pull request from squat/update_docusaurus
website: update docusaurus
2021-03-10 14:41:56 +01:00
Lucas Servén Marín
259d2a3d8b
website: update docusaurus
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-10 14:31:55 +01:00
Lucas Servén Marín
c85fbde2ba
docs/vpn.md: add clarification
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-09 16:58:07 +01:00
Lucas Servén Marín
251e8fac40
Merge pull request from squat/172-16-slash-12
pkg/mesh: correctly check 172.16/12 IP range
2021-03-06 01:06:36 +01:00
Lucas Servén Marín
39803cef66
pkg/mesh: correctly check 172.16/12 IP range
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-06 00:50:48 +01:00
Lucas Servén Marín
90a2540487
Merge pull request from squat/172-16-slash-12
pkg/mesh: correctly idenitfy 172.16/12 IPs
2021-03-05 18:32:59 +01:00
Lucas Servén Marín
7cc707f335
pkg/mesh: correctly idenitfy 172.16/12 IPs
Currently Kilo incorrectly identifies the 172.16/12 private IP range.
This commit fixes the logic.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-05 18:27:12 +01:00
Lucas Servén Marín
4d1756c23a
Merge pull request from squat/kubeamd_cni_path
manifests: fix kubeadm CNI path
2021-03-04 14:06:13 +01:00
Lucas Servén Marín
a408ce9f35
manifests: fix kubeadm CNI path
As discussed in
https://github.com/squat/kilo/issues/129#issuecomment-789651850,
the Kilo manifests for kubeadm install the CNI configuration in the
wrong directory. They are using /etc/kubernetes/cni/net.d [0] when they
should be using /etc/cni/net.d [1].

[0]
https://github.com/squat/kilo/blob/main/manifests/kilo-kubeadm.yaml#L163
[1]
https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#cni

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-04 12:53:46 +01:00
Lucas Servén Marín
2b959f7020
Merge pull request from squat/resync-period
cmd/kg,pkg: add --resync-period flag
2021-03-02 13:18:49 +01:00
Lucas Servén Marín
7a74d87cc7
Merge pull request from squat/dependabot/npm_and_yarn/website/prismjs-1.23.0
build(deps): bump prismjs from 1.21.0 to 1.23.0 in /website
2021-03-02 08:56:23 +01:00
dependabot[bot]
b0e670eb76
build(deps): bump prismjs from 1.21.0 to 1.23.0 in /website
Bumps [prismjs](https://github.com/PrismJS/prism) from 1.21.0 to 1.23.0.
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PrismJS/prism/compare/v1.21.0...v1.23.0)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-01 21:04:33 +00:00
Lucas Servén Marín
8dbbc636b5
cmd/kg,pkg: add --resync-period flag
This commit introduces a new `--resync-period` flag to control how often
the Kilo controllers should reconcile.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-01 18:20:06 +01:00
Lucas Servén Marín
c060bf24e2
Merge pull request from squat/reduce_iptables_calls
pkg/iptables: reduce calls to iptables
2021-02-26 22:17:04 +01:00
Lucas Servén Marín
4b32c49ae1
pkg/iptables: add logger to iptables controller
This commit adds a logger to the iptables controller using the options
pattern. It also logs when the controller needs to reset rules, to be
able to identify costly reconciliations.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-26 20:54:16 +01:00
Lucas Servén Marín
4c43548bd6
Merge pull request from squat/simply
docs: remove use of 'simply'
2021-02-26 11:25:33 +01:00
Lucas Servén Marín
18e2e752f6
docs: remove use of 'simply'
Let's make the documentation more inclusive and sensitive of the
familiarity and comfort of users.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-26 11:16:08 +01:00
Lucas Servén Marín
7fc50871ca
Merge pull request from squat/rename_branch_to_main
*: rename branch to main
2021-02-26 11:04:05 +01:00
Lucas Servén Marín
c5d0debab6
*: rename branch to main
This commit renames the principal branch of the repository to `main`!

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-26 10:46:31 +01:00
leonnicolas
0d0fdda619
Merge pull request from squat/maintainers
MAINTAINERS.md: propose @leonnicolas as maintainer
2021-02-20 20:58:39 +01:00
Lucas Servén Marín
f032c1182d
MAINTAINERS.md: propose @leonnicolas as maintainer
This commit proposes [Leon](https://github.com/leonnicolas) as a
maintainer of Kilo. Leon has done tons of great work in the project in
feature development, bug triaging, and documentation. It would be a
privilege to have you join!

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-20 19:35:35 +01:00
Lucas Servén Marín
acfd0bbaec
pkg/iptables: reduce calls to iptables
Currently, every time the iptables controller syncs rules, it spawns an
an iptables process for every rule it checks. This causes two problems:
1. it creates unnecessary load on the system; and
2. it causes contention on the xtables lock file.

This commit creates a lazy cache for iptables rules and chains that
avoids spawning iptables processes. This means that each time the
iptables rules are reconciled, if no rules need to be changed then at
most one iptables process should be spawned to check all of the rules in
a chain and at most one process should be spawned to check all of the
chains in a table.

Note: the success of this reduction in calls to iptables depends on a
somewhat fragile comparison of iptables rule text. The text of any rule
must match exactly, including the order of the flags. An improvement to
come would be to implement an iptables rule parser than can be used to
check semantic equivalence betweem iptables rules.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-20 19:24:06 +01:00
Lucas Servén Marín
afea50a388
Merge pull request from leonnicolas/bug_encapsulation
pkg/mesh/mesh.go: iptables rules in encapsulation
2021-02-20 09:13:07 +01:00
leonnicolas
52d8d13047
pkg/mesh/mesh.go: iptables rules in encapsulation
Because of new naming conventions for locations, the CIDRs were not
being set within locations.
This lead to no iptables rules added for nodes in the same location.
2021-02-20 02:00:57 +01:00
Lucas Servén Marín
4ae1ccf1e8
Merge pull request from SerialVelocity/patch-1
Vulnerability: Don't add generic ACCEPT rules to the filter chain
2021-02-15 14:08:36 +01:00
Ben Grabham
709c1ec6c0
Don't add generic ACCEPT rules to the filter chain 2021-02-15 12:00:25 +00:00
Lucas Servén Marín
0eaefc5e6e
Merge pull request from leonnicolas/release_binaries
.github/workflows/ci.yml: publish binaries
2021-02-14 19:53:58 +01:00
leonnicolas
2164e7003f
.github/workflows/ci.yml: publish binaries
All kgctl will be published on each new release.
The naming convention is kgctl-<os name>-<architecure>
2021-02-14 19:33:24 +01:00
Lucas Servén Marín
7ea8c1bc64
.github: allow workflow to be triggered manually
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-08 19:49:07 +01:00
Lucas Servén Marín
539a139a16
Merge pull request from squat/migrate_to_github_actions
.github/workflows: migrate to github actions
2021-01-31 15:13:27 +01:00
Lucas Servén Marín
c4c8fe81cc
.github/workflows: migrate to github actions
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-31 15:09:11 +01:00
Lucas Servén Marín
fd8bee718b
Merge pull request from squat/no_private_iface
pkg/mesh: don't shadow privIface
2021-01-30 20:16:49 +01:00
Lucas Servén Marín
03545d674f
pkg/mesh: don't shadow privIface
This commit fixes a bug where the variable holding the index of the
private interface was shadowed, causing it to always be "0".

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-30 20:09:50 +01:00
Lucas Servén Marín
f61b902128
Merge pull request from leonnicolas/bug_iptables
BUG: iptables rules
2021-01-30 17:42:28 +01:00
Lucas Servén Marín
64fb06a383
pkg/k8s: bump headers for 2021
This commit re-generates all generated files to include the new year in
the comment.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-30 17:40:01 +01:00
leonnicolas
448f618c60
BUG: iptables rules
Add default iptables to allow forward traffic from and to pod cidr.

Previously Kilo expected the default behaviour of the forward chain to
accept packets, which can not be guaranteed.
2021-01-30 12:52:30 +01:00
Lucas Servén Marín
3563e660dc
Merge pull request from squat/fix_graph_title
pkg/mesh/graph.go: use WireGuard CIDR as title
2021-01-29 18:21:11 +01:00
Lucas Servén Marín
4d00bc56fe
pkg/mesh/graph.go: use WireGuard CIDR as title
This commit changes the graph so that the WireGuard CIDR is used as the
title rather than the pod subnet assigned to a node in the cluster.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-29 15:49:42 +01:00
Lucas Servén Marín
27ca2d4b17
Merge pull request from leonnicolas/nodes_without_private_ips
Nodes without private IPs
2021-01-24 23:21:51 +01:00