Commit Graph

86 Commits

Author SHA1 Message Date
Lucas Servén Marín
e843262064
Merge pull request #152 from squat/check_netlink_events
pkg/route: correct route error check
2021-05-02 20:08:06 +02:00
leonnicolas
64ea86436f
pkg/k8s/apis/kilo/v1alpha1/types.go: add public key validation
Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-04-30 22:03:34 +02:00
Lucas Servén Marín
19abddf1fe
pkg/route: correct route error check
Currently, when the route controller processes updates from netlink, it
checks if the routes in the table are nil or have no destination.
However, we control this and can guarantee that it's never the case.
Instead, we should check if the routes from netlink are valid.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-04-30 18:17:51 +02:00
Lucas Servén Marín
166094b5ad
Merge pull request #148 from JulienVdG/sync-not-ready
RFC: Remove syncNodes/syncPeers 'not Ready' special case
2021-04-21 19:49:12 +02:00
Julien Viard de Galbert
2ac000c68a
Nat to nat (#146)
* wireguard: export an Endpoint comparison method

* Record discovered endpoints in node

* Synchronize DiscoveredEndpoints in k8s backend

* Add discoveredEndpointsAreEqual

* Handle discovered Endpoints in topology to enable NAT 2 NAT

* Refactor to use Endpoint.Equal

Compare IP first by default and compare DNS name first when we know the Endpoint was resolved.

* Drop the shallow copies of nodes and peers

Now that updateNATEndpoints was updated to discoverNATEndpoints and that
the endpoints are overridden by topology instead of mutating the nodes and
peers object, we can safely drop this copy.
2021-04-21 19:47:29 +02:00
Julien Viard de Galbert
81f592de74 Remove syncNodes/syncPeers not Ready special case
First the comment "so remove it from the mesh" is wrong / missleading as
since 034c27ab78 the delete in that if is
not in there anymore.

Second the m.nodes map is not updated so setting `diff = true` will call `applyTopology` without any changes... which seams useless.

Third the rest of the code already checks for Ready so this special case
here should not be needed.
2021-04-21 11:33:37 +02:00
leonnicolas
a6fcab6878
pkg/mesh/graph.go: fix format
Previously the newlines were ignored by circo.
This lead to very flat ellipses.
Masked newlines "\\n" are correctly handeled.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-26 11:12:05 +01:00
Lucas Servén Marín
d1948acd77
pkg/mesh: fix panic in graph
Commit 4d00bc56fe introduced a bug in the
Kilo graph generation logic. This commit used the WireGuard CIDR from
the topology struct as the graph title, however this field is nil
whenever the selected node is not a leader, causing the program to
panic.

This commit changes the meaning of the topology struct's wireGuardCIDR
field so that the field is always defined and the normalized value will
always be equal to the Kilo subnet CIDR. When the selected node is a
leader node, then the field's IP will be the IP allocated to the node
within the subnet. This effectively prevents the program from panicking.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-25 02:59:54 +01:00
leonnicolas
9d10d4a3de
FEATURE: allow disabling private IPs
When forcing the internal IP to "" or "-", private IPs won't be used.
2021-03-13 23:33:18 +01:00
leonnicolas
50ba744e74
pkg/encapsulation/ipip.go: fix order of flags 2021-03-13 19:55:00 +01:00
leonnicolas
db62b273c0
pkg/mesh/mesh.go: actually add resync period
resync period was not added to mesh struct.

Signed-off-by: leonnicolas <leonloechner@gmx.de>
2021-03-13 16:31:09 +01:00
Lucas Servén Marín
ede3118cc8
pkg/encapsulation/ipip*: fix ipip iptables rules
Since #116 implemented fragile comparisons of iptables rules to avoid
calling the iptables binary excessively during every reconciliation, the
iptables rules for IPIP encapsulation must be updated to match the
expected output. One complication is that rather than returning the
protocol number in the rule, iptables resolves the protocol number to a
name by looking up the number in the netd protocols database. This name
can vary depending on the host's environment. This commit adds two
solutions for resolving the protocol name:
1. a fixed mapping to the string `ipencap`, which should always work
for Kilo whenever it runs in the Alpine Linux container; and
2. a runtime lookup using the netd database, which only works if Kilo is
compiled with CGO and is meant to be used only if Kilo is not running in
the normal container environment.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-13 15:24:55 +01:00
Lucas Servén Marín
39803cef66
pkg/mesh: correctly check 172.16/12 IP range
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-06 00:50:48 +01:00
Lucas Servén Marín
7cc707f335
pkg/mesh: correctly idenitfy 172.16/12 IPs
Currently Kilo incorrectly identifies the 172.16/12 private IP range.
This commit fixes the logic.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-05 18:27:12 +01:00
Lucas Servén Marín
8dbbc636b5
cmd/kg,pkg: add --resync-period flag
This commit introduces a new `--resync-period` flag to control how often
the Kilo controllers should reconcile.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-03-01 18:20:06 +01:00
Lucas Servén Marín
4b32c49ae1
pkg/iptables: add logger to iptables controller
This commit adds a logger to the iptables controller using the options
pattern. It also logs when the controller needs to reset rules, to be
able to identify costly reconciliations.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-26 20:54:16 +01:00
Lucas Servén Marín
acfd0bbaec
pkg/iptables: reduce calls to iptables
Currently, every time the iptables controller syncs rules, it spawns an
an iptables process for every rule it checks. This causes two problems:
1. it creates unnecessary load on the system; and
2. it causes contention on the xtables lock file.

This commit creates a lazy cache for iptables rules and chains that
avoids spawning iptables processes. This means that each time the
iptables rules are reconciled, if no rules need to be changed then at
most one iptables process should be spawned to check all of the rules in
a chain and at most one process should be spawned to check all of the
chains in a table.

Note: the success of this reduction in calls to iptables depends on a
somewhat fragile comparison of iptables rule text. The text of any rule
must match exactly, including the order of the flags. An improvement to
come would be to implement an iptables rule parser than can be used to
check semantic equivalence betweem iptables rules.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-02-20 19:24:06 +01:00
leonnicolas
52d8d13047
pkg/mesh/mesh.go: iptables rules in encapsulation
Because of new naming conventions for locations, the CIDRs were not
being set within locations.
This lead to no iptables rules added for nodes in the same location.
2021-02-20 02:00:57 +01:00
Ben Grabham
709c1ec6c0
Don't add generic ACCEPT rules to the filter chain 2021-02-15 12:00:25 +00:00
Lucas Servén Marín
03545d674f
pkg/mesh: don't shadow privIface
This commit fixes a bug where the variable holding the index of the
private interface was shadowed, causing it to always be "0".

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-30 20:09:50 +01:00
Lucas Servén Marín
f61b902128
Merge pull request #106 from leonnicolas/bug_iptables
BUG: iptables rules
2021-01-30 17:42:28 +01:00
Lucas Servén Marín
64fb06a383
pkg/k8s: bump headers for 2021
This commit re-generates all generated files to include the new year in
the comment.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-30 17:40:01 +01:00
leonnicolas
448f618c60
BUG: iptables rules
Add default iptables to allow forward traffic from and to pod cidr.

Previously Kilo expected the default behaviour of the forward chain to
accept packets, which can not be guaranteed.
2021-01-30 12:52:30 +01:00
Lucas Servén Marín
3563e660dc
Merge pull request #105 from squat/fix_graph_title
pkg/mesh/graph.go: use WireGuard CIDR as title
2021-01-29 18:21:11 +01:00
Lucas Servén Marín
4d00bc56fe
pkg/mesh/graph.go: use WireGuard CIDR as title
This commit changes the graph so that the WireGuard CIDR is used as the
title rather than the pod subnet assigned to a node in the cluster.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-29 15:49:42 +01:00
leonnicolas
3a201ba0fa
Nodes without private IPs
Allow nodes to have no private IPs.
Nodes without private IPs will automatically be put into
their own location.
2021-01-24 22:37:24 +01:00
Lucas Servén Marín
95c0143b1a
pkg/mesh/mesh.go: ignore Kilo IP during discovery
This ensures that Kilo will not select an IP assigned to the Kilo
interface when discovering public and private IPs.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-01-19 20:25:50 +01:00
leonnicolas
e30cff5293
FEATURE: user space wireguard
Add the possibility to use a user space implementation of wireguard. Specifically, the rust implementation boringtun.
2020-12-29 18:50:58 +01:00
Tadeuš Varnas
849449890d
Apply suggestions from code review
Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
2020-12-14 10:20:53 +02:00
varnastadues
cb12666fc1 feat: add support for custom topology label 2020-12-11 16:44:20 +02:00
Lucas Servén Marín
45cedbb84a
pkg/*: allow kgctl to compile for other OSes
This commit enables the compilation of kgctl when GOOS!=linux.
This fixes #56.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-11-14 12:16:07 +01:00
Lucas Servén Marín
5e970d8b42
pkg/mesh: small change for clarity
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-09-18 16:11:01 +02:00
Lucas Servén Marín
116fb7337a
pkg/k8s: enable peers to use DNS names
This commit enables peers defined using the Peer CRD to declare their
endpoints using DNS names.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-09-17 14:48:38 +02:00
Lucas Servén Marín
82c819659d
pkg/mesh: introduce kilo_leader guage metric
This commit introduces a new Prometheus metric to detect if the node is
a leader of its location, from its own point of view.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-05-25 10:16:50 +02:00
Lucas Servén Marín
9b19bbe69c
pkg/iptables: remove nil rules from list on error
Previously, when `deleteFromIndex` exited early due to an error, nil
rules would be left in the controller's list of rules, which could
provoke a panic on the next reconciliation. This commit ensures that nil
rules are removed before an early exit.

Fixes: #51

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-05-11 22:50:01 +02:00
Lucas Servén Marín
968d13148f
pkg/mesh: update persistent keepalive on change
Previously, when udpdating the persistent keepalive of a node via
annotations, the node's WireGuard configuration was not updated. This
corrects the behavior.

Fixes: #54

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-05-06 15:54:34 +02:00
Lucas Servén Marín
0a10dc921c
pkg/k8s/apis: support for preshared keys in peers
This commit adds support for defining preshared keys when declaring a
new Peer CRD. This preshared key will be used whenever the nodes in the
Kilo mesh communicate with that peer.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-05-05 11:36:43 +02:00
Lucas Servén Marín
e4829832c5
pkg/mesh: ensure persistent-keepalive set on nodes
A bug identified by @carlosrmendes caused nodes to ignore the
persistent-keepalive annotation.

xref: https://github.com/squat/kilo/issues/53#issuecomment-620945927

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-04-30 13:53:38 +02:00
Lucas Servén Marín
b668c1ec3e
pkg/iptables: enable simultaneous ipv4 and ipv6
This commit enables simultaneously managing IPv4 and IPv6 iptables
rules. This makes it possible to have peers with IPv6 allowed IPs in an
otherwise IPv4 stack and vice versa.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-12 16:07:48 +01:00
Lucas Servén Marín
7051b9fe29
pkg/mesh: enable outgoing NAT to WAN
This commit enables NAT-ing packets outgoing to the WAN from both the
Pod subnet as well as from peers. This means that Pods can access the
Internet and that peers can use the Kilo mesh as a gateway to the
Internet.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-09 18:45:01 +01:00
Lucas Servén Marín
8908cf19cb
pkg/iptables: re-organize rules
This commit better organizes the location of iptables rules. This is
made possible by exposing two new funcs, `NewRule` and `NewChain`.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-06 16:57:09 +01:00
Lucas Servén Marín
b54b31b699
pkg/mesh: enable generating config without peer
This commit re-enables old functionality, which permitted the generation
of the configuration for a cluster without any peers.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-06 16:06:41 +01:00
Lucas Servén Marín
810dae695e
pkg/wireguard: edge case when endpoints are nil
Peers may have nil endpoints, a case which must be gracefully handled.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-06 15:21:30 +01:00
Lucas Servén Marín
29280a987e
pkg/mesh,pkg/wireguard: sync NAT endpoints
This commit changes how Kilo allows nodes and peers behind NAT to roam.
Rather that ignore changes to endpoints when comparing WireGuard
configurations, Kilo now incorporates changes to endpoints for peers
behind NAT into its configuration first and later compares the
configurations.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-04 01:37:08 +01:00
Lucas Servén Marín
24d7c27901
pkg/mesh,docs: document and fix keepalive logic
This commit documents the use of the persistent-keepalive annotation and
corrects the implementation of keepalives.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-03-04 01:36:56 +01:00
Lucas Servén Marín
515a57a301
pkg/mesh: don't synchronize peer endpoints
Kilo had a routine that synchronized the endpoints of peers back into
the API to ensure that endpoints updated by WireGuard for a roaming peer
would always positively compare with the endpoints in the API. This is
no longer needed as Kilo will now simply ignore changes to endpoints for
peers with a non-zero persistent keepalive.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-28 15:07:23 +01:00
Lucas Servén Marín
0d199db009
pkg/wireguard: ignore changes to peers behind NAT
This commit enables Kilo to ignore changes to the endpoints of peers
that sit behind a NAT gateway. We use the heuristic of a non-zero
persistent keepalive to decide whether the endpoint field should be
ignored. This will allow NATed peers to roam and for every node in the
cluster to have a different value for a peer's endpoint, as is natural
when a peer's connections are NATed.

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-28 14:56:02 +01:00
Lucas Servén Marín
12220b790d
pkg/encapsulation: remove unused 'none' encapsulation 2020-02-22 22:42:02 +01:00
Lucas Servén Marín
e08920c4fb
pkg/mesh: allow fully disabling CNI
This commit fixes the issue encountered in #36, where the CNI config is
touched even though CNI management is disabled.

Fixes: #36

Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-22 22:37:01 +01:00
Lucas Servén Marín
409d738124
pkg/mesh: fix segfault in #36
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2020-02-22 22:16:45 +01:00