iptables: Manage IP sets independently with the stateDB reconciler #31099
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/test |
joestringer
reviewed
Mar 4, 2024
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
3196dd5 to
1da753e
Compare
1da753e to
e8c781a
Compare
gandro
approved these changes
Mar 13, 2024
tklauser
reviewed
Mar 13, 2024
c55c6a6 to
75daa3d
Compare
tklauser
approved these changes
Mar 15, 2024
Add an immutable set data structure for use in objects stored in StateDB tables. The ImmSet[T] is useful when storing a relatively small set of items (1-1000). Implemented as a sorted slice. Mutations of the set clone the slice and lookups are implemented as binary searches. The benefit of this is a packed presentation, especially for value types (e.g. netip.Addr) which will cause less overhead for GC. Downside is that inserts and deletes become expensive when there are many items. Signed-off-by: Jussi Maki <jussi@isovalent.com> Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Add a stateDB table to store IP sets. This will be used in later commits to build an IP sets manager able to dynamically reconcile sets with v4 and v6 node IPs. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Add an independent cell to manage IP sets and reconcile them dynamically through the stateDB generic reconciler. The cell manages only two different sets, one related to the Node IPv4 addresses and the other one related to the Node IPv6 addresses. Other sets are not touched in any way. When IP sets are disabled, the IP sets manager tries to clean both Cilium managed IP sets at startup, to avoid leaving stale entries from previous runs. When IP sets are enabled, the IP sets manager exports two methods to add and remove IPs from a named set, respectively. The sets are updated in the relative stateDB table and the kernel state reconciled later using the `ipset` utility. The cell will be plumbed in the iptables cell in a later commit. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Remove IP sets management from iptables manager and use the new cell based on the stateDB reconciler. The node manager has been changed to use the new ipset manager methods. Also, a fake version of the cell has been added to mock the ipset manager in controlplane testing. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
ifName is not needed to install masquerading rules, hence remove it from the function signature. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
75daa3d to
250a17f
Compare
dylandreimerink
approved these changes
Mar 15, 2024
|
Removing some reviewers whose codeowners have already been covered. |
|
/test |
This was referenced Mar 19, 2024
|
This PR needs approval from current @cilium/tophat, as Dylan dropped from the team. |
aditighag
approved these changes
Mar 20, 2024
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an independent cell to manage IP sets and reconcile them dynamically through the stateDB generic reconciler.
The cell manages only two different sets, one related to the Node IPv4 addresses and the other one related to the Node IPv6 addresses. Other sets are not touched in any way.
When IP sets are disabled, the IP sets manager tries to clean both Cilium managed IP sets at startup, to avoid leaving stale entries from previous runs.
When IP sets are enabled, the IP sets manager exports two methods to add and remove IPs from a named set, respectively. The sets are updated in the relative stateDB table and the kernel state reconciled later using the
ipsetutility.This is a required step in preparation for the iptables manager refactoring that allows to react to devices and local node info changes. A PoC has already been developed and can be seen here.
Note to the reviewers: please review each commit individually.