59 Commits

Author SHA1 Message Date
Murali Reddy
df6b375f4e
AWS: perform disable src-dst check only if node has necessary IAM. Also introduce delay (#319)
between ec2 api calls, so that requests are not rejected due to API throttling

Fixes: #313
2018-02-23 13:08:52 +05:30
Sergey Lanzman
617c773655 code cleanup (#301) 2018-02-08 00:51:15 +01:00
Joakim Karlsson
12aec99844 added heartbeats 2018-02-03 22:43:34 +01:00
Murali Reddy
193776c568
prevent calling gobgp AddNeighbour call before GoBGP server is properly started (#296) 2018-02-01 01:56:40 +01:00
Joakim Karlsson
f3e7aced1a Metrics + Logging update (#294)
* - added protocol & port label to metrics
- removed some redundant code

* added example dashboard

* added dashboard screenshot

* updated dashboard json & screenshot

* ammend bad dashboard export

* first new metric

* .

* more metrics: controller_publish_metrics_time & controller_iptables_sync_time

* namespace redeclared

* fix typo in name

* smal fixes

* new metric controller_bgp_peers & controller_bgp_internal_peers_sync_time

* typo fix

* new metric controller_ipvs_service_sync_time

* fix

* register metric

* fix

* fix

* added more metrics

* service controller log levels

* fix

* fix

* added metrics controller

* fixes

* fix

* fix

* fixed more log levels

* server and graceful shutdown

* fix

* fix

* fix

* code cleanup

* docs

* move metrics exporting to controller

* fix

* fix

* fixes

* fix

* fix missing

* fix

* fix

* test

* test

* fix

* fix

* fix

* updated dashboard

* updates to metric controller

* fixed order in newmetricscontroller

* err declared and not used

* updated dashboard

* updated dashboard screenshot

* removed --metrics & changed --metrics-port to enable / disable metrics

* https://github.com/cloudnativelabs/kube-router/issues/271

* cannot use config.MetricsPort (type uint16) as type int in assignment

* cannot use mc.MetricsPort (type uint16) as type int in argument to strconv.Itoa

* updated docs

* changed default metric port to 0, disabled

* added missing newline to .dockerignore

* add lag parse to pickup on -v directives

* test

* test

* test

* fix regression

* syntax error: non-declaration statement outside function body

* fix

* changed nsc to mc

* updated docs

* markdown fix

* moved metrics registration out to respective controller so only metrics for running parts will be exposed

* removed junk that came from visual studio code

* fixed some typos

* Moved the metrics back into each controller and added expose behaviour so only the running components metrics would be published

* removed to much, added back instanciation of metricscontroller

* fixed some invalid  variable names

* fixed last typos on config name

* fixed order in newnetworkservicecontroller

* updated metrics docs & removed the metrics sync period as it will obey the controllers sync period

* forgott to save options.go

* cleanup

* Updated metric name & docs

* updated metrics.md

* fixed a high cpu usage bug in the metrics_controller's wait loop
2018-01-25 22:56:51 +05:30
Andrew Sy Kim
78588fc3a3 tunnel interface names cannot be longer than 15 characters (#274) 2018-01-07 18:23:13 +05:30
Andrew Sy Kim
50dcc32dd8 Unit Tests for Node Update Events (#265)
* activeNodes should not be a global variable for better testability

* OnNodeUpdate unit tests
2018-01-03 11:54:29 +05:30
Andrew Sy Kim
4eca430b63 route controller unit tests (#264) 2017-12-29 08:55:22 +05:30
Murali Reddy
c4830aa4e0
enable Pprof with option --enable-pprof (#245)
* rename to connectExternalBGPPeers

* enable pprof for debug purpose
2017-12-12 12:06:38 +05:30
Colin J. Brigato
fcd1a1aab6 Enable support for eBGP Multihop for external peers (#244) 2017-12-12 08:52:55 +05:30
Andrew Sy Kim
2685367ab6 add --enable-ibgp flag (#227) 2017-11-27 21:53:44 +05:30
Andrew Sy Kim
bca422105b --bgp-graceful-restart flag should apply for global peers (#226) 2017-11-23 02:31:57 +05:30
Murali Reddy
7c9db2c721 sync with iBGP peers only after RIB is polulated first 2017-11-23 01:45:15 +05:30
Andrew Sy Kim
0dabd7cf11 Support BGP Graceful Restart (#220) 2017-11-23 01:12:36 +05:30
Murali Reddy
97fb3423f7
explicilty create kube-bridge interface. Earlier when pod is launched on the node (#225)
bridge CNI plug-in was setting up. Which leads to errors when no pod is launched on a node.

Fixes #223
2017-11-21 18:54:07 +05:30
Murali Reddy
28c5dd20ef
use table id instead of table name for custom routing tables (#215) 2017-11-08 07:35:47 +05:30
Murali Reddy
4ca0afa82c Support for advertising service external IP to be configured BGP peers (#203)
introduces new flag `--advertise-external-ip`

Fixes #161
2017-10-17 00:54:19 +05:30
Murali Reddy
665e6676b2 Fix to avoid re-adding existing BGP export policy, and policy assignment (#200)
Fixes #197
2017-10-16 00:50:41 +05:30
Murali Reddy
50173e3b73 Support for 32 bit ASN numbers specifically the range 4200000000 - 4294967294 as specified by RFC 6996 (#196)
Fixes #194
2017-10-13 01:41:53 +05:30
Bryan Zubrod
342ea5ac9f Prevent masquerading pod -> NodeIP traffic (#174)
* Move getNodeIP logic to utils package

Remove redundant ipset lookups

utils.NewIPSet() does this for us.

* Don't masquerade pod -> nodeAddrsIPSet traffic

Previously with Pod egress enabled, this would get masqueraded.
This change also adds cleanup for said ipset.

* Enhanced cleanup of Pod egress, overlay networking

- Delete old/bad pod egress iptables rule(s) from old versions
- When pod egress or overlay are disabled, cleanup as needed

* Update IPSet.Sets to map type

* ipset enhancements

- Avoid providing method that would delete all ipset sets on a system
- New method DestroyAllWithin() destroys sets tracked by an IPSet
- Create() now handles cases where Sets/System state are not in sync
- Refresh() now handles leftover -temp set gracefully
- Swap() now uses ipset swap
- Delete() improved sync of Sets and system state
- Get() now validates if map element exists before trying
- etc

* Update routes controller to reflect ipset changes
2017-10-07 04:14:13 -05:00
ryarnyah
3debbfa4e2 Cleanup ipset create function + restore (#177)
* Cleanup ipset create function + restore. Fix #176

Switch from array to map to simplify set use

* Add sets initialization on create
2017-10-06 15:58:48 -05:00
bzub
a5a446a6ca Use forward domain notation for annotations
"kube-router.io/..."
This is in line with convention set by k8s upstream.
2017-10-05 22:18:18 -05:00
Ryar Nyah
3431a1831f Delete ipset dependency + delete unused ipsets 2017-09-25 21:17:25 +02:00
Bryan Zubrod
e19f2a69c2 BGP peer password auth, consistent configurations (#164)
* Add --peer-router-password option
Also:
- Consolodated NRC peer fields into a []config.NeighborConfig
  to store address, asn, and password for each peer.
- BREAKING: --peer-router and --peer-asn flags now take slices
  rather than strings.

* Add password auth node annotation for external peer

* Update documentation

New CLI flags and annotations
Renamed ones as well

* Consistent CLI flags, annotations, and peer config

BGP configs now all accept multiple values and are treated consistently.
Other refactoring was done as well.

* Stop bgpserver on peering errors to avoid listener leak

* Clarify BGP doc sections

Fix some typos
2017-09-24 23:21:12 -05:00
Bryan Zubrod
d6ea74067e Dynamic gobgpd listener config, fix leaked listener (#156)
* bgpserver: listen only on enabled address protocols
* tiny typo fix
* Ensure gobgp server listener gets closed
2017-09-16 02:11:32 -05:00
Murali Reddy
ca97d0d6eb Adding ability to disable IP-in-IP tunnelining for cross node pod-to-pod connectivity
where nodes are in different subnet. With tunneling disabled its expected that default
gateway has learned the pod CIDR's allocated for all the nodes and can route the
pod-to-pod traffic across nodes in different subnets

Fixes #119
2017-09-08 22:03:09 +05:30
Murali Reddy
f6a5e239f0 fixing gofmt, go_vet, gocyclo, golint errors 2017-09-04 17:10:48 +05:30
Murali Reddy
020d93238e fixing gofmt, go_vet, gocyclo, golint errorswq 2017-09-04 14:49:45 +05:30
Murali Reddy
c9c6107ddd Merge pull request #143 from cloudnativelabs/pbr_tunnels
Setup policy-based routing so that traffic arriving on a tunnel interface leaves on same tunnel interface irrespective of rp_filter value
2017-09-02 06:07:12 +05:30
Murali Reddy
7b9eedcd7c Setup policy-based routing so that traffic arriving on a tunnel interface leaves on same tunnel interface irrespective of rp_filter value
- ip rule to lookup custom route table for packets arriving from the pods
    - in the custom route table add route to route traffic to remote node through tunnel interface

Fixes #138
2017-09-02 04:00:20 +05:30
Murali Reddy
ed935a4d7a fix gofmt, go_vet, misspells 2017-09-02 00:29:35 +05:30
Murali Reddy
ff079d205a Enable netfilter for bridge, requirement for all CNI that use bridge
https://kubernetes.io/docs/concepts/cluster-administration/network-plugins/#network-plugin-requirements

Fixes #141
2017-08-29 20:13:33 +05:30
Murali Reddy
11a779f78c Add iptable rule in filter table FORWRD chain to allow traffic in and out to the pods
Fixes #120
2017-08-14 18:08:47 +05:30
Bryan Zubrod
c81bfbb616 Enable pod egress masquerading by default (#111)
* Enable pod egress masquerading by default
- Adds flag "--enable-pod-egress" (default: true)
- Removes previously created iptables rule if option is changed to false
* Use an ipset to match Pod egress traffic to be masqueraded
* Set --cluster-cidr as depreciated flag
If set to anything, normal dynamic Pod egress masquerading is turned on.
* Use Replace else Add logic for updating export policy
Fixes errors logged due to existing statement in poliy.
2017-08-10 11:50:06 -05:00
Murali Reddy
898d78d688 reduce ipip tunnel MTU 20 to accommodate the tunnel overhead
Fixes #108
2017-08-07 19:35:36 +05:30
Murali Reddy
b8d3914242 Use IP-IP tunnelling for cross-subnet pod connectivity
- create a ipip tunnel interface from each node to nodes in the different subnet
- insert route to local routing table using tunnel device

Fixes #92
2017-08-06 13:05:14 +05:30
Bryan Zubrod
f8174a66be network_route_controller: Avoid redundant policy sets (#98)
* gofmt

* route_controller: Avoid redundant DefinedSet adds
2017-08-03 02:49:20 -05:00
Murali Reddy
449f1bfcc6 fix Source/destination check disable logic 2017-07-21 15:20:42 +05:30
Murali Reddy
ef66b01002 WIP prometheus metrics: add pps in and out per service backend 2017-07-20 01:01:38 +05:30
Murali Reddy
83ca0c42d7 BGP export polices to advertise routes so that extra hop is avoided
Fixes #71
2017-07-19 21:13:03 +05:30
Murali Reddy
3f062f2828 fixing regression due to #71 2017-07-18 05:57:29 +05:30
Murali Reddy
e3ea82a1d1 add a BGP export policy on each node so that, learned routes
from iBGP peers are never advertised to global peer

Fixes #71
2017-07-18 04:04:30 +05:30
Murali Reddy
fb09646212 on BGP peer down, advertised route from peer is not cleaned-up in local routing table
Fixes #69
2017-07-17 09:20:11 +05:30
Murali Reddy
beb39cc54b When running on AWS disable source-destination checks automatically
Fixes #35
2017-07-15 01:50:19 +05:30
Bryan Zubrod
a3bddf6ecd services-controller: Add LoadBalancer Service support (#53)
* Allow LoadBalancer Service type
* Update docs
2017-07-11 18:12:11 -05:00
Bryan Zubrod
5af635a9bc CI: Automated build/release workflow (#46)
TLDR; Run "make help" for options.

* gofmt
* .gitignore kube-router binary
* Docs: build/release workflow
* Implement build/release workflow
2017-07-09 11:21:26 -05:00
bzub
cb661f871c controller: - Replace panics with errors
- Add context to errors for debugging
            - Refactor init() code so ipset isn't required to run
              "kube-router --help" for example
2017-07-05 21:57:29 -05:00
Murali Reddy
a757ea3203 Allow multiple peer routers specified through global BGP peer router flag '--peer-router'.
Node annotation to specifiy BGP peer routers also supports one or more BGP peers.

Fixes #37
2017-07-03 22:53:04 +05:30
Murali Reddy
2703522040 Support more than a single AS per cluster and configurable node specific
external BGP routers

Fixes #22
2017-06-13 10:22:22 +05:30
Murali Reddy
29396f9662 add option '--hostname-override' to deal with cases where kubelet is launched
with --hostname-override flag

Fixes #23
2017-06-10 07:10:38 +05:30