28 Commits

Author SHA1 Message Date
Joakim Karlsson
e53aef280c more work on healthchecks 2018-02-04 21:25:49 +01:00
Joakim Karlsson
12aec99844 added heartbeats 2018-02-03 22:43:34 +01:00
Joakim Karlsson
f3e7aced1a Metrics + Logging update (#294)
* - added protocol & port label to metrics
- removed some redundant code

* added example dashboard

* added dashboard screenshot

* updated dashboard json & screenshot

* ammend bad dashboard export

* first new metric

* .

* more metrics: controller_publish_metrics_time & controller_iptables_sync_time

* namespace redeclared

* fix typo in name

* smal fixes

* new metric controller_bgp_peers & controller_bgp_internal_peers_sync_time

* typo fix

* new metric controller_ipvs_service_sync_time

* fix

* register metric

* fix

* fix

* added more metrics

* service controller log levels

* fix

* fix

* added metrics controller

* fixes

* fix

* fix

* fixed more log levels

* server and graceful shutdown

* fix

* fix

* fix

* code cleanup

* docs

* move metrics exporting to controller

* fix

* fix

* fixes

* fix

* fix missing

* fix

* fix

* test

* test

* fix

* fix

* fix

* updated dashboard

* updates to metric controller

* fixed order in newmetricscontroller

* err declared and not used

* updated dashboard

* updated dashboard screenshot

* removed --metrics & changed --metrics-port to enable / disable metrics

* https://github.com/cloudnativelabs/kube-router/issues/271

* cannot use config.MetricsPort (type uint16) as type int in assignment

* cannot use mc.MetricsPort (type uint16) as type int in argument to strconv.Itoa

* updated docs

* changed default metric port to 0, disabled

* added missing newline to .dockerignore

* add lag parse to pickup on -v directives

* test

* test

* test

* fix regression

* syntax error: non-declaration statement outside function body

* fix

* changed nsc to mc

* updated docs

* markdown fix

* moved metrics registration out to respective controller so only metrics for running parts will be exposed

* removed junk that came from visual studio code

* fixed some typos

* Moved the metrics back into each controller and added expose behaviour so only the running components metrics would be published

* removed to much, added back instanciation of metricscontroller

* fixed some invalid  variable names

* fixed last typos on config name

* fixed order in newnetworkservicecontroller

* updated metrics docs & removed the metrics sync period as it will obey the controllers sync period

* forgott to save options.go

* cleanup

* Updated metric name & docs

* updated metrics.md

* fixed a high cpu usage bug in the metrics_controller's wait loop
2018-01-25 22:56:51 +05:30
Murali Reddy
f822109907
Prevent slice representing ipset growing forver resulting in excessive memory usage (#260)
Use refresh instead which internally used ipset swap

Fixes #228
2017-12-25 19:37:02 +05:30
Murali Reddy
84741b6a5e network policy: use 'addrtype' module and --src-type=LOCAL to match local traffic 2017-10-16 02:14:44 +05:30
Murali Reddy
9eb1848da5 Network policy: always permit traffic from local node to the pods irrespective of network policies (#195)
fixes #87
2017-10-13 00:43:29 +05:30
Murali Reddy
928deedf79 Support CIDR in network policy ingress and egress rules
Fixes #144
2017-10-12 12:54:17 +05:30
Murali Reddy
45cb08734e Network policy egress support
Fixes #103
2017-10-09 14:34:40 +05:30
Murali Reddy
0010425b8f bump up client-go to release-5.0 and vendor kubernetes/api
Fixes #178
2017-10-07 22:52:06 +05:30
Bryan Zubrod
342ea5ac9f Prevent masquerading pod -> NodeIP traffic (#174)
* Move getNodeIP logic to utils package

Remove redundant ipset lookups

utils.NewIPSet() does this for us.

* Don't masquerade pod -> nodeAddrsIPSet traffic

Previously with Pod egress enabled, this would get masqueraded.
This change also adds cleanup for said ipset.

* Enhanced cleanup of Pod egress, overlay networking

- Delete old/bad pod egress iptables rule(s) from old versions
- When pod egress or overlay are disabled, cleanup as needed

* Update IPSet.Sets to map type

* ipset enhancements

- Avoid providing method that would delete all ipset sets on a system
- New method DestroyAllWithin() destroys sets tracked by an IPSet
- Create() now handles cases where Sets/System state are not in sync
- Refresh() now handles leftover -temp set gracefully
- Swap() now uses ipset swap
- Delete() improved sync of Sets and system state
- Get() now validates if map element exists before trying
- etc

* Update routes controller to reflect ipset changes
2017-10-07 04:14:13 -05:00
Bryan Zubrod
5f58cd2786 Fix conditional so only matched pods are firewalled (#183) 2017-10-06 15:30:53 -05:00
Ryar Nyah
3431a1831f Delete ipset dependency + delete unused ipsets 2017-09-25 21:17:25 +02:00
Murali Reddy
f6a5e239f0 fixing gofmt, go_vet, gocyclo, golint errors 2017-09-04 17:10:48 +05:30
Murali Reddy
020d93238e fixing gofmt, go_vet, gocyclo, golint errorswq 2017-09-04 14:49:45 +05:30
Murali Reddy
ed935a4d7a fix gofmt, go_vet, misspells 2017-09-02 00:29:35 +05:30
Murali Reddy
1af19cbba2 NetworkPolicy: Fix e2e test failures
- Handle namespaceSelector in NetworkPolicyPeer
  - hanlde default allow and defaul deny policies as defined in
    https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-policies

Fixes #112
2017-08-18 02:50:56 +05:30
Murali Reddy
279bc66a99 Netork policy GA: select all pods in namespace if pod selector is not specified in the network policy spec
as per semantics https://kubernetes.io/docs/api-reference/v1.7/#networkpolicy-v1-networking

Fixes #90
2017-07-31 22:47:43 +05:30
Murali Reddy
922c9f5808 GA network policy does not reject if there is not a single source pod matching a policy
Fix ensures below two cases are explicitly handled

 - in the network policy spec for the ingress rule, its optionsl to give 'ports' and 'from' details
   when not specified it translates to match all ports, match all sources respectivley

 - user may explicitly give the 'ports' and 'from' details in the ingress rule. But at any given point
   its possible there is no matching pods (with labels defined in 'from') in the namespace.

Before the fix both the cases were handled similarly resulting in unexpected behaviour

Fixes #85
2017-07-29 16:53:52 +05:30
Murali Reddy
b4c063ee8a support for network policy GA
with this refactoring support for network policy V1 (or GA) is added.
Changes are backward compatible so beta network policy semantics
are still available for k8s ver 1.6.* and less

Fixes #16
2017-07-28 11:12:52 +05:30
bzub
b87454056c policy-controller: Don't check for depreciated LegacyHostIP 2017-07-12 21:53:34 -05:00
Bryan Zubrod
5af635a9bc CI: Automated build/release workflow (#46)
TLDR; Run "make help" for options.

* gofmt
* .gitignore kube-router binary
* Docs: build/release workflow
* Implement build/release workflow
2017-07-09 11:21:26 -05:00
bzub
cb661f871c controller: - Replace panics with errors
- Add context to errors for debugging
            - Refactor init() code so ipset isn't required to run
              "kube-router --help" for example
2017-07-05 21:57:29 -05:00
bzub
2b019ceec7 Handle invalid NetworkPolicy definition 2017-06-21 22:33:02 -05:00
Murali Reddy
29396f9662 add option '--hostname-override' to deal with cases where kubelet is launched
with --hostname-override flag

Fixes #23
2017-06-10 07:10:38 +05:30
Murali Reddy
d4f32978fb use NODE_NAME env variable to get the node object when running as daemon set
If NODE_NAME env is not set, fall back to hostname.

Partial fix towards #23 we still have issue where kube-router is run as agent
and kubelet is started with --hostname-overide flag
2017-06-07 02:28:21 +05:30
Murali Reddy
4531a915bb Handle both cases where node can be registered with master either
by host name or FQDN. kubelet can be started with --hostname-override with configurable value.
In AWS envirinment typcally its set FQDN obtained from the metda data. This fix ensures
we can deploy kube-router in case nodes are registered with FQDN

Fixes #17
2017-05-30 03:11:51 +05:30
Murali Reddy
d4edfc02fe cleanup rules in filter table, OUTPUT chain used for ingress filtering
on  "kube-router --cleanup-config"
2017-04-22 20:14:04 +05:30
Murali Reddy
04a5cc033a base line version tested with kube 1.5.6, 1.6 2017-04-17 10:33:09 +05:30