enable network policies strict mode #268
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aojea The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
|
not working :/ |
aojea
force-pushed
the
strict_mode
branch
2 times, most recently
from
1849ebd to
f131351
Compare
aojea
added
the
do-not-merge/hold
aojea
force-pushed
the
strict_mode
branch
7 times, most recently
from
629963a to
9f9e727
Compare
aojea
removed
the
do-not-merge/hold
There was a problem hiding this comment.
Pull Request Overview
Enables a "strict mode" that reevaluates existing conntrack flows against current NetworkPolicies and times out disallowed connections, ensuring policy changes apply to established connections.
- Adds StrictMode flag and threads it through configuration/command entrypoints.
- Implements a firewallEnforcer that scans conntrack entries and zeroes the timeout on disallowed flows.
- Adds an e2e test for dropping established connections and adjusts logging.
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/e2e_standard.bats | Adds an E2E test for established-connection enforcement and tweaks install verbosity. |
| pkg/dataplane/controller.go | Introduces StrictMode, a conntrack enforcement runner, and logging refinements. |
| pkg/dataplane/conntrack.go | Adds PacketFromFlow utility to convert conntrack entries into evaluatable packets. |
| pkg/cmd/cmd.go | Adds --strict-mode flag, defaulting to true. |
| cmd/kube-network-policies/*/main.go | Wires StrictMode from flags into dataplane config. |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
aojea
force-pushed
the
strict_mode
branch
4 times, most recently
from
c6071b3 to
6787ff6
Compare
apply network policies to existing connections. The dataplane now inspect the existing connections in the conntrack table and evaluates against the current network policies. If a established connection is no longer allowed then the dataplane sets the conntrack entry timeout to zero, causing the subsequent packets to be enqueued and processed dropping them if are no longer enabled. The strict mode is enabled by default and runs at most every 30 seconds once there is a change triggered in the dataplane, this is to avoid performance issues for listing conntrack entries too often.
|
@danwinship this is ready |
|
/hold Florian (netlink) explained this behavior is racy https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email protected]/ |
k8s-ci-robot
added
the
do-not-merge/hold
aojea
force-pushed
the
strict_mode
branch
3 times, most recently
from
29d9f63 to
cd9a667
Compare
k8s-ci-robot
added
size/XL
|
Ok, this is finally ready, I just had to go into a big rabbit hole with the ct labels but is the most elegant way to solve it Pending of two fixes in the libraries and to split in commits, but this is the final PR and we go for v1 |
3 participants
apply network policies to existing connections.
The dataplane now inspect the existing connections in the conntrack table and evaluates against the current network policies. If a established connection is no longer allowed then the dataplane it sets the conntrack timeout to zero, so next packets of the connections are reevaluated.
Fixes: #246
TODO:
cc: @danwinship