Skip to content

Commit d8b77c1

Browse files
tnqntnqn
committed
Add TrafficControl API
TrafficControl is a feature which allows mirroring or redirecting the traffic Pods send or receive. It enables users to monitor and analyze Pod traffic, and to enforce custom network protections for Pods with fine-grained control over network traffic. This patch adds types and CRD for TrafficControl API. Examples: 1. Mirror Pods (web=app) ingress traffic to a VXLAN tunnel ``` apiVersion: crd.antrea.io/v1alpha2 kind: TrafficControl metadata: name: mirror-web-app spec: appliedTo: podSelector: matchLabels: app: web direction: Ingress action: Mirror targetPort: vxlan: remoteIP: 1.1.1.1 ``` 2. Redirect Pods (web=app) traffic in both direction to OVS internal port firewall0 and expect the traffic to re-enter OVS via another OVS internal port firewall1 if they are not dropped. ``` apiVersion: crd.antrea.io/v1alpha2 kind: TrafficControl metadata: name: redirect spec: appliedTo: podSelector: matchLabels: role: web direction: Ingress action: Redirect targetPort: ovsInternal: name: firewall0 returnPort: ovsInternal: name: firewall1 ``` For antrea-io#3324 Signed-off-by: Quan Tian <[email protected]>
1 parent ffd410a commit d8b77c1

File tree

20 files changed

+2295
-10
lines changed

20 files changed

+2295
-10
lines changed

‎build/charts/antrea/conf/antrea-agent.conf

+3
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ featureGates:
4747
# Enable managing external IPs of Services of LoadBalancer type.
4848
{{- include "featureGate" (dict "featureGates" .Values.featureGates "name" "ServiceExternalIP" "default" false) }}
4949

50+
# Enable mirroring or redirecting the traffic Pods send or receive.
51+
{{- include "featureGate" (dict "featureGates" .Values.featureGates "name" "TrafficControl" "default" false) }}
52+
5053
# Name of the OpenVSwitch bridge antrea-agent will create and use.
5154
# Make sure it doesn't conflict with your existing OpenVSwitch bridges.
5255
ovsBridge: {{ .Values.ovs.bridgeName | quote }}

‎build/charts/antrea/templates/agent/clusterrole.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ rules:
167167
resources:
168168
- externalippools
169169
- ippools
170+
- trafficcontrols
170171
verbs:
171172
- get
172173
- watch

‎build/yamls/antrea-aks.yml

+291-2
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,9 @@ data:
8585
# Enable managing external IPs of Services of LoadBalancer type.
8686
# ServiceExternalIP: false
8787
88+
# Enable mirroring or redirecting the traffic Pods send or receive.
89+
# TrafficControl: false
90+
8891
# Name of the OpenVSwitch bridge antrea-agent will create and use.
8992
# Make sure it doesn't conflict with your existing OpenVSwitch bridges.
9093
ovsBridge: "br-int"
@@ -2493,6 +2496,291 @@ spec:
24932496
shortNames:
24942497
- tf
24952498
---
2499+
# Source: antrea/templates/crds/trafficcontrol.yaml
2500+
apiVersion: apiextensions.k8s.io/v1
2501+
kind: CustomResourceDefinition
2502+
metadata:
2503+
name: trafficcontrols.crd.antrea.io
2504+
spec:
2505+
group: crd.antrea.io
2506+
versions:
2507+
- name: v1alpha2
2508+
served: true
2509+
storage: true
2510+
schema:
2511+
openAPIV3Schema:
2512+
type: object
2513+
required:
2514+
- spec
2515+
properties:
2516+
spec:
2517+
type: object
2518+
required:
2519+
- appliedTo
2520+
- direction
2521+
- action
2522+
- targetPort
2523+
properties:
2524+
appliedTo:
2525+
type: object
2526+
properties:
2527+
podSelector:
2528+
type: object
2529+
properties:
2530+
matchExpressions:
2531+
type: array
2532+
items:
2533+
type: object
2534+
properties:
2535+
key:
2536+
type: string
2537+
operator:
2538+
enum:
2539+
- In
2540+
- NotIn
2541+
- Exists
2542+
- DoesNotExist
2543+
type: string
2544+
values:
2545+
type: array
2546+
items:
2547+
type: string
2548+
pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$"
2549+
matchLabels:
2550+
x-kubernetes-preserve-unknown-fields: true
2551+
namespaceSelector:
2552+
type: object
2553+
properties:
2554+
matchExpressions:
2555+
type: array
2556+
items:
2557+
type: object
2558+
properties:
2559+
key:
2560+
type: string
2561+
operator:
2562+
enum:
2563+
- In
2564+
- NotIn
2565+
- Exists
2566+
- DoesNotExist
2567+
type: string
2568+
values:
2569+
type: array
2570+
items:
2571+
type: string
2572+
pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$"
2573+
matchLabels:
2574+
x-kubernetes-preserve-unknown-fields: true
2575+
direction:
2576+
type: string
2577+
enum:
2578+
- Ingress
2579+
- Egress
2580+
- Both
2581+
action:
2582+
type: string
2583+
enum:
2584+
- Mirror
2585+
- Redirect
2586+
targetPort:
2587+
type: object
2588+
oneOf:
2589+
- required: [ovsInternal]
2590+
- required: [device]
2591+
- required: [geneve]
2592+
- required: [vxlan]
2593+
- required: [gre]
2594+
- required: [erspan]
2595+
properties:
2596+
ovsInternal:
2597+
type: object
2598+
required:
2599+
- name
2600+
properties:
2601+
name:
2602+
type: string
2603+
device:
2604+
type: object
2605+
required:
2606+
- name
2607+
properties:
2608+
name:
2609+
type: string
2610+
geneve:
2611+
type: object
2612+
required:
2613+
- remoteIP
2614+
properties:
2615+
remoteIP:
2616+
type: string
2617+
oneOf:
2618+
- format: ipv4
2619+
- format: ipv6
2620+
vni:
2621+
type: integer
2622+
minimum: 0
2623+
maximum: 16777215
2624+
destinationPort:
2625+
type: integer
2626+
minimum: 1
2627+
maximum: 65535
2628+
vxlan:
2629+
type: object
2630+
required:
2631+
- remoteIP
2632+
properties:
2633+
remoteIP:
2634+
type: string
2635+
oneOf:
2636+
- format: ipv4
2637+
- format: ipv6
2638+
vni:
2639+
type: integer
2640+
minimum: 0
2641+
maximum: 16777215
2642+
destinationPort:
2643+
type: integer
2644+
minimum: 1
2645+
maximum: 65535
2646+
gre:
2647+
type: object
2648+
required:
2649+
- remoteIP
2650+
properties:
2651+
remoteIP:
2652+
type: string
2653+
oneOf:
2654+
- format: ipv4
2655+
- format: ipv6
2656+
key:
2657+
type: integer
2658+
minimum: 0
2659+
maximum: 4294967295
2660+
erspan:
2661+
type: object
2662+
required:
2663+
- remoteIP
2664+
- version
2665+
properties:
2666+
remoteIP:
2667+
type: string
2668+
oneOf:
2669+
- format: ipv4
2670+
- format: ipv6
2671+
sessionID:
2672+
type: integer
2673+
minimum: 0
2674+
maximum: 1023
2675+
version:
2676+
type: integer
2677+
enum:
2678+
- 1
2679+
- 2
2680+
index:
2681+
type: integer
2682+
dir:
2683+
type: integer
2684+
enum:
2685+
- 0
2686+
- 1
2687+
hardwareID:
2688+
type: integer
2689+
returnPort:
2690+
type: object
2691+
oneOf:
2692+
- required: [ovsInternal]
2693+
- required: [device]
2694+
- required: [geneve]
2695+
- required: [vxlan]
2696+
- required: [gre]
2697+
properties:
2698+
ovsInternal:
2699+
type: object
2700+
required:
2701+
- name
2702+
properties:
2703+
name:
2704+
type: string
2705+
device:
2706+
type: object
2707+
required:
2708+
- name
2709+
properties:
2710+
name:
2711+
type: string
2712+
geneve:
2713+
type: object
2714+
required:
2715+
- remoteIP
2716+
properties:
2717+
remoteIP:
2718+
type: string
2719+
oneOf:
2720+
- format: ipv4
2721+
- format: ipv6
2722+
vni:
2723+
type: integer
2724+
minimum: 0
2725+
maximum: 16777215
2726+
destinationPort:
2727+
type: integer
2728+
minimum: 1
2729+
maximum: 65535
2730+
vxlan:
2731+
type: object
2732+
required:
2733+
- remoteIP
2734+
properties:
2735+
remoteIP:
2736+
type: string
2737+
oneOf:
2738+
- format: ipv4
2739+
- format: ipv6
2740+
vni:
2741+
type: integer
2742+
minimum: 0
2743+
maximum: 16777215
2744+
destinationPort:
2745+
type: integer
2746+
minimum: 1
2747+
maximum: 65535
2748+
gre:
2749+
type: object
2750+
required:
2751+
- remoteIP
2752+
properties:
2753+
remoteIP:
2754+
type: string
2755+
oneOf:
2756+
- format: ipv4
2757+
- format: ipv6
2758+
key:
2759+
type: integer
2760+
minimum: 0
2761+
maximum: 4294967295
2762+
additionalPrinterColumns:
2763+
- description: Specifies the direction of traffic that should be matched.
2764+
jsonPath: .spec.direction
2765+
name: Direction
2766+
type: string
2767+
- description: Specifies the action that should be taken for the traffic.
2768+
jsonPath: .spec.action
2769+
name: Action
2770+
type: string
2771+
- jsonPath: .metadata.creationTimestamp
2772+
name: Age
2773+
type: date
2774+
subresources:
2775+
status: {}
2776+
scope: Cluster
2777+
names:
2778+
plural: trafficcontrols
2779+
singular: trafficcontrol
2780+
kind: TrafficControl
2781+
shortNames:
2782+
- tc
2783+
---
24962784
# Source: antrea/templates/agent/clusterrole.yaml
24972785
kind: ClusterRole
24982786
apiVersion: rbac.authorization.k8s.io/v1
@@ -2663,6 +2951,7 @@ rules:
26632951
resources:
26642952
- externalippools
26652953
- ippools
2954+
- trafficcontrols
26662955
verbs:
26672956
- get
26682957
- watch
@@ -3180,7 +3469,7 @@ spec:
31803469
kubectl.kubernetes.io/default-container: antrea-agent
31813470
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
31823471
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
3183-
checksum/config: cb46b22ec258614e4df2cc06aaaba03d2a3ecd008de23288dbdce9cd3cc68647
3472+
checksum/config: 4554a36b927c6e64fdbc53b4d4c64673d48c9c829ec444e3be6e699ade8481b6
31843473
labels:
31853474
app: antrea
31863475
component: antrea-agent
@@ -3420,7 +3709,7 @@ spec:
34203709
annotations:
34213710
# Automatically restart Pod if the ConfigMap changes
34223711
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
3423-
checksum/config: cb46b22ec258614e4df2cc06aaaba03d2a3ecd008de23288dbdce9cd3cc68647
3712+
checksum/config: 4554a36b927c6e64fdbc53b4d4c64673d48c9c829ec444e3be6e699ade8481b6
34243713
labels:
34253714
app: antrea
34263715
component: antrea-controller

0 commit comments

Comments
 (0)