Skip to content

GitLab

Switch branch/tag
  1. 05 Jul, 2021 9 commits
  3. 01 Jul, 2021 6 commits
  5. 29 Jun, 2021 2 commits
  7. 28 Jun, 2021 7 commits
  9. 17 Jun, 2021 1 commit
  11. 16 Jun, 2021 1 commit
  13. 08 Jun, 2021 1 commit
  15. 07 Jun, 2021 7 commits
  17. 01 Jun, 2021 6 commits
    • Aaron U'Ren's avatar
      fix(goreleaser): add version and date to published binaries · 7e92ad9b
      Aaron U'Ren authored
      7e92ad9b
    • Aaron U'Ren's avatar
      fact(NPC): refactor isPodUpdateNetPolRelevant · d90c7532
      Aaron U'Ren authored 
      Refactor this logic so that it can be more easily tested and expanded
without cluttering the pod.go file. Additionally, add some safe guards
around the pod cast to ensure that we're working with pods before we
pass them.
      d90c7532
    • Aaron U'Ren's avatar
      fix(NPC): check if new pod is actionable · 1a82db75
      Aaron U'Ren authored 
      Previously, kube-router would do a full sync on a new pod whether or not
the pod was in an actionable state. This led to needless syncs as many
pods were missing PodIP addresses or other items necessary to apply
policy.

If a pod is missing these items it is better to wait for the next
message that comes via the UpdateFunc below so that we know that the pod
has all of the necessary items to apply policy to it.
      1a82db75
    • Aaron U'Ren's avatar
      fix(NPC): remove HostNetwork check from OnPodUpdate · 3dc5c3fb
      Aaron U'Ren authored 
      With the previous logic, if a pod changed from having HostNetwork =
False to HostNetwork = True, NPC would not trigger a refresh to clear
out the rules that once applied. Now this check has been moved lower in
the fullPolicySync() logic so that it accounts for these pods naturally.
      3dc5c3fb
    • Aaron U'Ren's avatar
      fix(NPC): check if pod is actionable · 13e0a398
      Aaron U'Ren authored 
      Check if the Pod is actionable before taking NetworkPolicy actions which
includes both adding KUBE-POD-FW and KUBE-NWPLCY chains for it.

Checks have now been consolidated to a single isNetPolActionable()
function which checks for pod phases that we don't want NetworkPolicy
for like: Failed, Completed, and Succeeded, missing pod IP addresses,
and pods with HostNetwork enabled.

fixes #1056
      13e0a398
    • Aaron U'Ren's avatar
      fix: add locking around ipset invocations · fa8d69ed
      Aaron U'Ren authored
      fa8d69ed