Skip to content

Commit 5aa10cc

Browse files
hackerainhackerain
committed
delete legacy acls when upgrading to v1.13.x (#4742)
the acls in v1.13.x are in tier 2 rather than tier 0 in v1.12.x, the legacy acls may cause some unexpected behaviors because acls in tier 0 have the higest priority. we should delete legacy acls and recreate them when upgrading to v1.13.x. Signed-off-by: suo <[email protected]>
1 parent 86ad84b commit 5aa10cc

14 files changed

+295
-58
lines changed

‎mocks/pkg/ovs/interface.go

+16-16
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/controller/admin_network_policy.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ func (c *Controller) handleAddAnp(key string) (err error) {
190190
return err
191191
}
192192

193-
ingressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "to-lport", nil)
193+
ingressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "to-lport", nil, -1)
194194
if err != nil {
195195
klog.Errorf("failed to generate clear operations for anp %s ingress acls: %v", key, err)
196196
return err
@@ -266,7 +266,7 @@ func (c *Controller) handleAddAnp(key string) (err error) {
266266
return fmt.Errorf("failed to delete unused ingress address set for anp %s: %w", key, err)
267267
}
268268

269-
egressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "from-lport", nil)
269+
egressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "from-lport", nil, -1)
270270
if err != nil {
271271
klog.Errorf("failed to generate clear operations for anp %s egress acls: %v", key, err)
272272
return err

‎pkg/controller/baseline_admin_network_policy.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ func (c *Controller) handleAddBanp(key string) (err error) {
148148
return err
149149
}
150150

151-
ingressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "to-lport", nil)
151+
ingressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "to-lport", nil, -1)
152152
if err != nil {
153153
klog.Errorf("failed to generate clear operations for banp %s ingress acls: %v", key, err)
154154
return err
@@ -225,7 +225,7 @@ func (c *Controller) handleAddBanp(key string) (err error) {
225225
return fmt.Errorf("failed to delete unused ingress address set for banp %s: %w", key, err)
226226
}
227227

228-
egressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "from-lport", nil)
228+
egressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "from-lport", nil, -1)
229229
if err != nil {
230230
klog.Errorf("failed to generate clear operations for banp %s egress acls: %v", key, err)
231231
return err

‎pkg/controller/controller.go

+17
Original file line numberDiff line numberDiff line change
@@ -995,6 +995,8 @@ func (c *Controller) Run(ctx context.Context) {
995995
}
996996
}
997997

998+
c.handleUpgrading()
999+
9981000
// start workers to do all the network operations
9991001
c.startWorkers(ctx)
10001002

@@ -1131,6 +1133,21 @@ func (c *Controller) shutdown() {
11311133
}
11321134
}
11331135

1136+
func (c *Controller) handleUpgrading() {
1137+
if err := c.upgradeSecurityGroups(); err != nil {
1138+
util.LogFatalAndExit(err, "failed to upgrade security groups")
1139+
}
1140+
if err := c.upgradeSubnets(); err != nil {
1141+
util.LogFatalAndExit(err, "failed to upgrade subnets")
1142+
}
1143+
if err := c.upgradeNetworkPolicies(); err != nil {
1144+
util.LogFatalAndExit(err, "failed to upgrade network policies")
1145+
}
1146+
if err := c.upgradeNodes(); err != nil {
1147+
util.LogFatalAndExit(err, "failed to upgrade nodes")
1148+
}
1149+
}
1150+
11341151
func (c *Controller) startWorkers(ctx context.Context) {
11351152
klog.Info("Starting workers")
11361153

‎pkg/controller/network_policy.go

+38-4
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,40 @@ func (c *Controller) enqueueUpdateNp(oldObj, newObj interface{}) {
6262
}
6363
}
6464

65+
// for upgrading from v1.12.x to v1.13.x
66+
func (c *Controller) upgradeNetworkPoliciesForV1_13() error {
67+
// clear legacy acls in tier 0 for all network policies
68+
// including ingress, egress and subnet gateway acls
69+
nps, err := c.npsLister.NetworkPolicies(corev1.NamespaceAll).List(labels.Everything())
70+
if err != nil {
71+
klog.Errorf("failed to list network policies %v", err)
72+
return err
73+
}
74+
75+
for _, np := range nps {
76+
npName := np.Name
77+
nameArray := []rune(np.Name)
78+
if !unicode.IsLetter(nameArray[0]) {
79+
npName = "np" + np.Name
80+
}
81+
pgName := strings.ReplaceAll(fmt.Sprintf("%s.%s", npName, np.Namespace), "-", ".")
82+
83+
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "", nil, util.DefaultACLTier); err != nil {
84+
klog.Errorf("clear legacy network policy %s acls: %v", pgName, err)
85+
return err
86+
}
87+
}
88+
89+
return nil
90+
}
91+
92+
func (c *Controller) upgradeNetworkPolicies() error {
93+
if err := c.upgradeNetworkPoliciesForV1_13(); err != nil {
94+
return err
95+
}
96+
return nil
97+
}
98+
6599
func (c *Controller) createAsForNetpol(ns, name, direction, asName string, addresses []string) error {
66100
if err := c.OVNNbClient.CreateAddressSet(asName, map[string]string{
67101
networkPolicyKey: fmt.Sprintf("%s/%s/%s", ns, name, direction),
@@ -165,7 +199,7 @@ func (c *Controller) handleUpdateNp(key string) error {
165199
return err
166200
}
167201

168-
ingressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "to-lport", nil)
202+
ingressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "to-lport", nil, -1)
169203
if err != nil {
170204
klog.Errorf("generate operations that clear np %s ingress acls: %v", key, err)
171205
return err
@@ -281,7 +315,7 @@ func (c *Controller) handleUpdateNp(key string) error {
281315
}
282316
}
283317
} else {
284-
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "to-lport", nil); err != nil {
318+
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "to-lport", nil, -1); err != nil {
285319
klog.Errorf("delete np %s ingress acls: %v", key, err)
286320
return err
287321
}
@@ -294,7 +328,7 @@ func (c *Controller) handleUpdateNp(key string) error {
294328
}
295329
}
296330

297-
egressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "from-lport", nil)
331+
egressACLOps, err := c.OVNNbClient.DeleteAclsOps(pgName, portGroupKey, "from-lport", nil, -1)
298332
if err != nil {
299333
klog.Errorf("generate operations that clear np %s egress acls: %v", key, err)
300334
return err
@@ -408,7 +442,7 @@ func (c *Controller) handleUpdateNp(key string) error {
408442
}
409443
}
410444
} else {
411-
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "from-lport", nil); err != nil {
445+
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "from-lport", nil, -1); err != nil {
412446
klog.Errorf("delete np %s egress acls: %v", key, err)
413447
return err
414448
}

‎pkg/controller/node.go

+33-1
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,38 @@ func nodeUnderlayAddressSetName(node string, af int) string {
9494
return fmt.Sprintf("node_%s_underlay_v%d", strings.ReplaceAll(node, "-", "_"), af)
9595
}
9696

97+
// for upgrading from v1.12.x to v1.13.x
98+
func (c *Controller) upgradeNodesForV1_13() error {
99+
// clear legacy acls in tier 0 for node port group
100+
nodes, err := c.nodesLister.List(labels.Everything())
101+
if err != nil {
102+
klog.Errorf("failed to list nodes: %v", err)
103+
return err
104+
}
105+
106+
for _, node := range nodes {
107+
pgName := strings.ReplaceAll(node.Annotations[util.PortNameAnnotation], "-", ".")
108+
109+
if pgName == "" {
110+
continue
111+
}
112+
113+
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "", nil, util.DefaultACLTier); err != nil {
114+
klog.Errorf("delete legacy node acl for node pg %s: %v", pgName, err)
115+
return err
116+
}
117+
}
118+
119+
return nil
120+
}
121+
122+
func (c *Controller) upgradeNodes() error {
123+
if err := c.upgradeNodesForV1_13(); err != nil {
124+
return err
125+
}
126+
return nil
127+
}
128+
97129
func (c *Controller) handleAddNode(key string) error {
98130
c.nodeKeyMutex.LockKey(key)
99131
defer func() { _ = c.nodeKeyMutex.UnlockKey(key) }()
@@ -786,7 +818,7 @@ func (c *Controller) checkAndUpdateNodePortGroup() error {
786818
}
787819
} else {
788820
// clear all acl
789-
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "", nil); err != nil {
821+
if err = c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "", nil, -1); err != nil {
790822
klog.Errorf("delete node acl for node pg %s: %v", pgName, err)
791823
}
792824
}

‎pkg/controller/security_group.go

+33
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,39 @@ func (c *Controller) enqueueDeleteSg(obj interface{}) {
6262
c.delSgQueue.Add(key)
6363
}
6464

65+
// for upgrading from v1.12.x to v1.13.x
66+
func (c *Controller) upgradeSecurityGroupsForV1_13() error {
67+
// clear legacy acls in tier 0 for deny all sg
68+
pgName := ovs.GetSgPortGroupName(util.DenyAllSecurityGroup)
69+
if err := c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "", nil, util.DefaultACLTier); err != nil {
70+
klog.Error(err)
71+
return fmt.Errorf("delete legacy acls from port group %s: %w", pgName, err)
72+
}
73+
74+
// clear legacy acls in tier 0 for all sg port groups
75+
sgs, err := c.sgsLister.List(labels.Everything())
76+
if err != nil {
77+
klog.Errorf("failed to list security groups: %v", err)
78+
return err
79+
}
80+
for _, sg := range sgs {
81+
pgName := ovs.GetSgPortGroupName(sg.Name)
82+
if err := c.OVNNbClient.DeleteAcls(pgName, portGroupKey, "", nil, util.DefaultACLTier); err != nil {
83+
klog.Error(err)
84+
return fmt.Errorf("delete legacy acls from port group %s: %w", pgName, err)
85+
}
86+
}
87+
88+
return nil
89+
}
90+
91+
func (c *Controller) upgradeSecurityGroups() error {
92+
if err := c.upgradeSecurityGroupsForV1_13(); err != nil {
93+
return err
94+
}
95+
return nil
96+
}
97+
6598
func (c *Controller) initDefaultDenyAllSecurityGroup() error {
6699
pgName := ovs.GetSgPortGroupName(util.DenyAllSecurityGroup)
67100
if err := c.OVNNbClient.CreatePortGroup(pgName, map[string]string{

‎pkg/controller/subnet.go

+27-2
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,31 @@ func (c *Controller) enqueueUpdateSubnet(oldObj, newObj interface{}) {
152152
}
153153
}
154154

155+
// for upgrading from v1.12.x to v1.13.x
156+
func (c *Controller) upgradeSubnetsForV1_13() error {
157+
// clear legacy acls in tier 0 for all subnets
158+
subnets, err := c.subnetsLister.List(labels.Everything())
159+
if err != nil {
160+
klog.Errorf("failed to list subnets %v", err)
161+
return err
162+
}
163+
164+
for _, subnet := range subnets {
165+
if err = c.OVNNbClient.DeleteAcls(subnet.Name, logicalSwitchKey, "", nil, util.DefaultACLTier); err != nil {
166+
klog.Errorf("clear legacy logical switch %s acls: %v", subnet.Name, err)
167+
return err
168+
}
169+
}
170+
return nil
171+
}
172+
173+
func (c *Controller) upgradeSubnets() error {
174+
if err := c.upgradeSubnetsForV1_13(); err != nil {
175+
return err
176+
}
177+
return nil
178+
}
179+
155180
func (c *Controller) formatSubnet(subnet *kubeovnv1.Subnet) (*kubeovnv1.Subnet, error) {
156181
var (
157182
changed bool
@@ -790,7 +815,7 @@ func (c *Controller) handleAddOrUpdateSubnet(key string) error {
790815
}
791816
} else {
792817
// clear acl when direction is ""
793-
if err = c.OVNNbClient.DeleteAcls(subnet.Name, logicalSwitchKey, "", nil); err != nil {
818+
if err = c.OVNNbClient.DeleteAcls(subnet.Name, logicalSwitchKey, "", nil, -1); err != nil {
794819
if err = c.patchSubnetStatus(subnet, "ResetLogicalSwitchAclFailed", err.Error()); err != nil {
795820
klog.Error(err)
796821
return err
@@ -890,7 +915,7 @@ func (c *Controller) handleDeleteLogicalSwitch(key string) (err error) {
890915
}
891916

892917
// clear acl when direction is ""
893-
if err = c.OVNNbClient.DeleteAcls(key, logicalSwitchKey, "", nil); err != nil {
918+
if err = c.OVNNbClient.DeleteAcls(key, logicalSwitchKey, "", nil, -1); err != nil {
894919
klog.Errorf("clear logical switch %s acls: %v", key, err)
895920
return err
896921
}

‎pkg/ovs/interface.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -162,8 +162,8 @@ type ACL interface {
162162
SetACLLog(pgName string, logEnable, isIngress bool) error
163163
SetLogicalSwitchPrivate(lsName, cidrBlock, nodeSwitchCIDR string, allowSubnets []string) error
164164
SGLostACL(sg *kubeovnv1.SecurityGroup) (bool, error)
165-
DeleteAcls(parentName, parentType, direction string, externalIDs map[string]string) error
166-
DeleteAclsOps(parentName, parentType, direction string, externalIDs map[string]string) ([]ovsdb.Operation, error)
165+
DeleteAcls(parentName, parentType, direction string, externalIDs map[string]string, tier int) error
166+
DeleteAclsOps(parentName, parentType, direction string, externalIDs map[string]string, tier int) ([]ovsdb.Operation, error)
167167
UpdateAnpRuleACLOps(pgName, asName, protocol, aclName string, priority int, aclAction ovnnb.ACLAction, logACLActions []ovnnb.ACLAction, rulePorts []v1alpha1.AdminNetworkPolicyPort, isIngress, isBanp bool) ([]ovsdb.Operation, error)
168168
}
169169

0 commit comments

Comments
 (0)