mirror of
https://github.com/rancher/plugins.git
synced 2025-07-13 23:14:03 +00:00
22dd6c553d
This commit adds a new parameter `ingressPolicy` (`string`) to the `firewall` plugin. The supported values are `open` and `same-bridge`. - `open` is the default and does NOP. - `same-bridge` creates "CNI-ISOLATION-STAGE-1" and "CNI-ISOLATION-STAGE-2" that are similar to Docker libnetwork's "DOCKER-ISOLATION-STAGE-1" and "DOCKER-ISOLATION-STAGE-2" rules. e.g., when `ns1` and `ns2` are connected to bridge `cni1`, and `ns3` is connected to bridge `cni2`, the `same-bridge` ingress policy disallows communications between `ns1` and `ns3`, while allowing communications between `ns1` and `ns2`. Please refer to the comment lines in `ingresspolicy.go` for the actual iptables rules. The `same-bridge` ingress policy is expected to be used in conjunction with `bridge` plugin. May not work as expected with other "main" plugins. It should be also noted that the `same-bridge` ingress policy executes raw `iptables` commands directly, even when the `backend` is set to `firewalld`. We could potentially use the "direct" API of firewalld [1] to execute iptables via firewalld, but it doesn't seem to have a clear benefit over just directly executing raw iptables commands. (Anyway, we have been already executing raw iptables commands in the `portmap` plugin) [1] https://firewalld.org/documentation/direct/options.html This commit replaces the `isolation` plugin proposal (issue 573, PR 574). The design of `ingressPolicy` was discussed in the comments of the withdrawn PR 574 , but `same-network` was renamed to `same-bridge` then. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> |
||
|---|---|---|
| .. | ||
| buildversion | ||
| sysctl | ||
| conntrack.go | ||
| iptables_test.go | ||
| iptables.go | ||
| utils_suite_test.go | ||
| utils_test.go | ||
| utils.go | ||