-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
networking: refactor building nomad bridge config
Co-authored-by: Martina Santangelo <[email protected]>
- Loading branch information
Showing
9 changed files
with
386 additions
and
75 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,86 @@ | ||
// Copyright (c) HashiCorp, Inc. | ||
// SPDX-License-Identifier: BUSL-1.1 | ||
|
||
package cni | ||
|
||
import "encoding/json" | ||
|
||
// Conflist is the .conflist format of CNI network config. | ||
type Conflist struct { | ||
CniVersion string `json:"cniVersion"` | ||
Name string `json:"name"` | ||
Plugins []any `json:"plugins"` | ||
} | ||
|
||
// Json produces indented json of the conflist. | ||
func (b Conflist) Json() ([]byte, error) { | ||
return json.MarshalIndent(b, "", "\t") | ||
} | ||
|
||
// NomadBridgeConfig determines the contents of the Conflist. | ||
type NomadBridgeConfig struct { | ||
BridgeName string | ||
AdminChainName string | ||
IPv4Subnet string | ||
HairpinMode bool | ||
ConsulCNI bool | ||
} | ||
|
||
// NewNomadBridgeConflist produces a full Conflist from the config. | ||
func NewNomadBridgeConflist(conf NomadBridgeConfig) Conflist { | ||
// Update website/content/docs/networking/cni.mdx when the bridge config | ||
// is modified. The json versions of the config can be found in | ||
// client/allocrunner/test_fixtures/*.conflist.json | ||
// If CNI plugins are added or versions need to be updated for new fields, | ||
// add a new constraint to nomad/job_endpoint_hooks.go | ||
|
||
ipRanges := [][]Range{ | ||
{{Subnet: conf.IPv4Subnet}}, | ||
} | ||
ipRoutes := []Route{ | ||
{Dst: "0.0.0.0/0"}, | ||
} | ||
|
||
plugins := []any{ | ||
Generic{ | ||
Type: "loopback", | ||
}, | ||
Bridge{ | ||
Type: "bridge", | ||
Bridgename: conf.BridgeName, | ||
IpMasq: true, | ||
IsGateway: true, | ||
ForceAddress: true, | ||
HairpinMode: conf.HairpinMode, | ||
Ipam: IPAM{ | ||
Type: "host-local", | ||
Ranges: ipRanges, | ||
Routes: ipRoutes, | ||
}, | ||
}, | ||
Firewall{ | ||
Type: "firewall", | ||
Backend: "iptables", | ||
AdminChainName: conf.AdminChainName, | ||
}, | ||
Portmap{ | ||
Type: "portmap", | ||
Capabilities: PortmapCapabilities{ | ||
Portmappings: true, | ||
}, | ||
Snat: true, | ||
}, | ||
} | ||
if conf.ConsulCNI { | ||
plugins = append(plugins, ConsulCNI{ | ||
Type: "consul-cni", | ||
LogLevel: "debug", | ||
}) | ||
} | ||
|
||
return Conflist{ | ||
CniVersion: "0.4.0", | ||
Name: "nomad", | ||
Plugins: plugins, | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
// Copyright (c) HashiCorp, Inc. | ||
// SPDX-License-Identifier: BUSL-1.1 | ||
|
||
package cni | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/shoenig/test/must" | ||
) | ||
|
||
func TestConflist_Json(t *testing.T) { | ||
conf := &Conflist{ | ||
CniVersion: "0.0.1", | ||
Name: "test-config", | ||
Plugins: []any{ | ||
Generic{Type: "test-plugin"}, | ||
}, | ||
} | ||
bts, err := conf.Json() | ||
must.NoError(t, err) | ||
must.Eq(t, `{ | ||
"cniVersion": "0.0.1", | ||
"name": "test-config", | ||
"plugins": [ | ||
{ | ||
"type": "test-plugin" | ||
} | ||
] | ||
}`, string(bts)) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,58 @@ | ||
// Copyright (c) HashiCorp, Inc. | ||
// SPDX-License-Identifier: BUSL-1.1 | ||
|
||
package cni | ||
|
||
// Generic has the one key that all plugins must have: "type" | ||
type Generic struct { | ||
Type string `json:"type"` | ||
} | ||
|
||
// Bridge is the subset of options that we use to configure the "bridge" plugin. | ||
// https://www.cni.dev/plugins/current/main/bridge/ | ||
type Bridge struct { | ||
Type string `json:"type"` | ||
Bridgename string `json:"bridge"` | ||
IpMasq bool `json:"ipMasq"` | ||
IsGateway bool `json:"isGateway"` | ||
ForceAddress bool `json:"forceAddress"` | ||
HairpinMode bool `json:"hairpinMode"` | ||
Ipam IPAM `json:"ipam"` | ||
} | ||
type IPAM struct { | ||
Type string `json:"type"` | ||
Ranges [][]Range `json:"ranges"` | ||
Routes []Route `json:"routes"` | ||
} | ||
type Range struct { | ||
Subnet string `json:"subnet"` | ||
} | ||
type Route struct { | ||
Dst string `json:"dst"` | ||
} | ||
|
||
// Firewall is the "firewall" plugin. | ||
// https://www.cni.dev/plugins/current/meta/firewall/ | ||
type Firewall struct { | ||
Type string `json:"type"` | ||
Backend string `json:"backend"` | ||
AdminChainName string `json:"iptablesAdminChainName"` | ||
} | ||
|
||
// Portmap is the "portmap" plugin. | ||
// https://www.cni.dev/plugins/current/meta/portmap/ | ||
type Portmap struct { | ||
Type string `json:"type"` | ||
Capabilities PortmapCapabilities `json:"capabilities"` | ||
Snat bool `json:"snat"` | ||
} | ||
type PortmapCapabilities struct { | ||
Portmappings bool `json:"portMappings"` | ||
} | ||
|
||
// ConsulCNI is the "consul-cni" plugin used for transparent proxy. | ||
// https://github.com/hashicorp/consul-k8s/blob/main/control-plane/cni/main.go | ||
type ConsulCNI struct { | ||
Type string `json:"type"` | ||
LogLevel string `json:"log_level"` | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,44 @@ | ||
{ | ||
"cniVersion": "0.4.0", | ||
"name": "nomad", | ||
"plugins": [ | ||
{ | ||
"type": "loopback" | ||
}, | ||
{ | ||
"type": "bridge", | ||
"bridge": "bad\"", | ||
"ipMasq": true, | ||
"isGateway": true, | ||
"forceAddress": true, | ||
"hairpinMode": true, | ||
"ipam": { | ||
"type": "host-local", | ||
"ranges": [ | ||
[ | ||
{ | ||
"subnet": "172.26.64.0/20" | ||
} | ||
] | ||
], | ||
"routes": [ | ||
{ | ||
"dst": "0.0.0.0/0" | ||
} | ||
] | ||
} | ||
}, | ||
{ | ||
"type": "firewall", | ||
"backend": "iptables", | ||
"iptablesAdminChainName": "NOMAD-ADMIN" | ||
}, | ||
{ | ||
"type": "portmap", | ||
"capabilities": { | ||
"portMappings": true | ||
}, | ||
"snat": true | ||
} | ||
] | ||
} |
Oops, something went wrong.