From 2a21841a6b176e408fd143449458771922a025b4 Mon Sep 17 00:00:00 2001 From: Qiyue Yao Date: Mon, 15 May 2023 17:16:34 +0800 Subject: [PATCH] Revert LogSettings use LogLabel Signed-off-by: Qiyue Yao --- .../antrea/crds/clusternetworkpolicy.yaml | 26 +- build/charts/antrea/crds/networkpolicy.yaml | 26 +- build/yamls/antrea-aks.yml | 52 +- build/yamls/antrea-crds.yml | 52 +- build/yamls/antrea-eks.yml | 52 +- build/yamls/antrea-gke.yml | 52 +- build/yamls/antrea-ipsec.yml | 52 +- build/yamls/antrea.yml | 52 +- docs/antrea-network-policy.md | 34 +- .../antrea-multicluster-leader-global.yml | 92 +-- ...cluster.crd.antrea.io_resourceexports.yaml | 46 +- ...cluster.crd.antrea.io_resourceimports.yaml | 46 +- pkg/agent/controller/networkpolicy/cache.go | 11 +- .../networkpolicy/networkpolicy_controller.go | 4 +- .../controller/networkpolicy/reconciler.go | 20 +- .../networkpolicy/reconciler_test.go | 2 +- pkg/agent/openflow/network_policy.go | 30 +- pkg/agent/types/networkpolicy.go | 7 +- pkg/apis/controlplane/types.go | 10 +- pkg/apis/controlplane/v1beta2/generated.pb.go | 565 ++++++------------ pkg/apis/controlplane/v1beta2/generated.proto | 10 +- pkg/apis/controlplane/v1beta2/types.go | 10 +- .../v1beta2/zz_generated.conversion.go | 34 +- .../v1beta2/zz_generated.deepcopy.go | 21 - .../controlplane/zz_generated.deepcopy.go | 21 - pkg/apis/crd/v1alpha1/types.go | 15 +- .../crd/v1alpha1/zz_generated.deepcopy.go | 21 - pkg/apiserver/openapi/zz_generated.openapi.go | 30 +- .../networkpolicy/antreanetworkpolicy.go | 4 +- .../networkpolicy/antreanetworkpolicy_test.go | 17 +- .../networkpolicy/clusternetworkpolicy.go | 2 +- .../clusternetworkpolicy_test.go | 17 +- pkg/controller/networkpolicy/crd_utils.go | 9 - .../networkpolicy/crd_utils_test.go | 29 - .../networkpolicy/networkpolicy_controller.go | 28 +- .../networkpolicy_controller_test.go | 12 +- pkg/controller/networkpolicy/validate.go | 18 - pkg/controller/networkpolicy/validate_test.go | 26 - test/e2e/utils/anp_spec_builder.go | 6 +- test/e2e/utils/cnp_spec_builder.go | 6 +- 40 files changed, 421 insertions(+), 1146 deletions(-) diff --git a/build/charts/antrea/crds/clusternetworkpolicy.yaml b/build/charts/antrea/crds/clusternetworkpolicy.yaml index b57a437f897..80643942cd2 100644 --- a/build/charts/antrea/crds/clusternetworkpolicy.yaml +++ b/build/charts/antrea/crds/clusternetworkpolicy.yaml @@ -383,16 +383,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -655,16 +648,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/charts/antrea/crds/networkpolicy.yaml b/build/charts/antrea/crds/networkpolicy.yaml index a65da3d85b9..0cc76ff6d3f 100644 --- a/build/charts/antrea/crds/networkpolicy.yaml +++ b/build/charts/antrea/crds/networkpolicy.yaml @@ -326,16 +326,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -569,16 +562,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/yamls/antrea-aks.yml b/build/yamls/antrea-aks.yml index 7db5c484a8d..a69ee5d0fc7 100644 --- a/build/yamls/antrea-aks.yml +++ b/build/yamls/antrea-aks.yml @@ -761,16 +761,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -1033,16 +1026,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: @@ -1877,16 +1863,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -2120,16 +2099,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/yamls/antrea-crds.yml b/build/yamls/antrea-crds.yml index 726be13f379..756b689a497 100644 --- a/build/yamls/antrea-crds.yml +++ b/build/yamls/antrea-crds.yml @@ -754,16 +754,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -1026,16 +1019,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: @@ -1858,16 +1844,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -2101,16 +2080,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/yamls/antrea-eks.yml b/build/yamls/antrea-eks.yml index 3c43a552b0d..71ef07c1ffc 100644 --- a/build/yamls/antrea-eks.yml +++ b/build/yamls/antrea-eks.yml @@ -761,16 +761,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -1033,16 +1026,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: @@ -1877,16 +1863,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -2120,16 +2099,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/yamls/antrea-gke.yml b/build/yamls/antrea-gke.yml index 50286a0db7d..4abc4f6a48b 100644 --- a/build/yamls/antrea-gke.yml +++ b/build/yamls/antrea-gke.yml @@ -761,16 +761,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -1033,16 +1026,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: @@ -1877,16 +1863,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -2120,16 +2099,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/yamls/antrea-ipsec.yml b/build/yamls/antrea-ipsec.yml index afc067a87ef..85a7e53e226 100644 --- a/build/yamls/antrea-ipsec.yml +++ b/build/yamls/antrea-ipsec.yml @@ -761,16 +761,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -1033,16 +1026,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: @@ -1877,16 +1863,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -2120,16 +2099,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/build/yamls/antrea.yml b/build/yamls/antrea.yml index 016af1895a5..29c80c4041d 100644 --- a/build/yamls/antrea.yml +++ b/build/yamls/antrea.yml @@ -761,16 +761,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -1033,16 +1026,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: @@ -1877,16 +1863,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" egress: type: array items: @@ -2120,16 +2099,9 @@ spec: type: string enableLogging: type: boolean - logSetting: - type: object - required: - - enabled - properties: - enabled: - type: boolean - logLabel: - type: string - pattern: "^.{0,32}$" + logLabel: + type: string + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9])?$" status: type: object properties: diff --git a/docs/antrea-network-policy.md b/docs/antrea-network-policy.md index 1711e65562e..95822ad3cd1 100644 --- a/docs/antrea-network-policy.md +++ b/docs/antrea-network-policy.md @@ -553,9 +553,8 @@ spec: matchLabels: role: db name: AllowFromFrontend - logSettings: - enabled: true - logLabel: "frontend-allowed" + enableLogging: true + logLabel: "frontend-allowed" ``` **spec**: The ClusterNetworkPolicy `spec` has all the information needed to @@ -717,27 +716,24 @@ to select Pods. More details can be found in the [ServiceAccountSelector](#servi **Note**: The order in which the egress rules are specified matters, i.e., rules will be enforced in the order in which they are written. -**logSettings** and **enableLogging**: The `enableLogging` field was introduced in -Antrea v0.11.0, and ACNP rule logging can be enabled by setting it. In Antrea -v1.12.0, we introduced a new `logSettings` field to configure rule logging, -deprecating `enableLogging`. These two fields should not be set at the same time. -`logSettings.enabled` and `enableLogging` are equivalent. When either of them is -set to `true`, the first packet of any connection that matches this rule will be +**enableLogging** and **logLabel**: Antrea-native policy ingress or egress rules +can be audited by setting its logging fields. When the `enableLogging` field is set +to `true`, the first packet of any connection that matches this rule will be logged to a file (`/var/log/antrea/networkpolicy/np.log`) on the Node on which the -rule is applied. The log files can then be used for further analysis. When using -`logSettings`, `enabled` must be set to `true` to enable logging; if `logLabel` is -provided, the label will be added in the log, otherwise it defaults to empty value. - -In the [ACNP with log settings](#acnp-with-log-settings) traffic that hits the +rule is enforced. The log files can then be used for further analysis. If `logLabel` +is provided, the label will be added in the log. For example, in the +[ACNP with log settings](#acnp-with-log-settings), traffic that hits the "AllowFromFrontend" rule will be logged with log label "frontend-allowed". + For drop and reject rules, deduplication is applied to reduce duplicated -logs, and duplication buffer length is set to 1 second. If a rule name is not -provided, an identifiable name will be generated for the rule and displayed in the log. -For rules in layer 7 NetworkPolicy, packets are logged with action `Redirect` prior -to analysis by the layer 7 engine, and the layer 7 engine can log more information -in its own logs. +log messages, and the duplication buffer length is set to 1 second. When a rule +does not have a name, an identifiable name will be generated for the rule and +added to the log. For rules in layer 7 NetworkPolicy, packets are logged with +action `Redirect` prior to analysis by the layer 7 engine, and the layer 7 engine +can log more information in its own logs. The rules are logged in the following format: + ```text