Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(transparentproxy) default to modify resolv.conf #1828

Merged
merged 9 commits into from
Apr 16, 2021
Merged

chore(transparentproxy) default to modify resolv.conf #1828

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
736c504
chore(transparentproxy) default to modify resolv.conf
Apr 15, 2021
a4799d3
Merge remote-tracking branch 'origin/master' into chore/default_modif…
Apr 15, 2021
fd4632e
fix(coredns) build
Apr 15, 2021
79eef53
test(e2e) externalservice improvement
Apr 15, 2021
2e26c82
test(e2e) builtindns for universal
Apr 15, 2021
ec7ab1f
chore(*) annotation kuma.io/builtindns for CNI
Apr 15, 2021
79631ce
chore(*) more tools in our universal image
Apr 16, 2021
14bf5ed
test(e2e) add container name in external service server cert
Apr 16, 2021
9623088
test(2e) make tests pass
Apr 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions app/kumactl/cmd/completion/testdata/bash.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2394,8 +2394,6 @@ _kumactl_install_transparent-proxy()
local_nonpersistent_flags+=("--kuma-dp-user=")
flags+=("--modify-iptables")
local_nonpersistent_flags+=("--modify-iptables")
flags+=("--modify-resolv-conf")
local_nonpersistent_flags+=("--modify-resolv-conf")
flags+=("--redirect-dns")
local_nonpersistent_flags+=("--redirect-dns")
flags+=("--redirect-dns-port=")
Expand All @@ -2415,6 +2413,8 @@ _kumactl_install_transparent-proxy()
flags+=("--redirect-outbound-port=")
two_word_flags+=("--redirect-outbound-port")
local_nonpersistent_flags+=("--redirect-outbound-port=")
flags+=("--skip-resolv-conf")
local_nonpersistent_flags+=("--skip-resolv-conf")
flags+=("--store-firewalld")
local_nonpersistent_flags+=("--store-firewalld")
flags+=("--config-file=")
Expand Down
2 changes: 1 addition & 1 deletion app/kumactl/cmd/completion/testdata/zsh.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -974,14 +974,14 @@ function _kumactl_install_transparent-proxy {
'--kuma-dp-uid[the UID of the user that will run kuma-dp]:' \
'--kuma-dp-user[the user that will run kuma-dp]:' \
'--modify-iptables[modify the host iptables to redirect the traffic to Envoy]' \
'--modify-resolv-conf[skip modifying the host `/etc/resolv.conf`]' \
'--redirect-dns[redirect the DNS requests to a specified port]' \
'--redirect-dns-port[the port where the DNS agent is listening]:' \
'--redirect-dns-upstream-target-chain[(optional) the iptables chain where the upstream DNS requests should be directed to. It is only applied for IP V4. Use with care.]:' \
'--redirect-inbound[redirect the inbound traffic to the Envoy. Should be disabled for Gateway data plane proxies.]' \
'--redirect-inbound-port[inbound port redirected to Envoy, as specified in dataplane'\''s `networking.transparentProxying.redirectPortInbound`]:' \
'--redirect-inbound-port-v6[IPv6 inbound port redirected to Envoy, as specified in dataplane'\''s `networking.transparentProxying.redirectPortInboundV6`]:' \
'--redirect-outbound-port[outbound port redirected to Envoy, as specified in dataplane'\''s `networking.transparentProxying.redirectPortOutbound`]:' \
'--skip-resolv-conf[skip modifying the host `/etc/resolv.conf`]' \
'--store-firewalld[store the iptables changes with firewalld]' \
'--config-file[path to the configuration file to use]:' \
'--log-level[log level: one of off|info|debug]:' \
Expand Down
16 changes: 8 additions & 8 deletions app/kumactl/cmd/install/install_transparent_proxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ type transparenProxyArgs struct {
RedirectDNS bool
AgentDNSListenerPort string
DNSUpstreamTargetChain string
ModifyResolvConf bool
SkipResolvConf bool
StoreFirewalld bool
KumaCpIP net.IP
}
Expand All @@ -55,7 +55,7 @@ func newInstallTransparentProxy() *cobra.Command {
RedirectDNS: false,
AgentDNSListenerPort: "15053",
DNSUpstreamTargetChain: "RETURN",
ModifyResolvConf: false,
SkipResolvConf: false,
StoreFirewalld: false,
KumaCpIP: defaultCpIP,
}
Expand Down Expand Up @@ -123,12 +123,12 @@ runuser -u kuma-dp -- \
return errors.Errorf("--kuma-dp-user or --kuma-dp-uid should be supplied")
}

if args.RedirectDNS && args.ModifyResolvConf {
return errors.Errorf("please supply only one of --redirect-dns or --modify-resolv-conf")
if args.RedirectDNS && !args.SkipResolvConf {
return errors.Errorf("please set --skip-resolv-conf when using --redirect-dns")
}

if args.ModifyResolvConf && args.KumaCpIP.String() == defaultCpIP.String() {
return errors.Errorf("please supply a valid `--kuma-cp-ip`")
if !args.SkipResolvConf && args.KumaCpIP.String() == defaultCpIP.String() {
return errors.Errorf("please supply a valid --kuma-cp-ip")
}

if args.ModifyIptables {
Expand All @@ -137,7 +137,7 @@ runuser -u kuma-dp -- \
}
}

if args.ModifyResolvConf {
if !args.SkipResolvConf {
if err := modifyResolvConf(cmd, &args); err != nil {
return err
}
Expand All @@ -161,7 +161,7 @@ runuser -u kuma-dp -- \
cmd.Flags().BoolVar(&args.RedirectDNS, "redirect-dns", args.RedirectDNS, "redirect the DNS requests to a specified port")
cmd.Flags().StringVar(&args.AgentDNSListenerPort, "redirect-dns-port", args.AgentDNSListenerPort, "the port where the DNS agent is listening")
cmd.Flags().StringVar(&args.DNSUpstreamTargetChain, "redirect-dns-upstream-target-chain", args.DNSUpstreamTargetChain, "(optional) the iptables chain where the upstream DNS requests should be directed to. It is only applied for IP V4. Use with care.")
cmd.Flags().BoolVar(&args.ModifyResolvConf, "modify-resolv-conf", args.ModifyResolvConf, "skip modifying the host `/etc/resolv.conf`")
cmd.Flags().BoolVar(&args.SkipResolvConf, "skip-resolv-conf", args.SkipResolvConf, "skip modifying the host `/etc/resolv.conf`")
cmd.Flags().BoolVar(&args.StoreFirewalld, "store-firewalld", args.StoreFirewalld, "store the iptables changes with firewalld")
cmd.Flags().IPVar(&args.KumaCpIP, "kuma-cp-ip", args.KumaCpIP, "the IP address of the Kuma CP which exposes the DNS service on port 53.")

Expand Down
1 change: 1 addition & 0 deletions app/kumactl/cmd/install/install_transparent_proxy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ var _ = Describe("kumactl install tracing", func() {
extraArgs: []string{
"--kuma-dp-uid", "0",
"--kuma-cp-ip", "1.2.3.4",
"--skip-resolv-conf",
"--redirect-dns",
"--redirect-dns-port", "12345",
"--redirect-dns-upstream-target-chain", "DOCKER_OUTPUT",
Expand Down
2 changes: 1 addition & 1 deletion mk/build.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ build/coredns:
git clone --branch $(COREDNS_VERSION) --depth 1 $(COREDNS_GIT_REPOSITORY) $(COREDNS_TMP_DIRECTORY)
cp $(COREDNS_PLUGIN_CFG_PATH) $(COREDNS_TMP_DIRECTORY)
cd $(COREDNS_TMP_DIRECTORY) && \
go generate coredns.go && \
GOOS= GOARCH= go generate coredns.go && \
$(GO_BUILD_COREDNS) -ldflags="-s -w -X github.com/coredns/coredns/coremain.GitCommit=$(shell git describe --dirty --always)" -o $(BUILD_ARTIFACTS_DIR)/coredns/coredns
rm -rf "$(COREDNS_TMP_DIRECTORY)"

Expand Down
16 changes: 16 additions & 0 deletions pkg/plugins/runtime/k8s/controllers/pod_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package controllers

import (
"context"
"strconv"

core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
"github.com/kumahq/kuma/pkg/dns/vips"
Expand Down Expand Up @@ -54,6 +55,8 @@ type PodReconciler struct {
Persistence *vips.Persistence
ResourceConverter k8s_common.Converter
SystemNamespace string
UseBuiltinDNS bool
BuiltinDNSPort uint32
}

func (r *PodReconciler) Reconcile(req kube_ctrl.Request) (kube_ctrl.Result, error) {
Expand Down Expand Up @@ -131,6 +134,19 @@ func (r *PodReconciler) Reconcile(req kube_ctrl.Request) (kube_ctrl.Result, erro
return kube_ctrl.Result{}, err
}

if r.UseBuiltinDNS {
if pod.Annotations == nil {
pod.Annotations = map[string]string{}
}
// will be used by the CNI to enable the relevant iptables settings
pod.Annotations[metadata.KumaBuiltinDNS] = metadata.AnnotationEnabled
pod.Annotations[metadata.KumaBuiltinDNSPort] = strconv.FormatInt(int64(r.BuiltinDNSPort), 10)

if err = r.Update(ctx, pod); err != nil {
return kube_ctrl.Result{}, errors.Wrapf(err, "unable to update annotations on pod %s", pod.Name)
}
}

return kube_ctrl.Result{}, nil
}

Expand Down
4 changes: 4 additions & 0 deletions pkg/plugins/runtime/k8s/metadata/annotations.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@ const (
// KumaMetricsPrometheusPath to override `Mesh`-wide default path
KumaMetricsPrometheusPath = "prometheus.metrics.kuma.io/path"

// KumaBuiltinDNS the sidecar will use its builtin DNS
KumaBuiltinDNS = "kuma.io/builtindns"
KumaBuiltinDNSPort = "kuma.io/builtindnsport"

KumaTrafficExcludeInboundPorts = "traffic.kuma.io/exclude-inbound-ports"
KumaTrafficExcludeOutboundPorts = "traffic.kuma.io/exclude-outbound-ports"
)
Expand Down
2 changes: 2 additions & 0 deletions pkg/plugins/runtime/k8s/plugin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,8 @@ func addPodReconciler(mgr kube_ctrl.Manager, rt core_runtime.Runtime, converter
ResourceConverter: converter,
Persistence: vips.NewPersistence(rt.ResourceManager(), rt.ConfigManager()),
SystemNamespace: rt.Config().Store.Kubernetes.SystemNamespace,
UseBuiltinDNS: rt.Config().Runtime.Kubernetes.Injector.BuiltinDNS.Enabled,
BuiltinDNSPort: rt.Config().Runtime.Kubernetes.Injector.BuiltinDNS.Port,
}
return reconciler.SetupWithManager(mgr)
}
Expand Down
4 changes: 3 additions & 1 deletion pkg/plugins/runtime/k8s/webhooks/injector/injector.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -420,7 +420,9 @@ func (i *KumaInjector) NewInitContainer(pod *kube_core.Pod) (kube_core.Container
excludeInboundPorts, _ := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTrafficExcludeInboundPorts)
excludeOutboundPorts, _ := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTrafficExcludeOutboundPorts)

dnsArg := []string{}
dnsArg := []string{
"--skip-resolv-conf",
}

if i.cfg.BuiltinDNS.Enabled {
dnsArg = append(dnsArg,
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,7 @@ spec:
- 1234,1235
- --exclude-outbound-ports
- "1236"
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,7 @@ spec:
- 1234,5678
- --exclude-outbound-ports
- 4321,7654
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
1 change: 1 addition & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@ spec:
- ""
- --exclude-outbound-ports
- ""
- --skip-resolv-conf
command:
- /usr/bin/kumactl
- install
Expand Down
2 changes: 1 addition & 1 deletion test/dockerfiles/Dockerfile.universal
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ RUN echo "# use this file to override default configuration of \`kuma-cp\`" > /k
RUN apt update \
&& apt dist-upgrade -y \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y \
tzdata openssh-server curl ncat vim net-tools iptables iproute2 dnsutils tmux \
tzdata openssh-server curl ncat vim net-tools iptables iproute2 dnsutils tmux strace tcpdump \
&& rm -rf /var/lib/apt/lists/*

RUN ssh-keygen -A \
Expand Down
Loading