| *** hongbin has joined #openstack-kuryr | 00:40 | |
| *** jistr has quit IRC | 01:00 | |
| *** jistr has joined #openstack-kuryr | 01:00 | |
| *** hongbin has quit IRC | 03:52 | |
| *** openstackgerrit has joined #openstack-kuryr | 05:58 | |
| openstackgerrit | Yash Gupta proposed openstack/kuryr-kubernetes master: Improve logging for event dispatcher https://review.openstack.org/648612 | 05:58 |
|---|---|---|
| *** yboaron_ has quit IRC | 06:02 | |
| *** janki has joined #openstack-kuryr | 06:10 | |
| *** ccamposr has joined #openstack-kuryr | 07:08 | |
| *** yboaron_ has joined #openstack-kuryr | 08:15 | |
| *** celebdor has joined #openstack-kuryr | 08:17 | |
| *** premsankar has quit IRC | 08:28 | |
| *** maysams has joined #openstack-kuryr | 08:34 | |
| *** yboaron_ has quit IRC | 08:56 | |
| *** celebdor has quit IRC | 09:11 | |
| *** pcaruana has joined #openstack-kuryr | 09:15 | |
| *** alisanhaji has joined #openstack-kuryr | 09:21 | |
| *** celebdor has joined #openstack-kuryr | 10:11 | |
| dulek | maysams: I rebased your patch and started seeing issues with allowed_cidrs variable? | 10:38 |
| dulek | maysams: My VM died yesterday, so I can't provide you with the exact logs. | 10:38 |
| maysams | dulek: do you remember what kind of issues? | 10:40 |
| dulek | maysams: Nope. But I'm stacking again, so I'll probably know very soon. ;) | 10:41 |
| maysams | dulek: right, thanks | 10:41 |
| dmellado | dulek: maysams I might be slightly off today but pls keep me in the loop on that | 11:02 |
| dulek | maysams: Hm, you're right that defaults to tcp… | 11:19 |
| openstackgerrit | Michał Dulko proposed openstack/kuryr-kubernetes master: NP: Create allow-all SG and add it to pod SG's https://review.openstack.org/648488 | 11:23 |
| maysams | dulek, yup | 11:23 |
| dulek | This will work - `--protocol any`. :) | 11:23 |
| dulek | maysams: "Ran 1 of 3253 Specs in 308.722 seconds". :) | 11:30 |
| dulek | ltomasbo: Hey! Why do you think that if there's only ingress NP we should also open egress? | 11:31 |
| maysams | dulek: this is the output of the tests? | 11:31 |
| dulek | I'm obviously new to all this, so need some context. ;) | 11:31 |
| ltomasbo | dulek, let me see the examples of kubernetes policies | 11:31 |
| ltomasbo | dulek, for instance, here: https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic | 11:33 |
| ltomasbo | well, better than deny, lets go to the allow all | 11:33 |
| ltomasbo | https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-allow-all-ingress-traffic | 11:33 |
| maysams | dulek: do you know if the only way to add tags to resources is with neutron cli? 'neutron tag-add --resource-type...'? | 11:34 |
| ltomasbo | if you see that, that NP is meant to allow all traffic from pods in the same namespace | 11:34 |
| ltomasbo | but if that is removing all the egress rules, at the end of the day, noone could talk to noone | 11:34 |
| dulek | maysams: Uh, I don't remember, but take a look on openstackclient, maybe it allows to do it better. | 11:36 |
| dulek | ltomasbo: Hm… | 11:36 |
| dulek | ltomasbo: I'm not 100% sure this NP is supposed to allow egress as well. | 11:37 |
| dulek | ltomasbo: I'll dig it up. | 11:37 |
| ltomasbo | dulek, tbh, I'm not sure either.... | 11:37 |
| ltomasbo | lets check the spec... | 11:37 |
| ltomasbo | dulek: If this field is empty then this NetworkPolicy limits all outgoing traffic | 11:38 |
| ltomasbo | dulek, so, maybe you are right | 11:39 |
| ltomasbo | ohh, perhaps the trick is on the policyTypes field | 11:39 |
| ltomasbo | dulek: policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. | 11:39 |
| dulek | ltomasbo: I don't know yet. :P | 11:39 |
| ltomasbo | so, egress is different than ingress | 11:40 |
| ltomasbo | https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.14/#networkpolicyspec-v1-networking-k8s-io | 11:40 |
| ltomasbo | dulek, maysams ^^ | 11:40 |
| ltomasbo | from there I understand, ingress is always applied, but not egress | 11:40 |
| ltomasbo | if you want to only apply egress (without limiting ingress) then you need to state it a the policyType, saying "Egress" | 11:40 |
| ltomasbo | we don't have that support yet either.... | 11:41 |
| ltomasbo | Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]) | 11:41 |
| ltomasbo | so, if there is no Egress field on the NP spec, the policy only applies to ingress, and egress should be allowed | 11:42 |
| dulek | ltomasbo: Ha, so to implement that we also need two new SG's - egress-all and ingress-all. | 11:43 |
| dulek | ltomasbo: And apply those based on policyType? | 11:43 |
| ltomasbo | dulek, so, the thing is that currently we support policies with either just ingress or ingress+egress | 11:44 |
| ltomasbo | dulek, but we were not considering at all policyTypes | 11:44 |
| ltomasbo | so, we have no support for just egress (indicating that ingress is allowed) | 11:45 |
| dulek | ltomasbo: But this shouldn't be too hard to implement, isn't it? If policyType=ingress, apply egress-all, if policyType=egress apply ingress-all. | 11:45 |
| ltomasbo | yep | 11:46 |
| dulek | The only problem would be - what if pod is under two NP's - one ingress and one egress. We shouldn't apply neither egress-all or ingress-all. | 11:46 |
| ltomasbo | umm | 11:47 |
| ltomasbo | well, that is why it is better to contain each NP associated to 1 SG | 11:47 |
| ltomasbo | and generate the rules accordingly | 11:47 |
| ltomasbo | then, it is additive, if one of the policies allows it, then it is allowed | 11:47 |
| ltomasbo | and this goes more complex, because one policy can enable only certain egres and the other other ingress/egress... | 11:48 |
| dulek | ltomasbo: Yeah, it's not trivial, I think. | 11:48 |
| ltomasbo | so, I would go for, if only ingress spec or policyType == ingress (or not defined) | 11:48 |
| ltomasbo | then add default egress rule allowing everyting | 11:48 |
| ltomasbo | if only ingress spec but policyType==ingress,egress tehn not add the egress rules as it should be blocked | 11:49 |
| ltomasbo | if ingress+egress spec (or only egress) and not policyTypes, then as we have now, removing the defulat egress rules | 11:50 |
| ltomasbo | we may need another table for that... xD | 11:51 |
| dulek | ltomasbo: This isn't really too complicated. But do we evaluate NP's on pod one-by-one or do we have all of them applied in one go? | 11:52 |
| ltomasbo | each NP is a sg that is attached to the related pods (ports) | 11:53 |
| ltomasbo | so, if many NPs applied to a pod, that means many sgs attached to their ports | 11:53 |
| ltomasbo | but relation is 1 NP == 1 SG | 11:53 |
| dulek | ltomasbo: Okay, so it shouldn't be too bad, we need some additional info about NP's - if they're ingress or egress or both. | 11:56 |
| dulek | And apply allow-egress and allow-ingress if all NP's are missing it. | 11:57 |
| ltomasbo | yep, I'm building a table for the cases | 11:57 |
| ltomasbo | maysams, do you remember the document I created for the Network policy options? I don't find it anymore... | 12:07 |
| maysams | yes | 12:07 |
| maysams | one sec | 12:07 |
| maysams | https://docs.google.com/document/d/1Uth4OihWjq72Dj-LbAPKvbueF-b-GylqRWtbUXn7IrE/edit?usp=sharing | 12:08 |
| ltomasbo | thanks! | 12:08 |
| maysams | ltomasbo: np! | 12:08 |
| ltomasbo | maysams, dulek: I've added another table to that document (https://docs.google.com/document/d/1Uth4OihWjq72Dj-LbAPKvbueF-b-GylqRWtbUXn7IrE/edit) regarding the possible options and actions | 12:18 |
| ltomasbo | please double check | 12:18 |
| *** janki has quit IRC | 12:20 | |
| maysams | ltomasbo: I will. Thanks! | 12:23 |
| ltomasbo | maysams, dulek: seems we cover 1/3 of the cases... | 12:29 |
| ltomasbo | man, NP is getting bigger and bigger... | 12:29 |
| dulek | ltomasbo: Well, at least there's value in those K8s e2e tests? :D | 12:29 |
| ltomasbo | dulek, indeed! | 12:30 |
| ltomasbo | qe should have been chasing those down too... | 12:30 |
| maysams | dulek: They are really valuable | 12:31 |
| ltomasbo | dulek, do you want to take a look at adding that as part of your patch? should be a different one/follow-up? | 12:31 |
| dulek | ltomasbo: Ah, my thoughts exactly, but decided to keep them to myself. :P | 12:32 |
| dulek | ltomasbo: I'm pretty sure it should be follow up, but let me think about it a bit. | 12:32 |
| maysams | lunch, brb | 12:32 |
| dulek | BTW - yeah, with my patches applied the egress test passes, but not then the ingress is broken. :D | 12:33 |
| ltomasbo | dulek, sure... let add an extra column with the expected result of your patch (removing default egress rules) | 12:33 |
| dulek | Though not really sure why. | 12:33 |
| dulek | ltomasbo: Please give me some time to analyze this. | 12:33 |
| ltomasbo | sure! | 12:33 |
| openstackgerrit | Luis Tomas Bolivar proposed openstack/kuryr-kubernetes master: Add support for policyTypes at Network Policies https://review.openstack.org/648699 | 14:16 |
| ltomasbo | dulek, maysams ^^fix for the policyType we discussed | 14:17 |
| openstackgerrit | Luis Tomas Bolivar proposed openstack/kuryr-kubernetes master: Add support for policyTypes at Network Policies https://review.openstack.org/648699 | 14:23 |
| ltomasbo | dulek, it would be great if you could give it a try on your env and see if it passes NP tests | 14:23 |
| dulek | 21 lines? Maaan, it's not bad. :D | 14:25 |
| ltomasbo | yep! it was simpler than expected | 14:25 |
| ltomasbo | (if it works...) | 14:25 |
| ltomasbo | dulek, plus, I put it on top of your modification removing the default egress rules | 14:26 |
| maysams | ltomasbo: I will take a look asap | 14:38 |
| ltomasbo | maysams, thanks! | 14:45 |
| *** alisanhaji has quit IRC | 14:57 | |
| dulek | ltomasbo: Damn, this explanation in the API reference is really complicated. :D | 15:08 |
| dulek | ltomasbo: I think the way you implemented it will not work in a case when Pod has two policies applied. | 15:09 |
| dulek | Imagine that there's one egress and one ingress policy applied on one pod. | 15:10 |
| dulek | A combination of SG's that allow all on ingress and egress will lead to opening all traffic. | 15:10 |
| dulek | And I don't think that is how it should be working. :( | 15:10 |
| ltomasbo | reading | 15:11 |
| ltomasbo | dulek, well, if you are applying those rules in a different NP, then that is user problem | 15:12 |
| ltomasbo | dulek, if you have a policy enabling all traffic, it does not matter if you later add another one enabling only some traffic, all will be allowed, right? | 15:12 |
| ltomasbo | is an OR and security groups works like that too | 15:13 |
| dulek | ltomasbo: Well, depends on the additive logic, isn't it? | 15:13 |
| dulek | ltomasbo: Yeah, it's OR or AND. I don't know how that should work in K8s. | 15:13 |
| dulek | And I understand that SG's in OpenStack work the other way. :) | 15:13 |
| ltomasbo | if you want to have ingress + egress rules combined, you need to apply them in the same policy | 15:13 |
| dulek | ltomasbo: I really hope you're right here. :D | 15:14 |
| ltomasbo | let me re-check the examples at https://kubernetes.io/docs/concepts/services-networking/network-policies/ | 15:14 |
| dulek | ltomasbo: "If you want to allow all traffic from all pods in a namespace (even if policies are added that cause some pods to be treated as “isolated”)" - this suggests you're right if I'm reading that "isolated" correctly? | 15:16 |
| ltomasbo | I think so | 15:17 |
| ltomasbo | dulek, did you try to run the tests with that? is it failing? | 15:19 |
| dulek | ltomasbo: Sorry, not yet, my env's quite fragile. | 15:19 |
| dulek | I should probably try to run that on a baremetal machine. :P | 15:20 |
| ltomasbo | dulek, no hurry! | 15:22 |
| *** dmellado has quit IRC | 15:24 | |
| *** dulek has quit IRC | 15:24 | |
| *** dmellado has joined #openstack-kuryr | 15:26 | |
| *** dulek has joined #openstack-kuryr | 15:27 | |
| *** gmann is now known as gmann_afk | 15:32 | |
| *** maysams has quit IRC | 16:10 | |
| *** ccamposr has quit IRC | 16:29 | |
| *** celebdor has quit IRC | 16:36 | |
| dulek | ltomasbo: Okay, it'll take ma a lot more time, because I think some podman update broke my VM again. :( | 16:44 |
| ltomasbo | dulek, no worries... | 16:45 |
| *** celebdor has joined #openstack-kuryr | 17:04 | |
| *** jistr is now known as jistr|off | 17:45 | |
| *** jistr|off is now known as jistr | 17:45 | |
| *** gcheresh has joined #openstack-kuryr | 18:24 | |
| *** pcaruana has quit IRC | 18:38 | |
| *** gcheresh has quit IRC | 19:08 | |
| *** gmann_afk is now known as gmann | 19:19 | |
| *** celebdor has quit IRC | 19:50 | |
| *** celebdor has joined #openstack-kuryr | 23:14 | |
| *** celebdor has quit IRC | 23:19 | |
| *** rh-jelabarre has quit IRC | 23:34 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!