Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
k3s
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Jacklull
k3s
Commits
95a1a868
Commit
95a1a868
authored
Jan 27, 2021
by
Brad Davidson
Committed by
Brad Davidson
Feb 03, 2021
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Spell check upstream code
Signed-off-by:
Brad Davidson
<
brad.davidson@rancher.com
>
parent
29483d06
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
10 additions
and
10 deletions
+10
-10
network_policy_controller.go
pkg/agent/netpol/network_policy_controller.go
+4
-4
pod.go
pkg/agent/netpol/pod.go
+2
-2
ipset.go
pkg/agent/netpol/utils/ipset.go
+4
-4
No files found.
pkg/agent/netpol/network_policy_controller.go
View file @
95a1a868
...
...
@@ -41,7 +41,7 @@ const (
// filter table a rule is added to jump the traffic originating (in case of egress network policy) from the pod
// or destined (in case of ingress network policy) to the pod specific iptables chain. Each
// pod specific iptables chain has rules to jump to the network polices chains, that pod matches. So packet
// originating/destined from/to pod goes through fi
tl
er table's, FORWARD chain, followed by pod specific chain,
// originating/destined from/to pod goes through fi
lt
er table's, FORWARD chain, followed by pod specific chain,
// followed by one or more network policy chains, till there is a match which will accept the packet, or gets
// dropped by the rule in the pod chain, if there is no match.
...
...
@@ -130,7 +130,7 @@ type numericPort2eps map[string]*endPoints
type
protocol2eps
map
[
string
]
numericPort2eps
type
namedPort2eps
map
[
string
]
protocol2eps
// Run runs forver till we receive notification on stopCh
// Run runs for
e
ver till we receive notification on stopCh
func
(
npc
*
NetworkPolicyController
)
Run
(
healthChan
chan
<-
*
healthcheck
.
ControllerHeartbeat
,
stopCh
<-
chan
struct
{},
wg
*
sync
.
WaitGroup
)
{
t
:=
time
.
NewTicker
(
npc
.
syncPeriod
)
defer
t
.
Stop
()
...
...
@@ -500,7 +500,7 @@ func (npc *NetworkPolicyController) Cleanup() {
return
}
// TODO: need a better way to delte rule with out using number
// TODO: need a better way to del
e
te rule with out using number
var
realRuleNo
int
for
i
,
rule
:=
range
forwardChainRules
{
if
strings
.
Contains
(
rule
,
kubePodFirewallChainPrefix
)
{
...
...
@@ -519,7 +519,7 @@ func (npc *NetworkPolicyController) Cleanup() {
return
}
// TODO: need a better way to delte rule with out using number
// TODO: need a better way to del
e
te rule with out using number
realRuleNo
=
0
for
i
,
rule
:=
range
forwardChainRules
{
if
strings
.
Contains
(
rule
,
kubePodFirewallChainPrefix
)
{
...
...
pkg/agent/netpol/pod.go
View file @
95a1a868
...
...
@@ -102,7 +102,7 @@ func (npc *NetworkPolicyController) syncPodFirewallChains(networkPoliciesInfo []
for
_
,
pod
:=
range
*
ingressNetworkPolicyEnabledPods
{
// below condition occurs when we get trasient update while removing or adding pod
// subseqent update will do the correct action
// subseq
u
ent update will do the correct action
if
len
(
pod
.
ip
)
==
0
||
pod
.
ip
==
""
{
continue
}
...
...
@@ -223,7 +223,7 @@ func (npc *NetworkPolicyController) syncPodFirewallChains(networkPoliciesInfo []
for
_
,
pod
:=
range
*
egressNetworkPolicyEnabledPods
{
// below condition occurs when we get trasient update while removing or adding pod
// subseqent update will do the correct action
// subseq
u
ent update will do the correct action
if
len
(
pod
.
ip
)
==
0
||
pod
.
ip
==
""
{
continue
}
...
...
pkg/agent/netpol/utils/ipset.go
View file @
95a1a868
...
...
@@ -21,7 +21,7 @@ const (
// DefaultMaxElem Default OptionMaxElem value.
DefaultMaxElem
=
"65536"
// DefaultHasSize Defaul OptionHashSize value.
// DefaultHasSize Defaul
t
OptionHashSize value.
DefaultHasSize
=
"1024"
// TypeHashIP The hash:ip set type uses a hash to store IP host addresses (default) or network addresses. Zero valued IP address cannot be stored in a hash:ip type of set.
...
...
@@ -86,7 +86,7 @@ type IPSet struct {
isIpv6
bool
}
// Set repre
n
sent a ipset set entry.
// Set represent a ipset set entry.
type
Set
struct
{
Parent
*
IPSet
Name
string
...
...
@@ -281,7 +281,7 @@ func (entry *Entry) Del() error {
return
nil
}
// Test wether an entry is in a set or not. Exit status number is zero if the
// Test w
h
ether an entry is in a set or not. Exit status number is zero if the
// tested entry is in the set and nonzero if it is missing from the set.
func
(
set
*
Set
)
Test
(
testOptions
...
string
)
(
bool
,
error
)
{
_
,
err
:=
set
.
Parent
.
run
(
append
([]
string
{
"test"
,
set
.
name
()},
testOptions
...
)
...
)
...
...
@@ -412,7 +412,7 @@ func (ipset *IPSet) Save() error {
// stdin. Please note, existing sets and elements are not erased by restore
// unless specified so in the restore file. All commands are allowed in restore
// mode except list, help, version, interactive mode and restore itself.
// Send formated ipset.sets into stdin of "ipset restore" command.
// Send format
t
ed ipset.sets into stdin of "ipset restore" command.
func
(
ipset
*
IPSet
)
Restore
()
error
{
stdin
:=
bytes
.
NewBufferString
(
buildIPSetRestore
(
ipset
))
_
,
err
:=
ipset
.
runWithStdin
(
stdin
,
"restore"
,
"-exist"
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment