Add network policy controller

go.mod

@@ -74,6 +74,7 @@ require (
 	github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8 // indirect
 	github.com/containernetworking/plugins v0.8.2 // indirect
 	github.com/coreos/flannel v0.11.0
+	github.com/coreos/go-iptables v0.4.2
 	github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e
 	github.com/docker/docker v0.7.3-0.20190731001754-589f1dad8dad
 	github.com/docker/go-metrics v0.0.1 // indirect

pkg/agent/config/config.go

@@ -399,6 +399,7 @@ func get(envInfo *cmds.Agent) (*config.Node, error) {
 	nodeConfig.AgentConfig.NodeLabels = envInfo.Labels
 	nodeConfig.AgentConfig.PrivateRegistry = envInfo.PrivateRegistry
 	nodeConfig.AgentConfig.DisableCCM = controlConfig.DisableCCM
+	nodeConfig.AgentConfig.DisableNPC = controlConfig.DisableNPC
 
 	return nodeConfig, nil
 }

pkg/agent/netpol/network_policy.go

+package netpol
+
+import (
+	"context"
+	"time"
+
+	"github.com/rancher/k3s/pkg/daemons/config"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func Run(ctx context.Context, nodeConfig *config.Node) error {
+	restConfig, err := clientcmd.BuildConfigFromFlags("", nodeConfig.AgentConfig.KubeConfigNode)
+	if err != nil {
+		return err
+	}
+
+	client, err := kubernetes.NewForConfig(restConfig)
+	if err != nil {
+		return err
+	}
+
+	npc, err := NewNetworkPolicyController(ctx.Done(), client, time.Minute, nodeConfig.AgentConfig.NodeName)
+	if err != nil {
+		return err
+	}
+
+	go npc.Run(ctx.Done())
+
+	return nil
+}

pkg/agent/run.go

@@ -13,6 +13,7 @@ import (
 	"github.com/rancher/k3s/pkg/agent/containerd"
 	"github.com/rancher/k3s/pkg/agent/flannel"
 	"github.com/rancher/k3s/pkg/agent/loadbalancer"
+	"github.com/rancher/k3s/pkg/agent/netpol"
 	"github.com/rancher/k3s/pkg/agent/syssetup"
 	"github.com/rancher/k3s/pkg/agent/tunnel"
 	"github.com/rancher/k3s/pkg/cli/cmds"
@@ -75,6 +76,12 @@ func run(ctx context.Context, cfg cmds.Agent, lb *loadbalancer.LoadBalancer) err
 		}
 	}
 
+	if !nodeConfig.AgentConfig.DisableNPC {
+		if err := netpol.Run(ctx, nodeConfig); err != nil {
+			return err
+		}
+	}
+
 	<-ctx.Done()
 	return ctx.Err()
 }

pkg/cli/cmds/server.go

@@ -37,6 +37,7 @@ type Server struct {
 	FlannelBackend           string
 	DefaultLocalStoragePath  string
 	DisableCCM               bool
+	DisableNPC               bool
 }
 
 var ServerConfig Server
@@ -206,6 +207,11 @@ func NewServerCommand(action func(*cli.Context) error) cli.Command {
 				Usage:       "Disable k3s default cloud controller manager",
 				Destination: &ServerConfig.DisableCCM,
 			},
+			cli.BoolFlag{
+				Name:        "disable-network-policy",
+				Usage:       "Disable k3s default network policy controller",
+				Destination: &ServerConfig.DisableNPC,
+			},
 			cli.StringFlag{
 				Name:        "flannel-backend",
 				Usage:       fmt.Sprintf("(experimental) One of '%s', '%s', '%s', or '%s'", config.FlannelBackendNone, config.FlannelBackendVXLAN, config.FlannelBackendIPSEC, config.FlannelBackendWireguard),

pkg/cli/server/server.go

@@ -87,6 +87,7 @@ func run(app *cli.Context, cfg *cmds.Server) error {
 	serverConfig.ControlConfig.FlannelBackend = cfg.FlannelBackend
 	serverConfig.ControlConfig.ExtraCloudControllerArgs = cfg.ExtraCloudControllerArgs
 	serverConfig.ControlConfig.DisableCCM = cfg.DisableCCM
+	serverConfig.ControlConfig.DisableNPC = cfg.DisableNPC
 
 	if cmds.AgentConfig.FlannelIface != "" && cmds.AgentConfig.NodeIP == "" {
 		cmds.AgentConfig.NodeIP = netutil.GetIPFromInterface(cmds.AgentConfig.FlannelIface)

pkg/daemons/config/types.go

@@ -79,6 +79,7 @@ type Agent struct {
 	StrongSwanDir       string
 	PrivateRegistry     string
 	DisableCCM          bool
+	DisableNPC          bool
 }
 
 type Control struct {
@@ -108,6 +109,7 @@ type Control struct {
 	IPSECPSK                 string
 	DefaultLocalStoragePath  string
 	DisableCCM               bool
+	DisableNPC               bool
 
 	Runtime *ControlRuntime `json:"-"`
 }