-
Notifications
You must be signed in to change notification settings - Fork 4.7k
/
multitenant.go
158 lines (125 loc) · 4.19 KB
/
multitenant.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
package plugin
import (
"sync"
"github.com/golang/glog"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
kapi "k8s.io/kubernetes/pkg/api"
osapi "github.com/openshift/origin/pkg/sdn/apis/network"
)
type multiTenantPlugin struct {
node *OsdnNode
vnids *nodeVNIDMap
vnidInUseLock sync.Mutex
vnidInUse map[uint32]bool
}
func NewMultiTenantPlugin() osdnPolicy {
return &multiTenantPlugin{
vnidInUse: make(map[uint32]bool),
}
}
func (mp *multiTenantPlugin) Name() string {
return osapi.MultiTenantPluginName
}
func (mp *multiTenantPlugin) Start(node *OsdnNode) error {
mp.node = node
mp.vnids = newNodeVNIDMap(mp, node.osClient)
if err := mp.vnids.Start(); err != nil {
return err
}
otx := node.oc.NewTransaction()
otx.AddFlow("table=80, priority=200, reg0=0, actions=output:NXM_NX_REG2[]")
otx.AddFlow("table=80, priority=200, reg1=0, actions=output:NXM_NX_REG2[]")
if err := otx.EndTransaction(); err != nil {
return err
}
if err := mp.node.SetupEgressNetworkPolicy(); err != nil {
return err
}
return nil
}
func (mp *multiTenantPlugin) updatePodNetwork(namespace string, oldNetID, netID uint32) {
// FIXME: this is racy; traffic coming from the pods gets switched to the new
// VNID before the service and firewall rules are updated to match. We need
// to do the updates as a single transaction (ovs-ofctl --bundle).
pods, err := mp.node.GetLocalPods(namespace)
if err != nil {
glog.Errorf("Could not get list of local pods in namespace %q: %v", namespace, err)
}
services, err := mp.node.kClient.Core().Services(namespace).List(metav1.ListOptions{})
if err != nil {
glog.Errorf("Could not get list of services in namespace %q: %v", namespace, err)
services = &kapi.ServiceList{}
}
if oldNetID != netID {
// Update OF rules for the existing/old pods in the namespace
for _, pod := range pods {
err = mp.node.UpdatePod(pod)
if err != nil {
glog.Errorf("Could not update pod %q in namespace %q: %v", pod.Name, namespace, err)
}
}
// Update OF rules for the old services in the namespace
for _, svc := range services.Items {
if !kapi.IsServiceIPSet(&svc) {
continue
}
mp.node.DeleteServiceRules(&svc)
mp.node.AddServiceRules(&svc, netID)
}
mp.EnsureVNIDRules(netID)
// Update namespace references in egress firewall rules
mp.node.UpdateEgressNetworkPolicyVNID(namespace, oldNetID, netID)
}
// Update local multicast rules
mp.node.podManager.UpdateLocalMulticastRules(oldNetID)
mp.node.podManager.UpdateLocalMulticastRules(netID)
}
func (mp *multiTenantPlugin) AddNetNamespace(netns *osapi.NetNamespace) {
mp.updatePodNetwork(netns.Name, 0, netns.NetID)
}
func (mp *multiTenantPlugin) UpdateNetNamespace(netns *osapi.NetNamespace, oldNetID uint32) {
mp.updatePodNetwork(netns.Name, oldNetID, netns.NetID)
}
func (mp *multiTenantPlugin) DeleteNetNamespace(netns *osapi.NetNamespace) {
mp.updatePodNetwork(netns.Name, netns.NetID, 0)
}
func (mp *multiTenantPlugin) GetVNID(namespace string) (uint32, error) {
return mp.vnids.WaitAndGetVNID(namespace)
}
func (mp *multiTenantPlugin) GetNamespaces(vnid uint32) []string {
return mp.vnids.GetNamespaces(vnid)
}
func (mp *multiTenantPlugin) GetMulticastEnabled(vnid uint32) bool {
return mp.vnids.GetMulticastEnabled(vnid)
}
func (mp *multiTenantPlugin) EnsureVNIDRules(vnid uint32) {
if vnid == 0 {
return
}
mp.vnidInUseLock.Lock()
defer mp.vnidInUseLock.Unlock()
if mp.vnidInUse[vnid] {
return
}
mp.vnidInUse[vnid] = true
glog.V(5).Infof("EnsureVNIDRules %d - adding rules", vnid)
otx := mp.node.oc.NewTransaction()
otx.AddFlow("table=80, priority=100, reg0=%d, reg1=%d, actions=output:NXM_NX_REG2[]", vnid, vnid)
if err := otx.EndTransaction(); err != nil {
glog.Errorf("Error adding OVS flow for VNID: %v", err)
}
}
func (mp *multiTenantPlugin) SyncVNIDRules() {
mp.vnidInUseLock.Lock()
defer mp.vnidInUseLock.Unlock()
unused := mp.node.oc.FindUnusedVNIDs()
glog.Infof("SyncVNIDRules: %d unused VNIDs", len(unused))
otx := mp.node.oc.NewTransaction()
for _, vnid := range unused {
mp.vnidInUse[uint32(vnid)] = false
otx.DeleteFlows("table=80, reg1=%d", vnid)
}
if err := otx.EndTransaction(); err != nil {
glog.Errorf("Error deleting syncing OVS VNID rules: %v", err)
}
}