Skip to content

Commit 1475be0

Browse files
jrajahalmejrajahalme
committed
policy: Add NetworkPolicyResourcesDiscoveryService
Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
1 parent 3b17d84 commit 1475be0

13 files changed

Lines changed: 2390 additions & 213 deletions

‎cilium/api/bpf_metadata.proto‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,10 @@ message BpfMetadata {
8282

8383
// Cache is garbage collected at interval 10 times the ttl (default 30 ms).
8484
google.protobuf.Duration cache_gc_interval = 15;
85+
86+
// Use delta NPDS rather than the state-of-the-world protocol.
87+
// Even with delta NPDS, each new stream starts with a full dump.
88+
// Only wildcard subscriptions are supported.
89+
// All listeners on the node must agree on this setting.
90+
bool use_delta_npds = 16;
8591
}

‎cilium/api/npds.proto‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import "validate/validate.proto";
1717
// [#protodoc-title: Network policy management and NPDS]
1818

1919
// Each resource name is a network policy identifier.
20+
// Deprecated: This service will be removed when Cilium 1.20 is the oldest supported release.
2021
service NetworkPolicyDiscoveryService {
2122
option (envoy.annotations.resource).type = "cilium.NetworkPolicy";
2223

@@ -33,6 +34,32 @@ service NetworkPolicyDiscoveryService {
3334
}
3435
}
3536

37+
// Policy and selector resource names are exact-match identifiers in delta NPDS.
38+
service NetworkPolicyResourceDiscoveryService {
39+
option (envoy.annotations.resource).type = "cilium.NetworkPolicyResource";
40+
41+
rpc DeltaNetworkPolicyResources(stream envoy.service.discovery.v3.DeltaDiscoveryRequest)
42+
returns (stream envoy.service.discovery.v3.DeltaDiscoveryResponse) {
43+
}
44+
}
45+
46+
// A delta NPDS resource that carries either an endpoint policy or a shared selector.
47+
message NetworkPolicyResource {
48+
oneof resource {
49+
NetworkPolicy policy = 1;
50+
Selector selector = 2;
51+
}
52+
}
53+
54+
// A shared set of remote identities referenced by selector resource name.
55+
// Unlike the old state-of-the-world remote identity lists, an empty selector
56+
// matches nothing.
57+
message Selector {
58+
// The set of numeric remote security IDs selected by this selector.
59+
// If empty, this selector selects no remote identities.
60+
repeated uint32 remote_identities = 1;
61+
}
62+
3663
// A network policy that is enforced by a filter on the network flows to/from
3764
// associated hosts.
3865
message NetworkPolicy {
@@ -153,6 +180,12 @@ message PortNetworkPolicyRule {
153180
// Optional. If not specified, any remote host is matched by this predicate.
154181
repeated uint32 remote_policies = 7;
155182

183+
// Optional selector resource names that can be resolved to shared remote
184+
// policy sets in delta NPDS.
185+
// Selector references are matched by exact selector resource name.
186+
// Optional. If not specified, any remote host is matched by this predicate.
187+
repeated string selectors = 11;
188+
156189
// Optional downstream TLS context. If present, the incoming connection must
157190
// be a TLS connection.
158191
TLSContext downstream_tls_context = 3;

‎cilium/bpf_metadata.cc‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,8 +257,14 @@ Config::Config(const ::cilium::BpfMetadata& config,
257257
if (ipcache_ || hosts_) {
258258
npmap_ =
259259
context.serverFactoryContext().singletonManager().getTyped<const Cilium::NetworkPolicyMap>(
260-
SINGLETON_MANAGER_REGISTERED_NAME(cilium_network_policy),
261-
[&context] { return std::make_shared<Cilium::NetworkPolicyMap>(context, true); });
260+
SINGLETON_MANAGER_REGISTERED_NAME(cilium_network_policy), [&context, &config] {
261+
return std::make_shared<Cilium::NetworkPolicyMap>(context, true,
262+
config.use_delta_npds());
263+
});
264+
if (npmap_->useDeltaXds() != config.use_delta_npds()) {
265+
throw EnvoyException(
266+
"cilium.bpf_metadata: use_npds_delta must be consistent across listeners");
267+
}
262268
}
263269
}
264270

‎cilium/grpc_subscription.cc‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,13 @@
1111

1212
#include "envoy/annotations/resource.pb.h"
1313
#include "envoy/common/exception.h"
14-
#include "envoy/common/random_generator.h"
1514
#include "envoy/config/core/v3/config_source.pb.h"
1615
#include "envoy/config/custom_config_validators.h"
16+
#include "envoy/config/grpc_mux.h"
1717
#include "envoy/config/subscription.h"
1818
#include "envoy/config/subscription_factory.h"
19-
#include "envoy/event/dispatcher.h"
2019
#include "envoy/grpc/async_client.h"
21-
#include "envoy/local_info/local_info.h"
20+
#include "envoy/server/factory_context.h"
2221
#include "envoy/stats/scope.h"
2322
#include "envoy/upstream/cluster_manager.h"
2423

@@ -106,6 +105,7 @@ TypeUrlToServiceMap* buildTypeUrlToServiceMap() {
106105
// https://www.mail-archive.com/protobuf@googlegroups.com/msg04540.html.
107106
for (absl::string_view name : {
108107
"cilium.NetworkPolicyDiscoveryService",
108+
"cilium.NetworkPolicyResourceDiscoveryService",
109109
"cilium.NetworkPolicyHostsDiscoveryService",
110110
}) {
111111
const auto* service_desc =
@@ -169,7 +169,7 @@ const Protobuf::MethodDescriptor& sotwGrpcMethod(absl::string_view type_url) {
169169

170170
// Hard-coded Cilium gRPC cluster
171171
// Note: No rate-limit settings are used, consider if needed.
172-
envoy::config::core::v3::ConfigSource getCiliumXDSAPIConfig() {
172+
envoy::config::core::v3::ConfigSource getCiliumXDSAPIConfig(bool use_delta_xds = false) {
173173
auto config_source = envoy::config::core::v3::ConfigSource();
174174
/* config_source.initial_fetch_timeout is set to 50 millliseconds.
175175
* This applies only to SDS Secrets for now, as for NPDS and NPHDS we explicitly set the timeout
@@ -179,7 +179,9 @@ envoy::config::core::v3::ConfigSource getCiliumXDSAPIConfig() {
179179
config_source.set_resource_api_version(envoy::config::core::v3::ApiVersion::V3);
180180
auto api_config_source = config_source.mutable_api_config_source();
181181
api_config_source->set_set_node_on_first_message_only(true);
182-
api_config_source->set_api_type(envoy::config::core::v3::ApiConfigSource::GRPC);
182+
api_config_source->set_api_type(use_delta_xds
183+
? envoy::config::core::v3::ApiConfigSource::DELTA_GRPC
184+
: envoy::config::core::v3::ApiConfigSource::GRPC);
183185
api_config_source->set_transport_api_version(envoy::config::core::v3::ApiVersion::V3);
184186
api_config_source->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("xds-grpc-cilium");
185187
return config_source;
@@ -204,9 +206,9 @@ uint64_t grpcStreamGeneration(Config::Subscription* subscription) {
204206
std::unique_ptr<Config::Subscription>
205207
subscribe(const std::string& type_url, Server::Configuration::CommonFactoryContext& context,
206208
Stats::Scope& scope, Config::SubscriptionCallbacks& callbacks,
207-
Config::OpaqueResourceDecoderSharedPtr resource_decoder,
209+
Config::OpaqueResourceDecoderSharedPtr resource_decoder, bool use_delta_xds,
208210
std::chrono::milliseconds init_fetch_timeout) {
209-
const envoy::config::core::v3::ConfigSource config_source = getCiliumXDSAPIConfig();
211+
const envoy::config::core::v3::ConfigSource config_source = getCiliumXDSAPIConfig(use_delta_xds);
210212
const envoy::config::core::v3::ApiConfigSource& api_config_source =
211213
config_source.api_config_source();
212214
THROW_IF_NOT_OK(Config::Utility::checkApiConfigSourceSubscriptionBackingCluster(
@@ -231,7 +233,7 @@ subscribe(const std::string& type_url, Server::Configuration::CommonFactoryConte
231233
factory_or_error.value()->createUncachedRawAsyncClient(), Grpc::RawAsyncClientPtr),
232234
/*failover_async_client_=*/nullptr,
233235
/*dispatcher_=*/context.mainThreadDispatcher(),
234-
/*service_method_=*/sotwGrpcMethod(type_url),
236+
/*service_method_=*/use_delta_xds ? deltaGrpcMethod(type_url) : sotwGrpcMethod(type_url),
235237
/*local_info_=*/context.localInfo(),
236238
/*rate_limit_settings_=*/rate_limit_settings_or_error.value(),
237239
/*scope_=*/scope,
@@ -247,8 +249,10 @@ subscribe(const std::string& type_url, Server::Configuration::CommonFactoryConte
247249
};
248250

249251
std::shared_ptr<Config::GrpcMux> grpc_mux =
250-
std::static_pointer_cast<Config::GrpcMux>(std::make_shared<SotwGrpcMuxImpl>(
251-
grpc_mux_context, api_config_source.set_node_on_first_message_only()));
252+
use_delta_xds ? std::static_pointer_cast<Config::GrpcMux>(
253+
std::make_shared<DeltaGrpcMuxImpl>(grpc_mux_context))
254+
: std::static_pointer_cast<Config::GrpcMux>(std::make_shared<SotwGrpcMuxImpl>(
255+
grpc_mux_context, api_config_source.set_node_on_first_message_only()));
252256

253257
return std::make_unique<Config::GrpcSubscriptionImpl>(
254258
grpc_mux, callbacks, resource_decoder, stats, type_url, context.mainThreadDispatcher(),

‎cilium/grpc_subscription.h‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,10 @@
55
#include <memory>
66
#include <string>
77

8-
#include "envoy/common/random_generator.h"
98
#include "envoy/config/core/v3/config_source.pb.h"
109
#include "envoy/config/subscription.h"
11-
#include "envoy/event/dispatcher.h"
12-
#include "envoy/local_info/local_info.h"
10+
#include "envoy/ssl/context_manager.h"
1311
#include "envoy/stats/scope.h"
14-
#include "envoy/upstream/cluster_manager.h"
1512

1613
namespace Envoy {
1714
namespace Cilium {
@@ -22,7 +19,7 @@ extern envoy::config::core::v3::ConfigSource cilium_xds_api_config;
2219
std::unique_ptr<Config::Subscription>
2320
subscribe(const std::string& type_url, Server::Configuration::CommonFactoryContext& context,
2421
Stats::Scope& scope, Config::SubscriptionCallbacks& callbacks,
25-
Config::OpaqueResourceDecoderSharedPtr resource_decoder,
22+
Config::OpaqueResourceDecoderSharedPtr resource_decoder, bool use_delta_xds = false,
2623
std::chrono::milliseconds init_fetch_timeout = std::chrono::milliseconds(0));
2724

2825
// Returns a monotonic stream generation for Cilium subscriptions.

0 commit comments

Comments
 (0)