78 lines
3.3 KiB
Go
78 lines
3.3 KiB
Go
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
// Vars so tests can shrink them. A dial that neither connects nor is refused
|
|
// within egressDialTimeout counts as blocked: a policy that drops packets looks
|
|
// exactly like that.
|
|
var (
|
|
egressDialTimeout = 500 * time.Millisecond
|
|
egressPollInterval = 200 * time.Millisecond
|
|
)
|
|
|
|
// cmdEgressGate is the first initContainer of every build pod and the last of
|
|
// every game server pod. A pod's NetworkPolicy is programmed asynchronously after
|
|
// the pod starts (live on k3s: a build-labelled pod reached the internet and the
|
|
// Kubernetes API for its first ~0.7 s, a server-labelled one felis-api's internal
|
|
// face on its first request), so the gate dials a destination the policy denies
|
|
// until it stops answering, and only then lets the pod's next container, the
|
|
// untrusted Dockerfile or server image, start.
|
|
//
|
|
// The default probe is the Kubernetes API Service, which the kubelet names in
|
|
// every pod's environment and neither policy admits. A probe that still answers
|
|
// after --wait means the policy is not enforced at all (a CNI without
|
|
// NetworkPolicy support, or k3s run with --disable-network-policy), and the
|
|
// build fails closed. A server passes --fail-open: an operator's
|
|
// --server-egress-allow-cidr may cover the node the API Service leads to, so a
|
|
// probe that keeps answering does not prove the fence is missing, and by then
|
|
// the policy has had --wait to land.
|
|
func cmdEgressGate(args []string, stdout, stderr io.Writer) int {
|
|
fs := flag.NewFlagSet("egress-gate", flag.ContinueOnError)
|
|
fs.SetOutput(stderr)
|
|
probe := fs.String("probe", "", "host:port the pod's NetworkPolicy denies (default: the Kubernetes API Service from KUBERNETES_SERVICE_HOST/PORT)")
|
|
wait := fs.Duration("wait", 2*time.Minute, "how long the probe may keep answering before the gate gives up")
|
|
failOpen := fs.Bool("fail-open", false, "when --wait runs out, warn and let the pod go on instead of refusing it")
|
|
if err := fs.Parse(args); err != nil {
|
|
return 2
|
|
}
|
|
if *probe == "" {
|
|
host, port := os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT")
|
|
if host == "" || port == "" {
|
|
fmt.Fprintln(stderr, "felis egress-gate: no --probe and no KUBERNETES_SERVICE_HOST/PORT to default to")
|
|
return 2
|
|
}
|
|
*probe = net.JoinHostPort(host, port)
|
|
}
|
|
|
|
start := time.Now()
|
|
for {
|
|
conn, err := net.DialTimeout("tcp", *probe, egressDialTimeout)
|
|
if err != nil {
|
|
fmt.Fprintf(stdout, "felis egress-gate: %s is unreachable after %s (%v); the egress lock is in effect\n",
|
|
*probe, time.Since(start).Round(time.Millisecond), err)
|
|
return 0
|
|
}
|
|
_ = conn.Close()
|
|
if time.Since(start) >= *wait {
|
|
if *failOpen {
|
|
fmt.Fprintf(stderr, "felis egress-gate: %s still answers after %s; starting anyway. Either this namespace's "+
|
|
"NetworkPolicy is not enforced (a CNI without NetworkPolicy support, or k3s started with "+
|
|
"--disable-network-policy), or an allowed CIDR admits the address behind it\n", *probe, *wait)
|
|
return 0
|
|
}
|
|
fmt.Fprintf(stderr, "felis egress-gate: %s still answers after %s: the build namespace's NetworkPolicy is not enforced "+
|
|
"(a CNI without NetworkPolicy support, or k3s started with --disable-network-policy); refusing to run the build\n",
|
|
*probe, *wait)
|
|
return 1
|
|
}
|
|
time.Sleep(egressPollInterval)
|
|
}
|
|
}
|