Kmesh enable ipsec #1030

bitcoffeeiux · 2024-11-10T15:15:57Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

bitcoffeeiux · 2024-11-10T15:19:10Z

bpf/kmesh/bpf2go/bpf2go.go

@@ -20,16 +20,20 @@ package bpf2go
 // go run github.com/cilium/ebpf/cmd/bpf2go --help
 //go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang  --cflags $EXTRA_CFLAGS --cflags $EXTRA_CDEFINE KmeshCgroupSock ../ads/cgroup_sock.c -- -I../ads/include -I../../include -I../../../api/v2-c -DCGROUP_SOCK_MANAGE -DKERNEL_VERSION_HIGHER_5_13_0=1
 //go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang  --cflags $EXTRA_CFLAGS --cflags $EXTRA_CDEFINE KmeshCgroupSockWorkload ../workload/cgroup_sock.c -- -I../workload/include -I../../include -I../probes -DKERNEL_VERSION_HIGHER_5_13_0=1
-//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang  --cflags $EXTRA_CFLAGS --cflags $EXTRA_CDEFINE KmeshSockops ../ads/sockops.c -- -I../ads/include -I../../include -I../../../api/v2-c -DKERNEL_VERSION_HIGHER_5_13_0=1
-//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang  --cflags $EXTRA_CFLAGS --cflags $EXTRA_CDEFINE KmeshTracePoint ../ads/tracepoint.c -- -I../ads/include -I../../include -DKERNEL_VERSION_HIGHER_5_13_0=1
+//not go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang  --cflags $EXTRA_CFLAGS --cflags $EXTRA_CDEFINE KmeshSockops ../ads/sockops.c -- -I../ads/include -I../../include -I../../../api/v2-c -DKERNEL_VERSION_HIGHER_5_13_0=1


This is no modification, it will be cleaned up later

LiZhenCheng9527 · 2024-11-11T01:43:42Z

bpf/kmesh/workload/include/ipsec_map.h

+    __type(value, struct nodeinfo);
+    __uint(map_flags, BPF_F_NO_PREALLOC);
+    __uint(max_entries, MAP_SIZE_OF_NODEINFO);
+} map_of_nodeinfo SEC(".maps");


map name need a prefix: km_

LiZhenCheng9527 · 2024-11-11T01:56:57Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	defer file.Close()
+
+	is.ipSecLoadLock.Lock()
+	defer is.ipSecLoadLock.Unlock()


Is it possible to unlock after line 108 is executed.
No need to defer

LiZhenCheng9527 · 2024-11-11T02:01:21Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+		log.Infof("start watching file %s", IpSecKeyFile)
+
+		var timerC <-chan time.Time
+		for {


How do I end the loop?

LiZhenCheng9527 · 2024-11-11T02:05:29Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	ipsecKeyBase := ipsecController.ipsecKey.GetIPSecKey()
+	ipsecController.kmeshNodeInfo.Spec.Spi = ipsecKeyBase.Spi
+
+	myNodeName := os.Getenv("NODE_NAME")


nit: localNodeName? or onle nodeName

LiZhenCheng9527 · 2024-11-11T02:25:52Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+				kniKey := lpm_key{
+					trie_key: uint32(prefix),
+				}
+				ip, _ := netip.ParseAddr(cidr[0])


Is this here to parse the cidr to get the IP? If so, see net.ParseCIDR

LiZhenCheng9527 · 2024-11-11T02:28:54Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+}
+
+func (ic *ipsecController) isMine(name string) bool {
+	myNodeName := os.Getenv("NODE_NAME")


Maybe can use a global variable to store nodeName

LiZhenCheng9527 · 2024-11-11T02:32:02Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+		log.Errorf("failed to create kmesh node info to k8s: %v", err)
+		return
+	}
+	tmpUpdate, err := ic.kniClient.Get(context.TODO(), ic.kmeshNodeInfo.Name, metav1.GetOptions{})


Does it take a while to wait for the kmeshNode to be created?

LiZhenCheng9527 · 2024-11-11T02:33:28Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	ic.ipsecKey.StartWatch(ipsecUpdateChan)
+
+	go func() {
+		for {


How to end this loop?

LiZhenCheng9527 · 2024-11-11T02:36:46Z

pkg/utils/kubeclient.go

@@ -39,6 +41,21 @@ func GetK8sclient() (kubernetes.Interface, error) {
 	return clientset, nil
 }

+func GetKmeshNodeInfoClient() (kni_versioned.Interface, error) {
+	var clientset kni_versioned.Interface


Is this necessary?

YaoZengzeng · 2024-11-15T01:43:23Z

bpf/kmesh/workload/include/tc.h

+    void *begin = (void *)(long)(ctx->data);
+    void *end = (void *)(long)(ctx->data_end);
+
+    // eth header


There is already a similar parse function (https://github.com/kmesh-net/kmesh/blob/main/bpf/kmesh/workload/xdp.c#L71), can it be reused or abstracted into a tool function.

YaoZengzeng · 2024-11-15T01:47:36Z

pkg/cni/plugin/plugin.go

+	}
+
+	if link, err = netlink.LinkByIndex(ifIndex); err != nil {
+		return fmt.Errorf("failed ot link valid interface, %v", err)


Suggested change

return fmt.Errorf("failed ot link valid interface, %v", err)

return fmt.Errorf("failed to link valid interface, %v", err)

YaoZengzeng · 2024-11-15T01:47:48Z

pkg/cni/plugin/plugin.go

+	}
+
+	if err = utils.AttchTCProgram(link, tc, utils.TC_DIR_INGRESS); err != nil {
+		return fmt.Errorf("failed ot attach tc program, %v", err)


Suggested change

return fmt.Errorf("failed ot attach tc program, %v", err)

return fmt.Errorf("failed to attach tc program, %v", err)

YaoZengzeng · 2024-11-15T01:55:24Z

@bitcoffeeiux it would be better to upload the design doc together for easier review :)

LiZhenCheng9527 · 2024-12-04T06:21:42Z

@bitcoffeeiux Any update on this PR?

LiZhenCheng9527 · 2024-12-16T07:36:28Z

bpf/kmesh/general/include/ipsec_map.h

+    __type(value, struct nodeinfo);
+    __uint(map_flags, BPF_F_NO_PREALLOC);
+    __uint(max_entries, MAP_SIZE_OF_NODEINFO);
+} map_of_nodeinfo SEC(".maps");


Suggested change

} map_of_nodeinfo SEC(".maps");

} km_nodeinfo SEC(".maps");

Or rename the map in config.h.

LiZhenCheng9527 · 2024-12-16T07:57:21Z

bpf/kmesh/general/tc_mark_decrypt.c

+        return TC_ACT_OK;
+    }
+    nodeid = nodeinfo->nodeid;
+    ctx->mark = (nodeid << 16) + 0x00d0;


What is this 0x00d0 and is it possible to add a comment?

This means that the packet needs to be decrypted by xfrm.

LiZhenCheng9527 · 2024-12-16T07:58:17Z

bpf/kmesh/general/tc_mark_encrypt.c

+    if (!nodeinfo) {
+        return TC_ACT_OK;
+    }
+    ctx->mark = ((nodeinfo->nodeid) << 16) + ((nodeinfo->spi) << 8) + 0x00e0;


LiZhenCheng9527 · 2024-12-16T08:01:13Z

docs/proposal/kmesh_support_encrypt.md

+
+Kmesh使能ipsec时，需要精细化控制ipsec数据加密行为，这其中要求Kmesh具有节点之间的信息同步机制。当前主要场景基于云原生业务场景，信息同步机制基于K8s集群api-server构建，依赖Kmesh自定义结构体来完成数据存储。
+
+CRD数据结构定义如下：


The meaning of each field in crd can be illustrated from the contents of type.go

LiZhenCheng9527 · 2024-12-16T08:02:19Z

docs/proposal/kmesh_support_encrypt.md

+
+### 4.3 Kmesh IPsec通信路径
+
+![](./pics/ipsec_traffic_path.png)


The image can be centred

LiZhenCheng9527 · 2024-12-16T08:03:30Z

pkg/bpf/general/tc.go

+	"reflect"
+	"syscall"
+
+	"github.com/cilium/ebpf"


golint error

LiZhenCheng9527 · 2024-12-16T08:08:34Z

pkg/cni/plugin/plugin.go

@@ -194,6 +255,11 @@ func CmdAdd(args *skel.CmdArgs) error {
 			log.Error(err)
 			return err
 		}
+
+		if err := enableTcEgress(args); err != nil {
+			err = fmt.Errorf("failed to set tc to dev %v, err is %v", args.IfName, err)


what tc means. can be stated in error info

hzxuzhonghu · 2024-12-17T09:33:36Z

bpf/kmesh/general/include/tc.h

+            return NULL;
+        }
+        key.trie_key.prefixlen = 128;
+        IP6_COPY(key.ip.ip6, ip6);


At some place, we use bpf_memcpy

hzxuzhonghu · 2024-12-17T09:36:40Z

daemon/options/encryption.go

+}
+
+func (c *encryptionConfig) AttachFlags(cmd *cobra.Command) {
+	cmd.PersistentFlags().BoolVar(&c.EnableIPsec, "enable-ipsec", false, "enable ipsec in daemon process")


nit: enable ipsec in service to service communication

hzxuzhonghu · 2024-12-17T09:37:46Z

deploy/yaml/clusterrole.yaml

@@ -11,3 +11,6 @@ rules:
 - apiGroups: ["apps"]
  resources: ["daemonsets"]
  verbs: ["get"]
+- apiGroups: ["kmesh.net"]
+  resources: ["kmeshnodeinfos"]
+  verbs: ["get", "create", "update", "patch", "list", "watch"]


patch, update, which one do you use?

pkg/bpf/ads/loader.go

bpf/kmesh/general/tc_mark_encrypt.c

hzxuzhonghu · 2024-12-17T10:08:40Z

pkg/cni/plugin/plugin.go

+	}
+
+	getVethPeerLinkNum := func(netns.NetNS) error {
+		if err = utils.ExecuteWithRedirect("ethtool", ethtoolArgs, &output); err != nil {


should use go code

pkg/cni/plugin/plugin.go

hzxuzhonghu · 2024-12-17T10:10:43Z

pkg/kube/apis/kmeshnodeinfo/v1alpha1/types.go

+	Spi    int8     `json:"spi"`
+	NicIPs []string `json:"nicIP"`
+	BootID string   `json:"bootid"`
+	Cirds  []string `json:"cirds"`


Please add some comments for the above fields

hzxuzhonghu · 2024-12-17T10:12:10Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	myNode        *v1.Node
+}
+
+func NewIPsecController(k8sClientSet kubernetes.Interface) (*IpsecController, error) {


Suggested change

func NewIPsecController(k8sClientSet kubernetes.Interface) (*IpsecController, error) {

func NewIPSecController(k8sClientSet kubernetes.Interface) (*IpsecController, error) {

pkg/controller/encryption/ipsec/ipsec_controller.go

hzxuzhonghu · 2024-12-17T10:57:57Z

pkg/utils/hash16.go

+func (s *Sum) Write(input []byte) (n int, err error) {
+	var sum uint64 = 0
+	for pos, i := range input {
+		si := uint32(i)
+		switch pos % 4 {
+		case 0:
+		case 1:
+			si = si << 8
+		case 2:
+			si = si << 16
+		case 3:
+			si = si << 24
+		}
+		sum += uint64(si)
+	}
+	for sum&0xffffffffffff0000 != 0 {
+		sum = sum&0xffff + sum>>16
+	}


Not sure what you want to do, just remind that golang lib has hash function

hzxuzhonghu · 2024-12-17T10:59:50Z

pkg/utils/tc.go

+	return nil
+}
+
+func DetchTCProgram(link netlink.Link, tc *ebpf.Program) error {


not called anywhere

hzxuzhonghu · 2024-12-17T11:05:46Z

pkg/kube/generate.sh

+
+kube::codegen::gen_client \
+    --with-watch \
+    --output-dir "${SCRIPT_ROOT}/pkg/kube/exnodeinfo" \


why do you use exnodeinfo

hzxuzhonghu · 2024-12-17T11:12:12Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+}
+
+func (ic *IpsecController) handleAllKmeshNodeInfo() bool {
+	kmeshNodeInfoList, err := ic.kniClient.List(context.TODO(), metav1.ListOptions{})


Donot use this list, since you have created a informer, use its List()

hzxuzhonghu · 2024-12-17T11:12:45Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+		if ic.isMine(node.Name) {
+			continue
+		}
+		if err = ic.handleOtherNodeInfo(&node); err != nil {


Suggested change

if err = ic.handleOtherNodeInfo(&node); err != nil {

if err = ic.handleNodeInfo(&node); err != nil {

hzxuzhonghu · 2024-12-17T11:14:47Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	}
+
+	if item.action == ActionAdd || item.action == ActionUpdate {
+		kniNodeInfo, err := ic.kniClient.Get(context.TODO(), item.name, metav1.GetOptions{})


donot use this one, use thae Get method from informer

hzxuzhonghu · 2024-12-17T11:15:31Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	}
+}
+
+func (ic *IpsecController) processNextItem() bool {


This function cannot return false, otherwise the Run( will exit)

hzxuzhonghu · 2024-12-18T06:40:54Z

docs/proposal/kmesh_support_encrypt.md

+
+其他节点：
+
+- node节点新增以后并将自己的kmeshnodeinfo上传api-server后，说明当前node节点上ipsec规则已准备好，当前kmesh-daemon仅需将对应node的state、policy、map更新即可


What will happen when a new node has already send traffic to the dst node, before the dst node setup the following policy ready

hzxuzhonghu · 2024-12-18T07:05:01Z

pkg/cni/plugin/plugin.go

+		if strings.Compare(line[0], "peer_ifindex") != 0 {
+			continue
+		}
+		if ifIndex, err = strconv.Atoi(strings.Trim(line[1], " ")); err != nil {


instead of trim, you can split ": " or just " "

hzxuzhonghu · 2024-12-18T07:06:07Z

pkg/cni/plugin/plugin.go

+	}
+
+	if ifIndex == 0 {
+		return fmt.Errorf("can not found valid if index")


Suggested change

return fmt.Errorf("can not found valid if index")

return fmt.Errorf("can not find valid peer interface index")

hzxuzhonghu · 2024-12-18T07:07:54Z

pkg/cni/plugin/plugin.go

@@ -194,6 +255,11 @@ func CmdAdd(args *skel.CmdArgs) error {
 			log.Error(err)
 			return err
 		}
+
+		if err := enableTcEgress(args); err != nil {
+			err = fmt.Errorf("failed to set tc to dev %v, err is %v", args.IfName, err)


Suggested change

err = fmt.Errorf("failed to set tc to dev %v, err is %v", args.IfName, err)

err = fmt.Errorf("failed to link tc to dev %v, err is %v", args.IfName, err)

pkg/cni/plugin/plugin.go

hzxuzhonghu · 2025-01-08T01:59:57Z

bpf/kmesh/general/tc_mark_encrypt.c

+    if (!nodeinfo) {
+        return TC_ACT_OK;
+    }
+    ctx->mark = ((nodeinfo->nodeid) << 16) + 0x00e0;


nit: ((nodeinfo->nodeid) << 16) | 0x00e0;

hzxuzhonghu · 2025-01-08T02:01:20Z

ctl/secret/secret.go

+		Use:   "secret",
+		Short: "Use secrets to generate secret configuration data for IPsec",
+		Example: `# Use secrets to generate secret configuration data for IPsec:
+ kmeshctl secret aeadKey aeadLength, only support rfc4106(gcm(aes))`,


Please provide complete usage guide

hzxuzhonghu · 2025-01-08T02:03:38Z

ctl/secret/secret.go

+	if err == nil {
+		return
+	}
+	_, err = clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Update(context.TODO(), secret, metav1.UpdateOptions{})


hmm. can you only call this when .Get return non err

hzxuzhonghu · 2025-01-08T02:04:26Z

deploy/yaml/clusterrole.yaml

@@ -9,5 +9,8 @@ rules:
  resources: ["pods","services","namespaces","nodes"]
  verbs: ["get", "update", "patch", "list", "watch"]
 - apiGroups: ["apps"]
-  resources: ["daemonsets"]
+  resources: ["daemonsets", "secret"]


I think you donot reply on secret get, but use filewatch

hzxuzhonghu · 2025-01-08T02:14:43Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+			}
+			for _, rawLocalAddr := range c.kmeshNodeInfo.Spec.Addresses {
+				localAddr := net.ParseIP(rawLocalAddr)
+				if addr.IP.Equal(localAddr) {


what does this check mean

Mount the tc program only when NodeInternalIP exists on the NIC.

hzxuzhonghu · 2025-01-08T02:18:08Z

pkg/controller/encryption/ipsec/ipsec_controller.go

+	}
+
+	for _, addr := range node.Spec.Addresses {
+		for _, cidr := range c.ipsecHandler.nodeInfos[addr].cidrs {


Why do not make node name as the key?

You can also use the name of the node as the key. In the current processing process, such as creating state rules, the iphandler processes information based on IP addresses and uses IP addresses to classify information.

hzxuzhonghu · 2025-01-08T02:22:49Z

pkg/controller/encryption/ipsec/ipsec_handler.go

+		return err
+	}
+
+	_, remoteCIDR, err := net.ParseCIDR("0.0.0.0/0")


If this is a const, we can define one

hzxuzhonghu · 2025-01-08T02:28:39Z

pkg/controller/encryption/ipsec/ipsec_handler.go

+	IpSecKeyFile = "./kmesh-ipsec/ipSec"
+)
+
+type ipSecInfo struct {


This is quite similar as KmeshNodeInfo, can you use it

Kmesh introduce IPsec encryption to encrypt communicatioon between nodes, which is critical to maintaining communication security. This submission includes come preliminary design of ipsec and outlines the basic data path for Kmesh using IPsec. Signed-off-by: bitcoffee <liuxin350@huawei.com>

We have added two new eBPF tc programs to mark traffic data. `tc_mark_encrypt` runs on the NIC of the pod. Currently, the veth NIC is supported. When the veth node receives a data packet, tc programs determines whether the traffic needs to be encrypted based oon the target information. If the traffic needs to be encrypted, tc add l marker to the packet and sends it to the IPsec of the host for processing. `tc_mark_decrypt` runs on the NIC of a node. After receiving an IPsec packet, mark the decrypted IPsec packet and determine whether to send the packet to the backend for processing or directly discarded by IPsec. Signed-off-by: bitcoffee <liuxin350@huawei.com>

kmesh node info is an CRD. This resource is used to transmit perr node information between kmesh nodes, including node names and IPsec information, to construct an IPsec encryption system. Signed-off-by: bitcoffee <liuxin350@huawei.com>

This patch is used to load the tc program and close the tc program. Note that the attach and detach operations are not included in this patch. The attach and detach operations will be implemented in the subsequent commit operations. Signed-off-by: bitcoffee <liuxin350@huawei.com>

This PR is used to add a controller for IPsec. This controller is used to enable IPsec when the Kmesh is started, stop IPsec when the Kmesh ends, and manage IPsec configuration data. When a node in a cluster changes, the node information is sent to api-server, and information about other nodes is obtained and synchronized to the IPsec. Signed-off-by: bitcoffee <liuxin350@huawei.com>

The tc eBPF processing logic is added to the cni. When the pod is started, the corresponding tc program is mounted in the egress direction of the veth network nic of the cni tc. The tc program adds encrypted labels to the traffic on the traffic egress. After the traffic reaches the host, the traffic is encrypted by IPsec. Signed-off-by: bitcoffee <liuxin350@huawei.com>

When the management tag is added, the Kmesh adds the tc enabling logic for the existing pod. When the management tag is removed, the Kmesh adds the disabling logic. Signed-off-by: bitcoffee <liuxin350@huawei.com>

kmeshctl secret used to generate IPsec config to K8s. Signed-off-by: bitcoffee <liuxin350@huawei.com>

make gen Signed-off-by: bitcoffee <liuxin350@huawei.com>

hzxuzhonghu · 2025-01-10T02:01:18Z

/lgtm
/approve

kmesh-bot · 2025-01-10T02:01:27Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hzxuzhonghu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [hzxuzhonghu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kmesh-bot added the kind/feature label Nov 10, 2024

kmesh-bot requested review from hzxuzhonghu, LiZhenCheng9527 and nlgwcy November 10, 2024 15:16

kmesh-bot added the size/XXL label Nov 10, 2024

bitcoffeeiux commented Nov 10, 2024

View reviewed changes

LiZhenCheng9527 reviewed Nov 11, 2024

View reviewed changes

bitcoffeeiux force-pushed the kmesh-develop-push branch from a4f8f46 to f35b8d7 Compare November 14, 2024 03:26

YaoZengzeng reviewed Nov 15, 2024

View reviewed changes

bitcoffeeiux force-pushed the kmesh-develop-push branch 2 times, most recently from aaaeb32 to 010c40b Compare December 5, 2024 08:16

bitcoffeeiux force-pushed the kmesh-develop-push branch from 010c40b to 3e7fc5c Compare December 13, 2024 08:15

kmesh-bot added size/L and removed size/XXL labels Dec 13, 2024

bitcoffeeiux force-pushed the kmesh-develop-push branch from 3e7fc5c to 85e14a6 Compare December 16, 2024 07:01

kmesh-bot added size/XXL and removed size/L labels Dec 16, 2024

LiZhenCheng9527 reviewed Dec 16, 2024

View reviewed changes

hzxuzhonghu reviewed Dec 17, 2024

View reviewed changes

hzxuzhonghu reviewed Dec 18, 2024

View reviewed changes

pkg/cni/plugin/plugin.go Show resolved Hide resolved

bitcoffeeiux force-pushed the kmesh-develop-push branch from 81dccb7 to 8d7d668 Compare January 7, 2025 13:36

hzxuzhonghu reviewed Jan 8, 2025

View reviewed changes

bitcoffeeiux force-pushed the kmesh-develop-push branch 2 times, most recently from d32dd79 to 93a5a6a Compare January 8, 2025 14:53

bitcoffeeiux added 9 commits January 8, 2025 23:22

ipsec: add CRD kmeshnodeinfo define

9bad73a

kmesh node info is an CRD. This resource is used to transmit perr node information between kmesh nodes, including node names and IPsec information, to construct an IPsec encryption system. Signed-off-by: bitcoffee <liuxin350@huawei.com>

ipsec: add Kmesh enable and disable tc for management pod

f98fb55

When the management tag is added, the Kmesh adds the tc enabling logic for the existing pod. When the management tag is removed, the Kmesh adds the disabling logic. Signed-off-by: bitcoffee <liuxin350@huawei.com>

ipsec: add kmeshctl secret command

c2dc3cd

kmeshctl secret used to generate IPsec config to K8s. Signed-off-by: bitcoffee <liuxin350@huawei.com>

ipsec: make gen

665e79b

make gen Signed-off-by: bitcoffee <liuxin350@huawei.com>

bitcoffeeiux force-pushed the kmesh-develop-push branch from 9173430 to 99ae63e Compare January 9, 2025 07:17

hzxuzhonghu previously approved these changes Jan 9, 2025

View reviewed changes

kmesh-bot added the approved label Jan 9, 2025

bitcoffeeiux dismissed hzxuzhonghu’s stale review via f822150 January 9, 2025 12:01

bitcoffeeiux force-pushed the kmesh-develop-push branch from 99ae63e to f822150 Compare January 9, 2025 12:01

kmesh-bot removed the approved label Jan 9, 2025

bitcoffeeiux force-pushed the kmesh-develop-push branch 4 times, most recently from 10303e1 to 665e79b Compare January 9, 2025 14:04

kmesh-bot assigned hzxuzhonghu Jan 10, 2025

kmesh-bot added the lgtm label Jan 10, 2025

kmesh-bot added the approved label Jan 10, 2025

kmesh-bot merged commit 4601e6a into kmesh-net:main Jan 10, 2025
11 checks passed

	return fmt.Errorf("failed ot link valid interface, %v", err)
	return fmt.Errorf("failed to link valid interface, %v", err)

	return fmt.Errorf("failed ot attach tc program, %v", err)
	return fmt.Errorf("failed to attach tc program, %v", err)


		Kmesh使能ipsec时，需要精细化控制ipsec数据加密行为，这其中要求Kmesh具有节点之间的信息同步机制。当前主要场景基于云原生业务场景，信息同步机制基于K8s集群api-server构建，依赖Kmesh自定义结构体来完成数据存储。

		CRD数据结构定义如下：


		### 4.3 Kmesh IPsec通信路径

		![](./pics/ipsec_traffic_path.png)

	func NewIPsecController(k8sClientSet kubernetes.Interface) (*IpsecController, error) {
	func NewIPSecController(k8sClientSet kubernetes.Interface) (*IpsecController, error) {

	if err = ic.handleOtherNodeInfo(&node); err != nil {
	if err = ic.handleNodeInfo(&node); err != nil {


		其他节点：

		- node节点新增以后并将自己的kmeshnodeinfo上传api-server后，说明当前node节点上ipsec规则已准备好，当前kmesh-daemon仅需将对应node的state、policy、map更新即可

	return fmt.Errorf("can not found valid if index")
	return fmt.Errorf("can not find valid peer interface index")

	err = fmt.Errorf("failed to set tc to dev %v, err is %v", args.IfName, err)
	err = fmt.Errorf("failed to link tc to dev %v, err is %v", args.IfName, err)

Kmesh enable ipsec #1030

Kmesh enable ipsec #1030

Conversation

bitcoffeeiux commented Nov 10, 2024

Choose a reason for hiding this comment

LiZhenCheng9527 Nov 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

YaoZengzeng commented Nov 15, 2024

LiZhenCheng9527 commented Dec 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hzxuzhonghu Dec 18, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hzxuzhonghu commented Jan 10, 2025

kmesh-bot commented Jan 10, 2025

LiZhenCheng9527 Nov 11, 2024 •

edited

Loading

hzxuzhonghu Dec 18, 2024 •

edited

Loading