diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index bffb9f38e5..78087ead8c 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -99,9 +99,6 @@ jobs: id: set-architectures run: | ARCHITECTURES=${{ needs.configure.outputs.architectures }} - if [ "${{ matrix.component }}" == "proxy" ]; then - ARCHITECTURES=$(echo ${ARCHITECTURES} | sed 's/,linux\/arm\/v7//') - fi echo "ARCHITECTURES=${ARCHITECTURES}" >> $GITHUB_ENV - name: Set up QEMU uses: docker/setup-qemu-action@v3.2.0 diff --git a/build/proxy/Dockerfile b/build/proxy/Dockerfile deleted file mode 100644 index 2fcc76de4a..0000000000 --- a/build/proxy/Dockerfile +++ /dev/null @@ -1 +0,0 @@ -FROM envoyproxy/envoy:v1.32.0 diff --git a/cmd/proxy/doc.go b/cmd/proxy/doc.go new file mode 100644 index 0000000000..7f09b658d1 --- /dev/null +++ b/cmd/proxy/doc.go @@ -0,0 +1,16 @@ +// Copyright 2019-2024 The Liqo Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Package proxy contains the logic for the Liqo proxy. +package main diff --git a/cmd/proxy/main.go b/cmd/proxy/main.go new file mode 100644 index 0000000000..152bc14c70 --- /dev/null +++ b/cmd/proxy/main.go @@ -0,0 +1,41 @@ +// Copyright 2019-2024 The Liqo Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package main + +import ( + "context" + "flag" + "os" + + "k8s.io/klog/v2" + + "github.com/liqotech/liqo/pkg/proxy" +) + +func main() { + ctx := context.Background() + + port := flag.Int("port", 8080, "port to listen on") + allowedHosts := flag.String("allowed-hosts", "", "comma separated list of allowed hosts") + + flag.Parse() + + p := proxy.New(*allowedHosts, *port) + + if err := p.Start(ctx); err != nil { + klog.Error(err) + os.Exit(1) + } +} diff --git a/deployments/liqo/templates/liqo-proxy-configmap.yaml b/deployments/liqo/templates/liqo-proxy-configmap.yaml deleted file mode 100644 index 2f3632cb8a..0000000000 --- a/deployments/liqo/templates/liqo-proxy-configmap.yaml +++ /dev/null @@ -1,80 +0,0 @@ -{{- $proxyConfig := (merge (dict "name" "proxy" "module" "networking") .) -}} - -{{- if .Values.proxy.enabled }} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "liqo.prefixedName" $proxyConfig }} -{{- if .Values.proxy.service.annotations }} - annotations: - {{- toYaml .Values.proxy.service.annotations | nindent 4 }} -{{- end}} - labels: - {{- include "liqo.labels" $proxyConfig | nindent 4 }} -data: - config: | - admin: - address: - socket_address: - protocol: TCP - address: 0.0.0.0 - port_value: 9901 - static_resources: - listeners: - - name: listener_http - address: - socket_address: - protocol: TCP - address: 0.0.0.0 - port_value: {{ .Values.proxy.config.listeningPort }} - access_log: - name: envoy.access_loggers.file - typed_config: - "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog - path: /dev/stdout - filter_chains: - - filters: - - name: envoy.filters.network.http_connection_manager - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: ingress_http - route_config: - name: local_route - virtual_hosts: - - name: local_service - domains: - - "*" - routes: - - match: - connect_matcher: - {} - route: - cluster: api_server - upgrade_configs: - - upgrade_type: CONNECT - connect_config: - {} - http_filters: - - name: envoy.filters.http.router - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router - clusters: - - name: api_server - connect_timeout: 1.25s - type: STRICT_DNS - respect_dns_ttl: true - dns_lookup_family: V4_ONLY - dns_refresh_rate: 300s - lb_policy: ROUND_ROBIN - load_assignment: - cluster_name: api_server - endpoints: - - lb_endpoints: - - endpoint: - address: - socket_address: - address: kubernetes.default - port_value: 443 - -{{- end }} diff --git a/deployments/liqo/templates/liqo-proxy-deployment.yaml b/deployments/liqo/templates/liqo-proxy-deployment.yaml index d32a55a9c8..84f4ab926c 100644 --- a/deployments/liqo/templates/liqo-proxy-deployment.yaml +++ b/deployments/liqo/templates/liqo-proxy-deployment.yaml @@ -36,12 +36,9 @@ spec: ports: - containerPort: {{ .Values.proxy.config.listeningPort }} resources: {{- toYaml .Values.proxy.pod.resources | nindent 12 }} - volumeMounts: - - mountPath: /etc/envoy/envoy.yaml - name: config-volume - subPath: config - {{- if or .Values.common.extraArgs .Values.proxy.pod.extraArgs }} args: + - --port={{ .Values.proxy.config.listeningPort }} + {{- if or .Values.common.extraArgs .Values.proxy.pod.extraArgs }} {{- if .Values.common.extraArgs }} {{- toYaml .Values.common.extraArgs | nindent 10 }} {{- end }} @@ -49,10 +46,6 @@ spec: {{- toYaml .Values.proxy.pod.extraArgs | nindent 10 }} {{- end }} {{- end }} - volumes: - - name: config-volume - configMap: - name: {{ include "liqo.prefixedName" $proxyConfig }} {{- if ((.Values.common).nodeSelector) }} nodeSelector: {{- toYaml .Values.common.nodeSelector | nindent 8 }} diff --git a/docs/advanced/k8s-api-server-proxy.md b/docs/advanced/k8s-api-server-proxy.md index 8524960a8d..288ac29e1c 100644 --- a/docs/advanced/k8s-api-server-proxy.md +++ b/docs/advanced/k8s-api-server-proxy.md @@ -8,7 +8,7 @@ This feature is **internally** used by the [in-band peering](UsagePeeringInBand) If you just need to peer two clusters without publicly exposing the Kubernetes API server, you can use the [in-band peering](UsagePeeringInBand). ``` -The Kubernetes API Server Proxy is an Envoy HTTP server that accepts [HTTP Connect](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests and forwards them to the Kubernetes API Server of the local cluster. +The Kubernetes API Server Proxy is an HTTP server that accepts [HTTP Connect](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests and forwards them to the Kubernetes API Server of the local cluster. It just proxy the requests to the API server and it has no permission on the local cluster. This means that, as usual, all the requesters must authenticate with the Kubernetes API Server to access the resources. diff --git a/pkg/proxy/connect.go b/pkg/proxy/connect.go new file mode 100644 index 0000000000..866a105d8c --- /dev/null +++ b/pkg/proxy/connect.go @@ -0,0 +1,103 @@ +// Copyright 2019-2024 The Liqo Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package proxy + +import ( + "bufio" + "io" + "net" + "net/http" + "time" + + "k8s.io/klog/v2" +) + +func (p *Proxy) handleConnect(c net.Conn) { + br := bufio.NewReader(c) + req, err := http.ReadRequest(br) + if err != nil { + klog.Errorf("error reading request: %v", err) + return + } + + if req.Method != http.MethodConnect { + response := &http.Response{ + StatusCode: http.StatusMethodNotAllowed, + ProtoMajor: 1, + ProtoMinor: 1, + } + if err := response.Write(c); err != nil { + klog.Errorf("error writing response: %v", err) + } + if err := c.Close(); err != nil { + klog.Errorf("error closing connection: %v", err) + } + return + } + + if !p.isAllowed(req.URL.Host) { + klog.Infof("host %s is not allowed", req.URL.Host) + + response := &http.Response{ + StatusCode: http.StatusForbidden, + ProtoMajor: 1, + ProtoMinor: 1, + } + if err := response.Write(c); err != nil { + klog.Errorf("error writing response: %v", err) + } + return + } + + klog.Infof("handling CONNECT to %s", req.URL.Host) + + response := &http.Response{ + StatusCode: 200, + ProtoMajor: 1, + ProtoMinor: 1, + } + if err := response.Write(c); err != nil { + klog.Errorf("error writing response: %v", err) + if err := c.Close(); err != nil { + klog.Errorf("error closing connection: %v", err) + } + return + } + + destConn, err := net.DialTimeout("tcp", req.URL.Host, 30*time.Second) + if err != nil { + response := &http.Response{ + StatusCode: http.StatusRequestTimeout, + ProtoMajor: 1, + ProtoMinor: 1, + } + if err := response.Write(c); err != nil { + klog.Errorf("error writing response: %v", err) + } + return + } + + go transfer(destConn, c) + go transfer(c, destConn) +} + +func transfer(destination io.WriteCloser, source io.ReadCloser) { + defer destination.Close() + defer source.Close() + _, err := io.Copy(destination, source) + if err != nil { + klog.Errorf("error copying data: %v", err) + } +} diff --git a/pkg/proxy/doc.go b/pkg/proxy/doc.go new file mode 100644 index 0000000000..ebf774036a --- /dev/null +++ b/pkg/proxy/doc.go @@ -0,0 +1,16 @@ +// Copyright 2019-2024 The Liqo Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Package proxy contains the logic for the Liqo proxy. +package proxy diff --git a/pkg/proxy/types.go b/pkg/proxy/types.go new file mode 100644 index 0000000000..149c2762fb --- /dev/null +++ b/pkg/proxy/types.go @@ -0,0 +1,89 @@ +// Copyright 2019-2024 The Liqo Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package proxy + +import ( + "context" + "fmt" + "net" + "strings" + + "k8s.io/klog/v2" + "sigs.k8s.io/controller-runtime/pkg/manager" +) + +var _ manager.Runnable = &Proxy{} + +// Proxy is a simple HTTP Connect proxy. +type Proxy struct { + AllowedHosts []string + Port int +} + +// New creates a new Proxy. +func New(allowedHosts string, port int) *Proxy { + ah := strings.Split(allowedHosts, ",") + // remove empty strings + for i := 0; i < len(ah); i++ { + if ah[i] == "" { + ah = append(ah[:i], ah[i+1:]...) + i-- + } + } + + return &Proxy{ + AllowedHosts: ah, + Port: port, + } +} + +// Start starts the proxy. +func (p *Proxy) Start(ctx context.Context) error { + klog.Infof("proxy listening on port %d", p.Port) + listener, err := net.Listen("tcp", fmt.Sprintf(":%d", p.Port)) + if err != nil { + return err + } + defer listener.Close() + + for { + select { + case <-ctx.Done(): + return nil + default: + } + + conn, err := listener.Accept() + if err != nil { + klog.Errorf("error accepting connection: %v", err) + continue + } + + go p.handleConnect(conn) + } +} + +func (p *Proxy) isAllowed(host string) bool { + if len(p.AllowedHosts) == 0 { + return true + } + + for _, allowedHost := range p.AllowedHosts { + if host == allowedHost { + return true + } + } + return false +} diff --git a/pkg/utils/network/netmonitor/netmonitor.go b/pkg/utils/network/netmonitor/netmonitor.go index a9d7d8f1c6..f447546fa7 100644 --- a/pkg/utils/network/netmonitor/netmonitor.go +++ b/pkg/utils/network/netmonitor/netmonitor.go @@ -131,18 +131,22 @@ func InterfacesMonitoring(ctx context.Context, eventChannel chan event.GenericEv for { select { case updateLink := <-chLink: + klog.V(4).Info("Link update received") if options.Link != nil { handleLinkUpdate(&updateLink, options.Link, interfaces, eventChannel) } case updateAddr := <-chAddr: + klog.V(4).Info("Addr update received") if options.Addr != nil { handleAddrUpdate(&updateAddr, options.Addr, eventChannel) } case updateRoute := <-chRoute: + klog.V(4).Info("Route update received") if options.Route != nil { handleRouteUpdate(&updateRoute, options.Route, eventChannel) } case updateNft := <-chNft: + klog.V(4).Info("Nft update received") if updateNft != nil && options.Nftables != nil { handleNftUpdate(updateNft, options.Nftables, eventChannel) }