Skip to content
This repository has been archived by the owner on Jul 11, 2023. It is now read-only.

injector: Generate init/init-iptables.sh dynamically from Go code and constants #2243

Closed
draychev opened this issue Jan 4, 2021 · 2 comments
Closed

injector: Generate init/init-iptables.sh dynamically from Go code and constants #2243

draychev opened this issue Jan 4, 2021 · 2 comments
Assignees
@shashankram

Comments

@draychev
Copy link
Contributor

draychev commented Jan 4, 2021 •
edited
Loading

The init container executes the init/init-iptables.sh script which is a static bash script. The bash script contains constants that are duplicated in Go code. A mismatch between these constants (port numbers) would cause breakage. These constants are currently synced manually. To prevent issues arising from inconsistencies between the bash and Go code - we should dynamically generate the init/init-iptables.sh file.

For example:

We can delete init-iptables.sh from the repo and generate it on the fly from the already defined constants such as EnvoyAdminPort

Sub-task

Skip irrelevant iptables commands when certain features are not configured for the given instance of OSM. For example a customer may decide to disable Admin port: https://github.com/openservicemesh/osm/blob/release-v0.6/init/init-iptables.sh#L5

Scope (please mark with X where applicable)

  • New Functionality [ ]
  • Install [ ]
  • SMI Traffic Access Policy [ ]
  • SMI Traffic Specs Policy [ ]
  • SMI Traffic Split Policy [ ]
  • Permissive Traffic Policy [ ]
  • Ingress [ ]
  • Egress [ ]
  • Envoy Control Plane [ ]
  • CLI Tool [ ]
  • Metrics [ ]
  • Certificate Management [ ]
  • Sidecar Injection [x]
  • Logging [ ]
  • Debugging [ ]
  • Tests [ ]
  • CI System [ ]
  • Project Release [ ]

Possible use cases
@ksubrmnn
Copy link
Contributor

ksubrmnn commented Jan 5, 2021

Whoever, takes this up, it would be great if they could also address #2106 when writing the docs for this PR

@shashankram shashankram self-assigned this Jan 21, 2021
shashankram added a commit to shashankram/osm that referenced this issue Jan 21, 2021
@shashankram
injector/init: generate init-container commands within osm-controller
1e15393 
This change generates the iptables commands within osm-controller
instead of running it as a script. The benefit in doing so is that
the controller can programmatically tweak iptables at the time
of sidecar injection, ex. to disable proxy admin port access.
Additionally, it prevents potential bugs due to code duplication
of port numbers used in iptable rules and within the controller.

Part of openservicemesh#2243

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Jan 21, 2021
@shashankram
injector/init: generate init-container commands within osm-controller
3eac4db 
This change generates the iptables commands within osm-controller
instead of running it as a script. The benefit in doing so is that
the controller can programmatically tweak iptables at the time
of sidecar injection, ex. to disable proxy admin port access,
or exclude certain control plane traffic from being intercepted
in managed environments.
Additionally, it prevents potential bugs due to code duplication
of port numbers used in iptable rules and within the controller.

Part of openservicemesh#2243

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram shashankram mentioned this issue Jan 21, 2021
Merged
@draychev draychev mentioned this issue Jan 21, 2021
Closed
shashankram added a commit to shashankram/osm that referenced this issue Jan 21, 2021
@shashankram
injector/init: generate init-container commands within osm-controller
4d71362 
This change generates the iptables commands within osm-controller
instead of running it as a script. The benefit in doing so is that
the controller can programmatically tweak iptables at the time
of sidecar injection, ex. to disable proxy admin port access,
or exclude certain control plane traffic from being intercepted
in managed environments.
Additionally, it prevents potential bugs due to code duplication
of port numbers used in iptable rules and within the controller.

Part of openservicemesh#2243

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit that referenced this issue Jan 21, 2021
@shashankram
injector/init: generate init-container commands within osm-controller (…
05677b0 
…#2343)

This change generates the iptables commands within osm-controller
instead of running it as a script. The benefit in doing so is that
the controller can programmatically tweak iptables at the time
of sidecar injection, ex. to disable proxy admin port access,
or exclude certain control plane traffic from being intercepted
in managed environments.
Additionally, it prevents potential bugs due to code duplication
of port numbers used in iptable rules and within the controller.

Part of #2243

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram
Copy link
Member

Fixed by #2343

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@shashankram shashankram

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@shashankram @ksubrmnn @draychev