Skip to content

Implement distance for firewall #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

Implement distance for firewall #191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5a1560b
Added notes where FRR Config is being applied
Honigeintopf Nov 5, 2024
d23ded7
Add firewallDistance to NewFrrConfig
Honigeintopf Nov 6, 2024
eb2cfa1
Added Firewall Distance to firewall-controller monitor reconciler
Honigeintopf Nov 22, 2024
a268344
Add Distance SeedClient to Monitor
Honigeintopf Nov 22, 2024
4e77bb2
Merge branch 'master' into implement-distance-for-firewall
Honigeintopf May 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions controllers/firewall_monitor_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,14 @@ import (
// FirewallMonitorReconciler reconciles a firewall monitor object
type FirewallMonitorReconciler struct {
ShootClient client.Client
SeedClient client.Client

Recorder record.EventRecorder
Log logr.Logger

FirewallName string
Namespace string
FirewallName string
Namespace string
SeedNamespace string

IDSEnabled bool
Interval time.Duration
Expand Down Expand Up @@ -57,6 +59,9 @@ func (r *FirewallMonitorReconciler) SetupWithManager(mgr ctrl.Manager) error {
return false
},
}).
WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
return object.GetNamespace() == r.Namespace && object.GetName() == r.FirewallName
})).
Complete(r)
}

Expand All @@ -70,6 +75,13 @@ func (r *FirewallMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
return ctrl.Result{}, err
}

f := &firewallv2.Firewall{}
if err := r.SeedClient.Get(ctx, req.NamespacedName, f); err != nil {
return ctrl.Result{}, fmt.Errorf("error retrieving resource: %w", err)
}

r.Log.Info("firewall fetched from Seed in Monitor", "Fw Distance", f.Distance, "Fw Name", f.Name)

idsStats := firewallv2.IDSStatsByDevice{}
if r.IDSEnabled {
s := suricata.New()
Expand Down Expand Up @@ -119,8 +131,8 @@ func (r *FirewallMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
ControllerVersion: v.Version,
NftablesExporterVersion: "", // TODO
Updated: metav1.NewTime(now),
Distance: 0,
DistanceSupported: false,
Distance: f.Distance,
DistanceSupported: true,
}

if !r.seedUpdated.IsZero() {
Expand Down
18 changes: 11 additions & 7 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,19 +206,23 @@ func main() {
panic(err)
}

shootClient, err := controllerclient.New(shootConfig, controllerclient.Options{Scheme: scheme})
shootClient, err := controllerclient.New(shootConfig, controllerclient.Options{
Scheme: scheme,
})
if err != nil {
l.Error("unable to create shoot client", "error", err)
panic(err)
}

fwmReconciler := &controllers.FirewallMonitorReconciler{
ShootClient: shootMgr.GetClient(),
Log: ctrl.Log.WithName("controllers").WithName("FirewallMonitorReconciler"),
Recorder: shootMgr.GetEventRecorderFor("FirewallMonitorController"),
IDSEnabled: enableIDS,
FirewallName: firewallName,
Namespace: firewallv2.FirewallShootNamespace,
ShootClient: shootMgr.GetClient(),
SeedClient: seedMgr.GetClient(),
Log: ctrl.Log.WithName("controllers").WithName("FirewallMonitorReconciler"),
Recorder: shootMgr.GetEventRecorderFor("FirewallMonitorController"),
IDSEnabled: enableIDS,
FirewallName: firewallName,
Namespace: firewallv2.FirewallShootNamespace,
SeedNamespace: seedNamespace,
}

frrVersion, err := frr.DetectVersion()
Expand Down
1 change: 1 addition & 0 deletions pkg/network/network.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@
return false, fmt.Errorf("failed to init networker config: %w", err)
}
c.Networks = GetNewNetworks(f, c.Networks)
c.FirewallDistance = uint8(f.Distance)

Check failure on line 73 in pkg/network/network.go

View workflow job for this annotation

GitHub Actions / Build 

c.FirewallDistance undefined (type *netconf.config has no field or method FirewallDistance)) (typecheck)

Check failure on line 73 in pkg/network/network.go

View workflow job for this annotation

GitHub Actions / Build 

c.FirewallDistance undefined (type *netconf.config has no field or method FirewallDistance)) (typecheck)

Check failure on line 73 in pkg/network/network.go

View workflow job for this annotation

GitHub Actions / Build 

c.FirewallDistance undefined (type *netconf.config has no field or method FirewallDistance)) (typecheck)

Check failure on line 73 in pkg/network/network.go

View workflow job for this annotation

GitHub Actions / Build 

c.FirewallDistance undefined (type *netconf.config has no field or method FirewallDistance) (typecheck)

Check failure on line 73 in pkg/network/network.go

View workflow job for this annotation

GitHub Actions / Test 

c.FirewallDistance undefined (type *netconf.config has no field or method FirewallDistance)

a := netconf.NewFrrConfigApplier(netconf.Firewall, *c, tmpFile, frrVersion)
tpl := netconf.MustParseTpl(netconf.TplFirewallFRR)
Expand Down
Loading