Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changes for local network policies #572

Merged
merged 1 commit into from
Jul 18, 2024
Merged

Conversation

mchalla
Copy link
Contributor

@mchalla mchalla commented Jun 23, 2024

  • Implemented on top of Genie changes from Tom
  • Add the following classes class[gbpe/LocalL24Classifier] class[gbp/LocalSecGroup] class[gbp/LocalSecGroupSubject] class[gbp/LocalSecGroupRule] class[gbp/LocalAllowDenyAction] class[gbp/LocalSubnets] class[gbp/LocalSubnet]
  • These are enabled via opflex.enable-local-netpol config variable and read from .netpol files in the netpol-sources.filesystem thats configured in the opflex config (Default localnetpol is disabled)
  • Each security group will contain a .netpol json file containing corresponding netpol
  • The implemenation will read these files and update the MODB via the read that then triggers callbacks. These will be the old callbacks in the policymanager that have been extended to also process the Local network policies.
  • Add new classtype LOCAL_POLICY to differentiate between POLICY that is always assumed as remote and would trigger a resolveObj
  • extend deserialize to support local ObjectInstances, currently it assumes its only called for remote ones.
  • add LocalAllowDenyAction on startup since this is the only MO shared across netpols and should never be deleted.
  • Implement delete by saving the notifs during add. File based delete will not work without some state because the file notification happens after the file is deleted.

@mchalla
Copy link
Contributor Author

mchalla commented Jun 23, 2024

India team still testing. DO NOT MERGE.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.402% (-0.4%) from 78.839%
when pulling b8f4b59 on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.455% (-0.4%) from 78.839%
when pulling 2cc97df on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.397% (-0.4%) from 78.839%
when pulling 2cc97df on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.464% (-0.4%) from 78.839%
when pulling 58240ef on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.389% (-0.5%) from 78.839%
when pulling 58240ef on opflex-hpp-optimization
into 5e6f2cb on master.

@mchalla mchalla force-pushed the opflex-hpp-optimization branch 5 times, most recently from 3149872 to c003fe7 Compare June 25, 2024 20:12
@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.356% (-0.5%) from 78.839%
when pulling c003fe7 on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.379% (-0.5%) from 78.839%
when pulling c003fe7 on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.368% (-0.5%) from 78.839%
when pulling 3999270 on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.354% (-0.5%) from 78.839%
when pulling 3999270 on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.308% (-0.5%) from 78.839%
when pulling f12e3fa on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.368% (-0.5%) from 78.839%
when pulling f12e3fa on opflex-hpp-optimization
into 5e6f2cb on master.

@coveralls
Copy link
Collaborator

Coverage Status

coverage: 78.37% (-0.4%) from 78.777%
when pulling b4568cb on opflex-hpp-optimization
into 43cc55a on master.

@mchalla mchalla force-pushed the opflex-hpp-optimization branch 2 times, most recently from 5455ed5 to ba25800 Compare July 9, 2024 01:19
@coveralls
Copy link
Collaborator

coveralls commented Jul 9, 2024

Coverage Status

coverage: 78.2% (-0.4%) from 78.633%
when pulling dab0a5c on opflex-hpp-optimization
into efa3d40 on master.

@mchalla mchalla force-pushed the opflex-hpp-optimization branch 2 times, most recently from 1cfb816 to c1fbbb8 Compare July 12, 2024 17:20
Copy link
Member

@tomflynn tomflynn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some nits

agent-ovs/opflex-agent-ovs.conf.in Outdated Show resolved Hide resolved
@@ -173,6 +177,18 @@ private static boolean isPolicy(MClass aIn)
return aIn.isSubclassOf("policy/Component") || aIn.isSubclassOf("policy/Definition");
}

private static boolean isLocalPolicy(MClass aIn)
{
return aIn.isInstanceOf("gbpe/LocalL24Classifier")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think about checking isPolicy(aIn) and then just looking for Local at the start of the class name instead of listing them all individually. We could just say that's the convention going forward for any local policy

I can handle this in a followup PR if you think it makes sense

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yea thats a good idea. thanks.

- Implemented on top of Genie changes from Tom
- Add the following classes
    class[gbpe/LocalL24Classifier]
    class[gbp/LocalSecGroup]
    class[gbp/LocalSecGroupSubject]
    class[gbp/LocalSecGroupRule]
    class[gbp/LocalAllowDenyAction]
    class[gbp/LocalLogAction]
    class[gbp/LocalSubnets]
    class[gbp/LocalSubnet]
- These are enabled via opflex.enable-local-netpol config variable
  and read from .netpol files in the netpol-sources.filesystem
  thats configured in the opflex config (Default localnetpol is disabled)
- Each security group will contain a .netpol json file containing
  corresponding netpol
- The implemenation will read these files and update the MODB
  via the read that then triggers callbacks. These will be the old
  callbacks in the policymanager that have been extended to also
  process the Local network policies.
- Add new classtype LOCAL_POLICY to differentiate between POLICY that
  is always assumed as remote and would trigger a resolveObj
- extend deserialize to support local ObjectInstances, currently it
  assumes its only called for remote ones.
- add LocalAllowDenyAction and LocalLogAction on
  startup since these MOs are shared across netpols
  and should never be deleted. This is added
  in common tenant and one is created at startup.
- Implement delete by saving the notifs during add. File based
  delete will not work without some state because the file
  notification happens after the file is deleted.

Signed-off-by: Madhu Challa <[email protected]>
@mchalla mchalla merged commit c027360 into master Jul 18, 2024
5 checks passed
@mchalla mchalla deleted the opflex-hpp-optimization branch July 18, 2024 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants