-
Couldn't load subscription status.
- Fork 259
feat: add azure iptables monitor binary and makefile changes #3779
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
7 commits Select commit Hold shift + click to select a range
6b0109d add iptables monitor binary and makefile changes
QxBytes d4832b9 address feedback
QxBytes 1293839 add option to send node events if enabled
QxBytes d08f6bd remove dependency on node patching
QxBytes 82ad20e remove passing node uid in since not possible with downward api
QxBytes ea9952a update naming and readme for ciliumnodes
QxBytes 6e810f8 address feedback (noop)
QxBytes File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| ARG ARCH | ||
| | ||
| # mcr.microsoft.com/azurelinux/base/core:3.0 | ||
| FROM mcr.microsoft.com/azurelinux/base/core@sha256:9948138108a3d69f1dae62104599ac03132225c3b7a5ac57b85a214629c8567d AS mariner-core | ||
| | ||
| # mcr.microsoft.com/azurelinux/distroless/minimal:3.0 | ||
| FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0801b80a0927309572b9adc99bd1813bc680473175f6e8175cd4124d95dbd50c AS mariner-distroless | ||
| | ||
| # skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.23.2-azurelinux3.0 --format "{{.Name}}@{{.Digest}}" | ||
| FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f1f0cbd464ae4cd9d41176d47f1f9fe16a6965425871f817587314e3a04576ec AS go | ||
| | ||
| | ||
| FROM go AS azure-iptables-monitor | ||
| ARG OS | ||
| ARG VERSION | ||
| WORKDIR /azure-iptables-monitor | ||
| COPY ./azure-iptables-monitor . | ||
| RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" . | ||
| | ||
| FROM mariner-core AS iptables | ||
| RUN tdnf install -y iptables | ||
| | ||
| FROM mariner-distroless AS linux | ||
| COPY --from=iptables /usr/sbin/*tables* /usr/sbin/ | ||
| COPY --from=iptables /usr/lib /usr/lib | ||
| COPY --from=azure-iptables-monitor /go/bin/iptables-monitor azure-iptables-monitor | ||
| | ||
| ENTRYPOINT ["/azure-iptables-monitor"] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| # azure-iptables-monitor | ||
| | ||
| `azure-iptables-monitor` is a utility for monitoring iptables rules on Kubernetes nodes and labeling a ciliumnode resource based on whether the corresponding node contains user-defined iptables rules. | ||
| | ||
| ## Description | ||
| | ||
| The goal of this program is to periodically scan iptables rules across all tables (nat, mangle, filter, raw, security) and determine if any rules exist that don't match expected patterns. When unexpected rules are found, the ciliumnode resource is labeled to indicate the presence of user-defined iptables rules. | ||
| | ||
| ## Usage | ||
| | ||
| Follow the steps below to build and run the program: | ||
| | ||
| 1. Build the binary using `make`: | ||
| ```bash | ||
| make azure-iptables-monitor | ||
| ``` | ||
| or make an image: | ||
| ```bash | ||
| make azure-iptables-monitor-image | ||
| ``` | ||
| | ||
| 2. Deploy or copy the binary to your node(s). | ||
| | ||
| 3. Prepare your allowed pattern files in the input directory. Each file should be named after an iptables table (`nat`, `mangle`, `filter`, `raw`, `security`) or `global` and contain regex patterns that match expected iptables rules. You may want to mount a configmap for this purpose. | ||
| | ||
| 4. Start the program with: | ||
| ```bash | ||
| ./azure-iptables-monitor --input=/etc/config/ --interval=300 | ||
| ``` | ||
| - The `--input` flag specifies the directory containing allowed regex pattern files. Default: `/etc/config/` | ||
| - The `--interval` flag specifies how often to check iptables rules in seconds. Default: `300` | ||
| - The `--events` flag enables Kubernetes event creation for rule violations. Default: `false` | ||
| - The program must be in a k8s environment and `NODE_NAME` must be a set environment variable with the current node. | ||
| | ||
| 5. The program will set the `user-iptables-rules` label to `true` on the specified ciliumnode resource if unexpected rules are found, or `false` if all rules match expected patterns. Proper RBAC is required for patching (patch for ciliumnodes, create for events, get for nodes). | ||
| | ||
| | ||
| ## Pattern File Format | ||
| | ||
| Each pattern file should contain one regex pattern per line: | ||
| ``` | ||
| ^-A INPUT -i lo -j ACCEPT$ | ||
| ^-A FORWARD -j DOCKER.* | ||
| ^-A POSTROUTING -s 10\.0\.0\.0/8 -j MASQUERADE$ | ||
| ``` | ||
| | ||
| - `global`: Patterns that can match rules in any iptables table | ||
| - `nat`, `mangle`, `filter`, `raw`, `security`: Patterns specific to each iptables table | ||
| - Empty lines are ignored | ||
| - Each line should be a valid Go regex pattern | ||
| | ||
| ## Debugging | ||
| | ||
| Logs are output to standard error. Increase verbosity with the `-v` flag: | ||
| ```bash | ||
| ./azure-iptables-monitor -v 3 | ||
| ``` | ||
| | ||
| ## Development | ||
| | ||
| To run tests at the repository level: | ||
| ```bash | ||
| make test-azure-iptables-monitor | ||
| ``` |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| module github.com/Azure/azure-container-networking/azure-iptables-monitor | ||
| | ||
| go 1.23.0 | ||
| | ||
| require ( | ||
| github.com/coreos/go-iptables v0.8.0 | ||
| github.com/stretchr/testify v1.9.0 | ||
| k8s.io/apimachinery v0.31.3 | ||
| k8s.io/client-go v0.31.3 | ||
| k8s.io/component-base v0.31.3 | ||
| k8s.io/klog/v2 v2.130.1 | ||
| ) | ||
| | ||
| require ( | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/blang/semver/v4 v4.0.0 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/emicklei/go-restful/v3 v3.11.0 // indirect | ||
| github.com/fxamacker/cbor/v2 v2.7.0 // indirect | ||
| github.com/go-logr/logr v1.4.2 // indirect | ||
| github.com/go-openapi/jsonpointer v0.19.6 // indirect | ||
| github.com/go-openapi/jsonreference v0.20.2 // indirect | ||
| github.com/go-openapi/swag v0.22.4 // indirect | ||
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/google/gnostic-models v0.6.8 // indirect | ||
| github.com/google/go-cmp v0.6.0 // indirect | ||
| github.com/google/gofuzz v1.2.0 // indirect | ||
| github.com/google/uuid v1.6.0 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/josharian/intern v1.0.0 // indirect | ||
| github.com/json-iterator/go v1.1.12 // indirect | ||
| github.com/mailru/easyjson v0.7.7 // indirect | ||
| github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect | ||
| github.com/modern-go/reflect2 v1.0.2 // indirect | ||
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/prometheus/client_golang v1.19.1 // indirect | ||
| github.com/prometheus/client_model v0.6.1 // indirect | ||
| github.com/prometheus/common v0.55.0 // indirect | ||
| github.com/prometheus/procfs v0.15.1 // indirect | ||
| github.com/spf13/cobra v1.8.1 // indirect | ||
| github.com/spf13/pflag v1.0.5 // indirect | ||
| github.com/x448/float16 v0.8.4 // indirect | ||
| golang.org/x/net v0.38.0 // indirect | ||
| golang.org/x/oauth2 v0.21.0 // indirect | ||
| golang.org/x/sys v0.31.0 // indirect | ||
| golang.org/x/term v0.30.0 // indirect | ||
| golang.org/x/text v0.23.0 // indirect | ||
| golang.org/x/time v0.3.0 // indirect | ||
| google.golang.org/protobuf v1.34.2 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| k8s.io/api v0.31.3 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect | ||
| k8s.io/utils v0.0.0-20240921022957-49e7df575cb6 // indirect | ||
| sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect | ||
| sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect | ||
| sigs.k8s.io/yaml v1.4.0 // indirect | ||
| ) |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.