generated from cybozu-go/neco-template
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Daichi Sakaue <[email protected]>
- Loading branch information
Showing
16 changed files
with
691 additions
and
131 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "fmt" | ||
|
|
||
| "github.com/cilium/cilium/pkg/client" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" | ||
| "k8s.io/apimachinery/pkg/runtime/schema" | ||
| "k8s.io/client-go/dynamic" | ||
| "k8s.io/client-go/kubernetes" | ||
| "k8s.io/client-go/rest" | ||
| ) | ||
|
|
||
| func createClients(ctx context.Context, name string) (*kubernetes.Clientset, *dynamic.DynamicClient, *client.Client, error) { | ||
| config, err := rest.InClusterConfig() | ||
| if err != nil { | ||
| return nil, nil, nil, err | ||
| } | ||
|
|
||
| // Create Kubernetes Clients | ||
| clientset, err := kubernetes.NewForConfig(config) | ||
| if err != nil { | ||
| return nil, nil, nil, err | ||
| } | ||
|
|
||
| dynamicClient, err := dynamic.NewForConfig(config) | ||
| if err != nil { | ||
| return nil, nil, nil, err | ||
| } | ||
|
|
||
| // Create Cilium Client | ||
| endpoint, err := getProxyEndpoint(ctx, clientset, rootOptions.namespace, name) | ||
| if err != nil { | ||
| return nil, nil, nil, err | ||
| } | ||
| ciliumClient, err := client.NewClient(endpoint) | ||
| if err != nil { | ||
| return nil, nil, nil, err | ||
| } | ||
|
|
||
| return clientset, dynamicClient, ciliumClient, err | ||
| } | ||
|
|
||
| func getProxyEndpoint(ctx context.Context, c *kubernetes.Clientset, namespace, name string) (string, error) { | ||
| targetPod, err := c.CoreV1().Pods(namespace).Get(ctx, name, metav1.GetOptions{}) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| targetNode := targetPod.Spec.NodeName | ||
|
|
||
| pods, err := c.CoreV1().Pods("kube-system").List(ctx, metav1.ListOptions{ | ||
| FieldSelector: "spec.nodeName=" + targetNode, | ||
| LabelSelector: rootOptions.proxySelector, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| if num := len(pods.Items); num != 1 { | ||
| err := fmt.Errorf("failed to find cilium-agent-proxy. found %d pods", num) | ||
| return "", err | ||
| } | ||
|
|
||
| podIP := pods.Items[0].Status.PodIP | ||
| return fmt.Sprintf("http://%s:%d", podIP, rootOptions.proxyPort), nil | ||
| } | ||
|
|
||
| func getPodEndpointID(ctx context.Context, d *dynamic.DynamicClient, namespace, name string) (int64, error) { | ||
| gvr := schema.GroupVersionResource{ | ||
| Group: "cilium.io", | ||
| Version: "v2", | ||
| Resource: "ciliumendpoints", | ||
| } | ||
|
|
||
| ep, err := d.Resource(gvr).Namespace(namespace).Get(ctx, name, metav1.GetOptions{}) | ||
| if err != nil { | ||
| return 0, err | ||
| } | ||
|
|
||
| endpointID, found, err := unstructured.NestedInt64(ep.Object, "status", "id") | ||
| if err != nil { | ||
| return 0, err | ||
| } | ||
| if !found { | ||
| return 0, errors.New("endpoint resource is broken") | ||
| } | ||
|
|
||
| return endpointID, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| package cmd |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "strconv" | ||
| "strings" | ||
|
|
||
| "github.com/cilium/cilium/api/v1/client/endpoint" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func init() { | ||
| rootCmd.AddCommand(listCmd) | ||
| } | ||
|
|
||
| var listCmd = &cobra.Command{ | ||
| Use: "list", | ||
| Short: "list network policies applied to a pod", | ||
| Long: `List network policies applied to a pod`, | ||
|
|
||
| Args: cobra.ExactArgs(1), | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| return runList(context.Background(), args[0]) | ||
| }, | ||
| } | ||
|
|
||
| const ( | ||
| directionEgress = "EGRESS" | ||
| directionIngress = "INGRESS" | ||
| ) | ||
|
|
||
| type derivedFromEntry struct { | ||
| Direction string `json:"direction"` | ||
| Kind string `json:"kind"` | ||
| Namespace string `json:"namespace"` | ||
| Name string `json:"name"` | ||
| } | ||
|
|
||
| func parseDerivedFromEntry(input []string, direction string) derivedFromEntry { | ||
| val := derivedFromEntry{ | ||
| Direction: direction, | ||
| } | ||
| for _, s := range input { | ||
| switch { | ||
| case strings.Contains(s, "k8s:io.cilium.k8s.policy.derived-from"): | ||
| val.Kind = strings.Split(s, "=")[1] | ||
| case strings.Contains(s, "k8s:io.cilium.k8s.policy.namespace"): | ||
| val.Namespace = strings.Split(s, "=")[1] | ||
| case strings.Contains(s, "k8s:io.cilium.k8s.policy.name"): | ||
| val.Name = strings.Split(s, "=")[1] | ||
| } | ||
| } | ||
| return val | ||
| } | ||
|
|
||
| func runList(ctx context.Context, name string) error { | ||
| _, dynamicClient, client, err := createClients(ctx, name) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| endpointID, err := getPodEndpointID(ctx, dynamicClient, rootOptions.namespace, name) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| params := endpoint.GetEndpointIDParams{ | ||
| Context: ctx, | ||
| ID: strconv.FormatInt(endpointID, 10), | ||
| } | ||
| response, err := client.Endpoint.GetEndpointID(¶ms) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| policyList := make([]derivedFromEntry, 0) | ||
|
|
||
| ingressRules := response.Payload.Status.Policy.Realized.L4.Ingress | ||
| for _, rule := range ingressRules { | ||
| for _, r := range rule.DerivedFromRules { | ||
| policyList = append(policyList, parseDerivedFromEntry(r, directionIngress)) | ||
| } | ||
| } | ||
|
|
||
| egressRules := response.Payload.Status.Policy.Realized.L4.Egress | ||
| for _, rule := range egressRules { | ||
| for _, r := range rule.DerivedFromRules { | ||
| policyList = append(policyList, parseDerivedFromEntry(r, directionEgress)) | ||
| } | ||
| } | ||
|
|
||
| text, err := json.MarshalIndent(policyList, "", " ") | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| fmt.Println(string(text)) | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| package cmd |
Oops, something went wrong.