Граф коммитов

874 Коммитов

Автор SHA1 Сообщение Дата
Jaeryn 0576688c57
copy kube-proxy tolerations NPM may run on customer tainted nodes (#493) 2020-02-07 11:53:22 -08:00
Jaeryn 2378d37546
NPM Version Validation (#498)
* The value of minor was incorrectly assumed to be e.g. 14.8-hotfix.20191113 instead of 14+

* adding Jonathan Chauncey's test

* addressing Robbie's comments
2020-02-07 11:49:22 -08:00
Mathew Merrick 2a6a195a9b
Update CNM test to delete endpoint (#499)
* Update network_test.go

* Update fileIpam_test.go
2020-02-06 16:45:46 -08:00
tamilmani1989 008f990743
fixed request and response function to send logs to AI (#495) 2020-02-06 15:27:23 -08:00
Ashutosh Dubey c2665f3e4a
adds environment flag fileIPAM (#482)
* adds environment flag fileIPAM

* "creating fileIpamSource once"

* Update fileIpam.go

well spaced if-1

* Update fileIpam_test.go

well spaced if-2

* comment improved

* smarter code structure
2020-02-06 14:59:56 -08:00
tamilmani1989 47a35e6524
Separated cns heartbeat to separate thread. (#496) 2020-02-06 14:56:48 -08:00
Ashvin Deodhar aeacc60dfe
Fix the code used to get the working directory (#484)
Use os.Executable to get the directory of the exe
2020-01-30 22:34:17 -08:00
tamilmani1989 5f9f9c7b4c
changed to cns logger for request and response (#491) 2020-01-30 17:34:34 -08:00
Ashvin Deodhar ca00635a6b
Fix CNS regression (#489)
log.SetTarget creates the log file under log directory using golang os package. Whenever code sets the log directory, it needed to call SetTarget to create the actual log file under that directory. In the recent logger changes, InitLogger by default set the log directory to the current folder. This created the log file in the current folder. The code then set the log directory to a different location without a subsequent call to log.SetTarget. This resulted into the logger to not find the actual log file in the set log directory.

This fix updates the logger InitLogger function to accept the log directory to create the file in correct log directory. To avoid having such issue, this fix also combines the function calls to set log directory and set target into a single function. This prevents any out of order calls resulting into such issue.
2020-01-30 09:33:35 -08:00
tamilmani1989 d0e6fe7819
Fix log in cnsclient package (#487) 2020-01-30 08:58:11 -08:00
Jaeryn 21888133e9
Limit NPM AI Telemetry Handle Retrievals (#488)
* let npm loop 30 min (1 heartbeat interval) for AI telemetry handle

* fix cns dockerfile so that it may resolve it's ip via env var
2020-01-29 15:01:56 -08:00
tamilmani1989 cee12356c4
added back telemetry cmdline option (#485)
* added back telemetry cmdline option

* not exit when telemetry disabled via cmdline
2020-01-28 17:06:18 -08:00
Jaeryn dd1777c776
Network Policy Namespace Leak (#479)
* add changes to contain rule application within policy namespace

* fix slice leak

* fixing pod and namespace selector combination bug
2020-01-24 16:23:08 -08:00
tamilmani1989 2eb1ccdee3
passed as reference instead of value (#483) 2020-01-24 15:13:09 -08:00
tamilmani1989 a151c83894
AITelemetry support for CNS (#455)
* Added logger package for CNS

* added aitelemetry for cns

* Added AI Telemetry for CNS

* added respective folders in makefile and added config file

* added all config fields

* addressed review comments

* removing repetitive log

* logged configpath

* reverted to keep old telemetry channel and pulled new ai package

* removed unwanted logs..added log file
2020-01-24 13:29:52 -08:00
Jaeryn df012bcd1f
Adding AI metrics for NPM (#475)
* Adding AI metrics for NPM

* addressing tamilmani's comments
2020-01-23 13:52:30 -08:00
Vipul Hattiwale 19ac791afc Option to not enable hairpin on the host interface. (#472) 2020-01-16 14:27:25 -08:00
tamilmani1989 546b0b0b7a Added resourcegroup and vmid as default dimension in AI metrics (#476)
* added resourcegroup as default dimension in metrics

* added vmid as dimension
2020-01-16 14:24:54 -08:00
tamilmani1989 2d619b78fe
AppInsightTelemetry support for CNI (#458)
* Added AITelemetry support for CNI

* added new files

* added other configs in config file

* fixed ut

* updated disableall similar to cns

* added container name to report

* addressed review comments

* addressed review comments

* added check for azure environment

* added log

* close log handle in unit test

* addressed review comments

* addressed review comments

* fixed a condition

* keep the netagent channel for logs

* fixed error

* addressed review comments
2020-01-14 14:53:24 -08:00
Mathew Merrick a59a9aa92b Use prebuilt artifacts in E2E (#474)
* update e2e to reuse pipeline artifacts

* install ginkgo

* update e2e config for apiserver

* add clean up step

* aks-engine version

* aks-engine version

* aks-engine version

* aks-engine version

* aks-engine version

* aks-engine version

* aks-engine version

* aks-engine version
2020-01-14 13:35:38 -08:00
Mathew Merrick 12b1acbd47
Update Cipher Suites (#473)
* update e2e cipher suites
2020-01-13 10:34:43 -08:00
Jaeryn f4a5dcbffa
add build and publish image capabilities for cns (#471) 2020-01-06 16:11:52 -08:00
tamilmani1989 5fb1d7f713
Added config option for disabling iptable lock (#470)
* added config option for disabling iptable lock

* added log for iptable and ebtable version

* moved logging dependency package details to platform specific file
2020-01-03 17:08:14 -08:00
Mathew Merrick 94759f579b Azure NPM UT Test Refactor (#467)
* add policy yamls for test scenarios

* fix policy names

* fix jump entry
2020-01-02 18:16:31 -08:00
Jaeryn e6c4e77476
append jump ipt entries and prepend the rest (#468) 2020-01-02 16:19:58 -08:00
Jaeryn d272578994
We need to allow external instead of all-namespaces when ingress/egress rules only contain {} (#466) 2020-01-02 14:26:27 -08:00
jaer-tsun 570f9b0920
Prevent Namespace Race (#463)
* poll api-server version for a minute before panicking

* always add namespace set, when adding nw policy

* create the ns set in add pod, if add namespace has not been called yet
2019-12-19 21:38:57 -08:00
jaer-tsun 43746bc677
apply policies in a way where the network policy may seem order agnostic (#462) 2019-12-18 16:28:08 -08:00
Ashvin Deodhar 71e71d5119
Add enableExactMatchForPodName flag in windows multitenancy config (#459)
enableExactMatchForPodName flag is missing in the multitenancy config
for windows. This changes adds this missing flag in the config.
Default set to true
2019-12-17 17:00:56 -08:00
jaer-tsun 8ae2c0a3a2
Merge NPM Port Rules Properly (#456)
* Fix NPM port rules

* Add port entry logic for ipblock, namespace, and pod selector; Fix tests.

* removing unnecessary hops between chains
2019-12-17 15:45:28 -08:00
vivekagg-MSFT b4f9840815
Store file override (#452) 2019-12-05 14:01:00 -08:00
jaer-tsun 61ccd6f387
Fix NPM Regression & Remove TelemetryBuffer Sidecar (#449)
* give precedence to drop rules (over allow)

* - Moving kube-system-chain above target-sets-chain
- Add drop entry at the end of Ingress-From and Egress-To chains when there are non Allow-All* entries

* write logs to stdout (and log file) so that we can see logs via kubectl

* removing kube-system chain and fixing tests

* removing telemetry buffer
2019-12-05 13:58:11 -08:00
tamilmani1989 6730d265b5
fixed compilation issue (#453) 2019-12-05 12:46:09 -08:00
Ashvin Deodhar 02cec02390
Join vnet as a part of NC publish (#451)
Join vnet before publishing NC. This is required as nmagent may be
restarted which causes the NC publishing to fail.
2019-12-04 10:35:49 -08:00
tamilmani1989 6ca873ce05
Remove Orphan lock file (#445)
* added removeorphanlockfile function

* remove lock file if process holding that exited

* addressed comments

* addressed comments and added a condition to check get process cmd is supported

* Addressed comments
fixed trim line ending

* updated log
2019-12-03 17:15:45 -08:00
tamilmani1989 534e646fd9
Fix for http client call to wireserver (#431)
* modified wireserver call to non-blocking. Fixed logging issue in ipam

* fixed ut

* addressing review comments

* used inithttpclient function
2019-11-25 17:07:50 -08:00
jaer-tsun e0ba7ad924
make sure that node registration is unique (#446) 2019-11-22 15:55:52 -08:00
tamilmani1989 622c340949
[windows] [cni] added script to invoke cni with dns as runtime config (#427)
* added script to invoke cni with dns as runtime config

* renamed file

* added usage example

* update script to take dns suffix

* addressed comments

* added comments

* parameterized few variables to make it work for containerd runtime

* updated desc
2019-11-20 18:10:14 -08:00
jaer-tsun d27696bb9b
K8s Version Comparison Fix (#437)
* Modifying the way we compare k8s version so that we don't fail versions with hotfix / pre-release tag

* cleaning build directory
2019-11-14 18:25:17 -08:00
Ashvin Deodhar 8d074e9509
Fix the logic to get the AzureNetworkContainer binary path (#440)
AzureNetworkContainer.exe is in the same location as azure-cns.exe but
if CNS is invoked from a process which is in a different working directory,
os.stat called in CNS points to the directory of parent process. This change
fixes the logic to point to the correct working directory.
2019-11-14 15:48:48 -08:00
jaer-tsun 43d2c684d1
Setup SNAT Configuration Based on Azure Host Support (#401)
* Save enable snat on host settings after querying NMagent version

* Adding changes to exclude outbound snat for win cni if new NMAgent is running

* try to acquire lock file when writing to disableSnatOnHost.json

* addressed some of Tamilmani's comments

* Adding snat for DNS if current NMAgent does not support it yet

* Adding DNS NAT changes for Windows CNI

* vendoring HCSShim changes that support destination based SNATing

* Reverting k8s.io/api dependencies from master branch to last working version

* Addressing Tamilmani's comments

* syncing with an older version of k8s.io dependencies

* verify valid windows version before Dns NAT.

* only remove snat on windows when host has full support

* addressing Tamilmani's comments

* addressing Tamilmani's comments

* rebased and re-depped
2019-11-14 12:01:04 -08:00
Mathew Merrick 2c0ae6d723 Allow egress all and ingress all without target set (#435)
* allow all egress and ingress without drop

* remove comment breaks

* update test

* remove sleep and socket cleanup

* address feedback

* all namespaces

* fix tests

* update npm test

* aks-engine

* aks-engine

* pipeline

* pipeline

* pipeline

* pipeline

* remove comment breaks

* remove comment breaks

* remove comment breaks

* remove comment breaks

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline

* pipeline
2019-11-14 11:11:11 -08:00
Ashvin Deodhar cd236e1f59
Publish/Unpublish Network Containers via CNS (#430)
Expose 2 APIs to publish and unpublish network containers from CNS.
a. PublishNetworkContainer
b. UnpublishNetworkContainer

DNC calls CNS to publish and unpublish the network containers.
2019-11-13 18:07:36 -08:00
tamilmani1989 19720a1a97
updated package path. Changed to caps (#429) 2019-10-31 11:08:51 -07:00
Mathew Merrick d0a9343e75
Persist cluster configs in AZP (#426)
* update cluster configs for more version testing
2019-10-29 14:12:44 -07:00
tamilmani1989 ea079b0724
addressed concerns discussed during brownbag session (#425)
* addressed concerns discussed during brownbag session

* updated fields in aitelemetry

* addressed review comments

* flipped the metadata thread field

* fixed compilation errors

* added default refresh timeout

* moved out of for loop

* added unittest

* added disableall field which disables everything(trace,metric)

* removed disable logic from ai package

* added an error check for getting metadata
2019-10-23 17:13:15 -07:00
Ashvin Deodhar 84fb35b545
Add Host NC communication support in Windows with HnsV2 (#424)
This PR adds support for host NC bidirectional communication with windows HnsV2. This is supported in multitenant scenario only. AllowHostToNCCommunication and AllowNCToHostCommunication flags are used to enable Host to NC and NC to host communication respectively.
2019-10-18 13:12:03 -07:00
Ashvin Deodhar edd2ae7c8b
Support hyper-v and process based containers with cricontainerd (*COW) (#417)
Support hyper-v and process based containers with cricontainerd (*COW)
2019-10-18 06:58:27 -07:00
tamilmani1989 e0605e90f6
added application insights telemetry package to send metrics and logs (#421)
* added application insights telemetry package to send metrics and logs to appinsights

* moved a function common to both packages
acquired a lock before writing to file

* added read write lock as per chandan comment. Addressed jaeryn comments

* fixed telemetry unit test

* defined interface and added appinsights package as vendor to acn

* added vendor package.go(appinsights)

* dependencies of appinsights

* added AI dependencies

* updated unit tests

* addressed review comments
2019-10-16 13:08:42 -07:00
Ashvin Deodhar decd0d466c
Fix saveNCGoalState bug for WebApps containerType (#407)
In case of WebApps the NC goal state gets saved with CNS if the loopback adapter creation is successful. This change fixes the bug where the goal state wasn't getting saved because the condition for WebApps containerType would run into default case and error out.
2019-10-11 22:48:57 -07:00