You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: add azure iptables monitor binary and makefile changes (#3779)
* add iptables monitor binary and makefile changes
* address feedback
* add option to send node events if enabled
* remove dependency on node patching
rbac now requires:
- apiGroups: ["cilium.io"]
resources: ["ciliumnodes"]
verbs: ["patch"]
we also must pass NODE_UID as an environment variable to send events
* remove passing node uid in since not possible with downward api
* update naming and readme for ciliumnodes
* address feedback (noop)
cd $(AZURE_IPTABLES_MONITOR_BUILD_DIR) && $(ARCHIVE_CMD) $(AZURE_IPTABLES_MONITOR_ARCHIVE_NAME) azure-iptables-monitor$(EXE_EXT)
840
+
endif
841
+
778
842
# Create a ipv6-hp-bpf archive for the target platform.
779
843
.PHONY: ipv6-hp-bpf-archive
780
844
ipv6-hp-bpf-archive: ipv6-hp-bpf-binary
@@ -811,6 +875,7 @@ workspace: ## Set up the Go workspace.
811
875
go work use .
812
876
go work use ./azure-ipam
813
877
go work use ./azure-ip-masq-merger
878
+
go work use ./azure-iptables-monitor
814
879
go work use ./build/tools
815
880
go work use ./dropgz
816
881
go work use ./zapai
@@ -823,7 +888,7 @@ RESTART_CASE ?= false
823
888
# CNI type is a key to direct the types of state validation done on a cluster.
824
889
CNI_TYPE ?= cilium
825
890
826
-
test-all: test-azure-ipam test-azure-ip-masq-merger test-main ## run all unit tests.
891
+
test-all: test-azure-ipam test-azure-ip-masq-merger test-azure-iptables-monitor test-main ## run all unit tests.
827
892
828
893
test-main:
829
894
go test -mod=readonly -buildvcs=false -tags "unit" --skip 'TestE2E*' -race -covermode atomic -coverprofile=coverage-main.out $(COVER_PKG)/...
@@ -863,6 +928,9 @@ test-azure-ipam: ## run the unit test for azure-ipam
863
928
test-azure-ip-masq-merger: ## run the unit test for azure-ip-masq-merger
864
929
cd$(AZURE_IP_MASQ_MERGER_DIR)&& go test -race -covermode atomic -coverprofile=../coverage-azure-ip-masq-merger.out && go tool cover -func=../coverage-azure-ip-masq-merger.out
865
930
931
+
test-azure-iptables-monitor: ## run the unit test for azure-iptables-monitor
932
+
cd$(AZURE_IPTABLES_MONITOR_DIR)&& go test -race -covermode atomic -coverprofile=../coverage-azure-iptables-monitor.out && go tool cover -func=../coverage-azure-iptables-monitor.out
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f1f0cbd464ae4cd9d41176d47f1f9fe16a6965425871f817587314e3a04576ec AS go
11
+
12
+
13
+
FROM go AS azure-iptables-monitor
14
+
ARG OS
15
+
ARG VERSION
16
+
WORKDIR /azure-iptables-monitor
17
+
COPY ./azure-iptables-monitor .
18
+
RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
`azure-iptables-monitor` is a utility for monitoring iptables rules on Kubernetes nodes and labeling a ciliumnode resource based on whether the corresponding node contains user-defined iptables rules.
4
+
5
+
## Description
6
+
7
+
The goal of this program is to periodically scan iptables rules across all tables (nat, mangle, filter, raw, security) and determine if any rules exist that don't match expected patterns. When unexpected rules are found, the ciliumnode resource is labeled to indicate the presence of user-defined iptables rules.
8
+
9
+
## Usage
10
+
11
+
Follow the steps below to build and run the program:
12
+
13
+
1. Build the binary using `make`:
14
+
```bash
15
+
make azure-iptables-monitor
16
+
```
17
+
or make an image:
18
+
```bash
19
+
make azure-iptables-monitor-image
20
+
```
21
+
22
+
2. Deploy or copy the binary to your node(s).
23
+
24
+
3. Prepare your allowed pattern files in the input directory. Each file should be named after an iptables table (`nat`, `mangle`, `filter`, `raw`, `security`) or `global` and contain regex patterns that match expected iptables rules. You may want to mount a configmap for this purpose.
- The `--input` flag specifies the directory containing allowed regex pattern files. Default: `/etc/config/`
31
+
- The `--interval` flag specifies how often to check iptables rules in seconds. Default: `300`
32
+
- The `--events` flag enables Kubernetes event creation for rule violations. Default: `false`
33
+
- The program must be in a k8s environment and `NODE_NAME` must be a set environment variable with the current node.
34
+
35
+
5. The program will set the `user-iptables-rules` label to `true` on the specified ciliumnode resource if unexpected rules are found, or `false`if all rules match expected patterns. Proper RBAC is required for patching (patch for ciliumnodes, create for events, get for nodes).
36
+
37
+
38
+
## Pattern File Format
39
+
40
+
Each pattern file should contain one regex pattern per line:
41
+
```
42
+
^-A INPUT -i lo -j ACCEPT$
43
+
^-A FORWARD -j DOCKER.*
44
+
^-A POSTROUTING -s 10\.0\.0\.0/8 -j MASQUERADE$
45
+
```
46
+
47
+
- `global`: Patterns that can match rules in any iptables table
48
+
- `nat`, `mangle`, `filter`, `raw`, `security`: Patterns specific to each iptables table
49
+
- Empty lines are ignored
50
+
- Each line should be a valid Go regex pattern
51
+
52
+
## Debugging
53
+
54
+
Logs are output to standard error. Increase verbosity with the `-v` flag:
0 commit comments