Simpler firewall rules

controllers/gce/firewalls/fakes.go

@@ -0,0 +1,104 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package firewalls
+
+import (
+	"fmt"
+
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/contrib/ingress/controllers/gce/utils"
+	netset "k8s.io/kubernetes/pkg/util/net/sets"
+)
+
+type fakeFirewallRules struct {
+	fw    []*compute.Firewall
+	namer utils.Namer
+}
+
+func (f *fakeFirewallRules) GetFirewall(name string) (*compute.Firewall, error) {
+	for _, rule := range f.fw {
+		if rule.Name == name {
+			return rule, nil
+		}
+	}
+	return nil, fmt.Errorf("Firewall rule %v not found.", name)
+}
+
+func (f *fakeFirewallRules) CreateFirewall(name, msgTag string, srcRange netset.IPNet, ports []int64, hosts []string) error {
+	strPorts := []string{}
+	for _, p := range ports {
+		strPorts = append(strPorts, fmt.Sprintf("%v", p))
+	}
+	f.fw = append(f.fw, &compute.Firewall{
+		// To accurately mimic the cloudprovider we need to add the k8s-fw
+		// prefix to the given rule name.
+		Name:         f.namer.FrName(name),
+		SourceRanges: srcRange.StringSlice(),
+		Allowed:      []*compute.FirewallAllowed{&compute.FirewallAllowed{Ports: strPorts}},
+	})
+	return nil
+}
+
+func (f *fakeFirewallRules) DeleteFirewall(name string) error {
+	firewalls := []*compute.Firewall{}
+	exists := false
+	// We need the full name for the same reason as CreateFirewall.
+	name = f.namer.FrName(name)
+	for _, rule := range f.fw {
+		if rule.Name == name {
+			exists = true
+			continue
+		}
+		firewalls = append(firewalls, rule)
+	}
+	if !exists {
+		return fmt.Errorf("Failed to find health check %v", name)
+	}
+	f.fw = firewalls
+	return nil
+}
+
+func (f *fakeFirewallRules) UpdateFirewall(name, msgTag string, srcRange netset.IPNet, ports []int64, hosts []string) error {
+	var exists bool
+	strPorts := []string{}
+	for _, p := range ports {
+		strPorts = append(strPorts, fmt.Sprintf("%v", p))
+	}
+
+	// To accurately mimic the cloudprovider we need to add the k8s-fw
+	// prefix to the given rule name.
+	name = f.namer.FrName(name)
+	for i := range f.fw {
+		if f.fw[i].Name == name {
+			exists = true
+			f.fw[i] = &compute.Firewall{
+				Name:         name,
+				SourceRanges: srcRange.StringSlice(),
+				Allowed:      []*compute.FirewallAllowed{&compute.FirewallAllowed{Ports: strPorts}},
+			}
+		}
+	}
+	if exists {
+		return nil
+	}
+	return fmt.Errorf("Update failed for rule %v, srcRange %v ports %v, rule not found", name, srcRange, ports)
+}
+
+// NewFakeFirewallRules creates a fake for firewall rules.
+func NewFakeFirewallRules() *fakeFirewallRules {
+	return &fakeFirewallRules{fw: []*compute.Firewall{}, namer: utils.Namer{}}
+}

controllers/gce/firewalls/firewalls.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package firewalls
+
+import (
+	"github.com/golang/glog"
+
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/contrib/ingress/controllers/gce/utils"
+	netset "k8s.io/kubernetes/pkg/util/net/sets"
+)
+
+// Src range from which the GCE L7 performs health checks.
+const l7SrcRange = "130.211.0.0/22"
+
+// FirewallRules manages firewall rules.
+type FirewallRules struct {
+	cloud    Firewall
+	namer    utils.Namer
+	srcRange netset.IPNet
+}
+
+// NewFirewallPool creates a new firewall rule manager.
+// cloud: the cloud object implementing Firewall.
+// namer: cluster namer.
+func NewFirewallPool(cloud Firewall, namer utils.Namer) SingleFirewallPool {
+	srcNetSet, err := netset.ParseIPNets(l7SrcRange)
+	if err != nil {
+		glog.Fatalf("Could not parse L7 src range %v for firewall rule: %v", l7SrcRange, err)
+	}
+	return &FirewallRules{cloud: cloud, namer: namer, srcRange: srcNetSet}
+}
+
+// Sync sync firewall rules with the cloud.
+func (fr *FirewallRules) Sync(nodePorts []int64, nodeNames []string) error {
+	if len(nodePorts) == 0 {
+		return fr.Shutdown()
+	}
+	// Firewall rule prefix must match that inserted by the gce library.
+	suffix := fr.namer.FrSuffix()
+	// TODO: Fix upstream gce cloudprovider lib so GET also takes the suffix
+	// instead of the whole name.
+	name := fr.namer.FrName(suffix)
+	rule, _ := fr.cloud.GetFirewall(name)
+	if rule == nil {
+		glog.Infof("Creating global l7 firewall rule %v", name)
+		return fr.cloud.CreateFirewall(suffix, "GCE L7 firewall rule", fr.srcRange, nodePorts, nodeNames)
+	}
+	glog.V(3).Infof("Firewall rule already %v exists, verifying for nodeports %v", name, nodePorts)
+	return fr.cloud.UpdateFirewall(suffix, "GCE L7 firewall rule", fr.srcRange, nodePorts, nodeNames)
+}
+
+// Shutdown shuts down this firewall rules manager.
+func (fr *FirewallRules) Shutdown() error {
+	glog.Infof("Deleting fireawll rule with suffix %v", fr.namer.FrSuffix())
+	return fr.cloud.DeleteFirewall(fr.namer.FrSuffix())
+}
+
+// GetFirewall just returns the firewall object corresponding to the given name.
+// TODO: Currently only used in testing. Modify so we don't leak compute
+// objects out of this interface by returning just the (src, ports, error).
+func (fr *FirewallRules) GetFirewall(name string) (*compute.Firewall, error) {
+	return fr.cloud.GetFirewall(name)
+}

controllers/gce/firewalls/interfaces.go

@@ -0,0 +1,39 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package firewalls
+
+import (
+	compute "google.golang.org/api/compute/v1"
+	netset "k8s.io/kubernetes/pkg/util/net/sets"
+)
+
+// SingleFirewallPool syncs the firewall rule for L7 traffic.
+type SingleFirewallPool interface {
+	// TODO: Take a list of node ports for the firewall.
+	Sync(nodePorts []int64, nodeNames []string) error
+	Shutdown() error
+}
+
+// Firewall interfaces with the GCE firewall api.
+// This interface is a little different from the rest because it dovetails into
+// the same firewall methods used by the TCPLoadBalancer.
+type Firewall interface {
+	CreateFirewall(name, msgTag string, srcRange netset.IPNet, ports []int64, hosts []string) error
+	GetFirewall(name string) (*compute.Firewall, error)
+	DeleteFirewall(name string) error
+	UpdateFirewall(name, msgTag string, srcRange netset.IPNet, ports []int64, hosts []string) error
+}