-
Notifications
You must be signed in to change notification settings - Fork 334
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(transparent-proxy): add option to uninstall transparent proxy #10890
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bartsmykla
added
the
ci/run-full-matrix
PR: Runs all possible e2e test combination (expensive use carefully)
label
Jul 14, 2024
bartsmykla
force-pushed
the
feat/add-option-to-uninstall-tproxy
branch
from
July 15, 2024 04:31
2992885
to
29a05d6
Compare
The iptables comments prefix will be used during the uninstallation of the transparent proxy. Allowing this prefix to be configurable adds unnecessary complexity, as it would require an additional flag during the uninstallation process. This could potentially lead to issues if the prefix is changed during installation but not specified during uninstallation. Removing this configurability simplifies the process and reduces the risk of errors. Signed-off-by: Bart Smykla <[email protected]>
This commit refactors the logic for executing the iptables-restore command, introducing a new internal `restore` function to handle common restore logic. This change simplifies the external interface and adds flexibility for different restore scenarios. Key changes: - Refactored restore logic: Moved the common logic for executing the iptables-restore command into a new `restore` function. This function handles writing rules to a temporary file, executing the restore command, and retrying on failure. - New `Restore` method: The `Restore` method now wraps the `restore` function with the `--noflush` flag, ensuring that the current rules are not flushed before restoring. - New `RestoreWithFlush` method: Introduced the `RestoreWithFlush` method to allow restoring rules while flushing the current rules. This method is intended for use in the transparent proxy uninstallation process, ensuring a clean state before removal. - Improved argument handling: The `restore` function now accepts additional arguments, enabling more flexible command execution. These changes improve the maintainability and readability of the code, making it easier to manage different iptables-restore scenarios and enhancing the robustness of the command execution logic. Signed-off-by: Bart Smykla <[email protected]>
This method runs iptables-restore with the `--test` flag to validate iptables rules without applying them. It helps in ensuring that the rules are correct and can be applied without errors. Signed-off-by: Bart Smykla <[email protected]>
This commit introduces two new methods, `Errorf` and `Infof`, to the `Logger` struct. These methods allow for formatted logging of error and information messages, respectively, improving flexibility and readability in log output. Additionally, all relevant comments and descriptions have been updated to reflect these changes. Signed-off-by: Bart Smykla <[email protected]>
This commit improves the comments and descriptions for the logger methods within the `Logger` struct. The updated documentation provides clearer explanations of each method's purpose and functionality, enhancing readability and maintainability of the codebase. Signed-off-by: Bart Smykla <[email protected]>
This commit introduces a new field, `IPv6`, to the `InitializedConfigIPvX` struct. This boolean field is used to indicate whether the current configuration refers to IPv6. It enhances the configuration structure by providing a clear and straightforward way to handle IPv6-specific settings and logic. Signed-off-by: Bart Smykla <[email protected]>
…ging This commit introduces significant refactoring to the `config` package, focusing on improving the management of iptables executables and enhancing error handling and logging. The key improvements and changes include: 1. Method Refactoring: - Split the `writeRulesToFile` method into separate functions, `createTempFile` and `writeToFile`. - Added a new function, `createBackupFile`, for better modularity and reusability. 2. Restore Functionality Enhancements: - Refactored the `restore`, `Restore`, `RestoreWithFlush`, and `RestoreTest` methods to handle iptables rule restoration and validation more effectively, incorporating improved error handling and logging. - Implemented robust backup and restore mechanisms in `RestoreWithFlush` to ensure that current iptables rules are safely backed up before applying new rules. 3. Documentation Improvements: - Added detailed comments and descriptions for several functions to enhance code readability and maintainability, making it easier for future developers to understand and extend the functionality. Signed-off-by: Bart Smykla <[email protected]>
Signed-off-by: Bart Smykla <[email protected]>
This commit enhances the `restore`, `Restore`, and `RestoreWithFlush` methods by adding a `quiet` parameter to control verbose logging during the iptables restore process. This allows for optional suppression of detailed log messages, improving flexibility in logging behavior. Signed-off-by: Bart Smykla <[email protected]>
This commit introduces the following enhancements and features: 1. Uninstallation/Cleanup Logic: - Added functionality to clean up and uninstall the transparent proxy setup. - The cleanup process removes iptables rules and chains related to the transparent proxy. - Ensures that only relevant rules and chains are removed based on the presence of iptables comments. - Validates the new rules after cleanup and restores them if they are valid. 2. Installation Process Improvement: - The installation process for the transparent proxy now includes a cleanup step at the beginning. - This ensures that any existing transparent proxy rules are removed before setting up the new rules, preventing conflicts and ensuring a clean installation. 3. Detailed Logging: - Improved log messages for better clarity and debugging. - Logs the successful completion of the transparent proxy cleanup process. Signed-off-by: Bart Smykla <[email protected]>
This change ensures the default installation of the transparent proxy supports both IPv4 and IPv6, aligning with the `--ip-family-mode` default value of `dualstack`. This is crucial for cleanup operations, which are not modified via CLI flags, and it is safe to run even if IPv6 is unavailable. Signed-off-by: Bart Smykla <[email protected]>
Cleanup no longer returns any output, so the function signatures are updated accordingly. Signed-off-by: Bart Smykla <[email protected]>
The existing unit tests for uninstalling the transparent proxy were not functional and served only as placeholders. Given the difficulty of idempotently testing this command across all environments, these tests are being removed. A following commit will introduce functional tests for transparent proxy uninstallation, ensuring proper coverage. Signed-off-by: Bart Smykla <[email protected]>
Removed the `IPv6` property from `InitializedConfigIPvX` and replaced it with a `Logger` that includes `iptables` or `ip6tables` prefixes. This change required enhancing the Logger abstraction to support dynamic prefixing. Signed-off-by: Bart Smykla <[email protected]>
Signed-off-by: Bart Smykla <[email protected]>
- Updated cleanup logic to handle custom iptables rules more effectively by removing all rules and chains containing comments with our prefix or names starting with the prefix (KUMA_MESH). - Enhanced log and error messages for better clarity and troubleshooting. - Addressed a known bug on Ubuntu 20.04 related to `iptables-nft-restore --test` failing with more than two tables, adding appropriate handling for this issue. Signed-off-by: Bart Smykla <[email protected]>
- Changed the order of prefixes in logger for clearer logs: instead of `# [WARNING] [iptables] ...` it is now `# [iptables] [WARNING] ...` - Removed unnecessary log after restoring iptables: "iptables set to divert the traffic to Envoy" as earlier logs are more informative. - Consolidated log and error message content into single lines instead of breaking them into multiple lines, making phrase searches in IDEs or code editors easier. - Updated `Logger` instances passed to initialization functions in configs to include appropriate prefixes (`[iptables ]` or `[ip6tables]`). Signed-off-by: Bart Smykla <[email protected]>
bartsmykla
force-pushed
the
feat/add-option-to-uninstall-tproxy
branch
from
July 15, 2024 05:31
29a05d6
to
f76b233
Compare
Signed-off-by: Bart Smykla <[email protected]>
Signed-off-by: Bart Smykla <[email protected]>
jakubdyszkiewicz
approved these changes
Jul 15, 2024
Signed-off-by: Bart Smykla <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Tip
I recommend reviewing each commit individually, as I've organized the work into self-contained, descriptive commits for easier understanding.
Closes #6093
Add logic for Transparent Proxy uninstallation/cleanup
iptables-nft-restore --test
failing with more than two tables, adding appropriate handling for this issueImprovements in logging
iptables set to divert the traffic to Envoy
Logger
instances passed to initialization functions in configs to include appropriate prefixes ([iptables]
or[ip6tables]
)Add Tests for Transparent Proxy uninstallation
Remove unit tests for uninstalling Transparent Proxy
Remove unused string from cleanup signatures
Set
IPv6
inDefaultConfig
value to true--ip-family-mode
default value ofdualstack
Refactor Executables initialization for better error handling and logging
writeRulesToFile
method intocreateTempFile
andwriteToFile
createBackupFile
for better modularity and reusabilityrestore
,Restore
,RestoreWithFlush
, andRestoreTest
methods for better iptables rule restoration and validation, incorporating improved error handling and loggingRestoreWithFlush
Enhance descriptions for Logger methods
Logger
struct for better readability and maintainabilityAdd new Logger methods
Errorf
andInfof
Errorf
andInfof
methods to theLogger
struct for formatted logging of error and information messagesAdd
RestoreTest
method toInitializedExecutablesIPvX
--test
flag to validate iptables rules without applying themRefactor iptables restore logic and add
RestoreWithFlush
methodrestore
function to handle common restore logic, and addedRestoreWithFlush
method for scenarios requiring rule flushingRemove the ability to change the iptables comments prefix
Checklist prior to review
syscall.Mkfifo
have equivalent implementation on the other OSci/
labels to run additional/fewer testsUPGRADE.md
?