klauvsteinen/unifi-network-operator
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Firewall rule API, including needed changes in other APIs

Browse Source
This commit is contained in:
Vegard Engen
2025-04-18 23:59:19 +02:00
parent 89a811bef9
commit c63d52bb46
15 changed files with 1084 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
internal/controller/firewallgroup_controller.go
View File

@@ -146,8 +146,18 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
return reconcile.Result{}, err
}
}
serviceNamespaceNames := make(map[string]struct{})
for _, serviceEntry := range nwObj.Spec.ManualServices {
serviceNamespaceNames[serviceEntry.Namespace+"/"+serviceEntry.Name] = struct{}{}
}
log.Info(fmt.Sprintf("Manually specified: %+v", serviceNamespaceNames))
for _, service := range services.Items {
if val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]; found && val == nwObj.Name && service.Status.LoadBalancer.Ingress != nil {
_, manually_specified := serviceNamespaceNames[service.Namespace+"/"+service.Name]
val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]
log.Info(fmt.Sprintf("%s %sv %+v %+v", service.Name, val, manually_specified, found))
// if val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]; (manually_specified || (found && val == nwObj.Name)) && service.Status.LoadBalancer.Ingress != nil {
if (manually_specified || (found && val == nwObj.Name)) && service.Status.LoadBalancer.Ingress != nil {
for _, ingress := range service.Status.LoadBalancer.Ingress {
if ingress.IP != "" {
ip := ingress.IP
@@ -176,12 +186,33 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
}
}
}
nwObj.Status.ResolvedAddresses = ipv4
nwObj.Status.ResolvedAddresses = append(nwObj.Status.ResolvedAddresses, ipv6...)
nwObj.Status.ResolvedIPV4Addresses = ipv4
nwObj.Status.ResolvedIPV6Addresses = ipv6
nwObj.Status.ResolvedTCPPorts = tcpports
nwObj.Status.ResolvedUDPPorts = udpports
currentTime := metav1.Now()
nwObj.Status.LastSyncTime = &currentTime
nwObj.Status.SyncedWithUnifi = true
if nwObj.Status.ResourcesManaged == nil {
nwObj.Status.ResourcesManaged = &unifiv1beta1.FirewallGroupResourcesManaged{
IPV4Object: &unifiv1beta1.NamedUnifiResource{
ID: "",
Name: "",
},
IPV6Object: &unifiv1beta1.NamedUnifiResource{
ID: "",
Name: "",
},
TCPPortsObject: &unifiv1beta1.NamedUnifiResource{
ID: "",
Name: "",
},
UDPPortsObject: &unifiv1beta1.NamedUnifiResource{
ID: "",
Name: "",
},
}
}
err = r.UnifiClient.Reauthenticate()
if err != nil {
return reconcile.Result{}, err
@@ -216,10 +247,14 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(updateerr, "Could neither delete or rename firewall group")
return reconcile.Result{}, updateerr
}
nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name
} else {
log.Error(err, "Could not delete firewall group")
return reconcile.Result{}, err
}
} else {
nwObj.Status.ResourcesManaged.IPV4Object.Name = ""
nwObj.Status.ResourcesManaged.IPV4Object.ID = ""
}
ipv4_done = true
} else {
@@ -251,10 +286,14 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(updateerr, "Could neither delete or rename firewall group")
return reconcile.Result{}, updateerr
}
nwObj.Status.ResourcesManaged.IPV6Object.Name = firewall_group.Name
} else {
log.Error(err, "Could not delete firewall group")
return reconcile.Result{}, err
}
} else {
nwObj.Status.ResourcesManaged.IPV6Object.Name = ""
nwObj.Status.ResourcesManaged.IPV6Object.ID = ""
}
ipv6_done = true
} else {
@@ -279,17 +318,21 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Info(msg)
if strings.Contains(msg, "api.err.objectreferredby") {
log.Info("Firewall group is in use. Invoking workaround...!")
firewall_group.GroupMembers = []string{"127.0.0.1"}
firewall_group.GroupMembers = []string{"0"}
firewall_group.Name = firewall_group.Name + "-deleted"
_, updateerr := r.UnifiClient.Client.UpdateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
if updateerr != nil {
log.Error(updateerr, "Could neither delete or rename firewall group")
return reconcile.Result{}, updateerr
}
nwObj.Status.ResourcesManaged.TCPPortsObject.Name = firewall_group.Name
} else {
log.Error(err, "Could not delete firewall group")
return reconcile.Result{}, err
}
} else {
nwObj.Status.ResourcesManaged.TCPPortsObject.Name = ""
nwObj.Status.ResourcesManaged.TCPPortsObject.ID = ""
}
tcpports_done = true
} else {
@@ -321,10 +364,14 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(updateerr, "Could neither delete or rename firewall group")
return reconcile.Result{}, updateerr
}
nwObj.Status.ResourcesManaged.UDPPortsObject.Name = firewall_group.Name
} else {
log.Error(err, "Could not delete firewall group")
return reconcile.Result{}, err
}
} else {
nwObj.Status.ResourcesManaged.UDPPortsObject.Name = ""
nwObj.Status.ResourcesManaged.UDPPortsObject.ID = ""
}
udpports_done = true
} else {
@@ -349,6 +396,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(err, "Could not update firewall group")
return reconcile.Result{}, err
}
nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name
ipv4_done = true
}
if firewall_group.Name == ipv6_name+"-deleted" && len(ipv6) > 0 {
@@ -360,6 +408,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(err, "Could not update firewall group")
return reconcile.Result{}, err
}
nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name
ipv6_done = true
}
if firewall_group.Name == tcpports_name+"-deleted" && len(tcpports) > 0 {
@@ -371,6 +420,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(err, "Could not update firewall group")
return reconcile.Result{}, err
}
nwObj.Status.ResourcesManaged.TCPPortsObject.Name = firewall_group.Name
tcpports_done = true
}
if firewall_group.Name == udpports_name+"-deleted" && len(udpports) > 0 {
@@ -382,6 +432,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
log.Error(err, "Could not update firewall group")
return reconcile.Result{}, err
}
nwObj.Status.ResourcesManaged.UDPPortsObject.Name = firewall_group.Name
udpports_done = true
}
}
@@ -392,11 +443,19 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
firewall_group.SiteID = r.UnifiClient.SiteID
firewall_group.GroupMembers = ipv4
firewall_group.GroupType = "address-group"
_, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
log.Info(fmt.Sprintf("%+v", firewall_group_result))
if err != nil {
log.Error(err, "Could not create firewall group")
return reconcile.Result{}, err
} else {
firewall_group = *firewall_group_result
}
log.Info(fmt.Sprintf("ID and name: %s %s", firewall_group.ID, firewall_group.Name))
log.Info(fmt.Sprintf("%+v", firewall_group))
nwObj.Status.ResourcesManaged.IPV4Object.ID = firewall_group.ID
nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name
}
if len(ipv6) > 0 && !ipv6_done {
log.Info(fmt.Sprintf("Creating %s", ipv6_name))
@@ -405,11 +464,17 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
firewall_group.SiteID = r.UnifiClient.SiteID
firewall_group.GroupMembers = ipv6
firewall_group.GroupType = "ipv6-address-group"
_, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
log.Info(fmt.Sprintf("%+v", firewall_group_result))
if err != nil {
log.Error(err, "Could not create firewall group")
return reconcile.Result{}, err
} else {
firewall_group = *firewall_group_result
}
nwObj.Status.ResourcesManaged.IPV6Object.ID = firewall_group.ID
nwObj.Status.ResourcesManaged.IPV6Object.Name = firewall_group.Name
}
if len(tcpports) > 0 && !tcpports_done {
log.Info(fmt.Sprintf("Creating %s", tcpports_name))
@@ -419,11 +484,15 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
firewall_group.GroupMembers = tcpports
firewall_group.GroupType = "port-group"
log.Info(fmt.Sprintf("Trying to apply: %+v", firewall_group))
_, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
if err != nil {
log.Error(err, "Could not create firewall group")
return reconcile.Result{}, err
} else {
firewall_group = *firewall_group_result
}
nwObj.Status.ResourcesManaged.TCPPortsObject.ID = firewall_group.ID
nwObj.Status.ResourcesManaged.TCPPortsObject.Name = firewall_group.Name
}
if len(udpports) > 0 && !udpports_done {
log.Info(fmt.Sprintf("Creating %s", udpports_name))
@@ -433,12 +502,18 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
firewall_group.GroupMembers = udpports
firewall_group.GroupType = "port-group"
log.Info(fmt.Sprintf("Trying to apply: %+v", firewall_group))
_, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group)
log.Info(fmt.Sprintf("%+v", firewall_group_result))
if err != nil {
log.Error(err, "Could not create firewall group")
return reconcile.Result{}, err
} else {
firewall_group = *firewall_group_result
}
nwObj.Status.ResourcesManaged.UDPPortsObject.ID = firewall_group.ID
nwObj.Status.ResourcesManaged.UDPPortsObject.Name = firewall_group.Name
}
log.Info(fmt.Sprintf("Updating status for %s: %+v", nwObj.Name, nwObj.Status))
if err := r.Status().Update(ctx, &nwObj); err != nil {
log.Error(err, "unable to update FirewallGroup status")
return reconcile.Result{}, err

540
internal/controller/firewallrule_controller.go
View File

@@ -18,6 +18,9 @@ package controller
import (
"context"
"fmt"
// "strings"
"encoding/json"
"time"
corev1 "k8s.io/api/core/v1"
@@ -28,6 +31,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/handler"
"sigs.k8s.io/controller-runtime/pkg/log"
goUnifi "github.com/vegardengen/go-unifi/unifi"
unifiv1beta1 "github.com/vegardengen/unifi-network-operator/api/v1beta1"
"github.com/vegardengen/unifi-network-operator/internal/config"
"github.com/vegardengen/unifi-network-operator/internal/unifi"
@@ -56,6 +60,38 @@ type FirewallRuleReconciler struct {
//
// For more details, check Reconcile and its Result here:
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.20.2/pkg/reconcile
func fillDefaultRule() goUnifi.FirewallPolicy {
var firewallRule goUnifi.FirewallPolicy
firewallRule.Action = "ALLOW"
firewallRule.CreateAllowRespond = true
firewallRule.ConnectionStateType = "ALL"
firewallRule.ConnectionStates = []string{}
firewallRule.Destination = goUnifi.FirewallDestination{
MatchOppositePorts: false,
MatchingTarget: "IP",
MatchingTargetType: "OBJECT",
}
firewallRule.Enabled = true
firewallRule.ICMPTypename = "ANY"
firewallRule.ICMPV6Typename = "ANY"
firewallRule.MatchIPSec = false
firewallRule.MatchOppositeProtocol = false
firewallRule.Predefined = false
firewallRule.Schedule = goUnifi.FirewallSchedule{
Mode: "ALWAYS",
RepeatOnDays: []string{},
TimeAllDay: false,
}
firewallRule.Source = goUnifi.FirewallSource{
MatchMac: false,
MatchOppositePorts: false,
MatchOppositeNetworks: false,
}
return firewallRule
}
func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
log := log.FromContext(ctx)
@@ -67,39 +103,10 @@ func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request
}
defaultNs := cfg.Data["defaultNamespace"]
kubernetesZone := cfg.Data["kubernetesUnifiZone"]
var kubernetesZoneID string
log.Info(defaultNs)
err = r.UnifiClient.Reauthenticate()
if err != nil {
return ctrl.Result{}, err
}
var zoneCRDs unifiv1beta1.FirewallZoneList
var networkCRDs unifiv1beta1.NetworkconfigurationList
err = r.List(ctx, &zoneCRDs, client.InNamespace(defaultNs))
if err != nil {
log.Error(err, "Could not list firewall zones")
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
zoneCRDNames := make(map[string]struct{})
for _, zoneCRD := range zoneCRDs.Items {
zoneCRDNames[zoneCRD.Name] = struct{}{}
}
err = r.List(ctx, &networkCRDs, client.InNamespace(defaultNs))
if err != nil {
log.Error(err, "Could not list networks")
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
networkCRDNames := make(map[string]struct{})
for _, networkCRD := range networkCRDs.Items {
networkCRDNames[networkCRD.Name] = struct{}{}
}
log.Info(kubernetesZone)
var firewallRule unifiv1beta1.FirewallRule
@@ -108,12 +115,475 @@ func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request
}
log.Info(firewallRule.Spec.Name)
if firewallRule.Status.ResourcesManaged == nil {
firewallGroupsManaged := []unifiv1beta1.FirewallGroupEntry{}
unifiFirewallRules := []unifiv1beta1.UnifiFirewallRuleEntry{}
firewallRule.Status.ResourcesManaged = &unifiv1beta1.FirewallRuleResourcesManaged{
UnifiFirewallRules: unifiFirewallRules,
FirewallGroups: firewallGroupsManaged,
}
}
err = r.UnifiClient.Reauthenticate()
if err != nil {
return ctrl.Result{}, err
}
var zoneCRDs unifiv1beta1.FirewallZoneList
var networkCRDs unifiv1beta1.NetworkconfigurationList
err = r.List(ctx, &zoneCRDs)
if err != nil {
log.Error(err, "Could not list firewall zones")
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
zoneCRDNames := make(map[string]int)
for i, zoneCRD := range zoneCRDs.Items {
namespace := defaultNs
if len(zoneCRD.Namespace) > 0 {
namespace = zoneCRD.Namespace
}
if kubernetesZone == zoneCRD.Name {
kubernetesZoneID = zoneCRD.Spec.ID
log.Info(fmt.Sprintf("Zone for kubernetes resources: %s with ID %s", kubernetesZone, kubernetesZoneID))
}
zoneCRDNames[namespace+"/"+zoneCRD.Name] = i
}
err = r.List(ctx, &networkCRDs)
if err != nil {
log.Error(err, "Could not list networks")
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
networkCRDNames := make(map[string]int)
for i, networkCRD := range networkCRDs.Items {
namespace := defaultNs
if len(networkCRD.Namespace) > 0 {
namespace = networkCRD.Namespace
}
networkCRDNames[namespace+"/"+networkCRD.Name] = i
}
destination_services := make(map[string]struct{})
destination_groups := make(map[string]struct{})
for _, dest_group := range firewallRule.Spec.Destination.FirewallGroups {
namespace := defaultNs
if len(dest_group.Namespace) > 0 {
namespace = dest_group.Namespace
}
destination_groups[namespace+"/"+dest_group.Name] = struct{}{}
}
for _, dest_service := range firewallRule.Spec.Destination.Services {
namespace := defaultNs
if len(dest_service.Namespace) > 0 {
namespace = dest_service.Namespace
}
destination_services[namespace+"/"+dest_service.Name] = struct{}{}
}
log.Info(fmt.Sprintf("%+v", destination_services))
var firewallGroupCRDs unifiv1beta1.FirewallGroupList
var myFirewallGroups []unifiv1beta1.FirewallGroup
if err = r.List(ctx, &firewallGroupCRDs); err != nil {
log.Error(err, "Failed to list firewall groups")
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
for _, firewallGroup := range firewallGroupCRDs.Items {
if val, found := firewallGroup.Annotations["unifi.engen.priv.no/firewall-rule"]; found && val == firewallRule.Name {
myFirewallGroups = append(myFirewallGroups, firewallGroup)
} else if _, found := destination_groups[firewallGroup.Namespace+"/"+firewallGroup.Name]; found {
myFirewallGroups = append(myFirewallGroups, firewallGroup)
}
}
myFirewallGroupNames := make(map[string]struct{})
for _, firewallGroup := range myFirewallGroups {
myFirewallGroupNames[firewallGroup.Name] = struct{}{}
}
var serviceCRDs corev1.ServiceList
var myServices []corev1.Service
if err = r.List(ctx, &serviceCRDs); err != nil {
log.Error(err, "Failed to list services")
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
for _, service := range serviceCRDs.Items {
skipService := false
if val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]; found {
if _, found := myFirewallGroupNames[val]; found {
skipService = true
}
}
if val, found := service.Annotations["unifi.engen.priv.no/firewall-rule"]; found && val == firewallRule.Name && !skipService {
myServices = append(myServices, service)
} else if _, found := destination_services[service.Namespace+"/"+service.Name]; found && !skipService {
myServices = append(myServices, service)
}
}
for _, service := range myServices {
log.Info(fmt.Sprintf("Should handle service %s", service.Name))
var firewallGroupCRD unifiv1beta1.FirewallGroup
if err := r.Get(ctx, types.NamespacedName{
Name: toKubeName("k8s-auto" + "_" + service.Namespace + "/" + service.Name),
Namespace: firewallRule.Namespace,
}, &firewallGroupCRD); err == nil {
myFirewallGroups = append(myFirewallGroups, firewallGroupCRD)
} else {
log.Info("Going to create firewall group")
var manualServices []unifiv1beta1.ServiceEntry
manualServices = append(manualServices, unifiv1beta1.ServiceEntry{
Name: service.Name,
Namespace: service.Namespace,
})
createdFirewallGroupCRD := &unifiv1beta1.FirewallGroup{
ObjectMeta: ctrl.ObjectMeta{
Name: toKubeName("k8s-auto" + "_" + service.Namespace + "/" + service.Name),
Namespace: firewallRule.Namespace,
},
Spec: unifiv1beta1.FirewallGroupSpec{
Name: "auto-" + service.Namespace + "/" + service.Name,
AutoCreatedFrom: unifiv1beta1.FirewallRuleEntry{
Name: firewallRule.Name,
Namespace: firewallRule.Namespace,
},
ManualServices: manualServices,
MatchServicesInAllNamespaces: true,
},
}
log.Info(fmt.Sprintf("%+v", createdFirewallGroupCRD))
if err := r.Create(ctx, createdFirewallGroupCRD); err != nil {
log.Error(err, fmt.Sprintf("Failed to create %s", createdFirewallGroupCRD.Name))
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
} else {
_ = r.Get(ctx, types.NamespacedName{Name: createdFirewallGroupCRD.Name, Namespace: createdFirewallGroupCRD.Namespace}, &firewallGroupCRD)
}
log.Info("Adding %+v", firewallGroupCRD)
myFirewallGroups = append(myFirewallGroups, firewallGroupCRD)
found := false
for _, managedFirewallGroup := range firewallRule.Status.ResourcesManaged.FirewallGroups {
if managedFirewallGroup.Name == firewallGroupCRD.Name && managedFirewallGroup.Namespace == firewallGroupCRD.Namespace {
found = true
}
}
if !found {
firewallRule.Status.ResourcesManaged.FirewallGroups = append(firewallRule.Status.ResourcesManaged.FirewallGroups, unifiv1beta1.FirewallGroupEntry{Name: firewallGroupCRD.Name, Namespace: firewallGroupCRD.Namespace})
if err := r.Status().Update(ctx, &firewallRule); err != nil {
log.Error(err, "Failed to update status with added firewallgroup")
}
}
}
}
unifi_firewall_rules, err := r.UnifiClient.Client.ListFirewallPolicy(context.Background(), r.UnifiClient.SiteID)
if err != nil {
log.Error(err, "Could not list firewall rules")
return ctrl.Result{}, err
}
unifiFirewallruleNames := make(map[string]struct{})
for _, unifi_firewall_rule := range unifi_firewall_rules {
unifiFirewallruleNames[unifi_firewall_rule.Name] = struct{}{}
}
log.Info(fmt.Sprintf("Number of firewall rules: %d", len(unifi_firewall_rules)))
for _, zoneEntry := range firewallRule.Spec.Source.FirewallZones {
namespace := defaultNs
if len(zoneEntry.Namespace) > 0 {
namespace = zoneEntry.Namespace
}
if i, found := zoneCRDNames[namespace+"/"+zoneEntry.Name]; found {
log.Info(fmt.Sprintf("Creating firewallrules for %s", zoneCRDs.Items[i].Name))
for _, firewallGroup := range myFirewallGroups {
if len(firewallGroup.Status.ResolvedIPV4Addresses) > 0 {
if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-tcp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv4 tcp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID
firewallRule.Source.MatchingTarget = "ANY"
firewallRule.Protocol = "tcp"
firewallRule.IPVersion = "IPV4"
firewallRule.Description = fmt.Sprintf("Allow tcp IPV4 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv4 tcp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name))
}
}
if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-udp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv4 udp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID
firewallRule.Source.MatchingTarget = "ANY"
firewallRule.Protocol = "udp"
firewallRule.IPVersion = "IPV4"
firewallRule.Description = fmt.Sprintf("Allow udp IPV4 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv4 udp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name))
}
}
}
if len(firewallGroup.Status.ResolvedIPV6Addresses) > 0 {
if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-tcp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv6 tcp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID
firewallRule.Source.MatchingTarget = "ANY"
firewallRule.Protocol = "tcp"
firewallRule.IPVersion = "IPV6"
firewallRule.Description = fmt.Sprintf("Allow tcp IPV6 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv6 tcp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name))
}
}
if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-udp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv6 udp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID
firewallRule.Source.MatchingTarget = "ANY"
firewallRule.Protocol = "udp"
firewallRule.IPVersion = "IPV6"
firewallRule.Description = fmt.Sprintf("Allow udp IPV6 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv6 udp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name))
}
}
}
}
}
}
for _, networkEntry := range firewallRule.Spec.Source.Networks {
namespace := defaultNs
if len(networkEntry.Namespace) > 0 {
namespace = networkEntry.Namespace
}
if i, found := networkCRDNames[namespace+"/"+networkEntry.Name]; found {
log.Info(fmt.Sprintf("Creating firewallrules for %s", networkCRDs.Items[i].Name))
for _, firewallGroup := range myFirewallGroups {
if len(firewallGroup.Status.ResolvedIPV4Addresses) > 0 {
if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-tcp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv4 tcp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID}
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID
firewallRule.Source.MatchingTarget = "NETWORK"
firewallRule.Protocol = "tcp"
firewallRule.IPVersion = "IPV4"
firewallRule.Description = fmt.Sprintf("Allow tcp IPV4 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv4 tcp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name))
}
}
if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-udp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv4 udp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID}
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID
firewallRule.Source.MatchingTarget = "NETWORK"
firewallRule.Protocol = "udp"
firewallRule.IPVersion = "IPV4"
firewallRule.Description = fmt.Sprintf("Allow udp IPV4 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv4 udp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name))
}
}
}
if len(firewallGroup.Status.ResolvedIPV6Addresses) > 0 {
if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-tcp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv6 tcp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID}
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID
firewallRule.Source.MatchingTarget = "NETWORK"
firewallRule.Protocol = "tcp"
firewallRule.IPVersion = "IPV6"
firewallRule.Description = fmt.Sprintf("Allow tcp IPV6 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv6 tcp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name))
}
}
if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-udp"
if _, found := unifiFirewallruleNames[rulename]; !found {
log.Info(fmt.Sprintf("Creating ipv6 udp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename))
firewallRule := fillDefaultRule()
firewallRule.Name = rulename
firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID}
firewallRule.Source.PortMatchingType = "ANY"
firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID
firewallRule.Source.MatchingTarget = "NETWORK"
firewallRule.Protocol = "udp"
firewallRule.IPVersion = "IPV6"
firewallRule.Description = fmt.Sprintf("Allow udp IPV6 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name)
firewallRule.Destination.MatchingTargetType = "OBJECT"
firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID
firewallRule.Destination.MatchingTarget = "IP"
firewallRule.Destination.PortMatchingType = "OBJECT"
firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID
firewallRule.Destination.ZoneID = kubernetesZoneID
log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule))
pretty, _ := json.MarshalIndent(firewallRule, "", " ")
log.Info(string(pretty))
_, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule)
if err != nil {
log.Error(err, "Could not create firewall policy")
return ctrl.Result{}, err
}
} else {
log.Info(fmt.Sprintf("Firewall rule for ipv6 udp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name))
}
}
}
}
}
}
return ctrl.Result{}, nil
}
func (r *FirewallRuleReconciler) mapFirewallGroupToFirewallRules(ctx context.Context, obj client.Object) []ctrl.Request {
var requests []ctrl.Request
service, ok := obj.(*corev1.Service)
firewallGroup, ok := obj.(*unifiv1beta1.FirewallGroup)
if !ok {
return requests
}
@@ -125,10 +595,10 @@ func (r *FirewallRuleReconciler) mapFirewallGroupToFirewallRules(ctx context.Con
}
for _, rule := range allFirewallRules.Items {
if rule.Spec.MatchFirewallGroupsInAllNamespaces || rule.Namespace == service.Namespace {
if rule.Spec.MatchFirewallGroupsInAllNamespaces || rule.Namespace == firewallGroup.Namespace {
annotationKey := "unifi.engen.priv.no/firewall-rule"
annotationVal := rule.Name
if val, ok := service.Annotations[annotationKey]; ok && (annotationVal == "" || val == annotationVal) {
if val, ok := firewallGroup.Annotations[annotationKey]; ok && (annotationVal == "" || val == annotationVal) {
requests = append(requests, ctrl.Request{
NamespacedName: types.NamespacedName{
Name: rule.Name,

16
internal/controller/networkconfiguration_controller.go
View File

@@ -22,6 +22,7 @@ import (
"time"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/log"
@@ -178,6 +179,10 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl
Vlan: int64(unifinetwork.VLAN),
VlanEnabled: unifinetwork.VLANEnabled,
}
networkStatus := unifiv1.NetworkconfigurationStatus{
FirewallZoneID: unifinetwork.FirewallZoneID,
}
log.Info(fmt.Sprintf("Network status %s: %+v", networkSpec.Name, networkStatus))
if _, found := networkNamesCRDs[unifinetwork.Name]; !found {
firewallZoneNamesCRDs := make(map[string]struct{})
firewallZoneIdsCRDs := make(map[string]struct{})
@@ -190,12 +195,18 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl
Name: toKubeName(unifinetwork.Name),
Namespace: defaultNs,
},
Spec: networkSpec,
Spec: networkSpec,
Status: networkStatus,
}
err = r.Create(ctx, networkCRD)
if err != nil {
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
err = r.Get(ctx, types.NamespacedName{Name: networkCRD.Name, Namespace: networkCRD.Namespace}, networkCRD)
networkCRD.Status = networkStatus
if err = r.Status().Update(ctx, networkCRD); err != nil {
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
} else {
for _, networkCRD := range networkCRDs.Items {
if networkCRD.Spec.Name == unifinetwork.Name {
@@ -205,6 +216,9 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl
if err != nil {
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
if err = r.Status().Update(ctx, &networkCRD); err != nil {
return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
}
}
}
}