API for attaching BPF programs inside network namespaces

This API addition allows XDP, TC, and TCX BPF programs to be attached to interfaces inside network namespaces. The API from the Network Observability Operator (https://github.com/netobserv/network-observability-operator) was adapted. Signed-off-by: Andre Fredette <[email protected]>
bpfman · Nov 18, 2024 · a17d6d9 · a17d6d9
1 parent d86dfcd
commit a17d6d9
Show file tree

Hide file tree

Showing 6 changed files with 309 additions and 7 deletions.
diff --git a/apis/v1alpha1/shared_types.go b/apis/v1alpha1/shared_types.go
@@ -21,15 +21,44 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+// Identifies interfaces that may be in a network namespace.
+type NetnsInterface struct {
+	// Interfaces contains the interface names to which the BPF program should
+	// be attached. If empty, all the interfaces in the system are selected,
+	// except the ones listed in ExcludeInterfaces. An entry enclosed by
+	// slashes, such as `/br-/`, is matched as a regular expression. Otherwise
+	// it is matched as a case-sensitive string.
+	//+optional
+	Interfaces []string `json:"interfaces"`
+
+	// ExcludeInterfaces contains the interface names that are excluded from
+	// selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
+	// regular expression. Otherwise it is matched as a case-sensitive string.
+	//+kubebuilder:default:=lo;
+	//+optional
+	ExcludeInterfaces []string `json:"excludeInterfaces"`
+
+	// NetworkNamespaces contains a list of network namespaces in which to look
+	// for the listed interfaces. If emtpy, the all network namespaces in the
+	// system are selected.
+	// +optional
+	NetworkNamespaces *[]string `json:"networknamespaces,omitempty"`
+}
+
 // InterfaceSelector defines interface to attach to.
 // +kubebuilder:validation:MaxProperties=1
 // +kubebuilder:validation:MinProperties=1
 type InterfaceSelector struct {
-	// Interfaces refers to a list of network interfaces to attach the BPF
+	// Interfaces contains a list of network interfaces to attach the BPF
 	// program to.
 	// +optional
 	Interfaces *[]string `json:"interfaces,omitempty"`
 
+	// NetnsInterfaces contains a list of network interfaces that may be
+	// qualified by network namespace.
+	// +optional
+	NetnsInterfaces *[]NetnsInterface `json:"netnsinterfaces,omitempty"`
+
 	// Attach BPF program to the primary interface on the node. Only 'true' accepted.
 	// +optional
 	PrimaryNodeInterface *bool `json:"primarynodeinterface,omitempty"`

diff --git a/apis/v1alpha1/zz_generated.deepcopy.go b/apis/v1alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/bpfman.io_bpfapplications.yaml b/config/crd/bases/bpfman.io_bpfapplications.yaml
@@ -475,11 +475,49 @@ spec:
                           properties:
                             interfaces:
                               description: |-
-                                Interfaces refers to a list of network interfaces to attach the BPF
+                                Interfaces contains a list of network interfaces to attach the BPF
                                 program to.
                               items:
                                 type: string
                               type: array
+                            netnsinterfaces:
+                              description: |-
+                                NetnsInterfaces contains a list of network interfaces that may be
+                                qualified by network namespace.
+                              items:
+                                description: Identifies interfaces that may be in
+                                  a network namespace.
+                                properties:
+                                  excludeInterfaces:
+                                    default:
+                                    - lo
+                                    description: |-
+                                      ExcludeInterfaces contains the interface names that are excluded from
+                                      selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
+                                      regular expression. Otherwise it is matched as a case-sensitive string.
+                                    items:
+                                      type: string
+                                    type: array
+                                  interfaces:
+                                    description: |-
+                                      Interfaces contains the interface names to which the BPF program should
+                                      be attached. If empty, all the interfaces in the system are selected,
+                                      except the ones listed in ExcludeInterfaces. An entry enclosed by
+                                      slashes, such as `/br-/`, is matched as a regular expression. Otherwise
+                                      it is matched as a case-sensitive string.
+                                    items:
+                                      type: string
+                                    type: array
+                                  networknamespaces:
+                                    description: |-
+                                      NetworkNamespaces contains a list of network namespaces in which to look
+                                      for the listed interfaces. If emtpy, the all network namespaces in the
+                                      system are selected.
+                                    items:
+                                      type: string
+                                    type: array
+                                type: object
+                              type: array
                             primarynodeinterface:
                               description: Attach BPF program to the primary interface
                                 on the node. Only 'true' accepted.
@@ -598,11 +636,49 @@ spec:
                           properties:
                             interfaces:
                               description: |-
-                                Interfaces refers to a list of network interfaces to attach the BPF
+                                Interfaces contains a list of network interfaces to attach the BPF
                                 program to.
                               items:
                                 type: string
                               type: array
+                            netnsinterfaces:
+                              description: |-
+                                NetnsInterfaces contains a list of network interfaces that may be
+                                qualified by network namespace.
+                              items:
+                                description: Identifies interfaces that may be in
+                                  a network namespace.
+                                properties:
+                                  excludeInterfaces:
+                                    default:
+                                    - lo
+                                    description: |-
+                                      ExcludeInterfaces contains the interface names that are excluded from
+                                      selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
+                                      regular expression. Otherwise it is matched as a case-sensitive string.
+                                    items:
+                                      type: string
+                                    type: array
+                                  interfaces:
+                                    description: |-
+                                      Interfaces contains the interface names to which the BPF program should
+                                      be attached. If empty, all the interfaces in the system are selected,
+                                      except the ones listed in ExcludeInterfaces. An entry enclosed by
+                                      slashes, such as `/br-/`, is matched as a regular expression. Otherwise
+                                      it is matched as a case-sensitive string.
+                                    items:
+                                      type: string
+                                    type: array
+                                  networknamespaces:
+                                    description: |-
+                                      NetworkNamespaces contains a list of network namespaces in which to look
+                                      for the listed interfaces. If emtpy, the all network namespaces in the
+                                      system are selected.
+                                    items:
+                                      type: string
+                                    type: array
+                                type: object
+                              type: array
                             primarynodeinterface:
                               description: Attach BPF program to the primary interface
                                 on the node. Only 'true' accepted.
@@ -1090,11 +1166,49 @@ spec:
                           properties:
                             interfaces:
                               description: |-
-                                Interfaces refers to a list of network interfaces to attach the BPF
+                                Interfaces contains a list of network interfaces to attach the BPF
                                 program to.
                               items:
                                 type: string
                               type: array
+                            netnsinterfaces:
+                              description: |-
+                                NetnsInterfaces contains a list of network interfaces that may be
+                                qualified by network namespace.
+                              items:
+                                description: Identifies interfaces that may be in
+                                  a network namespace.
+                                properties:
+                                  excludeInterfaces:
+                                    default:
+                                    - lo
+                                    description: |-
+                                      ExcludeInterfaces contains the interface names that are excluded from
+                                      selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
+                                      regular expression. Otherwise it is matched as a case-sensitive string.
+                                    items:
+                                      type: string
+                                    type: array
+                                  interfaces:
+                                    description: |-
+                                      Interfaces contains the interface names to which the BPF program should
+                                      be attached. If empty, all the interfaces in the system are selected,
+                                      except the ones listed in ExcludeInterfaces. An entry enclosed by
+                                      slashes, such as `/br-/`, is matched as a regular expression. Otherwise
+                                      it is matched as a case-sensitive string.
+                                    items:
+                                      type: string
+                                    type: array
+                                  networknamespaces:
+                                    description: |-
+                                      NetworkNamespaces contains a list of network namespaces in which to look
+                                      for the listed interfaces. If emtpy, the all network namespaces in the
+                                      system are selected.
+                                    items:
+                                      type: string
+                                    type: array
+                                type: object
+                              type: array
                             primarynodeinterface:
                               description: Attach BPF program to the primary interface
                                 on the node. Only 'true' accepted.

diff --git a/config/crd/bases/bpfman.io_tcprograms.yaml b/config/crd/bases/bpfman.io_tcprograms.yaml
@@ -140,11 +140,49 @@ spec:
                 properties:
                   interfaces:
                     description: |-
-                      Interfaces refers to a list of network interfaces to attach the BPF
+                      Interfaces contains a list of network interfaces to attach the BPF
                       program to.
                     items:
                       type: string
                     type: array
+                  netnsinterfaces:
+                    description: |-
+                      NetnsInterfaces contains a list of network interfaces that may be
+                      qualified by network namespace.
+                    items:
+                      description: Identifies interfaces that may be in a network
+                        namespace.
+                      properties:
+                        excludeInterfaces:
+                          default:
+                          - lo
+                          description: |-
+                            ExcludeInterfaces contains the interface names that are excluded from
+                            selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
+                            regular expression. Otherwise it is matched as a case-sensitive string.
+                          items:
+                            type: string
+                          type: array
+                        interfaces:
+                          description: |-
+                            Interfaces contains the interface names to which the BPF program should
+                            be attached. If empty, all the interfaces in the system are selected,
+                            except the ones listed in ExcludeInterfaces. An entry enclosed by
+                            slashes, such as `/br-/`, is matched as a regular expression. Otherwise
+                            it is matched as a case-sensitive string.
+                          items:
+                            type: string
+                          type: array
+                        networknamespaces:
+                          description: |-
+                            NetworkNamespaces contains a list of network namespaces in which to look
+                            for the listed interfaces. If emtpy, the all network namespaces in the
+                            system are selected.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    type: array
                   primarynodeinterface:
                     description: Attach BPF program to the primary interface on the
                       node. Only 'true' accepted.

diff --git a/config/crd/bases/bpfman.io_tcxprograms.yaml b/config/crd/bases/bpfman.io_tcxprograms.yaml
@@ -140,11 +140,49 @@ spec:
                 properties:
                   interfaces:
                     description: |-
-                      Interfaces refers to a list of network interfaces to attach the BPF
+                      Interfaces contains a list of network interfaces to attach the BPF
                       program to.
                     items:
                       type: string
                     type: array
+                  netnsinterfaces:
+                    description: |-
+                      NetnsInterfaces contains a list of network interfaces that may be
+                      qualified by network namespace.
+                    items:
+                      description: Identifies interfaces that may be in a network
+                        namespace.
+                      properties:
+                        excludeInterfaces:
+                          default:
+                          - lo
+                          description: |-
+                            ExcludeInterfaces contains the interface names that are excluded from
+                            selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
+                            regular expression. Otherwise it is matched as a case-sensitive string.
+                          items:
+                            type: string
+                          type: array
+                        interfaces:
+                          description: |-
+                            Interfaces contains the interface names to which the BPF program should
+                            be attached. If empty, all the interfaces in the system are selected,
+                            except the ones listed in ExcludeInterfaces. An entry enclosed by
+                            slashes, such as `/br-/`, is matched as a regular expression. Otherwise
+                            it is matched as a case-sensitive string.
+                          items:
+                            type: string
+                          type: array
+                        networknamespaces:
+                          description: |-
+                            NetworkNamespaces contains a list of network namespaces in which to look
+                            for the listed interfaces. If emtpy, the all network namespaces in the
+                            system are selected.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    type: array
                   primarynodeinterface:
                     description: Attach BPF program to the primary interface on the
                       node. Only 'true' accepted.