Skip to content

Commit

Permalink
API for attaching BPF programs inside network namespaces
Browse files Browse the repository at this point in the history 
This API addition allows XDP, TC, and TCX BPF programs to be attached to
interfaces inside network namespaces.

The API from the Network Observability Operator
(https://github.com/netobserv/network-observability-operator)
was adapted.

Signed-off-by: Andre Fredette <[email protected]>
  • Loading branch information
@anfredette
anfredette committed Nov 18, 2024
1 parent d86dfcd commit b5ffae1
Show file tree
Hide file tree
Showing 6 changed files with 296 additions and 7 deletions.
30 changes: 29 additions & 1 deletion apis/v1alpha1/shared_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,43 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// Identifies interfaces that may be in a network namespace.
type NetnsInterface struct {
// Interfaces contains the interface names to which the BPF program should
// be attached. If empty, all the interfaces in the system are selected,
// except the ones listed in ExcludeInterfaces. An entry enclosed by
// slashes, such as `/br-/`, is matched as a regular expression. Otherwise
// it is matched as a case-sensitive string.
// +optional
Interfaces []string `json:"interfaces"`

// ExcludeInterfaces contains the interface names that are excluded from
// selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
// regular expression. Otherwise it is matched as a case-sensitive string.
// +optional
ExcludeInterfaces []string `json:"excludeInterfaces"`

// NetworkNamespaces contains a list of network namespaces in which to look
// for the listed interfaces. If emtpy, the all network namespaces in the
// system are selected.
// +optional
NetworkNamespaces *[]string `json:"networknamespaces,omitempty"`
}

// InterfaceSelector defines interface to attach to.
// +kubebuilder:validation:MaxProperties=1
// +kubebuilder:validation:MinProperties=1
type InterfaceSelector struct {
// Interfaces refers to a list of network interfaces to attach the BPF
// Interfaces contains a list of network interfaces to attach the BPF
// program to.
// +optional
Interfaces *[]string `json:"interfaces,omitempty"`

// NetnsInterfaces contains a list of network interfaces that may be
// qualified by network namespace.
// +optional
NetnsInterfaces *[]NetnsInterface `json:"netnsinterfaces,omitempty"`

// Attach BPF program to the primary interface on the node. Only 'true' accepted.
// +optional
PrimaryNodeInterface *bool `json:"primarynodeinterface,omitempty"`
Expand Down
45 changes: 45 additions & 0 deletions apis/v1alpha1/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

114 changes: 111 additions & 3 deletions config/crd/bases/bpfman.io_bpfapplications.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -475,11 +475,47 @@ spec:
properties:
interfaces:
description: |-
Interfaces refers to a list of network interfaces to attach the BPF
Interfaces contains a list of network interfaces to attach the BPF
program to.
items:
type: string
type: array
netnsinterfaces:
description: |-
NetnsInterfaces contains a list of network interfaces that may be
qualified by network namespace.
items:
description: Identifies interfaces that may be in
a network namespace.
properties:
excludeInterfaces:
description: |-
ExcludeInterfaces contains the interface names that are excluded from
selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
regular expression. Otherwise it is matched as a case-sensitive string.
items:
type: string
type: array
interfaces:
description: |-
Interfaces contains the interface names to which the BPF program should
be attached. If empty, all the interfaces in the system are selected,
except the ones listed in ExcludeInterfaces. An entry enclosed by
slashes, such as `/br-/`, is matched as a regular expression. Otherwise
it is matched as a case-sensitive string.
items:
type: string
type: array
networknamespaces:
description: |-
NetworkNamespaces contains a list of network namespaces in which to look
for the listed interfaces. If emtpy, the all network namespaces in the
system are selected.
items:
type: string
type: array
type: object
type: array
primarynodeinterface:
description: Attach BPF program to the primary interface
on the node. Only 'true' accepted.
Expand Down Expand Up @@ -598,11 +634,47 @@ spec:
properties:
interfaces:
description: |-
Interfaces refers to a list of network interfaces to attach the BPF
Interfaces contains a list of network interfaces to attach the BPF
program to.
items:
type: string
type: array
netnsinterfaces:
description: |-
NetnsInterfaces contains a list of network interfaces that may be
qualified by network namespace.
items:
description: Identifies interfaces that may be in
a network namespace.
properties:
excludeInterfaces:
description: |-
ExcludeInterfaces contains the interface names that are excluded from
selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
regular expression. Otherwise it is matched as a case-sensitive string.
items:
type: string
type: array
interfaces:
description: |-
Interfaces contains the interface names to which the BPF program should
be attached. If empty, all the interfaces in the system are selected,
except the ones listed in ExcludeInterfaces. An entry enclosed by
slashes, such as `/br-/`, is matched as a regular expression. Otherwise
it is matched as a case-sensitive string.
items:
type: string
type: array
networknamespaces:
description: |-
NetworkNamespaces contains a list of network namespaces in which to look
for the listed interfaces. If emtpy, the all network namespaces in the
system are selected.
items:
type: string
type: array
type: object
type: array
primarynodeinterface:
description: Attach BPF program to the primary interface
on the node. Only 'true' accepted.
Expand Down Expand Up @@ -1090,11 +1162,47 @@ spec:
properties:
interfaces:
description: |-
Interfaces refers to a list of network interfaces to attach the BPF
Interfaces contains a list of network interfaces to attach the BPF
program to.
items:
type: string
type: array
netnsinterfaces:
description: |-
NetnsInterfaces contains a list of network interfaces that may be
qualified by network namespace.
items:
description: Identifies interfaces that may be in
a network namespace.
properties:
excludeInterfaces:
description: |-
ExcludeInterfaces contains the interface names that are excluded from
selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
regular expression. Otherwise it is matched as a case-sensitive string.
items:
type: string
type: array
interfaces:
description: |-
Interfaces contains the interface names to which the BPF program should
be attached. If empty, all the interfaces in the system are selected,
except the ones listed in ExcludeInterfaces. An entry enclosed by
slashes, such as `/br-/`, is matched as a regular expression. Otherwise
it is matched as a case-sensitive string.
items:
type: string
type: array
networknamespaces:
description: |-
NetworkNamespaces contains a list of network namespaces in which to look
for the listed interfaces. If emtpy, the all network namespaces in the
system are selected.
items:
type: string
type: array
type: object
type: array
primarynodeinterface:
description: Attach BPF program to the primary interface
on the node. Only 'true' accepted.
Expand Down
38 changes: 37 additions & 1 deletion config/crd/bases/bpfman.io_tcprograms.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -140,11 +140,47 @@ spec:
properties:
interfaces:
description: |-
Interfaces refers to a list of network interfaces to attach the BPF
Interfaces contains a list of network interfaces to attach the BPF
program to.
items:
type: string
type: array
netnsinterfaces:
description: |-
NetnsInterfaces contains a list of network interfaces that may be
qualified by network namespace.
items:
description: Identifies interfaces that may be in a network
namespace.
properties:
excludeInterfaces:
description: |-
ExcludeInterfaces contains the interface names that are excluded from
selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
regular expression. Otherwise it is matched as a case-sensitive string.
items:
type: string
type: array
interfaces:
description: |-
Interfaces contains the interface names to which the BPF program should
be attached. If empty, all the interfaces in the system are selected,
except the ones listed in ExcludeInterfaces. An entry enclosed by
slashes, such as `/br-/`, is matched as a regular expression. Otherwise
it is matched as a case-sensitive string.
items:
type: string
type: array
networknamespaces:
description: |-
NetworkNamespaces contains a list of network namespaces in which to look
for the listed interfaces. If emtpy, the all network namespaces in the
system are selected.
items:
type: string
type: array
type: object
type: array
primarynodeinterface:
description: Attach BPF program to the primary interface on the
node. Only 'true' accepted.
Expand Down
38 changes: 37 additions & 1 deletion config/crd/bases/bpfman.io_tcxprograms.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -140,11 +140,47 @@ spec:
properties:
interfaces:
description: |-
Interfaces refers to a list of network interfaces to attach the BPF
Interfaces contains a list of network interfaces to attach the BPF
program to.
items:
type: string
type: array
netnsinterfaces:
description: |-
NetnsInterfaces contains a list of network interfaces that may be
qualified by network namespace.
items:
description: Identifies interfaces that may be in a network
namespace.
properties:
excludeInterfaces:
description: |-
ExcludeInterfaces contains the interface names that are excluded from
selection. An entry enclosed by slashes, such as `/br-/`, is matched as a
regular expression. Otherwise it is matched as a case-sensitive string.
items:
type: string
type: array
interfaces:
description: |-
Interfaces contains the interface names to which the BPF program should
be attached. If empty, all the interfaces in the system are selected,
except the ones listed in ExcludeInterfaces. An entry enclosed by
slashes, such as `/br-/`, is matched as a regular expression. Otherwise
it is matched as a case-sensitive string.
items:
type: string
type: array
networknamespaces:
description: |-
NetworkNamespaces contains a list of network namespaces in which to look
for the listed interfaces. If emtpy, the all network namespaces in the
system are selected.
items:
type: string
type: array
type: object
type: array
primarynodeinterface:
description: Attach BPF program to the primary interface on the
node. Only 'true' accepted.
Expand Down
Loading

0 comments on commit b5ffae1

Please sign in to comment.