Skip to content

Commit d2a3012

Browse files
zhangzujianzhangzujian
committed
feat: configure ACL sampling in install script
Signed-off-by: zhangzujian <zhangzujian.7@gmail.com>
1 parent 261e7db commit d2a3012

3 files changed

Lines changed: 107 additions & 0 deletions

File tree

‎dist/images/install-acl-sampling_test.sh‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
5+
INSTALL_SCRIPT="$SCRIPT_DIR/install.sh"
6+
7+
assert_equal() {
8+
local expected=$1
9+
local actual=$2
10+
if [ "$actual" != "$expected" ]; then
11+
printf 'expected %q, got %q\n' "$expected" "$actual" >&2
12+
exit 1
13+
fi
14+
}
15+
16+
assert_script_contains() {
17+
local expected=$1
18+
if ! grep -Fq -- "$expected" "$INSTALL_SCRIPT"; then
19+
printf 'install.sh does not contain %q\n' "$expected" >&2
20+
exit 1
21+
fi
22+
}
23+
24+
load_acl_sampling_config() {
25+
eval "$(sed -n \
26+
'/^ENABLE_ACL_SAMPLING=/,/^ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT=/p' \
27+
"$INSTALL_SCRIPT")"
28+
}
29+
30+
unset ENABLE_ACL_SAMPLING ACL_SAMPLING_SET_ID ACL_SAMPLING_LOCAL_GROUP_ID
31+
unset ACL_SAMPLING_APP_ID_NEW ACL_SAMPLING_APP_ID_ESTABLISHED
32+
unset ACL_SAMPLING_COLLECTOR_ID_ALLOW ACL_SAMPLING_COLLECTOR_ID_DEFAULT_DENY
33+
unset ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT
34+
load_acl_sampling_config
35+
36+
assert_equal false "$ENABLE_ACL_SAMPLING"
37+
assert_equal 142 "$ACL_SAMPLING_SET_ID"
38+
assert_equal 142 "$ACL_SAMPLING_LOCAL_GROUP_ID"
39+
assert_equal 102 "$ACL_SAMPLING_APP_ID_NEW"
40+
assert_equal 103 "$ACL_SAMPLING_APP_ID_ESTABLISHED"
41+
assert_equal 1 "$ACL_SAMPLING_COLLECTOR_ID_ALLOW"
42+
assert_equal 2 "$ACL_SAMPLING_COLLECTOR_ID_DEFAULT_DENY"
43+
assert_equal 1 "$ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT"
44+
assert_equal 100 "$ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT"
45+
46+
ENABLE_ACL_SAMPLING=true
47+
ACL_SAMPLING_SET_ID=240
48+
ACL_SAMPLING_LOCAL_GROUP_ID=241
49+
ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT=100
50+
ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT=25
51+
load_acl_sampling_config
52+
53+
assert_equal true "$ENABLE_ACL_SAMPLING"
54+
assert_equal 240 "$ACL_SAMPLING_SET_ID"
55+
assert_equal 241 "$ACL_SAMPLING_LOCAL_GROUP_ID"
56+
assert_equal 100 "$ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT"
57+
assert_equal 25 "$ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT"
58+
59+
for argument in \
60+
'--enable-acl-sampling=$ENABLE_ACL_SAMPLING' \
61+
'--acl-sampling-set-id=$ACL_SAMPLING_SET_ID' \
62+
'--acl-sampling-local-group-id=$ACL_SAMPLING_LOCAL_GROUP_ID' \
63+
'--acl-sampling-app-id-new=$ACL_SAMPLING_APP_ID_NEW' \
64+
'--acl-sampling-app-id-established=$ACL_SAMPLING_APP_ID_ESTABLISHED' \
65+
'--acl-sampling-collector-id-allow=$ACL_SAMPLING_COLLECTOR_ID_ALLOW' \
66+
'--acl-sampling-collector-id-default-deny=$ACL_SAMPLING_COLLECTOR_ID_DEFAULT_DENY' \
67+
'--acl-sampling-allow-probability-percent=$ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT' \
68+
'--acl-sampling-default-deny-probability-percent=$ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT'
69+
do
70+
assert_script_contains "$argument"
71+
done
72+
73+
echo 'install.sh ACL sampling tests passed'

‎dist/images/install.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,15 @@ HW_OFFLOAD=${HW_OFFLOAD:-false}
2222
ENABLE_LB=${ENABLE_LB:-true}
2323
ENABLE_NP=${ENABLE_NP:-true}
2424
NP_ENFORCEMENT=${NP_ENFORCEMENT:-standard}
25+
ENABLE_ACL_SAMPLING=${ENABLE_ACL_SAMPLING:-false}
26+
ACL_SAMPLING_SET_ID=${ACL_SAMPLING_SET_ID:-142}
27+
ACL_SAMPLING_LOCAL_GROUP_ID=${ACL_SAMPLING_LOCAL_GROUP_ID:-142}
28+
ACL_SAMPLING_APP_ID_NEW=${ACL_SAMPLING_APP_ID_NEW:-102}
29+
ACL_SAMPLING_APP_ID_ESTABLISHED=${ACL_SAMPLING_APP_ID_ESTABLISHED:-103}
30+
ACL_SAMPLING_COLLECTOR_ID_ALLOW=${ACL_SAMPLING_COLLECTOR_ID_ALLOW:-1}
31+
ACL_SAMPLING_COLLECTOR_ID_DEFAULT_DENY=${ACL_SAMPLING_COLLECTOR_ID_DEFAULT_DENY:-2}
32+
ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT=${ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT:-1}
33+
ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT=${ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT:-100}
2534
ENABLE_EIP_SNAT=${ENABLE_EIP_SNAT:-true}
2635
LS_DNAT_MOD_DL_DST=${LS_DNAT_MOD_DL_DST:-true}
2736
LS_CT_SKIP_DST_LPORT_IPS=${LS_CT_SKIP_DST_LPORT_IPS:-true}
@@ -238,6 +247,7 @@ echo "Default Subnet CIDR: $POD_CIDR"
238247
echo "Join Subnet CIDR: $JOIN_CIDR"
239248
echo "Enable SVC LB: $ENABLE_LB"
240249
echo "Enable Networkpolicy: $ENABLE_NP"
250+
echo "Enable ACL Sampling: $ENABLE_ACL_SAMPLING"
241251
echo "Enable EIP and SNAT: $ENABLE_EIP_SNAT"
242252
echo "Enable Mirror: $ENABLE_MIRROR"
243253
echo "-------------------------------"
@@ -8370,6 +8380,14 @@ spec:
83708380
- --enable-lb=$ENABLE_LB
83718381
- --enable-np=$ENABLE_NP
83728382
- --np-enforcement=$NP_ENFORCEMENT
8383+
- --enable-acl-sampling=$ENABLE_ACL_SAMPLING
8384+
- --acl-sampling-set-id=$ACL_SAMPLING_SET_ID
8385+
- --acl-sampling-app-id-new=$ACL_SAMPLING_APP_ID_NEW
8386+
- --acl-sampling-app-id-established=$ACL_SAMPLING_APP_ID_ESTABLISHED
8387+
- --acl-sampling-collector-id-allow=$ACL_SAMPLING_COLLECTOR_ID_ALLOW
8388+
- --acl-sampling-collector-id-default-deny=$ACL_SAMPLING_COLLECTOR_ID_DEFAULT_DENY
8389+
- --acl-sampling-allow-probability-percent=$ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT
8390+
- --acl-sampling-default-deny-probability-percent=$ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT
83738391
- --enable-eip-snat=$ENABLE_EIP_SNAT
83748392
- --enable-external-vpc=$ENABLE_EXTERNAL_VPC
83758393
- --logtostderr=false
@@ -8596,6 +8614,9 @@ spec:
85968614
- --cert-manager-issuer-name=$CERT_MANAGER_ISSUER_NAME
85978615
- --set-vxlan-tx-off=$SET_VXLAN_TX_OFF
85988616
- --host-tunnel-src=$HOST_TUNNEL_SRC
8617+
- --enable-acl-sampling=$ENABLE_ACL_SAMPLING
8618+
- --acl-sampling-set-id=$ACL_SAMPLING_SET_ID
8619+
- --acl-sampling-local-group-id=$ACL_SAMPLING_LOCAL_GROUP_ID
85998620
securityContext:
86008621
runAsUser: 0
86018622
privileged: false

‎docs/acl-sampling.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,19 @@ Use `./charts/kube-ovn` instead to configure the classic chart. Keep the
6666
controller and CNI agent values identical across split or independently
6767
managed deployments.
6868

69+
For the manifest-based installer, use the equivalent environment variables:
70+
71+
```bash
72+
ENABLE_ACL_SAMPLING=true \
73+
ACL_SAMPLING_ALLOW_PROBABILITY_PERCENT=1 \
74+
ACL_SAMPLING_DEFAULT_DENY_PROBABILITY_PERCENT=100 \
75+
bash dist/images/install.sh
76+
```
77+
78+
The remaining variable names are the upper snake-case forms of the Helm
79+
fields, prefixed with `ACL_SAMPLING_`, for example
80+
`ACL_SAMPLING_LOCAL_GROUP_ID` and `ACL_SAMPLING_APP_ID_ESTABLISHED`.
81+
6982
The configuration fields have the following semantics:
7083

7184
| Field | Constraint | Purpose |

0 commit comments

Comments
 (0)