DANM Policer umbrella tracker

[Levovar]

DANM is already capable of providing macro-segmentation via managing physical L2 domains. However in a truly secure, no-trust networking envrionment it is expected to have multiple layers of security. In such an environment micro-segmentation, aka. possibility to isolate Pods from each other even when they are connected to the same L2 domain is required.

A new DANM utility could be added to implement this requirement, in the usual, 100% API-driven and multi-network aware manner. The Controller can be driven by a CRD-based API, which is almost similar to the existing NetworkPolicy API, but with a little multi-interface twist in it. Reason not to-reuse the NetworkPolicy API is to avoid collusion with existing, single interface restricted Controller implementations.

[Levovar]

Umbrella ticket, implemented by: https://github.com/nokia/danm-utils/pull/6 https://github.com/nokia/danm-utils/pull/8 https://github.com/nokia/danm-utils/pull/10

[Levovar]

After the latest change https://github.com/nokia/danm-utils/pull/15 the first phase of Policer is done. Multi-interface aware and CNI agnostic centralized micro-segmentation in Kubernetes is officially a thing (see example at the end of the PR).

This ticket now morphs into a Policer umbrella, tracking the various known enhancements still needing implementation.

[Levovar]

DANM Policer Progress

• [x] API and client changes
• [x] Implement PodSelector optimized rule processing engine
• [x] Implement iptables provisioner for rules
• [x] Dual-stack support
• [x] Ingress support
• [x] Egress support
• [x] Support newly provisioning isolation rules for Pod Add life-cycle event
• [x] Support newly provisioning isolation rules for Pod Modify life-cycle event
• [x] Expand default isolation rules to allow packets for ESTABLISHED and RELATED TCP, SCTP, UDP, and ICMP connections: https://github.com/nokia/danm-utils/issues/18
• [x] Allow DNS traffic by default even for isolated Pods: https://github.com/nokia/danm-utils/issues/18
• [x] Support NetworkSelector in rules: https://github.com/nokia/danm-utils/issues/20
• [ ] Support default DENY ALL and ALLOW ALL style policies
• [ ] Support NamespaceSelector in rules
• [ ] Support adjusting the already existing isolation rules during Pod Add
• [ ] Support adjusting the already existing isolation rules when labels are changed during Pod Modify
• [ ] Support adjusting the already existing isolation rules during Pod Delete
• [ ] Support DanmNetworkPolicy Add life-cycle event
• [ ] Support DanmNetworkPolicy Delete life-cycle event
• [ ] Support DanmNetworkPolicy Modify life-cycle event
• [ ] Support IPBlock style rules in DANM NPs
• [ ] Perfromance optimizations for supporting huge clusters
• [ ] Implement alternative rules provisioner (sthing sthing sthing eBPF?)
• [ ] Support cluster-wide network policies