delete legacy denyall acls when upgrading to v1.13.x (kubeovn#4742)

the acls in v1.13.x are in tier 2 rather than tier 0 in v1.12.x, which results that legacy denyall sg will drop all traffics if a pod bound a sg, because acls in tier 0 have the higest priority. we should recreate acls in denyall sg when upgrading to v1.13.x. Signed-off-by: Rain Suo <[email protected]>
hackerain · Nov 27, 2024 · 5e9f14c · 5e9f14c
1 parent a80490a
commit 5e9f14c
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 0 deletions.
diff --git a/pkg/ovs/ovn-nb-acl.go b/pkg/ovs/ovn-nb-acl.go
@@ -277,6 +277,32 @@ func (c *OVNNbClient) CreateNodeACL(pgName, nodeIPStr, joinIPStr string) error {
 func (c *OVNNbClient) CreateSgDenyAllACL(sgName string) error {
 	pgName := GetSgPortGroupName(sgName)
 
+	// for upgrading from v1.12.x to v1.13.x
+	// see https://github.com/kubeovn/kube-ovn/issues/4742
+	oldIngressACL, err := c.GetACL(pgName, ovnnb.ACLDirectionToLport, util.SecurityGroupDropPriority, fmt.Sprintf("outport == @%s && ip", pgName), true)
+	if err != nil {
+		klog.Error(err)
+		return err
+	}
+	if oldIngressACL.Tier == util.DefaultACLTier {
+		if err := c.DeleteACL(pgName, portGroupKey, ovnnb.ACLDirectionToLport, util.SecurityGroupDropPriority, fmt.Sprintf("outport == @%s && ip", pgName)); err != nil {
+			klog.Errorf("delete legacy acl from port group %s: %v", pgName, err)
+			return err
+		}
+	}
+	oldEgressACL, err := c.GetACL(pgName, ovnnb.ACLDirectionFromLport, util.SecurityGroupDropPriority, fmt.Sprintf("inport == @%s && ip", pgName), true)
+	if err != nil {
+		klog.Error(err)
+		return err
+	}
+	if oldEgressACL.Tier == util.DefaultACLTier {
+		if err := c.DeleteACL(pgName, portGroupKey, ovnnb.ACLDirectionFromLport, util.SecurityGroupDropPriority, fmt.Sprintf("inport == @%s && ip", pgName)); err != nil {
+			klog.Errorf("delete legacy acl from port group %s: %v", pgName, err)
+			return err
+		}
+	}
+
+	// create new acls for deny all sg
 	ingressACL, err := c.newACL(pgName, ovnnb.ACLDirectionToLport, util.SecurityGroupDropPriority, fmt.Sprintf("outport == @%s && ip", pgName), ovnnb.ACLActionDrop, util.NetpolACLTier)
 	if err != nil {
 		klog.Error(err)

diff --git a/pkg/util/const.go b/pkg/util/const.go
@@ -157,6 +157,7 @@ const (
 	AnpMaxPriority       = 99
 	AnpACLMaxPriority    = 30000
 	BanpACLMaxPriority   = 1800
+	DefaultACLTier       = 0
 	AnpACLTier           = 1
 	NetpolACLTier        = 2
 	BanpACLTier          = 3