feat(routing): implemented back iptables filtering #360

lukas8219 · 2025-03-24T00:30:18Z

No description provided.

github-actions · 2025-03-24T00:30:41Z

Terraform Plan:

google_project_iam_custom_role.resource_cleaner: Refreshing state... [id=projects/gke-metadata-server/roles/resourceCleaner]
google_iam_workload_identity_pool.test_kind_cluster: Refreshing state... [id=projects/gke-metadata-server/locations/global/workloadIdentityPools/test-kind-cluster]
google_service_account.release: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]]
data.google_project.gke_metadata_server: Reading...
google_project_iam_custom_role.continuous_integration: Refreshing state... [id=projects/gke-metadata-server/roles/continuousIntegration]
google_service_account.test: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]]
google_service_account.pull_request: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]]
google_service_account.clean_resources: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]]
google_storage_bucket.test: Refreshing state... [id=gke-metadata-server-test]
google_service_account_iam_member.clean_resources_workload_identity_user: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser/principal://iam.googleapis.com/projects/637293746831/locations/global/workloadIdentityPools/github-actions/subject/repo:matheuscscp/gke-metadata-server:environment:clean-resources]
google_service_account_iam_member.pull_request_workload_identity_user: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser/principal://iam.googleapis.com/projects/637293746831/locations/global/workloadIdentityPools/github-actions/subject/repo:matheuscscp/gke-metadata-server:environment:pull-request]
google_service_account_iam_member.release_workload_identity_user: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser/principal://iam.googleapis.com/projects/637293746831/locations/global/workloadIdentityPools/github-actions/subject/repo:matheuscscp/gke-metadata-server:environment:release]
google_service_account_iam_binding.test_workload_identity_users: Refreshing state... [id=projects/gke-metadata-server/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser]
google_storage_bucket_iam_binding.test_bucket_object_admins: Refreshing state... [id=b/gke-metadata-server-test/roles/storage.objectAdmin]
data.google_project.gke_metadata_server: Read complete after 1s [id=projects/gke-metadata-server]
google_project_iam_member.openid_token_creator: Refreshing state... [id=gke-metadata-server/roles/iam.serviceAccountOpenIdTokenCreator/principal://iam.googleapis.com/projects/637293746831/locations/global/workloadIdentityPools/test-kind-cluster/subject/system:serviceaccount:kube-system:gke-metadata-server]
google_project_iam_member.resource_cleaner: Refreshing state... [id=gke-metadata-server/projects/gke-metadata-server/roles/resourceCleaner/serviceAccount:[email protected]]
google_project_iam_binding.continuous_integration: Refreshing state... [id=gke-metadata-server/projects/gke-metadata-server/roles/continuousIntegration]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

github-actions · 2025-03-24T00:30:57Z

New Releases Check:

No version releases in this pull request.

Dockerfile

lukas8219 · 2025-03-24T00:32:00Z

go.mod

 	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.10.0
-	github.com/vishvananda/netlink v1.3.0
+	github.com/vishvananda/netlink v1.3.1-0.20250206174618-62fb240731fa


Not sure this is needed but I think i ran go mod tidy instead of go mod download ?

go mod tidy is the right one, go mod download is for dockerfile caching magic. Super weird this tag changing like this, their latest is still 1.3.0: https://github.com/vishvananda/netlink/releases/tag/v1.3.0

But the CI failed it ran make tidy (which runs go mod tidy) and found differences. I think it corrected the go.mod file back to simply 1.3.0, so I think there's something wrong with your environment modifying the go.mod file like this?

There was also a diff on the file internal/iptables/iptables.go, this one is probably because of go fmt. Are you using format on save? I use VSCode format on save for Go.

lukas8219 · 2025-03-24T00:54:11Z

api/api.go

 	RoutingModeDefault  = RoutingModeBPF
 	RoutingModeBPF      = "eBPF"
 	RoutingModeLoopback = "Loopback"
+	RoutingModeIPTables = "IPTables"


We should do it in lowercase?

I think uppercase like this is fine 👍

matheuscscp

First pass ❤️

matheuscscp · 2025-03-25T13:46:14Z

go.mod

 	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.10.0
-	github.com/vishvananda/netlink v1.3.0
+	github.com/vishvananda/netlink v1.3.1-0.20250206174618-62fb240731fa


go mod tidy is the right one, go mod download is for dockerfile caching magic. Super weird this tag changing like this, their latest is still 1.3.0: https://github.com/vishvananda/netlink/releases/tag/v1.3.0

But the CI failed it ran make tidy (which runs go mod tidy) and found differences. I think it corrected the go.mod file back to simply 1.3.0, so I think there's something wrong with your environment modifying the go.mod file like this?

matheuscscp · 2025-03-25T13:50:55Z

go.mod

 	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.10.0
-	github.com/vishvananda/netlink v1.3.0
+	github.com/vishvananda/netlink v1.3.1-0.20250206174618-62fb240731fa


There was also a diff on the file internal/iptables/iptables.go, this one is probably because of go fmt. Are you using format on save? I use VSCode format on save for Go.

matheuscscp · 2025-03-25T13:51:18Z

api/api.go

 	RoutingModeDefault  = RoutingModeBPF
 	RoutingModeBPF      = "eBPF"
 	RoutingModeLoopback = "Loopback"
+	RoutingModeIPTables = "IPTables"


I think uppercase like this is fine 👍

matheuscscp · 2025-03-25T13:52:27Z

Dockerfile

+FROM golang:1.24.1-alpine3.21 AS base

-RUN apk add --no-cache clang llvm bpftool libbpf-dev
+RUN apk add --no-cache clang llvm bpftool libbpf-dev iptables
+ENV CGO_ENABLED=0
+ENV GOOS=linux

+FROM base AS builder


Is this the change you mentioned about devcontainers? Your commented is outdated with the code so I can't see it in the exact part of the code you made it anymore. If yes, this looks good to me 👍

matheuscscp · 2025-03-25T13:53:15Z

api/api.go

+	GKEMetadataServerAddressDefault = "169.254.169.254"
+	GKEMetadataServerPortDefault    = 80


Suggested change

GKEMetadataServerAddressDefault = "169.254.169.254"

GKEMetadataServerPortDefault = 80

GKEMetadataServerDefaultAddress = "169.254.169.254"

GKEMetadataServerDefaultPort = 80

Nice one, please check if we have these values anywhere else in the code and use these constants 🙏

matheuscscp · 2025-03-25T13:56:31Z

internal/iptables/iptables.go

+	"net/netip"
+	"strconv"
+
+	"github.com/matheuscscp/gke-metadata-server/api"


We put internal imports in a separate import block between the standard libraries and third party imports

Suggested change

"github.com/matheuscscp/gke-metadata-server/api"

"github.com/matheuscscp/gke-metadata-server/api"

internal/iptables/iptables.go

feat(routing): implemented back iptables filtering

5dcf7d1

lukas8219 temporarily deployed to terraform-plan March 24, 2025 00:30 — with GitHub Actions Inactive

lukas8219 had a problem deploying to pull-request March 24, 2025 00:30 — with GitHub Actions Failure

lukas8219 commented Mar 24, 2025

View reviewed changes

Dockerfile Show resolved Hide resolved

lukas8219 commented Mar 24, 2025

View reviewed changes

lukas8219 added 2 commits March 23, 2025 21:36

added iptables binary in base image

3285016

changed to TableFilter in wrong NAT

cf5e94c

lukas8219 temporarily deployed to terraform-plan March 24, 2025 00:37 — with GitHub Actions Inactive

lukas8219 had a problem deploying to pull-request March 24, 2025 00:37 — with GitHub Actions Failure

lukas8219 requested a review from matheuscscp March 24, 2025 00:37

lukas8219 commented Mar 24, 2025

View reviewed changes

matheuscscp reviewed Mar 25, 2025

View reviewed changes

internal/iptables/iptables.go Outdated Show resolved Hide resolved

Adjusted for requested changes

52d1c5f

lukas8219 temporarily deployed to terraform-plan March 30, 2025 20:09 — with GitHub Actions Inactive

lukas8219 had a problem deploying to pull-request March 30, 2025 20:10 — with GitHub Actions Failure

		GKEMetadataServerAddressDefault = "169.254.169.254"
		GKEMetadataServerPortDefault = 80

	"github.com/matheuscscp/gke-metadata-server/api"
	"github.com/matheuscscp/gke-metadata-server/api"

Uh oh!

feat(routing): implemented back iptables filtering #360

Are you sure you want to change the base?

feat(routing): implemented back iptables filtering #360

Conversation

lukas8219 commented Mar 24, 2025

Uh oh!

github-actions bot commented Mar 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 24, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

matheuscscp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Mar 24, 2025 •

edited

Loading