Regenerate proxy iptables rules on EgressNetworkPolicy change
@@ -3,6 +3,7 @@ package plugin
import (
"fmt"
"net"
+ "sync"
"github.com/golang/glog"
@@ -26,9 +27,11 @@ type proxyFirewallItem struct {
type ovsProxyPlugin struct {
registry *Registry
- firewall map[string][]proxyFirewallItem
-
baseEndpointsHandler pconfig.EndpointsConfigHandler
+
+ lock sync.Mutex
+ firewall map[string][]proxyFirewallItem
+ allEndpoints []kapi.Endpoints
}
// Called by higher layers to create the proxy plugin instance; only used by nodes
@@ -77,8 +80,15 @@ func (proxy *ovsProxyPlugin) watchEgressNetworkPolicies() {
if eventType == watch.Deleted {
policy.Spec.Egress = nil
}
+
+ func() {
+ proxy.lock.Lock()
+ defer proxy.lock.Unlock()
proxy.updateNetworkPolicy(*policy)
- // FIXME: poke the endpoint-syncer somehow...
+ if proxy.allEndpoints != nil {
+ proxy.updateEndpoints()
+ }
+ }()
}
}
@@ -111,8 +121,15 @@ func (proxy *ovsProxyPlugin) firewallBlocksIP(namespace string, ip net.IP) bool
}
func (proxy *ovsProxyPlugin) OnEndpointsUpdate(allEndpoints []kapi.Endpoints) {
+ proxy.lock.Lock()
+ defer proxy.lock.Unlock()
+ proxy.allEndpoints = allEndpoints
+ proxy.updateEndpoints()
+}
+
+func (proxy *ovsProxyPlugin) updateEndpoints() {
if len(proxy.firewall) == 0 {
- proxy.baseEndpointsHandler.OnEndpointsUpdate(allEndpoints)
+ proxy.baseEndpointsHandler.OnEndpointsUpdate(proxy.allEndpoints)
return
}
@@ -122,10 +139,10 @@ func (proxy *ovsProxyPlugin) OnEndpointsUpdate(allEndpoints []kapi.Endpoints) {
return
}
- filteredEndpoints := make([]kapi.Endpoints, 0, len(allEndpoints))
+ filteredEndpoints := make([]kapi.Endpoints, 0, len(proxy.allEndpoints))
EndpointLoop:
- for _, ep := range allEndpoints {
+ for _, ep := range proxy.allEndpoints {
ns := ep.ObjectMeta.Namespace
for _, ss := range ep.Subsets {
for _, addr := range ss.Addresses {
