DNS based policy for egress
GrigoriyMikhalkin opened this issue · 10 comments
Support DNS based policies for egress. Similar to DNS based policies in cilium.
As part of the solution we also need to implement DNS proxy.
There is already another implementation which acts as a dns proxy and put the entries into a ipset:
After reading nftables documentation i think we can not use ipset, instead nft sets/maps/verdict maps must be used. We already use the in the accounting logic. General approach is still the same.
Nice hint to nadoo/glider! We really must capture&cache all DNS traffic. Not only queries that target the current set of toFQDNs of all ClusterwideNetworkPolicies. In a running setup we want to be able to change those rules and get them applied immediately and don't want to wait for DNS requests coming by (with systemd-resolved and CoreDNS in Kubernetes we have two "caches").
So we can have architecture like this:
CWNP Controller <--- reads DNS entries from cache --- DNS Cache <--- writes DNS data to cache --- DNS Proxy
Where DNS Proxy is based on glider. It monitors and caches all DNS data in DNS Cache. And then CWNP controller, when it receives resource with toFQDN field, looks up entries for domain names in DNS Cache. One problem is with matchPatterns -- it looks like the only way in that case is to do a brute search for domain names(i.e. iterate over all entries in DNS Cache).
I can also create named sets via DNS Proxy(probably will unload controller to some extent). But still, i need to store associations to these named sets in DNS Cache(because set names are very limited, for example no longer than 16 chars). And then tie them to rules in CWNP Controller.
So we can have architecture like this:
CWNP Controller <--- reads DNS entries from cache --- DNS Cache <--- writes DNS data to cache --- DNS ProxyWhere DNS Proxy is based on glider. It monitors and caches all DNS data in DNS Cache. And then CWNP controller, when it receives resource with
toFQDNfield, looks up entries for domain names in DNS Cache. One problem is withmatchPatterns -- it looks like the only way in that case is to do a brute search for domain names(i.e. iterate over all entries in DNS Cache).
Cilium does the same: https://github.com/cilium/cilium/blob/641c0f9b3072a014c9541ecaa4e00a2b24c98d97/pkg/fqdn/cache.go#L425
Let's make an appoint for reviewing this one please. @majst01 Can you maybe schedule something in the next time when you think you have some time left? It would be so nice to finish this up...