[Fix] liqo on raspbain os

.github/workflows/integration.yml

@@ -99,9 +99,6 @@ jobs:
         id: set-architectures
         run: |
           ARCHITECTURES=${{ needs.configure.outputs.architectures }}
-          if [ "${{ matrix.component }}" == "proxy" ]; then
-            ARCHITECTURES=$(echo ${ARCHITECTURES} | sed 's/,linux\/arm\/v7//')
-          fi
           echo "ARCHITECTURES=${ARCHITECTURES}" >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/[email protected]

cmd/proxy/main.go

@@ -0,0 +1,41 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"context"
+	"flag"
+	"os"
+
+	"k8s.io/klog/v2"
+
+	"github.com/liqotech/liqo/pkg/proxy"
+)
+
+func main() {
+	ctx := context.Background()
+
+	port := flag.Int("port", 8080, "port to listen on")
+	allowedHosts := flag.String("allowed-hosts", "", "comma separated list of allowed hosts")
+
+	flag.Parse()
+
+	p := proxy.New(*allowedHosts, *port)
+
+	if err := p.Start(ctx); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+}

deployments/liqo/templates/liqo-proxy-deployment.yaml

@@ -36,23 +36,16 @@ spec:
           ports:
           - containerPort: {{ .Values.proxy.config.listeningPort }}
           resources: {{- toYaml .Values.proxy.pod.resources | nindent 12 }}
-          volumeMounts:
-          - mountPath: /etc/envoy/envoy.yaml
-            name: config-volume
-            subPath: config
-          {{- if or .Values.common.extraArgs .Values.proxy.pod.extraArgs }}
           args:
+          - --port={{ .Values.proxy.config.listeningPort }}
+          {{- if or .Values.common.extraArgs .Values.proxy.pod.extraArgs }}
           {{- if .Values.common.extraArgs }}
           {{- toYaml .Values.common.extraArgs | nindent 10 }}
           {{- end }}
           {{- if .Values.proxy.pod.extraArgs }}
           {{- toYaml .Values.proxy.pod.extraArgs | nindent 10 }}
           {{- end }}
           {{- end }}
-      volumes:
-      - name: config-volume
-        configMap:
-          name: {{ include "liqo.prefixedName" $proxyConfig }}
       {{- if ((.Values.common).nodeSelector) }}
       nodeSelector:
       {{- toYaml .Values.common.nodeSelector | nindent 8 }}

docs/advanced/k8s-api-server-proxy.md

@@ -8,7 +8,7 @@ This feature is **internally** used by the [in-band peering](UsagePeeringInBand)
 If you just need to peer two clusters without publicly exposing the Kubernetes API server, you can use the [in-band peering](UsagePeeringInBand).
 ```
 
-The Kubernetes API Server Proxy is an Envoy HTTP server that accepts [HTTP Connect](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests and forwards them to the Kubernetes API Server of the local cluster.
+The Kubernetes API Server Proxy is an HTTP server that accepts [HTTP Connect](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests and forwards them to the Kubernetes API Server of the local cluster.
 It just proxy the requests to the API server and it has no permission on the local cluster.
 This means that, as usual, all the requesters must authenticate with the Kubernetes API Server to access the resources.
 

pkg/proxy/connect.go

@@ -0,0 +1,86 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+	"time"
+
+	"k8s.io/klog/v2"
+)
+
+func (p *Proxy) handleConnect(c net.Conn) {
+	br := bufio.NewReader(c)
+	req, err := http.ReadRequest(br)
+	if err != nil {
+		klog.Errorf("error reading request: %v", err)
+		return
+	}
+
+	if req.Method != http.MethodConnect {
+		response := &http.Response{
+			StatusCode: http.StatusMethodNotAllowed,
+			ProtoMajor: 1,
+			ProtoMinor: 1,
+		}
+		response.Write(c)
+		c.Close()
+		return
+	}
+
+	if !p.isAllowed(req.URL.Host) {
+		klog.Infof("host %s is not allowed", req.URL.Host)
+
+		response := &http.Response{
+			StatusCode: http.StatusForbidden,
+			ProtoMajor: 1,
+			ProtoMinor: 1,
+		}
+		response.Write(c)
+		return
+	}
+
+	klog.Infof("handling CONNECT to %s", req.URL.Host)
+
+	response := &http.Response{
+		StatusCode: 200,
+		ProtoMajor: 1,
+		ProtoMinor: 1,
+	}
+	response.Write(c)
+
+	destConn, err := net.DialTimeout("tcp", req.URL.Host, 30*time.Second)
+	if err != nil {
+		response := &http.Response{
+			StatusCode: http.StatusRequestTimeout,
+			ProtoMajor: 1,
+			ProtoMinor: 1,
+		}
+		response.Write(c)
+		return
+	}
+
+	go transfer(destConn, c)
+	go transfer(c, destConn)
+}
+
+func transfer(destination io.WriteCloser, source io.ReadCloser) {
+	defer destination.Close()
+	defer source.Close()
+	io.Copy(destination, source)
+}

pkg/proxy/types.go

@@ -0,0 +1,86 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+)
+
+var _ manager.Runnable = &Proxy{}
+
+type Proxy struct {
+	AllowedHosts []string
+	Port         int
+}
+
+func New(allowedHosts string, port int) *Proxy {
+	ah := strings.Split(allowedHosts, ",")
+	// remove empty strings
+	for i := 0; i < len(ah); i++ {
+		if ah[i] == "" {
+			ah = append(ah[:i], ah[i+1:]...)
+			i--
+		}
+	}
+
+	return &Proxy{
+		AllowedHosts: ah,
+		Port:         port,
+	}
+}
+
+func (p *Proxy) Start(ctx context.Context) error {
+	klog.Infof("proxy listening on port %d", p.Port)
+	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", p.Port))
+	if err != nil {
+		return err
+	}
+	defer listener.Close()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		default:
+		}
+
+		conn, err := listener.Accept()
+		if err != nil {
+			klog.Errorf("error accepting connection: %v", err)
+			continue
+		}
+
+		go p.handleConnect(conn)
+	}
+}
+
+func (p *Proxy) isAllowed(host string) bool {
+	if len(p.AllowedHosts) == 0 {
+		return true
+	}
+
+	for _, allowedHost := range p.AllowedHosts {
+		if host == allowedHost {
+			return true
+		}
+	}
+	return false
+}

pkg/utils/network/netmonitor/netmonitor.go

@@ -131,18 +131,22 @@ func InterfacesMonitoring(ctx context.Context, eventChannel chan event.GenericEv
 	for {
 		select {
 		case updateLink := <-chLink:
+			klog.V(4).Info("Link update received")
 			if options.Link != nil {
 				handleLinkUpdate(&updateLink, options.Link, interfaces, eventChannel)
 			}
 		case updateAddr := <-chAddr:
+			klog.V(4).Info("Addr update received")
 			if options.Addr != nil {
 				handleAddrUpdate(&updateAddr, options.Addr, eventChannel)
 			}
 		case updateRoute := <-chRoute:
+			klog.V(4).Info("Route update received")
 			if options.Route != nil {
 				handleRouteUpdate(&updateRoute, options.Route, eventChannel)
 			}
 		case updateNft := <-chNft:
+			klog.V(4).Info("Nft update received")
 			if updateNft != nil && options.Nftables != nil {
 				handleNftUpdate(updateNft, options.Nftables, eventChannel)
 			}