Another implementation

[feitnomore]

I've created another implementation to work on "bridge" interfaces.
You can check it here: https://github.com/kubevirt-manager/mnp-nft-bridge

Thanks

[zeeke]

hi @feitnomore! The project looks very interesting.

If I got it right, it leverages nftables to enforce MultiNetworkPolicies APIs. Is there a specific reason for having it work on bridge CNI networks only?

[feitnomore]

@zeeke , to be honest, I've targetted bridge as this was the gap I was trying to cover. The project uses nftables bridge family, with basically prerouting and postrouting hooks.
In order to achieve the desired functionality, I use the MAC ADDR of the target of the rule (Pod/Vm/etc) and apply the filters. Unfortunately I don't have anything with macvtap/macvlan or other mechanisms to test. At some point I guess it might work, but I prefer not to advertise it, as I have not tested and my knowledge on these others is not solid.

Note: Also, to avoid issues, the code looks for NetworkAttachmentDefinitions that are type bridge as well.

Any thoughts?

[zeeke]

@feitnomore thanks for explaining!
I'm not an expert on nftables, but I suppose this project can be mentioned alongside other API implementations.

thanks for contributing!

[feitnomore]

Thanks for the feedback. Let me know if any action is needed from my side.
I would also love to hear feedback from others, specially when it comes to mavlan/macvtap.