Filter ipset entries based on node

[awh]

From @awh on September 20, 2016 13:18

For the sake of simplicity, the current implementation builds the same rules and ipsets on all nodes. This limits scalability - instead, a pod's IP should only be added to a node's matching ipsets if that pod is scheduled on that node (it may be possible to implement this by putting a filter on the k8s notification API subscription).

Copied from original issue: weaveworks-experiments/weave-npc#6

[rade]

a pod's IP should only be added to a node's matching ipsets if that pod is scheduled on that node

This optimisation is only applicable to destination ipsets, i.e. those appearing in the dst portions of the iptable rules weave-npc maintains.

[bboreham]

I believe that statement follows from the fact that we only have ingress rules at present. When we add egress rules it would be the src address.

I think it would be better to filter out non-applying rules at a higher level, where we know which way round they are and hence which end is interesting.

[rade]

I believe that statement follows from the fact that we only have ingress rules at present.

Yes, but it wasn't obvious to me, hence I figured it would be good to clarify that, especially since even with only ingress rules we also have ipsets that represent sources (i.e. where connections are allowed to come from).

[bboreham]

I tried this, and it blocked the outgoing end of the connection.

[bboreham]

I missed a large subtlety: the same IPset can be used for both src and dst checks depending on where a selector appears in the rules, and if it is used as a src it needs to include all pods anywhere in the network.