[MESOS-4344] Allow operators to assign net_cls major handles to mesos agents

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.28.0
• Component/s: containerization
• Labels: container mesosphere
• Epic Link: net_cls
• Sprint: Mesosphere Sprint 27, Mesosphere Sprint 28
• Story Points: 1
• Assignee: Avinash Sridharan
• Reporter: Avinash Sridharan
• Shepherd: Jie Yu
• Created: 12/Jan/16 17:00
• Updated: 26/Nov/18 12:21
• Resolved: 26/Nov/18 12:21

Description

The net_cls cgroup associates a 16-bit major and 16-bit minor network handle to packets originating from tasks associated with a specific net_cls cgroup. In mesos we need to give the operator the ability to fix the 16-bit major handle used in an agent (the minor handle will be allocated by the agent. See MESOS-4345). Fixing the parent handle on the agent allows operators to install default firewall rules using the parent handle to enforce a default policy (say DENY ALL) for all container traffic till the container is allocated a minor handle.

A simple way to achieve this requirement is to pass the major handle as a flag to the agent at startup.

Issue Links

• relates to: MESOS-4345 Implement a network-handle manager for net_cls cgroup subsystem
• links to: RB 42781
• links to: RB 42782