Skip to content

Commit aa8bb64

Browse files
Pavani-Panakantiorsenthil
Pavani-Panakanti
authored and
orsenthil
committed
Changes to attach probes at pod start
1 parent eb39d03 commit aa8bb64

File tree

4 files changed

+87
-31
lines changed

4 files changed

+87
-31
lines changed

‎cmd/routed-eni-cni-plugin/cni.go

Lines changed: 49 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ import (
4242
"github.com/aws/amazon-vpc-cni-k8s/pkg/utils/cniutils"
4343
"github.com/aws/amazon-vpc-cni-k8s/pkg/utils/logger"
4444
pb "github.com/aws/amazon-vpc-cni-k8s/rpc"
45-
"github.com/aws/amazon-vpc-cni-k8s/utils"
4645
)
4746

4847
const ipamdAddress = "127.0.0.1:50051"
@@ -279,34 +278,33 @@ func add(args *skel.CmdArgs, cniTypes typeswrapper.CNITYPES, grpcClient grpcwrap
279278
// dummy interface is appended to PrevResult for use during cleanup
280279
result.Interfaces = append(result.Interfaces, dummyInterface)
281280

282-
if utils.IsStrictMode(r.NetworkPolicyMode) {
283-
// Set up a connection to the network policy agent
284-
npConn, err := grpcClient.Dial(npAgentAddress, grpc.WithTransportCredentials(insecure.NewCredentials()))
285-
if err != nil {
286-
log.Errorf("Failed to connect to network policy agent: %v", err)
287-
return errors.Wrap(err, "add cmd: failed to connect to network policy agent backend server")
288-
}
289-
defer npConn.Close()
281+
// Set up a connection to the network policy agent
282+
npConn, err := grpcClient.Dial(npAgentAddress, grpc.WithTransportCredentials(insecure.NewCredentials()))
283+
if err != nil {
284+
log.Errorf("Failed to connect to network policy agent: %v", err)
285+
return errors.Wrap(err, "add cmd: failed to connect to network policy agent backend server")
286+
}
287+
defer npConn.Close()
290288

291-
//Make a GRPC call for network policy agent
292-
npc := rpcClient.NewNPBackendClient(npConn)
289+
//Make a GRPC call for network policy agent
290+
npc := rpcClient.NewNPBackendClient(npConn)
293291

294-
npr, err := npc.EnforceNpToPod(context.Background(),
295-
&pb.EnforceNpRequest{
296-
K8S_POD_NAME: string(k8sArgs.K8S_POD_NAME),
297-
K8S_POD_NAMESPACE: string(k8sArgs.K8S_POD_NAMESPACE),
298-
})
299-
300-
// No need to cleanup IP and network, kubelet will send delete.
301-
if err != nil || !npr.Success {
302-
log.Errorf("Failed to setup default network policy for Pod Name %s and NameSpace %s: GRPC returned - %v Network policy agent returned - %v",
303-
string(k8sArgs.K8S_POD_NAME), string(k8sArgs.K8S_POD_NAMESPACE), err, npr)
304-
return errors.New("add cmd: failed to setup network policy in strict mode")
305-
}
292+
npr, err := npc.EnforceNpToPod(context.Background(),
293+
&pb.EnforceNpRequest{
294+
K8S_POD_NAME: string(k8sArgs.K8S_POD_NAME),
295+
K8S_POD_NAMESPACE: string(k8sArgs.K8S_POD_NAMESPACE),
296+
NETWORK_POLICY_MODE: r.NetworkPolicyMode,
297+
})
306298

307-
log.Debugf("Network Policy agent returned Success : %v", npr.Success)
299+
// No need to cleanup IP and network, kubelet will send delete.
300+
if err != nil || !npr.Success {
301+
log.Errorf("Failed to setup default network policy for Pod Name %s and NameSpace %s: GRPC returned - %v Network policy agent returned - %v",
302+
string(k8sArgs.K8S_POD_NAME), string(k8sArgs.K8S_POD_NAMESPACE), err, npr)
303+
return errors.New("add cmd: failed to setup network policy")
308304
}
309305

306+
log.Debugf("Network Policy agent for EnforceNpToPod returned Success : %v", npr.Success)
307+
310308
return cniTypes.PrintResult(result, conf.CNIVersion)
311309
}
312310

@@ -444,6 +442,33 @@ func del(args *skel.CmdArgs, cniTypes typeswrapper.CNITYPES, grpcClient grpcwrap
444442
} else {
445443
log.Warnf("Container %s did not have a valid IP %s", args.ContainerID, r.IPv4Addr)
446444
}
445+
446+
// Set up a connection to the network policy agent
447+
npConn, err := grpcClient.Dial(npAgentAddress, grpc.WithTransportCredentials(insecure.NewCredentials()))
448+
if err != nil {
449+
log.Errorf("Failed to connect to network policy agent: %v", err)
450+
} else {
451+
defer npConn.Close()
452+
453+
//Make a GRPC call for network policy agent
454+
npc := rpcClient.NewNPBackendClient(npConn)
455+
456+
npr, err := npc.DeletePodNp(context.Background(),
457+
&pb.DeleteNpRequest{
458+
K8S_POD_NAME: string(k8sArgs.K8S_POD_NAME),
459+
K8S_POD_NAMESPACE: string(k8sArgs.K8S_POD_NAMESPACE),
460+
})
461+
462+
// NP agent will never return an error if its not able to delete ebpf probes
463+
if err != nil || !npr.Success {
464+
log.Errorf("Failed to delete pod network policy for Pod Name %s and NameSpace %s: GRPC returned - %v Network policy agent returned - %v",
465+
string(k8sArgs.K8S_POD_NAME), string(k8sArgs.K8S_POD_NAMESPACE), err, npr)
466+
return errors.New("del cmd: failed to setup network policy")
467+
}
468+
469+
log.Debugf("Network Policy agent for DeletePodNp returned Success : %v", npr.Success)
470+
}
471+
447472
return nil
448473
}
449474

‎cmd/routed-eni-cni-plugin/cni_test.go

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,15 @@ func TestCmdAdd(t *testing.T) {
9494
mockC := mock_rpc.NewMockCNIBackendClient(ctrl)
9595
mocksRPC.EXPECT().NewCNIBackendClient(conn).Return(mockC)
9696

97+
npConn, _ := grpc.Dial(npAgentAddress, grpc.WithInsecure())
98+
99+
mocksGRPC.EXPECT().Dial(gomock.Any(), gomock.Any()).Return(npConn, nil)
100+
mockNP := mock_rpc.NewMockNPBackendClient(ctrl)
101+
mocksRPC.EXPECT().NewNPBackendClient(npConn).Return(mockNP)
102+
103+
enforceNpReply := &rpc.EnforceNpReply{Success: true}
104+
mockNP.EXPECT().EnforceNpToPod(gomock.Any(), gomock.Any()).Return(enforceNpReply, nil)
105+
97106
addNetworkReply := &rpc.AddNetworkReply{Success: true, IPv4Addr: ipAddr, DeviceNumber: devNum, NetworkPolicyMode: "none"}
98107
mockC.EXPECT().AddNetwork(gomock.Any(), gomock.Any()).Return(addNetworkReply, nil)
99108

@@ -281,10 +290,18 @@ func TestCmdDel(t *testing.T) {
281290
mockC := mock_rpc.NewMockCNIBackendClient(ctrl)
282291
mocksRPC.EXPECT().NewCNIBackendClient(conn).Return(mockC)
283292

284-
delNetworkReply := &rpc.DelNetworkReply{Success: true, IPv4Addr: ipAddr, DeviceNumber: devNum}
293+
npConn, _ := grpc.Dial(npAgentAddress, grpc.WithInsecure())
294+
295+
mocksGRPC.EXPECT().Dial(gomock.Any(), gomock.Any()).Return(npConn, nil)
296+
mockNP := mock_rpc.NewMockNPBackendClient(ctrl)
297+
mocksRPC.EXPECT().NewNPBackendClient(npConn).Return(mockNP)
285298

299+
delNetworkReply := &rpc.DelNetworkReply{Success: true, IPv4Addr: ipAddr, DeviceNumber: devNum}
286300
mockC.EXPECT().DelNetwork(gomock.Any(), gomock.Any()).Return(delNetworkReply, nil)
287301

302+
deleteNpReply := &rpc.DeleteNpReply{Success: true}
303+
mockNP.EXPECT().DeletePodNp(gomock.Any(), gomock.Any()).Return(deleteNpReply, nil)
304+
288305
addr := &net.IPNet{
289306
IP: net.ParseIP(delNetworkReply.IPv4Addr),
290307
Mask: net.IPv4Mask(255, 255, 255, 255),
@@ -377,10 +394,19 @@ func TestCmdAddForPodENINetwork(t *testing.T) {
377394
mockC := mock_rpc.NewMockCNIBackendClient(ctrl)
378395
mocksRPC.EXPECT().NewCNIBackendClient(conn).Return(mockC)
379396

397+
npConn, _ := grpc.Dial(npAgentAddress, grpc.WithInsecure())
398+
399+
mocksGRPC.EXPECT().Dial(gomock.Any(), gomock.Any()).Return(npConn, nil)
400+
mockNP := mock_rpc.NewMockNPBackendClient(ctrl)
401+
mocksRPC.EXPECT().NewNPBackendClient(npConn).Return(mockNP)
402+
380403
addNetworkReply := &rpc.AddNetworkReply{Success: true, IPv4Addr: ipAddr, PodENISubnetGW: "10.0.0.1", PodVlanId: 1,
381404
PodENIMAC: "eniHardwareAddr", ParentIfIndex: 2, NetworkPolicyMode: "none"}
382405
mockC.EXPECT().AddNetwork(gomock.Any(), gomock.Any()).Return(addNetworkReply, nil)
383406

407+
enforceNpReply := &rpc.EnforceNpReply{Success: true}
408+
mockNP.EXPECT().EnforceNpToPod(gomock.Any(), gomock.Any()).Return(enforceNpReply, nil)
409+
384410
addr := &net.IPNet{
385411
IP: net.ParseIP(addNetworkReply.IPv4Addr),
386412
Mask: net.IPv4Mask(255, 255, 255, 255),
@@ -414,10 +440,18 @@ func TestCmdDelForPodENINetwork(t *testing.T) {
414440
mockC := mock_rpc.NewMockCNIBackendClient(ctrl)
415441
mocksRPC.EXPECT().NewCNIBackendClient(conn).Return(mockC)
416442

417-
delNetworkReply := &rpc.DelNetworkReply{Success: true, IPv4Addr: ipAddr, PodVlanId: 1}
443+
npConn, _ := grpc.Dial(npAgentAddress, grpc.WithInsecure())
444+
445+
mocksGRPC.EXPECT().Dial(gomock.Any(), gomock.Any()).Return(npConn, nil)
446+
mockNP := mock_rpc.NewMockNPBackendClient(ctrl)
447+
mocksRPC.EXPECT().NewNPBackendClient(npConn).Return(mockNP)
418448

449+
delNetworkReply := &rpc.DelNetworkReply{Success: true, IPv4Addr: ipAddr, PodVlanId: 1}
419450
mockC.EXPECT().DelNetwork(gomock.Any(), gomock.Any()).Return(delNetworkReply, nil)
420451

452+
deleteNpReply := &rpc.DeleteNpReply{Success: true}
453+
mockNP.EXPECT().DeletePodNp(gomock.Any(), gomock.Any()).Return(deleteNpReply, nil)
454+
421455
addr := &net.IPNet{
422456
IP: net.ParseIP(delNetworkReply.IPv4Addr),
423457
Mask: net.IPv4Mask(255, 255, 255, 255),

‎rpc/rpc.proto

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,13 @@ message DelNetworkReply {
7171
// The service definition.
7272
service NPBackend {
7373
rpc EnforceNpToPod (EnforceNpRequest) returns (EnforceNpReply) {}
74+
rpc DeletePodNp (DeleteNpRequest) returns (DeleteNpReply) {}
7475
}
7576

7677
message EnforceNpRequest {
7778
string K8S_POD_NAME = 1;
7879
string K8S_POD_NAMESPACE = 2;
80+
string NETWORK_POLICY_MODE = 3;
7981
}
8082

8183
message EnforceNpReply {

‎utils/utils.go

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,3 @@ func IsValidNetworkPolicyEnforcingMode(input string) bool {
6565
return false
6666
}
6767
}
68-
69-
// IsStrictMode checks if strict mode is enabled
70-
func IsStrictMode(input string) bool {
71-
return strings.ToLower(input) == string(Strict)
72-
}

0 commit comments

Comments
 (0)