From af7bcc39007a8264ccb4928d614e62174260ff79 Mon Sep 17 00:00:00 2001 From: Thomas Ferrandiz Date: Thu, 23 May 2024 15:48:12 +0000 Subject: [PATCH 1/2] Bump flannel version to v0.25.2 Signed-off-by: Thomas Ferrandiz --- go.mod | 10 +++++----- go.sum | 17 ++++++++++------- pkg/agent/flannel/flannel.go | 2 +- 3 files changed, 16 insertions(+), 13 deletions(-) diff --git a/go.mod b/go.mod index 1a3ff4814c..2a04f55ded 100644 --- a/go.mod +++ b/go.mod @@ -74,7 +74,7 @@ replace ( ) require ( - github.com/Microsoft/hcsshim v0.11.5 + github.com/Microsoft/hcsshim v0.12.3 github.com/Mirantis/cri-dockerd v0.0.0-00010101000000-000000000000 github.com/blang/semver/v4 v4.0.0 github.com/cloudnativelabs/kube-router/v2 v2.0.0-00010101000000-000000000000 @@ -88,7 +88,7 @@ require ( github.com/coreos/go-systemd/v22 v22.5.0 github.com/docker/docker v25.0.5+incompatible github.com/erikdubbelboer/gspt v0.0.0-20190125194910-e68493906b83 - github.com/flannel-io/flannel v0.24.2 + github.com/flannel-io/flannel v0.25.2 github.com/go-bindata/go-bindata v3.1.2+incompatible github.com/go-logr/logr v1.4.1 github.com/go-logr/stdr v1.2.3-0.20220714215716-96bad1d688c5 @@ -112,7 +112,7 @@ require ( github.com/minio/minio-go/v7 v7.0.70 github.com/mwitkow/go-http-dialer v0.0.0-20161116154839-378f744fb2b8 github.com/natefinch/lumberjack v2.0.0+incompatible - github.com/onsi/ginkgo/v2 v2.15.0 + github.com/onsi/ginkgo/v2 v2.16.0 github.com/onsi/gomega v1.32.0 github.com/opencontainers/runc v1.1.12 github.com/opencontainers/selinux v1.11.0 @@ -181,7 +181,7 @@ require ( github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e // indirect github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect - github.com/avast/retry-go/v4 v4.3.2 // indirect + github.com/avast/retry-go/v4 v4.6.0 // indirect github.com/benbjohnson/clock v1.3.5 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver v3.5.1+incompatible // indirect @@ -208,7 +208,7 @@ require ( github.com/containerd/typeurl v1.0.2 // indirect github.com/containerd/typeurl/v2 v2.1.1 // indirect github.com/containernetworking/cni v1.1.2 // indirect - github.com/containernetworking/plugins v1.3.0 // indirect + github.com/containernetworking/plugins v1.4.1 // indirect github.com/containers/ocicrypt v1.1.10 // indirect github.com/coreos/go-oidc v2.2.1+incompatible // indirect github.com/coreos/go-semver v0.3.1 // indirect diff --git a/go.sum b/go.sum index 271d29a220..d7f55583dc 100644 --- a/go.sum +++ b/go.sum @@ -252,6 +252,8 @@ github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2B github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= +github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= +github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= github.com/Microsoft/hcsshim v0.11.0 h1:7EFNIY4igHEXUdj1zXgAyU3fLc7QfOKHbkldRVTBdiM= github.com/Microsoft/hcsshim v0.11.0/go.mod h1:OEthFdQv/AD2RAdzR6Mm1N1KPCztGKDurW1Z8b8VGMM= github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ= @@ -289,8 +291,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= -github.com/avast/retry-go/v4 v4.3.2 h1:x4sTEu3jSwr7zNjya8NTdIN+U88u/jtO/q3OupBoDtM= -github.com/avast/retry-go/v4 v4.3.2/go.mod h1:rg6XFaiuFYII0Xu3RDbZQkxCofFwruZKW8oEF1jpWiU= +github.com/avast/retry-go/v4 v4.6.0 h1:K9xNA+KeB8HHc2aWFuLb25Offp+0iVRXEvFx8IinRJA= +github.com/avast/retry-go/v4 v4.6.0/go.mod h1:gvWlPhBVsvBbLkVGDg/KwvBv0bEkCOLRRSHKIr2PyOE= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o= @@ -404,8 +406,8 @@ github.com/containernetworking/cni v1.1.2 h1:wtRGZVv7olUHMOqouPpn3cXJWpJgM6+EUl3 github.com/containernetworking/cni v1.1.2/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw= github.com/containernetworking/plugins v1.1.1/go.mod h1:Sr5TH/eBsGLXK/h71HeLfX19sZPp3ry5uHSkI4LPxV8= github.com/containernetworking/plugins v1.2.0/go.mod h1:/VjX4uHecW5vVimFa1wkG4s+r/s9qIfPdqlLF4TW8c4= -github.com/containernetworking/plugins v1.3.0 h1:QVNXMT6XloyMUoO2wUOqWTC1hWFV62Q6mVDp5H1HnjM= -github.com/containernetworking/plugins v1.3.0/go.mod h1:Pc2wcedTQQCVuROOOaLBPPxrEXqqXBFt3cZ+/yVg6l0= +github.com/containernetworking/plugins v1.4.1 h1:+sJRRv8PKhLkXIl6tH1D7RMi+CbbHutDGU+ErLBORWA= +github.com/containernetworking/plugins v1.4.1/go.mod h1:n6FFGKcaY4o2o5msgu/UImtoC+fpQXM3076VHfHbj60= github.com/containers/ocicrypt v1.1.8/go.mod h1:jM362hyBtbwLMWzXQZTlkjKGAQf/BN/LFMtH0FIRt34= github.com/containers/ocicrypt v1.1.10 h1:r7UR6o8+lyhkEywetubUUgcKFjOWOaWz8cEBrCPX0ic= github.com/containers/ocicrypt v1.1.10/go.mod h1:YfzSSr06PTHQwSTUKqDSjish9BeW1E4HUmreluQcMd8= @@ -526,8 +528,8 @@ github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBD github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/flannel-io/flannel v0.24.2 h1:dXMRlGvmQ7iPtKuGJifmvpfrME5U3TVWDWZ2L/QqPqc= -github.com/flannel-io/flannel v0.24.2/go.mod h1:GvvhQS/xd5QM6oc9yeVz8KBbp5hWJZgPtwTKgpuLUPI= +github.com/flannel-io/flannel v0.25.2 h1:ATQ4PhZqd2MUpLm+NKbAaNxm2PJSLE+mS9WUI4RkKPs= +github.com/flannel-io/flannel v0.25.2/go.mod h1:o5FAm9Rl28TydPKw1cQFYWPopfQKIjlYrcdFzBusaGI= github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc= github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg= github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag= @@ -1279,8 +1281,9 @@ github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+ github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM= -github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY= github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM= +github.com/onsi/ginkgo/v2 v2.16.0 h1:7q1w9frJDzninhXxjZd+Y/x54XNjG/UlRLIYPZafsPM= +github.com/onsi/ginkgo/v2 v2.16.0/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs= github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= diff --git a/pkg/agent/flannel/flannel.go b/pkg/agent/flannel/flannel.go index bcbfae1ff1..ea28c67fea 100644 --- a/pkg/agent/flannel/flannel.go +++ b/pkg/agent/flannel/flannel.go @@ -23,8 +23,8 @@ import ( "github.com/flannel-io/flannel/pkg/backend" "github.com/flannel-io/flannel/pkg/ip" - "github.com/flannel-io/flannel/pkg/iptables" "github.com/flannel-io/flannel/pkg/subnet/kube" + "github.com/flannel-io/flannel/pkg/trafficmngr/iptables" "github.com/pkg/errors" "github.com/sirupsen/logrus" "golang.org/x/net/context" From 6dcd52eb8efcf3d4f671918c84cfc28aeef1d7f6 Mon Sep 17 00:00:00 2001 From: Thomas Ferrandiz Date: Fri, 24 May 2024 07:52:16 +0000 Subject: [PATCH 2/2] Use TrafficManager interface when calling flannel Signed-off-by: Thomas Ferrandiz --- go.mod | 1 + go.sum | 2 + pkg/agent/flannel/flannel.go | 96 ++++++++++++++++++++++-------------- 3 files changed, 62 insertions(+), 37 deletions(-) diff --git a/go.mod b/go.mod index 2a04f55ded..3cfb04b998 100644 --- a/go.mod +++ b/go.mod @@ -101,6 +101,7 @@ require ( github.com/gorilla/websocket v1.5.1 github.com/ipfs/go-ds-leveldb v0.5.0 github.com/ipfs/go-log/v2 v2.5.1 + github.com/joho/godotenv v1.5.1 github.com/json-iterator/go v1.1.12 github.com/k3s-io/helm-controller v0.16.1-0.20240502205943-2f32059d43e6 github.com/k3s-io/kine v0.11.9 diff --git a/go.sum b/go.sum index d7f55583dc..508117fb7d 100644 --- a/go.sum +++ b/go.sum @@ -880,6 +880,8 @@ github.com/jbenet/go-temp-err-catcher v0.1.0/go.mod h1:0kJRvmDZXNMIiJirNPEYfhpPw github.com/jbenet/goprocess v0.1.4 h1:DRGOFReOMqqDNXwW70QkacFW0YN9QnwLV0Vqk+3oU0o= github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4= github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU= +github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= +github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo= github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4= diff --git a/pkg/agent/flannel/flannel.go b/pkg/agent/flannel/flannel.go index ea28c67fea..7a7268e042 100644 --- a/pkg/agent/flannel/flannel.go +++ b/pkg/agent/flannel/flannel.go @@ -25,6 +25,7 @@ import ( "github.com/flannel-io/flannel/pkg/ip" "github.com/flannel-io/flannel/pkg/subnet/kube" "github.com/flannel-io/flannel/pkg/trafficmngr/iptables" + "github.com/joho/godotenv" "github.com/pkg/errors" "github.com/sirupsen/logrus" "golang.org/x/net/context" @@ -80,50 +81,37 @@ func flannel(ctx context.Context, flannelIface *net.Interface, flannelConf, kube if err != nil { return errors.Wrap(err, "failed to register flannel network") } + trafficMngr := &iptables.IPTablesManager{} + err = trafficMngr.Init(ctx, &sync.WaitGroup{}) + if err != nil { + return errors.Wrap(err, "failed to initialize flannel ipTables manager") + } if netMode == (ipv4+ipv6) || netMode == ipv4 { - net, err := config.GetFlannelNetwork(&bn.Lease().Subnet) - if err != nil { - return errors.Wrap(err, "failed to get flannel network details") + if config.Network.Empty() { + return errors.New("ipv4 mode requested but no ipv4 network provided") } - iptables.CreateIP4Chain("nat", "FLANNEL-POSTRTG") - iptables.CreateIP4Chain("filter", "FLANNEL-FWD") - getMasqRules := func() []iptables.IPTablesRule { - if config.HasNetworks() { - return iptables.MasqRules(config.Networks, bn.Lease()) - } - return iptables.MasqRules([]ip.IP4Net{config.Network}, bn.Lease()) - } - getFwdRules := func() []iptables.IPTablesRule { - return iptables.ForwardRules(net.String()) - } - go iptables.SetupAndEnsureIP4Tables(getMasqRules, 60) - go iptables.SetupAndEnsureIP4Tables(getFwdRules, 50) } - if config.IPv6Network.String() != emptyIPv6Network { - ip6net, err := config.GetFlannelIPv6Network(&bn.Lease().IPv6Subnet) - if err != nil { - return errors.Wrap(err, "failed to get ipv6 flannel network details") - } - if flannelIPv6Masq { - logrus.Debugf("Creating IPv6 masquerading iptables rules for %s network", config.IPv6Network.String()) - iptables.CreateIP6Chain("nat", "FLANNEL-POSTRTG") - getRules := func() []iptables.IPTablesRule { - if config.HasIPv6Networks() { - return iptables.MasqIP6Rules(config.IPv6Networks, bn.Lease()) - } - return iptables.MasqIP6Rules([]ip.IP6Net{config.IPv6Network}, bn.Lease()) - } - go iptables.SetupAndEnsureIP6Tables(getRules, 60) - } - iptables.CreateIP6Chain("filter", "FLANNEL-FWD") - getRules := func() []iptables.IPTablesRule { - return iptables.ForwardRules(ip6net.String()) - } - go iptables.SetupAndEnsureIP6Tables(getRules, 50) + //setup masq rules + prevNetwork := ReadCIDRFromSubnetFile(subnetFile, "FLANNEL_NETWORK") + prevSubnet := ReadCIDRFromSubnetFile(subnetFile, "FLANNEL_SUBNET") + + prevIPv6Network := ReadIP6CIDRFromSubnetFile(subnetFile, "FLANNEL_IPV6_NETWORK") + prevIPv6Subnet := ReadIP6CIDRFromSubnetFile(subnetFile, "FLANNEL_IPV6_SUBNET") + if flannelIPv6Masq { + err = trafficMngr.SetupAndEnsureMasqRules(ctx, config.Network, prevSubnet, prevNetwork, config.IPv6Network, prevIPv6Subnet, prevIPv6Network, bn.Lease(), 60) + } else { + //set empty flannel ipv6 Network to prevent masquerading + err = trafficMngr.SetupAndEnsureMasqRules(ctx, config.Network, prevSubnet, prevNetwork, ip.IP6Net{}, prevIPv6Subnet, prevIPv6Network, bn.Lease(), 60) + } + if err != nil { + return errors.Wrap(err, "failed to setup masq rules") } + //setup forward rules + trafficMngr.SetupAndEnsureForwardRules(ctx, config.Network, config.IPv6Network, 50) + if err := WriteSubnetFile(subnetFile, config.Network, config.IPv6Network, true, bn, netMode); err != nil { // Continue, even though it failed. logrus.Warningf("Failed to write flannel subnet file: %s", err) @@ -237,3 +225,37 @@ func WriteSubnetFile(path string, nw ip.IP4Net, nwv6 ip.IP6Net, ipMasq bool, bn return os.Rename(tempFile, path) //TODO - is this safe? What if it's not on the same FS? } + +// ReadCIDRFromSubnetFile reads the flannel subnet file and extracts the value of IPv4 network CIDRKey +func ReadCIDRFromSubnetFile(path string, CIDRKey string) ip.IP4Net { + var prevCIDR ip.IP4Net + if _, err := os.Stat(path); !os.IsNotExist(err) { + prevSubnetVals, err := godotenv.Read(path) + if err != nil { + logrus.Errorf("Couldn't fetch previous %s from subnet file at %s: %v", CIDRKey, path, err) + } else if prevCIDRString, ok := prevSubnetVals[CIDRKey]; ok { + err = prevCIDR.UnmarshalJSON([]byte(prevCIDRString)) + if err != nil { + logrus.Errorf("Couldn't parse previous %s from subnet file at %s: %v", CIDRKey, path, err) + } + } + } + return prevCIDR +} + +// ReadIP6CIDRFromSubnetFile reads the flannel subnet file and extracts the value of IPv6 network CIDRKey +func ReadIP6CIDRFromSubnetFile(path string, CIDRKey string) ip.IP6Net { + var prevCIDR ip.IP6Net + if _, err := os.Stat(path); !os.IsNotExist(err) { + prevSubnetVals, err := godotenv.Read(path) + if err != nil { + logrus.Errorf("Couldn't fetch previous %s from subnet file at %s: %v", CIDRKey, path, err) + } else if prevCIDRString, ok := prevSubnetVals[CIDRKey]; ok { + err = prevCIDR.UnmarshalJSON([]byte(prevCIDRString)) + if err != nil { + logrus.Errorf("Couldn't parse previous %s from subnet file at %s: %v", CIDRKey, path, err) + } + } + } + return prevCIDR +}