VPC-CNI minimal image builds

.gitignore

@@ -1,5 +1,11 @@
+# Ignore generated binaries
 aws-k8s-agent
 aws-cni
+aws-vpc-cni
+aws-vpc-cni-init
+bandwidth
+host-local
+loopback
 verify-aws
 verify-network
 *~

Makefile

@@ -78,7 +78,7 @@ LDFLAGS = -X pkg/version/info.Version=$(VERSION) -X pkg/awsutils/awssession.vers
 # ALLPKGS is the set of packages provided in source.
 ALLPKGS = $(shell go list $(VENDOR_OVERRIDE_FLAG) ./... | grep -v cmd/packet-verifier)
 # BINS is the set of built command executables.
-BINS = aws-k8s-agent aws-cni grpc-health-probe cni-metrics-helper
+BINS = aws-k8s-agent aws-cni grpc-health-probe cni-metrics-helper aws-vpc-cni aws-vpc-cni-init
 # Plugin binaries
 # Not copied: bridge dhcp firewall flannel host-device host-local ipvlan macvlan ptp sbr static tuning vlan
 # For gnu tar, the full path in the tar file is required
@@ -119,6 +119,16 @@ build-linux:    ## Build the VPC CNI plugin agent using the host's Go toolchain.
 	go build $(VENDOR_OVERRIDE_FLAG) $(BUILD_FLAGS) -o grpc-health-probe ./cmd/grpc-health-probe
 	go build $(VENDOR_OVERRIDE_FLAG) $(BUILD_FLAGS) -o egress-v4-cni     ./cmd/egress-v4-cni-plugin
 
+# Build VPC CNI init container entrypoint
+build-aws-vpc-cni-init: BUILD_FLAGS = $(BUILD_MODE) -ldflags '-s -w $(LDFLAGS)'
+build-aws-vpc-cni-init:    ## Build the VPC CNI init container using the host's Go toolchain.
+	go build $(VENDOR_OVERRIDE_FLAG) $(BUILD_FLAGS) -o aws-vpc-cni-init     ./cmd/aws-vpc-cni-init
+
+# Build VPC CNI container entrypoint
+build-aws-vpc-cni: BUILD_FLAGS = $(BUILD_MODE) -ldflags '-s -w $(LDFLAGS)'
+build-aws-vpc-cni:    ## Build the VPC CNI container using the host's Go toolchain.
+	go build $(VENDOR_OVERRIDE_FLAG) $(BUILD_FLAGS) -o aws-vpc-cni     ./cmd/aws-vpc-cni
+
 # Build VPC CNI plugin & agent container image.
 docker:	setup-ec2-sdk-override	   ## Build VPC CNI plugin & agent container image.
 	docker build $(DOCKER_BUILD_FLAGS) \

cmd/aws-vpc-cni-init/main.go

@@ -0,0 +1,195 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may
+// not use this file except in compliance with the License. A copy of the
+// License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed
+// on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+// express or implied. See the License for the specific language governing
+// permissions and limitations under the License.
+
+// The aws-node initialization
+package main
+
+import (
+	"os"
+
+	"github.com/aws/amazon-vpc-cni-k8s/utils/cp"
+	"github.com/aws/amazon-vpc-cni-k8s/utils/imds"
+	"github.com/aws/amazon-vpc-cni-k8s/utils/sysctl"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/vishvananda/netlink"
+)
+
+const (
+	defaultHostCNIBinPath = "/host/opt/cni/bin"
+	vpcCniInitDonePath    = "/vpc-cni-init/done"
+	metadataLocalIP       = "local-ipv4"
+	metadataMAC           = "mac"
+
+	envDisableIPv4TcpEarlyDemux = "DISABLE_TCP_EARLY_DEMUX"
+	envEnableIPv6               = "ENABLE_IPv6"
+	envHostCniBinPath           = "HOST_CNI_BIN_PATH"
+)
+
+func getEnv(env, defaultVal string) string {
+	if val, ok := os.LookupEnv(env); ok {
+		return val
+	}
+	return defaultVal
+}
+
+func getNodePrimaryIF() (string, error) {
+	var primaryIF string
+	primaryMAC, err := imds.GetMetaData("mac")
+	if err != nil {
+		return primaryIF, errors.Wrap(err, "Failed to get primary MAC from IMDS")
+	}
+	log.Infof("Found primaryMAC %s", primaryMAC)
+
+	links, err := netlink.LinkList()
+	if err != nil {
+		return primaryIF, errors.Wrap(err, "Failed to list links")
+	}
+	for _, link := range links {
+		if link.Attrs().HardwareAddr.String() == primaryMAC {
+			primaryIF = link.Attrs().Name
+			break
+		}
+	}
+
+	if primaryIF == "" {
+		return primaryIF, errors.Wrap(err, "Failed to retrieve primary IF")
+	}
+	return primaryIF, nil
+}
+
+func configureSystemParams(sysctlUtil sysctl.Interface, primaryIF string) error {
+	var err error
+	// Configure rp_filter in loose mode
+	entry := "net/ipv4/conf/" + primaryIF + "/rp_filter"
+	err = sysctlUtil.Set(entry, 2)
+	if err != nil {
+		return errors.Wrapf(err, "Failed to set rp_filter for %s", primaryIF)
+	}
+	val, _ := sysctlUtil.Get(entry)
+	log.Infof("Updated %s to %d", entry, val)
+
+	// Enable or disable TCP early demux based on environment variable
+	// Note that older kernels may not support tcp_early_demux, so we must first check that it exists.
+	entry = "net/ipv4/tcp_early_demux"
+	if _, err := sysctlUtil.Get(entry); err == nil {
+		disableIPv4EarlyDemux := getEnv(envDisableIPv4TcpEarlyDemux, "false")
+		if disableIPv4EarlyDemux == "true" {
+			err = sysctlUtil.Set(entry, 0)
+			if err != nil {
+				return errors.Wrap(err, "Failed to disable tcp_early_demux")
+			}
+		} else {
+			err = sysctlUtil.Set(entry, 1)
+			if err != nil {
+				return errors.Wrap(err, "Failed to enable tcp_early_demux")
+			}
+		}
+		val, _ = sysctlUtil.Get(entry)
+		log.Infof("Updated %s to %d", entry, val)
+	}
+	return nil
+}
+
+func configureIPv6Settings(sysctlUtil sysctl.Interface, primaryIF string) error {
+	var err error
+	// Enable IPv6 when environment variable is set
+	// Note that IPv6 is not disabled when environment variable is unset. This is omitted to preserve default host semantics.
+	enableIPv6 := getEnv(envEnableIPv6, "false")
+	if enableIPv6 == "true" {
+		entry := "net/ipv6/conf/all/disable_ipv6"
+		err = sysctlUtil.Set(entry, 0)
+		if err != nil {
+			return errors.Wrap(err, "Failed to set disable_ipv6 to 0")
+		}
+		val, _ := sysctlUtil.Get(entry)
+		log.Infof("Updated %s to %d", entry, val)
+
+		entry = "net/ipv6/conf/all/forwarding"
+		err = sysctlUtil.Set(entry, 1)
+		if err != nil {
+			return errors.Wrap(err, "Failed to enable ipv6 forwarding")
+		}
+		val, _ = sysctlUtil.Get(entry)
+		log.Infof("Updated %s to %d", entry, val)
+
+		entry = "net/ipv6/conf/" + primaryIF + "/accept_ra"
+		err = sysctlUtil.Set(entry, 2)
+		if err != nil {
+			return errors.Wrap(err, "Failed to enable ipv6 accept_ra")
+		}
+		val, _ = sysctlUtil.Get(entry)
+		log.Infof("Updated %s to %d", entry, val)
+	}
+	return nil
+}
+
+func main() {
+	os.Exit(_main())
+}
+
+func _main() int {
+	log.Debug("Started Initialization")
+	pluginBins := []string{"loopback", "portmap", "bandwidth", "host-local", "aws-cni-support.sh"}
+	var err error
+	for _, plugin := range pluginBins {
+		if _, err = os.Stat(plugin); err != nil {
+			log.WithError(err).Fatalf("Required executable: %s not found", plugin)
+			return 1
+		}
+	}
+
+	log.Infof("Copying CNI plugin binaries ...")
+	hostCNIBinPath := getEnv(envHostCniBinPath, defaultHostCNIBinPath)
+	err = cp.InstallBinaries(pluginBins, hostCNIBinPath)
+	if err != nil {
+		log.WithError(err).Errorf("Failed to install binaries")
+		return 1
+	}
+	log.Infof("Copied all CNI plugin binaries to %s", hostCNIBinPath)
+
+	var primaryIF string
+	primaryIF, err = getNodePrimaryIF()
+	if err != nil {
+		log.WithError(err).Errorf("Failed to get primary IF")
+		return 1
+	}
+	log.Infof("Found primaryIF %s", primaryIF)
+
+	sysctlUtil := sysctl.New()
+	err = configureSystemParams(sysctlUtil, primaryIF)
+	if err != nil {
+		log.WithError(err).Errorf("Failed to configure system parameters")
+		return 1
+	}
+
+	err = configureIPv6Settings(sysctlUtil, primaryIF)
+	if err != nil {
+		log.WithError(err).Errorf("Failed to configure IPv6 settings")
+		return 1
+	}
+
+	// TODO: In order to speed up pod launch time, VPC CNI init container is not a Kubernetes init container.
+	// The VPC CNI container blocks on the existence of vpcCniInitDonePath
+	//err = cp.TouchFile(vpcCniInitDonePath)
+	//if err != nil {
+	//	log.WithError(err).Errorf("Failed to set VPC CNI init done")
+	//	return 1
+	//}
+
+	log.Infof("CNI init container done")
+
+	// TODO: Since VPC CNI init container is a real container, it never exits
+	// time.Sleep(time.Duration(1<<63 - 1))
+	return 0
+}