Filter Managed ENI.

[orsenthil]

What type of PR is this?

Feature

Which issue does this PR fix?:

#2875

What does this PR do / Why do we need it?:

If the SG reconciler runs before the ENI/IP reconciler it will modify the security groups as the ENI/IP reconciler hasn't had a chance to check the tags on the ENI yet.

Without relying on cache, when the SG reconciler is run, it will not update the ENI with the node.k8s.amazonaws.com/no_manage: true tag

Testing done on this change:

• Unit Tests are successful.
• Integration Tests need to be verified.

Current Mocks do not verify this.

Testing Done.

• Mock / Unit Tests are successful.

• Canary Tests are OK.
  

• Unmanaged ENI's don't have a coveraged - Reopened this - Expand integration test coverage for unmanaged ENIs #2474

*Manual Testing

• Attached a new ENI to an existing instance with no_manage: true
• Since the new ENIs are gotten from the datastore, noticed that RefreshSG followed the no_manage: tag, and skipped changing any Security Groups for newly added ENI with no_manage tag.

Verified with a debugging output against a custom CNI build

1. eni-025db9eced8c995b0 - ENI with no_manage tag.

2. IPAM Marking it as unmanaged.

{"level":"debug","ts":"2024-05-07T01:25:19.021Z","caller":"ipamd/ipamd.go:430","msg":"Marking ENI eni-025db9eced8c995b0 as being unmanaged"}
{"level":"debug","ts":"2024-05-07T01:25:19.021Z","caller":"ipamd/ipamd.go:431","msg":"Skipping ENI eni-025db9eced8c995b0: since it is unmanaged"}

3. Refresh SG Skipping (Temporarily added a debug statement).

[root@ip-192-168-51-243 aws-routed-eni]# tail -f ipamd.log |grep DEBUG
{"level":"debug","ts":"2024-05-07T01:41:22.262Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: ADDING ENI FROM DATASTORE eni-09c8c893dd7b75844"}
{"level":"debug","ts":"2024-05-07T01:41:22.262Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: ADDING ENI FROM DATASTORE eni-039b6089c57710b3e"}
{"level":"debug","ts":"2024-05-07T01:41:22.262Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: TEMP FILTERED ENI  eni-039b6089c57710b3e"}
{"level":"debug","ts":"2024-05-07T01:41:22.263Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: TEMP FILTERED ENI  eni-09c8c893dd7b75844"}
{"level":"debug","ts":"2024-05-07T01:41:22.263Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: UNMANAGED ENI  eni-025db9eced8c995b0"}
{"level":"debug","ts":"2024-05-07T01:41:22.263Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: FILTERED ENI  eni-039b6089c57710b3e"}
{"level":"debug","ts":"2024-05-07T01:41:22.263Z","caller":"ipamd/ipamd.go:510","msg":"DEBUG: FILTERED ENI  eni-09c8c893dd7b75844"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: ADDING ENI FROM DATASTORE eni-09c8c893dd7b75844"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: ADDING ENI FROM DATASTORE eni-039b6089c57710b3e"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: TEMP FILTERED ENI  eni-039b6089c57710b3e"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: TEMP FILTERED ENI  eni-09c8c893dd7b75844"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: UNMANAGED ENI  eni-025db9eced8c995b0"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: FILTERED ENI  eni-039b6089c57710b3e"}
{"level":"debug","ts":"2024-05-07T01:48:53.140Z","caller":"ipamd/ipamd.go:517","msg":"DEBUG: FILTERED ENI  eni-09c8c893dd7b75844"}

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[jayanthvn]

We need to fill the ENIs from datastore, else the eniIDs will always be null

[jayanthvn]

Maybe this - https://github.com/aws/amazon-vpc-cni-k8s/blob/master/pkg/ipamd/datastore/data_store.go#L1192 or any other get function from datastore. Basically we will just use the ENIs from datastore instead of IMDS to sync SGs.

[orsenthil]

@jayanthvn - I have addressed the review comment, and add the test information. PTAL again. Thanks.

[orsenthil]

This is a dependency update, it was required to use with my editor to find dependencies correctly. I can bring it separately (or with this PR itself). #2905

[jayanthvn]

lgtm