Implement CNI v1.1 support #1021

squeed · 2024-03-20T12:09:28Z

This implements CNI v1.1 for all plugins.

TODO (will probably shuffle to issues):

GC for masquerade rules
GC for portmap
GC for bandwidth
GC for windows

Signed-off-by: Casey Callendrello <c1@caseyc.net>

cni v1.1 adds new route fields: - MTU - AdvMSS - Priority - Table - Scope Signed-off-by: Casey Callendrello <c1@caseyc.net>

This adds a simple GC implementation for host-local IPAM. It walks the directory and removes any un-allocated files. Signed-off-by: Casey Callendrello <c1@caseyc.net>

- STATUS and GC implementation Still outstanding is GCing iptables rules - return interface MTU - tests Signed-off-by: Casey Callendrello <c1@caseyc.net>

- STATUS and GC implementations - MTU in result type - Tests & test fixes Signed-off-by: Casey Callendrello <c1@caseyc.net>

There are no resources to GC, so just pass through to delegated IPAM. Signed-off-by: Casey Callendrello <c1@caseyc.net>

- report MTU - delegate STATUS and GC to ipam (if configured) Signed-off-by: Casey Callendrello <c1@caseyc.net>

- STATUS and GC passthrough - MTU reporting Signed-off-by: Casey Callendrello <c1@caseyc.net>

It doesn't implement release, which we will need. It's also abandonware. Signed-off-by: Casey Callendrello <c1@caseyc.net>

Needed for GC tests. Signed-off-by: Casey Callendrello <c1@caseyc.net>

- STATUS checks to see that the daemon is running - GC clears stale leases Signed-off-by: Casey Callendrello <c1@caseyc.net>

- No need for STATUS or GC; the default impls are fine - return MTU Signed-off-by: Casey Callendrello <c1@caseyc.net>

- STATUS and GC are just passed through to ipam - MTU is reported Signed-off-by: Casey Callendrello <c1@caseyc.net>

- Pass through GC and STATUS to ipam - Report MTU Signed-off-by: Casey Callendrello <c1@caseyc.net>

- Pass through STATUS and GC to IPAM - return MTU Signed-off-by: Casey Callendrello <c1@caseyc.net>

This passes through STATUS and GC to ipam. It does not clean up any stale HNS endpoints, nor does it report MTU. These remain as TODO items. Signed-off-by: Casey Callendrello <c1@caseyc.net>

Signed-off-by: Casey Callendrello <c1@caseyc.net>

This adds a basic CNI v1.1 implementation to the meta plugins. For the plugins which do have state (firewall, bandwidth, portmap) this does *not* perform GC. That remains outstanding. Signed-off-by: Casey Callendrello <c1@caseyc.net>

bleggett

LGTM, ty, lot of little changes.

bleggett · 2024-03-25T21:07:24Z

pkg/testutils/dhcp4server/leasepool/lease.go

+		return err
+	}
+
+	l.IP = net.ParseIP(stringUnMarshal.IP)


Maybe check if the parse failed here.

This whole file is just a copy-paste of an old dependency. It's silly code just for testing; I didn't want to fix it up.

bleggett · 2024-03-25T21:08:13Z

pkg/testutils/dhcp4server/leasepool/memorypool/memorypool.go

 			t.pool = t.pool[:(len(t.pool) - 1)]
-			//Place the Lease At the Begining (This saves us having some sort of counter...)
+			// Place the Lease At the Beginning (This saves us having some sort of counter...)


Suggested change

// Place the Lease At the Beginning (This saves us having some sort of counter...)

// Place the Lease at the beginning (This saves us having some sort of counter...)

ultra-nit

s1061123

GC for masquerade rules

GC for portmap

GC for bandwidth

GC for windows

Suppose that we need to mention somewhere else (e.g. issue or TODO file, or each plugin's code comment) to keep track.

s1061123 · 2024-04-01T06:16:01Z

pkg/ip/ipmasq_linux.go

+	var multicastNet string
+	var ip string // the ip and its full-length prefix
+
+	if isV6 {


isV6 seems to be used only here. So how about to replace it with ipn.IP.To4() == nil directly?

s1061123 · 2024-04-01T06:27:32Z

pkg/testutils/dhcp4server/leasepool/lease.go

@@ -0,0 +1,102 @@
+package leasepool


As far as I understand, this code comes from https://github.com/d2g/dhcp4server/, licensed as Mozilla Public License 2.0(MPL2.0) and it includes this code, not vendoring.

Can we copy this file without LICENSE notification? (I mean that dhcp4server is MPL2.0, not APL2.0). Should we add MPL2.0 in LICENSE file?

s1061123 · 2024-04-01T06:28:43Z

pkg/ip/ipmasq_linux.go

@@ -114,6 +114,46 @@ func TeardownIPMasq(ipn *net.IPNet, chain string, comment string) error {
 	return nil
 }

+func CheckIPMasq(ipn *net.IPNet, chain, comment string) error {


Missing comments for the function?

s1061123 · 2024-04-01T06:38:33Z

plugins/ipam/dhcp/daemon.go

@@ -130,6 +131,36 @@ func (d *DHCP) Release(args *skel.CmdArgs, _ *struct{}) error {
 	return nil
 }

+func (d *DHCP) Ping(_ *skel.CmdArgs, _ *struct{}) error {


Ping could be implemented with DHCP discover message. How about to mention in comments as TODO?

s1061123 · 2024-04-01T06:50:09Z

plugins/ipam/host-local/backend/allocator/config.go

+	ValidAttachments []GCAttachment `json:"cni.dev/valid-attachments,omitempty"`
+}
+
+// GCAttachment is the parameters to a GC call -- namely,


Can we use github.com/containernetworking/cni/pkg/types.GCAttachment ?

s1061123 · 2024-04-01T07:00:06Z

plugins/main/host-device/host-device.go

@@ -625,3 +633,33 @@ func validateCniContainerInterface(intf current.Interface) error {

 	return nil
 }
+
+func cmdStatus(args *skel.CmdArgs) error {


We may check the host-device's existence for status. How about to do that (or add comments for TODO?)

s1061123 · 2024-04-01T07:01:48Z

plugins/main/ipvlan/ipvlan.go

@@ -484,3 +491,32 @@ func validateCniContainerInterface(intf current.Interface, modeExpected string)

 	return nil
 }
+
+func cmdStatus(args *skel.CmdArgs) error {


How about to check whether master interface exists or not?

We must manually adapt the containernetworking IPAM invoking functions, since as of today, the PRs adding that support are not merged. Status is being added in [0], which was extracted from [1], where GC is added. [0] - containernetworking/plugins#1050 [1] - containernetworking/plugins#1021 Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

squeed added 3 commits March 19, 2024 11:57

deps: bump libcni to v1.2.0-rc1, other deps

2f5fb5b

Signed-off-by: Casey Callendrello <c1@caseyc.net>

lib: add v1.1 wrappers

156e37e

Signed-off-by: Casey Callendrello <c1@caseyc.net>

ipam: configure new route fields:

68a181f

cni v1.1 adds new route fields: - MTU - AdvMSS - Priority - Table - Scope Signed-off-by: Casey Callendrello <c1@caseyc.net>

squeed changed the title ~~Cni version 1.1~~ Implement CNI v1.1 support Mar 20, 2024

squeed added 16 commits March 20, 2024 21:41

ipam/host-local: implement GC

c5eabbd

This adds a simple GC implementation for host-local IPAM. It walks the directory and removes any un-allocated files. Signed-off-by: Casey Callendrello <c1@caseyc.net>

ptp: cni v1.1 support

c66b165

- STATUS and GC implementation Still outstanding is GCing iptables rules - return interface MTU - tests Signed-off-by: Casey Callendrello <c1@caseyc.net>

bridge: cni v1.1 support

0017d39

- STATUS and GC implementations - MTU in result type - Tests & test fixes Signed-off-by: Casey Callendrello <c1@caseyc.net>

plugins/dummy: CNI v1.1 support

b7ae92e

There are no resources to GC, so just pass through to delegated IPAM. Signed-off-by: Casey Callendrello <c1@caseyc.net>

host-device: CNI v1.1 support

574fa51

- report MTU - delegate STATUS and GC to ipam (if configured) Signed-off-by: Casey Callendrello <c1@caseyc.net>

ipvlan: cni v1.1 support

54dd2e4

- STATUS and GC passthrough - MTU reporting Signed-off-by: Casey Callendrello <c1@caseyc.net>

dhcp: fork dhcp4server

76e191e

It doesn't implement release, which we will need. It's also abandonware. Signed-off-by: Casey Callendrello <c1@caseyc.net>

dhcpserver: implement release

6cce47d

Needed for GC tests. Signed-off-by: Casey Callendrello <c1@caseyc.net>

dhcp: implement cni v1.1

1bc6fde

- STATUS checks to see that the daemon is running - GC clears stale leases Signed-off-by: Casey Callendrello <c1@caseyc.net>

loopback: CNI v1.1 support

42757d5

- No need for STATUS or GC; the default impls are fine - return MTU Signed-off-by: Casey Callendrello <c1@caseyc.net>

macvlan: add CNI v1.1 support

d8bf923

- STATUS and GC are just passed through to ipam - MTU is reported Signed-off-by: Casey Callendrello <c1@caseyc.net>

tap: add CNI v1.1 support

dbd92f3

- Pass through GC and STATUS to ipam - Report MTU Signed-off-by: Casey Callendrello <c1@caseyc.net>

vlan: implement cni v1.1 support

650d9ad

- Pass through STATUS and GC to IPAM - return MTU Signed-off-by: Casey Callendrello <c1@caseyc.net>

windows: implement stub CNI v1.1 support

8dcc499

This passes through STATUS and GC to ipam. It does not clean up any stale HNS endpoints, nor does it report MTU. These remain as TODO items. Signed-off-by: Casey Callendrello <c1@caseyc.net>

sample: add STATUS and GC impls

34dca5b

Signed-off-by: Casey Callendrello <c1@caseyc.net>

plugins/meta: stub CNI v1.1 implementation

a0374ee

This adds a basic CNI v1.1 implementation to the meta plugins. For the plugins which do have state (firewall, bandwidth, portmap) this does *not* perform GC. That remains outstanding. Signed-off-by: Casey Callendrello <c1@caseyc.net>

squeed force-pushed the cni-version-1.1 branch from cef22f9 to a0374ee Compare March 21, 2024 16:59

bleggett reviewed Mar 25, 2024

View reviewed changes

s1061123 requested changes Mar 26, 2024

View reviewed changes

s1061123 requested changes Apr 1, 2024

View reviewed changes

s1061123 mentioned this pull request Apr 22, 2024

build(deps): bump the golang group with 4 updates #1028

Closed

LionelJouin mentioned this pull request May 20, 2024

Table ID option in SBR Meta Plugin #1046

Closed

maiqueb mentioned this pull request May 29, 2024

build: vendor project maiqueb/devconf2024#6

Merged

LionelJouin mentioned this pull request Aug 27, 2024

Pass status along ipam update #1082

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement CNI v1.1 support #1021

Implement CNI v1.1 support #1021

squeed commented Mar 20, 2024 •

edited

Loading

bleggett left a comment

bleggett Mar 25, 2024

squeed Apr 15, 2024

bleggett Mar 25, 2024

s1061123 left a comment

s1061123 Apr 1, 2024

s1061123 Apr 1, 2024

s1061123 Apr 1, 2024

s1061123 Apr 1, 2024

s1061123 Apr 1, 2024

s1061123 Apr 1, 2024

s1061123 Apr 1, 2024

	// Place the Lease At the Beginning (This saves us having some sort of counter...)
	// Place the Lease at the beginning (This saves us having some sort of counter...)

Implement CNI v1.1 support #1021

Are you sure you want to change the base?

Implement CNI v1.1 support #1021

Conversation

squeed commented Mar 20, 2024 • edited Loading

bleggett left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

s1061123 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

squeed commented Mar 20, 2024 •

edited

Loading