Enable BPF without disruption

api/v1/installation_types.go

@@ -757,6 +757,14 @@ type Installation struct {
 	Status InstallationStatus `json:"status,omitempty"`
 }
 
+// BPFEnabled is an extension method that returns true if the Installation resource
+// has Calico Network Linux Dataplane set and equal to value "BPF" otherwise false.
+func (installation *InstallationSpec) BPFEnabled() bool {
+	return installation.CalicoNetwork != nil &&
+		installation.CalicoNetwork.LinuxDataplane != nil &&
+		*installation.CalicoNetwork.LinuxDataplane == LinuxDataplaneBPF
+}
+
 // +kubebuilder:object:root=true
 
 // InstallationList contains a list of Installation

pkg/controller/applicationlayer/applicationlayer_controller.go

@@ -510,7 +510,7 @@ func (r *ReconcileApplicationLayer) getTProxyMode(al *operatorv1.ApplicationLaye
 // patchFelixConfiguration takes all application layer specs as arguments and patches felix config.
 // If at least one of the specs requires TPROXYMode as "Enabled" it'll be patched as "Enabled" otherwise it is "Disabled".
 func (r *ReconcileApplicationLayer) patchFelixConfiguration(ctx context.Context, al *operatorv1.ApplicationLayer) error {
-	_, err := utils.PatchFelixConfiguration(ctx, r.client, func(fc *crdv1.FelixConfiguration) bool {
+	_, err := utils.PatchFelixConfiguration(ctx, r.client, func(fc *crdv1.FelixConfiguration) (bool, error) {
 		var tproxyMode crdv1.TPROXYModeOption
 		if ok, v := r.getTProxyMode(al); ok {
 			tproxyMode = v
@@ -523,7 +523,7 @@ func (r *ReconcileApplicationLayer) patchFelixConfiguration(ctx context.Context,
 				//
 				// The felix bug was fixed in v3.16, v3.15.1 and v3.14.4; it should be safe to set new config fields
 				// once we know we're only upgrading from those versions and above.
-				return false
+				return false, nil
 			}
 
 			// If the mode is already set, fall through to the normal logic, it's safe to force-set the field now.
@@ -538,7 +538,7 @@ func (r *ReconcileApplicationLayer) patchFelixConfiguration(ctx context.Context,
 
 		// If tproxy mode is already set to desired state return false to indicate patch not needed.
 		if policySyncPrefixSetDesired && tproxyModeSetDesired {
-			return false
+			return false, nil
 		}
 
 		fc.Spec.TPROXYMode = &tproxyMode
@@ -549,7 +549,7 @@ func (r *ReconcileApplicationLayer) patchFelixConfiguration(ctx context.Context,
 			"policySyncPathPrefix", fc.Spec.PolicySyncPathPrefix,
 			"tproxyMode", string(tproxyMode),
 		)
-		return true
+		return true, nil
 	})
 
 	return err

pkg/controller/egressgateway/egressgateway_controller.go

@@ -308,12 +308,12 @@ func (r *ReconcileEgressGateway) Reconcile(ctx context.Context, request reconcil
 	}
 
 	// patch and get the felix configuration
-	fc, err := utils.PatchFelixConfiguration(ctx, r.client, func(fc *crdv1.FelixConfiguration) bool {
+	fc, err := utils.PatchFelixConfiguration(ctx, r.client, func(fc *crdv1.FelixConfiguration) (bool, error) {
 		if fc.Spec.PolicySyncPathPrefix != "" {
-			return false // don't proceed with the patch
+			return false, nil // don't proceed with the patch
 		}
 		fc.Spec.PolicySyncPathPrefix = "/var/run/nodeagent"
-		return true // proceed with this patch
+		return true, nil // proceed with this patch
 	})
 	if err != nil {
 		reqLogger.Error(err, "Error patching felix configuration")

pkg/controller/installation/bpf.go

@@ -0,0 +1,120 @@
+// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package installation
+
+import (
+	"errors"
+	"reflect"
+	"strconv"
+
+	"github.com/tigera/operator/pkg/controller/utils"
+
+	crdv1 "github.com/tigera/operator/pkg/apis/crd.projectcalico.org/v1"
+	"github.com/tigera/operator/pkg/common"
+	"github.com/tigera/operator/pkg/render"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+)
+
+// bpfValidateAnnotations validate Felix Configuration annotations match BPF Enabled spec for all scenarios.
+func bpfValidateAnnotations(fc *crdv1.FelixConfiguration) error {
+	var annotationValue *bool
+	if fc.Annotations[render.BPFOperatorAnnotation] != "" {
+		v, err := strconv.ParseBool(fc.Annotations[render.BPFOperatorAnnotation])
+		annotationValue = &v
+		if err != nil {
+			return err
+		}
+	}
+
+	// The values are considered matching if one of the following is true:
+	// - Both values are nil
+	// - Neither are nil and they have the same value.
+	// Otherwise, the we consider the annotation to not match the spec field.
+	match := annotationValue == nil && fc.Spec.BPFEnabled == nil
+	match = match || annotationValue != nil && fc.Spec.BPFEnabled != nil && *annotationValue == *fc.Spec.BPFEnabled
+
+	if !match {
+		return errors.New(`Unable to set bpfEnabled: FelixConfiguration "default" has been modified by someone else, refusing to override potential user configuration.`)
+	}
+
+	return nil
+}
+
+// isRolloutCompleteWithBPFVolumes checks if the calico-node DaemonSet
+// rollout process is completed with BPF volume mount been created.
+// If the Installation resource has been patched to dataplane: BPF then the
+// calico-node daemonset will be re-created with BPF infrastructure such as
+// the "bpffs" volumne mount etc. which will cause the DS to do a rolling update.
+// Therefore, one way to check that the daemonset rolling update is complete is
+// to compare the DS status current scheduled pods equals the updated number and
+// the current scheduled pods also equals the number available.  When all these
+// checks are reconciled then FelixConfig can be patched as bpfEnabled: true.
+func isRolloutCompleteWithBPFVolumes(ds *appsv1.DaemonSet) bool {
+	for _, volume := range ds.Spec.Template.Spec.Volumes {
+		if volume.Name == render.BPFVolumeName {
+			//return ds.Status.CurrentNumberScheduled == ds.Status.UpdatedNumberScheduled && ds.Status.CurrentNumberScheduled == ds.Status.NumberAvailable
+			if ds.Status.CurrentNumberScheduled == ds.Status.UpdatedNumberScheduled && ds.Status.CurrentNumberScheduled == ds.Status.NumberAvailable {
+				return true
+			} else {
+				return false
+			}
+		}
+	}
+	return false
+}
+
+func setBPFEnabledOnFelixConfiguration(fc *crdv1.FelixConfiguration, bpfEnabled bool) error {
+	err := bpfValidateAnnotations(fc)
+	if err != nil {
+		return err
+	}
+
+	text := strconv.FormatBool(bpfEnabled)
+
+	// Add an annotation matching the field value. This allows the operator to compare the annotation to the field
+	// when performing an update to determine if another entity has modified the value since the last write.
+	var fcAnnotations map[string]string
+	if fc.Annotations == nil {
+		fcAnnotations = make(map[string]string)
+	} else {
+		fcAnnotations = fc.Annotations
+	}
+	fcAnnotations[render.BPFOperatorAnnotation] = text
+	fc.SetAnnotations(fcAnnotations)
+	fc.Spec.BPFEnabled = &bpfEnabled
+	return nil
+}
+
+func bpfEnabledOnDaemonsetWithEnvVar(ds *appsv1.DaemonSet) (bool, error) {
+	bpfEnabledStatus := false
+	var err error
+
+	if ds != nil &&
+		!reflect.DeepEqual(ds.Spec, appsv1.DaemonSetSpec{}) &&
+		!reflect.DeepEqual(ds.Spec.Template, corev1.PodTemplateSpec{}) &&
+		!reflect.DeepEqual(ds.Spec.Template.Spec, corev1.PodSpec{}) {
+		bpfEnabledEnvVar := utils.GetPodEnvVar(ds.Spec.Template.Spec, common.NodeDaemonSetName, "FELIX_BPFENABLED")
+		if bpfEnabledEnvVar != nil {
+			bpfEnabledStatus, err = strconv.ParseBool(*bpfEnabledEnvVar)
+		}
+	}
+
+	return bpfEnabledStatus, err
+}
+
+func bpfEnabledOnFelixConfig(fc *crdv1.FelixConfiguration) bool {
+	return fc.Spec.BPFEnabled != nil && *fc.Spec.BPFEnabled
+}