Skip to content

Commit 83f9094

Browse files
jainpulkit22jainpulkit22
committed
Adding more configuration flexibility to Egress for user
Added a StrictEnforcement field to the Egress spec. If this field is set to flase then if the egress node is not available due to any reason then the packet transfer or we can say the traffic will go via normal Node SNAT, while in the second case where this field is set to true, and if egress node is not available packet won't go out and traffic will be stuck because of unavailability of egress node.
1 parent b7e0c38 commit 83f9094

File tree

11 files changed

+97
-30
lines changed

11 files changed

+97
-30
lines changed

‎build/charts/antrea/crds/egress.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ spec:
2020
type: object
2121
required:
2222
- appliedTo
23+
- strictEnforcement
2324
oneOf:
2425
- anyOf:
2526
- required:
@@ -118,6 +119,8 @@ spec:
118119
type: string
119120
burst:
120121
type: string
122+
strictEnforcement:
123+
type: boolean
121124
status:
122125
type: object
123126
properties:

‎build/yamls/antrea-aks.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,7 @@ spec:
14141414
type: object
14151415
required:
14161416
- appliedTo
1417+
- strictEnforcement
14171418
oneOf:
14181419
- anyOf:
14191420
- required:
@@ -1512,6 +1513,8 @@ spec:
15121513
type: string
15131514
burst:
15141515
type: string
1516+
strictEnforcement:
1517+
type: boolean
15151518
status:
15161519
type: object
15171520
properties:

‎build/yamls/antrea-crds.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1403,6 +1403,7 @@ spec:
14031403
type: object
14041404
required:
14051405
- appliedTo
1406+
- strictEnforcement
14061407
oneOf:
14071408
- anyOf:
14081409
- required:
@@ -1501,6 +1502,8 @@ spec:
15011502
type: string
15021503
burst:
15031504
type: string
1505+
strictEnforcement:
1506+
type: boolean
15041507
status:
15051508
type: object
15061509
properties:

‎build/yamls/antrea-eks.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,7 @@ spec:
14141414
type: object
14151415
required:
14161416
- appliedTo
1417+
- strictEnforcement
14171418
oneOf:
14181419
- anyOf:
14191420
- required:
@@ -1512,6 +1513,8 @@ spec:
15121513
type: string
15131514
burst:
15141515
type: string
1516+
strictEnforcement:
1517+
type: boolean
15151518
status:
15161519
type: object
15171520
properties:

‎build/yamls/antrea-gke.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,7 @@ spec:
14141414
type: object
14151415
required:
14161416
- appliedTo
1417+
- strictEnforcement
14171418
oneOf:
14181419
- anyOf:
14191420
- required:
@@ -1512,6 +1513,8 @@ spec:
15121513
type: string
15131514
burst:
15141515
type: string
1516+
strictEnforcement:
1517+
type: boolean
15151518
status:
15161519
type: object
15171520
properties:

‎build/yamls/antrea-ipsec.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,7 @@ spec:
14141414
type: object
14151415
required:
14161416
- appliedTo
1417+
- strictEnforcement
14171418
oneOf:
14181419
- anyOf:
14191420
- required:
@@ -1512,6 +1513,8 @@ spec:
15121513
type: string
15131514
burst:
15141515
type: string
1516+
strictEnforcement:
1517+
type: boolean
15151518
status:
15161519
type: object
15171520
properties:

‎build/yamls/antrea.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,7 @@ spec:
14141414
type: object
14151415
required:
14161416
- appliedTo
1417+
- strictEnforcement
14171418
oneOf:
14181419
- anyOf:
14191420
- required:
@@ -1512,6 +1513,8 @@ spec:
15121513
type: string
15131514
burst:
15141515
type: string
1516+
strictEnforcement:
1517+
type: boolean
15151518
status:
15161519
type: object
15171520
properties:

‎pkg/agent/controller/egress/egress_controller.go

+38-27
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ var emptyWatch = watch.NewEmptyWatch()
8888

8989
var newIPAssigner = ipassigner.NewIPAssigner
9090

91+
var egressNodeAvailability = hasEgressNode
92+
9193
// egressState keeps the actual state of an Egress that has been realized.
9294
type egressState struct {
9395
// The actual egress IP of the Egress. If it's different from the desired IP, there is an update to EgressIP, and we
@@ -989,6 +991,12 @@ func (c *EgressController) updateEgressStatus(egress *crdv1b1.Egress, egressIP s
989991
return nil
990992
}
991993

994+
func hasEgressNode(egress *crdv1b1.Egress) bool {
995+
if egress.Status.EgressNode == "" {
996+
return false
997+
}
998+
return true
999+
}
9921000
func (c *EgressController) syncEgress(egressName string) error {
9931001
startTime := time.Now()
9941002
defer func() {
@@ -1118,39 +1126,42 @@ func (c *EgressController) syncEgress(egressName string) error {
11181126
}()
11191127

11201128
egressIP := net.ParseIP(eState.egressIP)
1121-
// Install SNAT flows for desired Pods.
1122-
for pod := range pods {
1123-
eState.pods.Insert(pod)
1124-
stalePods.Delete(pod)
1129+
strictEnforcement := egress.Spec.StrictEnforcement
1130+
if strictEnforcement || egressNodeAvailability(egress) {
1131+
// Install SNAT flows for desired Pods.
1132+
for pod := range pods {
1133+
eState.pods.Insert(pod)
1134+
stalePods.Delete(pod)
1135+
1136+
// If the Egress is not the effective one for the Pod, do nothing.
1137+
if !c.bindPodEgress(pod, egressName) {
1138+
continue
1139+
}
11251140

1126-
// If the Egress is not the effective one for the Pod, do nothing.
1127-
if !c.bindPodEgress(pod, egressName) {
1128-
continue
1129-
}
1141+
// Get the Pod's openflow port.
1142+
parts := strings.Split(pod, "/")
1143+
podNamespace, podName := parts[0], parts[1]
1144+
ifaces := c.ifaceStore.GetContainerInterfacesByPod(podName, podNamespace)
1145+
if len(ifaces) == 0 {
1146+
klog.Infof("Interfaces of Pod %s/%s not found", podNamespace, podName)
1147+
continue
1148+
}
11301149

1131-
// Get the Pod's openflow port.
1132-
parts := strings.Split(pod, "/")
1133-
podNamespace, podName := parts[0], parts[1]
1134-
ifaces := c.ifaceStore.GetContainerInterfacesByPod(podName, podNamespace)
1135-
if len(ifaces) == 0 {
1136-
klog.Infof("Interfaces of Pod %s/%s not found", podNamespace, podName)
1137-
continue
1150+
ofPort := ifaces[0].OFPort
1151+
if eState.ofPorts.Has(ofPort) {
1152+
staleOFPorts.Delete(ofPort)
1153+
continue
1154+
}
1155+
if err := c.ofClient.InstallPodSNATFlows(uint32(ofPort), egressIP, mark); err != nil {
1156+
return err
1157+
}
1158+
eState.ofPorts.Insert(ofPort)
11381159
}
11391160

1140-
ofPort := ifaces[0].OFPort
1141-
if eState.ofPorts.Has(ofPort) {
1142-
staleOFPorts.Delete(ofPort)
1143-
continue
1144-
}
1145-
if err := c.ofClient.InstallPodSNATFlows(uint32(ofPort), egressIP, mark); err != nil {
1161+
// Uninstall SNAT flows for stale Pods.
1162+
if err := c.uninstallPodFlows(egressName, eState, staleOFPorts, stalePods); err != nil {
11461163
return err
11471164
}
1148-
eState.ofPorts.Insert(ofPort)
1149-
}
1150-
1151-
// Uninstall SNAT flows for stale Pods.
1152-
if err := c.uninstallPodFlows(egressName, eState, staleOFPorts, stalePods); err != nil {
1153-
return err
11541165
}
11551166
return nil
11561167
}

‎pkg/agent/controller/egress/egress_controller_test.go

+27
Original file line numberDiff line numberDiff line change
@@ -1101,6 +1101,15 @@ func TestSyncEgress(t *testing.T) {
11011101
},
11021102
},
11031103
}
1104+
1105+
egressNodeAvailability = func(egress *crdv1b1.Egress) bool {
1106+
return true
1107+
}
1108+
1109+
defer func() {
1110+
egressNodeAvailability = hasEgressNode
1111+
}()
1112+
11041113
for _, tt := range tests {
11051114
t.Run(tt.name, func(t *testing.T) {
11061115
initObjects := []runtime.Object{tt.existingEgress}
@@ -1195,6 +1204,15 @@ func TestPodUpdateShouldSyncEgress(t *testing.T) {
11951204
{Pod: &cpv1b2.PodReference{Name: "pendingPod", Namespace: "ns1"}},
11961205
},
11971206
}
1207+
1208+
egressNodeAvailability = func(egress *crdv1b1.Egress) bool {
1209+
return true
1210+
}
1211+
1212+
defer func() {
1213+
egressNodeAvailability = hasEgressNode
1214+
}()
1215+
11981216
c := newFakeController(t, []runtime.Object{egress})
11991217
stopCh := make(chan struct{})
12001218
defer close(stopCh)
@@ -1327,6 +1345,15 @@ func TestSyncOverlappingEgress(t *testing.T) {
13271345
{Pod: &cpv1b2.PodReference{Name: "pod4", Namespace: "ns4"}},
13281346
},
13291347
}
1348+
1349+
egressNodeAvailability = func(egress *crdv1b1.Egress) bool {
1350+
return true
1351+
}
1352+
1353+
defer func() {
1354+
egressNodeAvailability = hasEgressNode
1355+
}()
1356+
13301357
c := newFakeController(t, []runtime.Object{egress1, egress2, egress3})
13311358
stopCh := make(chan struct{})
13321359
defer close(stopCh)

‎pkg/apis/crd/v1beta1/types.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -1004,7 +1004,8 @@ type EgressSpec struct {
10041004
// Cannot be set with ExternalIPPool.
10051005
ExternalIPPools []string `json:"externalIPPools,omitempty"`
10061006
// Bandwidth specifies the rate limit of north-south egress traffic of this Egress.
1007-
Bandwidth *Bandwidth `json:"bandwidth,omitempty"`
1007+
Bandwidth *Bandwidth `json:"bandwidth,omitempty"`
1008+
StrictEnforcement bool `json:"strictEnforcement"`
10081009
}
10091010

10101011
type Bandwidth struct {

‎pkg/apiserver/openapi/zz_generated.openapi.go

+9-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)