Skip to content

Commit bd090e0

Browse files
yash97sushrkorsenthilGnatorXdependabot[bot]
authored
Updating Release 1.6 branch. (#494)
* remove global exclusion for G108,G114 and add nosec in code (#404) * Update controller_auth_proxy_patch.yaml (#405) Update the reference from gcr.io to registry.k8s.io > kube-rbac-proxy is moving to registry.k8s.io/kubebuilder/kube-rbac-proxy (from gcr.io/kubebuilder/kube-rbac-proxy) because GCR is being sunset. We need to update these references. * Fix log which causes panic (#407) * Fix log which causes panic * Consistent key name * consistent naming * updating ginkgo and gomega * Bump github.com/prometheus/common from 0.51.1 to 0.53.0 Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.51.1 to 0.53.0. - [Release notes](https://github.com/prometheus/common/releases) - [Commits](prometheus/common@v0.51.1...v0.53.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Bump github.com/prometheus/client_model from 0.6.0 to 0.6.1 (#432) Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model) from 0.6.0 to 0.6.1. - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.0...v0.6.1) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/onsi/ginkgo/v2 from 2.17.2 to 2.19.0 (#431) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.17.2 to 2.19.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.17.2...v2.19.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * QPS and busrt adjustment (#436) * readme update for events (#453) * Set controller user-agent to vpc-resource-controller/git-version (#455) * update user-agent string. * Use AppName instead of ControllerName. * Add security group pods scale test in ginkgo (#457) * Add security group pods scale test in ginkgo * Add instructions to run scale tests manually * fix typo in README * Passing page limit to cach config instead of override. (#452) * passing page limit to cache config * adding error log to optimized list watcher * importing vpc pkg * pods will requeue for reconcile if nodes are not managed and requested eni (#463) * pod will requeue for reconcile if nodes are not managed and requested eni * log statement change * looping through all container for eni requests * adding ut for utils function * add CNINode integration tests (#479) * add CNINode integration tests * address PR comments * updating log statements * add retry in VerifyCNINode * Bump go.uber.org/zap from 1.26.0 to 1.27.0 (#480) Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.26.0 to 1.27.0. - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.26.0...v1.27.0) --- updated-dependencies: - dependency-name: go.uber.org/zap dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * increasing timeout for few integration test (#486) * Skipping health check on nodes if EC2 returns throttling errors (#485) * updating limits.go for supported ec2 instance type #491 * Bump github.com/samber/lo from 1.39.0 to 1.47.0 (#481) Bumps [github.com/samber/lo](https://github.com/samber/lo) from 1.39.0 to 1.47.0. - [Release notes](https://github.com/samber/lo/releases) - [Commits](samber/lo@v1.39.0...v1.47.0) --- updated-dependencies: - dependency-name: github.com/samber/lo dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Sushmitha Ravikumar <[email protected]> Co-authored-by: Senthil Kumaran <[email protected]> Co-authored-by: Garvin Pang <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hao Zhou <[email protected]>
1 parent 88956b9 commit bd090e0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1420
-172
lines changed

‎.github/workflows/presubmit.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,5 +67,5 @@ jobs:
6767
- name: Install `gosec`
6868
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
6969
- name: Run Gosec Security Scanner
70-
run: ~/go/bin/gosec -exclude-dir test -exclude-generated -severity medium -exclude=G108,G114 ./...
70+
run: ~/go/bin/gosec -exclude-dir test -exclude-generated -severity medium ./...
7171

‎README.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,16 @@
88

99
Controller running on EKS Control Plane for managing Branch & Trunk Network Interface for [Kubernetes Pod](https://kubernetes.io/docs/concepts/workloads/pods/) using the [Security Group for Pod](https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html) feature and IPv4 Address Management(IPAM) of [Windows Nodes](https://docs.aws.amazon.com/eks/latest/userguide/windows-support.html).
1010

11-
The controller broadcasts its version to nodes. Describing any node will provide the version information in node `Events`. The mapping between the controller's version and the cluster's platform version is also available in release notes.
11+
The controller broadcasts its version to nodes. Describing any node will provide the version information in node `Events`. The mapping between the controller's version and the cluster's platform version is also available in release notes. Please be aware that kubernetes events last for one hour in general and you may have to check the version information events in newly created nodes.
12+
13+
Version events example:
14+
```
15+
Events:
16+
Type Reason Age From Message
17+
---- ------ ---- ---- -------
18+
Normal ControllerVersionNotice 2m58s vpc-resource-controller The node is managed by VPC resource controller version v1.4.9
19+
Normal NodeTrunkInitiated 2m55s vpc-resource-controller The node has trunk interface initialized successfully
20+
```
1221

1322
## Security Group for Pods
1423

‎config/default/controller_auth_proxy_patch.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ spec:
1010
spec:
1111
containers:
1212
- name: kube-rbac-proxy
13-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
13+
image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.5.0
1414
args:
1515
- "--secure-listen-address=0.0.0.0:8443"
1616
- "--upstream=http://127.0.0.1:8080/"

‎controllers/core/node_controller.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,12 @@ func (r *NodeReconciler) Check() healthz.Checker {
168168
return nil
169169
}
170170

171+
if r.Manager.SkipHealthCheck() {
172+
// node manager observes EC2 error on processing node, pausing reconciler check to avoid stressing the system
173+
r.Log.Info("due to EC2 error, node controller skips node reconciler health check for now")
174+
return nil
175+
}
176+
171177
err := rcHealthz.PingWithTimeout(func(c chan<- error) {
172178
// when the reconciler is ready, testing the reconciler with a fake node request
173179
pingRequest := &ctrl.Request{

‎controllers/core/pod_controller.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"github.com/aws/amazon-vpc-resource-controller-k8s/pkg/node"
2828
"github.com/aws/amazon-vpc-resource-controller-k8s/pkg/node/manager"
2929
"github.com/aws/amazon-vpc-resource-controller-k8s/pkg/resource"
30+
"github.com/aws/amazon-vpc-resource-controller-k8s/pkg/utils"
3031
"github.com/google/uuid"
3132

3233
"github.com/go-logr/logr"
@@ -56,7 +57,7 @@ type PodReconciler struct {
5657

5758
var (
5859
PodRequeueRequest = ctrl.Result{Requeue: true, RequeueAfter: time.Second}
59-
MaxPodConcurrentReconciles = 10
60+
MaxPodConcurrentReconciles = 20
6061
)
6162

6263
// Reconcile handles create/update/delete event by delegating the request to the handler
@@ -112,6 +113,10 @@ func (r *PodReconciler) Reconcile(request custom.Request) (ctrl.Result, error) {
112113
logger.V(1).Info("pod's node is not yet initialized by the manager, will retry", "Requested", request.NamespacedName.String(), "Cached pod name", pod.ObjectMeta.Name, "Cached pod namespace", pod.ObjectMeta.Namespace)
113114
return PodRequeueRequest, nil
114115
} else if !node.IsManaged() {
116+
if utils.PodHasENIRequest(pod) {
117+
r.Log.Info("pod's node is not managed, but has eni request, will retry", "Requested", request.NamespacedName.String(), "Cached pod name", pod.ObjectMeta.Name, "Cached pod namespace", pod.ObjectMeta.Namespace)
118+
return PodRequeueRequest, nil
119+
}
115120
logger.V(1).Info("pod's node is not managed, skipping pod event", "Requested", request.NamespacedName.String(), "Cached pod name", pod.ObjectMeta.Name, "Cached pod namespace", pod.ObjectMeta.Namespace)
116121
return ctrl.Result{}, nil
117122
} else if !node.IsReady() {

‎controllers/core/pod_controller_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ package controllers
1616
import (
1717
"errors"
1818
"testing"
19+
"time"
1920

2021
"github.com/aws/amazon-vpc-resource-controller-k8s/controllers/custom"
2122
mock_condition "github.com/aws/amazon-vpc-resource-controller-k8s/mocks/amazon-vcp-resource-controller-k8s/pkg/condition"
@@ -188,7 +189,7 @@ func TestPodReconciler_Reconcile_NonManaged(t *testing.T) {
188189

189190
result, err := mock.PodReconciler.Reconcile(mockReq)
190191
assert.NoError(t, err)
191-
assert.Equal(t, result, controllerruntime.Result{})
192+
assert.Equal(t, controllerruntime.Result{Requeue: true, RequeueAfter: time.Second}, result)
192193
}
193194

194195
// TestPodReconciler_Reconcile_NoNodeAssigned tests that the request for a Pod with no Node assigned

‎controllers/custom/builder.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -113,15 +113,16 @@ func (b *Builder) Complete(reconciler Reconciler) (healthz.Checker, error) {
113113
workqueue.DefaultControllerRateLimiter(), b.options.Name)
114114

115115
optimizedListWatch := newOptimizedListWatcher(b.ctx, b.clientSet.CoreV1().RESTClient(),
116-
b.converter.Resource(), b.options.Namespace, b.options.PageLimit, b.converter)
116+
b.converter.Resource(), b.options.Namespace, b.converter, b.log.WithName("listWatcher"))
117117

118118
// Create the config for low level controller with the custom converter
119119
// list and watch
120120
config := &cache.Config{
121-
Queue: cache.NewDeltaFIFO(b.converter.Indexer, b.dataStore),
122-
ListerWatcher: optimizedListWatch,
123-
ObjectType: b.converter.ResourceType(),
124-
FullResyncPeriod: b.options.ResyncPeriod,
121+
Queue: cache.NewDeltaFIFO(b.converter.Indexer, b.dataStore),
122+
ListerWatcher: optimizedListWatch,
123+
WatchListPageSize: int64(b.options.PageLimit),
124+
ObjectType: b.converter.ResourceType(),
125+
FullResyncPeriod: b.options.ResyncPeriod,
125126
Process: func(obj interface{}, _ bool) error {
126127
// from oldest to newest
127128
for _, d := range obj.(cache.Deltas) {

‎controllers/custom/custom_controller.go

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121

2222
"github.com/aws/amazon-vpc-resource-controller-k8s/pkg/condition"
2323
"github.com/go-logr/logr"
24+
apierrors "k8s.io/apimachinery/pkg/api/errors"
2425
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2526
"k8s.io/apimachinery/pkg/runtime"
2627
"k8s.io/apimachinery/pkg/types"
@@ -178,23 +179,26 @@ func (c *CustomController) WaitForCacheSync(controller cache.Controller) {
178179

179180
// newOptimizedListWatcher returns a list watcher with a custom list function that converts the
180181
// response for each page using the converter function and returns a general watcher
181-
func newOptimizedListWatcher(ctx context.Context, restClient cache.Getter, resource string, namespace string, limit int,
182-
converter Converter) *cache.ListWatch {
182+
func newOptimizedListWatcher(ctx context.Context, restClient cache.Getter, resource string, namespace string,
183+
converter Converter, log logr.Logger) *cache.ListWatch {
183184

184185
listFunc := func(options metav1.ListOptions) (runtime.Object, error) {
185186
list, err := restClient.Get().
186187
Namespace(namespace).
187188
Resource(resource).
188-
// This needs to be done because just setting the limit using option's
189-
// Limit is being overridden and the response is returned without pagination.
190189
VersionedParams(&metav1.ListOptions{
191-
Limit: int64(limit),
190+
Limit: options.Limit,
192191
Continue: options.Continue,
193192
}, metav1.ParameterCodec).
194193
Do(ctx).
195194
Get()
196195
if err != nil {
197-
return list, err
196+
if statusErr, ok := err.(*apierrors.StatusError); ok {
197+
log.Error(err, "List operation error", "code", statusErr.Status().Code)
198+
} else {
199+
log.Error(err, "List operation error")
200+
}
201+
return nil, err
198202
}
199203
// Strip down the the list before passing the paginated response back to
200204
// the pager function
@@ -206,11 +210,20 @@ func newOptimizedListWatcher(ctx context.Context, restClient cache.Getter, resou
206210
// before storing the object in the data store.
207211
watchFunc := func(options metav1.ListOptions) (watch.Interface, error) {
208212
options.Watch = true
209-
return restClient.Get().
213+
watch, err := restClient.Get().
210214
Namespace(namespace).
211215
Resource(resource).
212216
VersionedParams(&options, metav1.ParameterCodec).
213217
Watch(ctx)
218+
if err != nil {
219+
if statusErr, ok := err.(*apierrors.StatusError); ok {
220+
log.Error(err, "Watch operation error", "code", statusErr.Status().Code)
221+
} else {
222+
log.Error(err, "Watch operation error")
223+
}
224+
return nil, err
225+
}
226+
return watch, err
214227
}
215228
return &cache.ListWatch{ListFunc: listFunc, WatchFunc: watchFunc}
216229
}

‎go.mod

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,14 @@ require (
99
github.com/go-logr/zapr v1.3.0
1010
github.com/golang/mock v1.6.0
1111
github.com/google/uuid v1.6.0
12-
github.com/onsi/ginkgo/v2 v2.17.1
13-
github.com/onsi/gomega v1.31.1
12+
github.com/onsi/ginkgo/v2 v2.19.0
13+
github.com/onsi/gomega v1.33.1
1414
github.com/pkg/errors v0.9.1
1515
github.com/prometheus/client_golang v1.19.0
16-
github.com/prometheus/client_model v0.6.0
17-
github.com/prometheus/common v0.52.2
16+
github.com/prometheus/client_model v0.6.1
17+
github.com/prometheus/common v0.53.0
1818
github.com/stretchr/testify v1.9.0
19-
go.uber.org/zap v1.26.0
19+
go.uber.org/zap v1.27.0
2020
golang.org/x/time v0.5.0
2121
gomodules.xyz/jsonpatch/v2 v2.4.0
2222
k8s.io/api v0.29.3
@@ -26,6 +26,7 @@ require (
2626
)
2727

2828
require (
29+
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
2930
github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
3031
github.com/gorilla/websocket v1.5.0 // indirect
3132
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
@@ -42,13 +43,12 @@ require (
4243
github.com/go-openapi/jsonpointer v0.19.6 // indirect
4344
github.com/go-openapi/jsonreference v0.20.2 // indirect
4445
github.com/go-openapi/swag v0.22.3 // indirect
45-
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
4646
github.com/gogo/protobuf v1.3.2 // indirect
4747
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4848
github.com/golang/protobuf v1.5.4 // indirect
4949
github.com/google/go-cmp v0.6.0 // indirect
5050
github.com/google/gofuzz v1.2.0 // indirect
51-
github.com/google/pprof v0.0.0-20230323073829-e72429f035bd // indirect
51+
github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect
5252
github.com/imdario/mergo v0.3.13 // indirect
5353
github.com/jmespath/go-jmespath v0.4.0 // indirect
5454
github.com/josharian/intern v1.0.0 // indirect
@@ -60,16 +60,16 @@ require (
6060
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
6161
github.com/pmezard/go-difflib v1.0.0 // indirect
6262
github.com/prometheus/procfs v0.12.0 // indirect
63-
github.com/samber/lo v1.39.0
63+
github.com/samber/lo v1.47.0
6464
github.com/spf13/pflag v1.0.5 // indirect
6565
go.uber.org/multierr v1.11.0 // indirect
6666
golang.org/x/exp v0.0.0-20231006140011-7918f672742d
67-
golang.org/x/net v0.23.0 // indirect
67+
golang.org/x/net v0.25.0 // indirect
6868
golang.org/x/oauth2 v0.18.0 // indirect
69-
golang.org/x/sys v0.18.0 // indirect
70-
golang.org/x/term v0.18.0 // indirect
71-
golang.org/x/text v0.14.0 // indirect
72-
golang.org/x/tools v0.17.0 // indirect
69+
golang.org/x/sys v0.20.0 // indirect
70+
golang.org/x/term v0.20.0 // indirect
71+
golang.org/x/text v0.16.0 // indirect
72+
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
7373
google.golang.org/appengine v1.6.8 // indirect
7474
google.golang.org/protobuf v1.33.0 // indirect
7575
gopkg.in/inf.v0 v0.9.1 // indirect

0 commit comments

Comments
 (0)