Skip to content

Commit 7079242

Browse files
tpantelisskitt
tpantelis
authored and
skitt
committed
Configure packefilter driver via ConfigMap setting
Signed-off-by: Tom Pantelis <[email protected]>
1 parent 9bf7169 commit 7079242

File tree

7 files changed

+212
-19
lines changed

7 files changed

+212
-19
lines changed

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ require (
1414
github.com/projectcalico/api v0.0.0-20230602153125-fb7148692637
1515
github.com/prometheus-community/pro-bing v0.6.1
1616
github.com/prometheus/client_golang v1.21.0
17-
github.com/submariner-io/admiral v0.21.0-m0
17+
github.com/submariner-io/admiral v0.21.0-m0.0.20250310100633-0c3e8c111df1
1818
github.com/submariner-io/shipyard v0.21.0-m0
1919
github.com/vishvananda/netlink v1.3.0
2020
golang.org/x/net v0.35.0

‎go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,8 +441,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
441441
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
442442
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
443443
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
444-
github.com/submariner-io/admiral v0.21.0-m0 h1:KKni3XSZDxXzGwhsqVza3z634TfUCnrLhuz81S3cdeo=
445-
github.com/submariner-io/admiral v0.21.0-m0/go.mod h1:vgTpeAcKCgVXHJeDQErVglJCKP8Ng5vJQglZqucIcWA=
444+
github.com/submariner-io/admiral v0.21.0-m0.0.20250310100633-0c3e8c111df1 h1:Esl5Hyt4pCyW5f/fnv2Q3EyDoQVx6fzS0wfjqi1NRuI=
445+
github.com/submariner-io/admiral v0.21.0-m0.0.20250310100633-0c3e8c111df1/go.mod h1:vgTpeAcKCgVXHJeDQErVglJCKP8Ng5vJQglZqucIcWA=
446446
github.com/submariner-io/shipyard v0.21.0-m0 h1:5xVQ5yyEN3mlpcl23nfiG2rr1vkKlDu2imyRGa8sN9c=
447447
github.com/submariner-io/shipyard v0.21.0-m0/go.mod h1:JQ65yiYy8r/B6thPkG1QW/AgDtXoL0lw7fylzfIjG08=
448448
github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=

‎pkg/globalnet/main.go

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,19 @@ import (
2525
"time"
2626

2727
"github.com/kelseyhightower/envconfig"
28+
"github.com/submariner-io/admiral/pkg/configmap"
2829
"github.com/submariner-io/admiral/pkg/http"
2930
"github.com/submariner-io/admiral/pkg/log"
3031
"github.com/submariner-io/admiral/pkg/log/kzerolog"
3132
"github.com/submariner-io/admiral/pkg/names"
33+
"github.com/submariner-io/admiral/pkg/resource"
3234
"github.com/submariner-io/admiral/pkg/util"
3335
admversion "github.com/submariner-io/admiral/pkg/version"
3436
submarinerv1 "github.com/submariner-io/submariner/pkg/apis/submariner.io/v1"
3537
"github.com/submariner-io/submariner/pkg/cidr"
3638
submarinerClientset "github.com/submariner-io/submariner/pkg/client/clientset/versioned"
3739
"github.com/submariner-io/submariner/pkg/globalnet/controllers"
38-
"github.com/submariner-io/submariner/pkg/packetfilter"
39-
"github.com/submariner-io/submariner/pkg/packetfilter/iptables"
40+
pfconfigure "github.com/submariner-io/submariner/pkg/packetfilter/configure"
4041
"github.com/submariner-io/submariner/pkg/versions"
4142
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
4243
"k8s.io/client-go/dynamic"
@@ -86,8 +87,14 @@ func main() {
8687
dynClient, err := dynamic.NewForConfig(cfg)
8788
logger.FatalOnError(err, "Unable to create dynamic client")
8889

89-
// Set packetfilter driver to iptables. Once nftables is available, we'll check which driver is supported.
90-
packetfilter.SetNewDriverFn(iptables.New)
90+
// set up signals so we handle the first shutdown signal gracefully
91+
ctx := signals.SetupSignalHandler()
92+
93+
globalConfigMap, err := configmap.Get(ctx, resource.ForConfigMap(k8sClient, spec.Namespace), configmap.Global)
94+
logger.FatalOnError(err, "Error retrieving the global ConfigMap")
95+
96+
err = pfconfigure.DriverFromConfigMap(globalConfigMap)
97+
logger.FatalOnError(err, "Error configuring packet filter driver")
9198

9299
if spec.Uninstall {
93100
logger.Info("Uninstalling submariner-globalnet")
@@ -100,9 +107,6 @@ func main() {
100107

101108
logger.Info("Starting submariner-globalnet", spec)
102109

103-
// set up signals so we handle the first shutdown signal gracefully
104-
ctx := signals.SetupSignalHandler()
105-
106110
defer http.StartServer(http.Metrics|http.Profile, spec.MetricsPort)()
107111

108112
err = mcsv1a1.AddToScheme(scheme.Scheme)

‎pkg/packetfilter/configure/configure.go

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
SPDX-License-Identifier: Apache-2.0
3+
4+
Copyright Contributors to the Submariner project.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package configure
20+
21+
import (
22+
"strconv"
23+
24+
"github.com/pkg/errors"
25+
"github.com/submariner-io/admiral/pkg/log"
26+
"github.com/submariner-io/submariner/pkg/packetfilter"
27+
"github.com/submariner-io/submariner/pkg/packetfilter/iptables"
28+
"github.com/submariner-io/submariner/pkg/packetfilter/nftables"
29+
corev1 "k8s.io/api/core/v1"
30+
logf "sigs.k8s.io/controller-runtime/pkg/log"
31+
)
32+
33+
const UseNftablesKey = "use-nftables"
34+
35+
var logger = log.Logger{Logger: logf.Log.WithName("Packetfilter")}
36+
37+
func DriverFromConfigMap(cm *corev1.ConfigMap) error {
38+
useNftables := false
39+
40+
if cm != nil {
41+
if value, ok := cm.Data[UseNftablesKey]; ok {
42+
var err error
43+
44+
useNftables, err = strconv.ParseBool(value)
45+
if err != nil {
46+
return errors.Wrapf(err, "unable to parse %q from ConfigMap %q", UseNftablesKey, cm.Name)
47+
}
48+
}
49+
}
50+
51+
if useNftables {
52+
logger.Info("Using nftables packet filter driver")
53+
packetfilter.SetNewDriverFn(nftables.New)
54+
} else {
55+
logger.Info("Using iptables packet filter driver")
56+
packetfilter.SetNewDriverFn(iptables.New)
57+
}
58+
59+
return nil
60+
}

‎pkg/packetfilter/configure/configure_suite_test.go

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
/*
2+
SPDX-License-Identifier: Apache-2.0
3+
4+
Copyright Contributors to the Submariner project.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package configure_test
20+
21+
import (
22+
"fmt"
23+
"testing"
24+
25+
. "github.com/onsi/ginkgo/v2"
26+
. "github.com/onsi/gomega"
27+
"github.com/submariner-io/submariner/pkg/packetfilter"
28+
"github.com/submariner-io/submariner/pkg/packetfilter/configure"
29+
"github.com/submariner-io/submariner/pkg/packetfilter/iptables"
30+
"github.com/submariner-io/submariner/pkg/packetfilter/nftables"
31+
corev1 "k8s.io/api/core/v1"
32+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
33+
)
34+
35+
type DriverType int
36+
37+
const (
38+
IPTables DriverType = iota
39+
NfTables
40+
)
41+
42+
const defaultDriver = IPTables
43+
44+
var _ = Describe("DriverFromConfigMap", func() {
45+
var cm *corev1.ConfigMap
46+
47+
BeforeEach(func() {
48+
cm = &corev1.ConfigMap{
49+
ObjectMeta: metav1.ObjectMeta{
50+
Name: "config",
51+
},
52+
Data: map[string]string{},
53+
}
54+
})
55+
56+
When(configure.UseNftablesKey+" key is present", func() {
57+
Context("and set to true", func() {
58+
It("should set the nftables driver", func() {
59+
cm.Data[configure.UseNftablesKey] = "true"
60+
Expect(configure.DriverFromConfigMap(cm)).To(Succeed())
61+
verifyDriverFn(NfTables)
62+
})
63+
})
64+
65+
Context("and set to false", func() {
66+
It("should set the iptables driver", func() {
67+
cm.Data[configure.UseNftablesKey] = "false"
68+
Expect(configure.DriverFromConfigMap(cm)).To(Succeed())
69+
verifyDriverFn(IPTables)
70+
})
71+
})
72+
})
73+
74+
When(configure.UseNftablesKey+" key is not present", func() {
75+
It("should set the default driver", func() {
76+
Expect(configure.DriverFromConfigMap(cm)).To(Succeed())
77+
verifyDriverFn(defaultDriver)
78+
})
79+
})
80+
81+
When("the Data map is nil", func() {
82+
It("should set the default driver", func() {
83+
cm.Data = nil
84+
Expect(configure.DriverFromConfigMap(cm)).To(Succeed())
85+
verifyDriverFn(defaultDriver)
86+
})
87+
})
88+
89+
When(configure.UseNftablesKey+" key value is invalid", func() {
90+
It("should return an error", func() {
91+
cm.Data[configure.UseNftablesKey] = "bogus"
92+
Expect(configure.DriverFromConfigMap(cm)).ToNot(Succeed())
93+
})
94+
})
95+
96+
When("the ConfigMap is nil", func() {
97+
It("should set the default driver", func() {
98+
Expect(configure.DriverFromConfigMap(nil)).To(Succeed())
99+
verifyDriverFn(defaultDriver)
100+
})
101+
})
102+
})
103+
104+
func verifyDriverFn(dType DriverType) {
105+
fnValue := func(v interface{}) string {
106+
return fmt.Sprintf("%v", v)
107+
}
108+
109+
if dType == NfTables {
110+
Expect(fnValue(packetfilter.GetNewDriverFn())).To(Equal(fnValue(nftables.New)))
111+
} else {
112+
Expect(fnValue(packetfilter.GetNewDriverFn())).To(Equal(fnValue(iptables.New)))
113+
}
114+
}
115+
116+
func TestConfigure(t *testing.T) {
117+
RegisterFailHandler(Fail)
118+
RunSpecs(t, "Configure Suite")
119+
}

‎pkg/packetfilter/packetfilter.go

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -308,16 +308,22 @@ type Interface interface {
308308
UpdateChainRules(table TableType, chain string, rules []*Rule) error
309309
}
310310

311+
type DriverFn func() (Driver, error)
312+
311313
var (
312-
newDriverFn func() (Driver, error)
313-
newDriverFnV6 func() (Driver, error)
314+
newDriverFn DriverFn
315+
newDriverFnV6 DriverFn
314316
)
315317

316-
func SetNewDriverFn(f func() (Driver, error)) {
318+
func SetNewDriverFn(f DriverFn) {
317319
newDriverFn = f
318320
}
319321

320-
func SetNewDriverFnV6(f func() (Driver, error)) {
322+
func GetNewDriverFn() DriverFn {
323+
return newDriverFn
324+
}
325+
326+
func SetNewDriverFnV6(f DriverFn) {
321327
newDriverFnV6 = f
322328
}
323329

‎pkg/routeagent_driver/main.go

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,21 +27,22 @@ import (
2727

2828
"github.com/kelseyhightower/envconfig"
2929
"github.com/pkg/errors"
30+
"github.com/submariner-io/admiral/pkg/configmap"
3031
"github.com/submariner-io/admiral/pkg/http"
3132
"github.com/submariner-io/admiral/pkg/log"
3233
"github.com/submariner-io/admiral/pkg/log/kzerolog"
3334
"github.com/submariner-io/admiral/pkg/names"
35+
"github.com/submariner-io/admiral/pkg/resource"
3436
"github.com/submariner-io/admiral/pkg/util"
3537
admversion "github.com/submariner-io/admiral/pkg/version"
3638
"github.com/submariner-io/admiral/pkg/watcher"
3739
v1 "github.com/submariner-io/submariner/pkg/apis/submariner.io/v1"
3840
submarinerClientset "github.com/submariner-io/submariner/pkg/client/clientset/versioned"
39-
cni "github.com/submariner-io/submariner/pkg/cni"
41+
"github.com/submariner-io/submariner/pkg/cni"
4042
"github.com/submariner-io/submariner/pkg/event"
4143
"github.com/submariner-io/submariner/pkg/event/controller"
4244
"github.com/submariner-io/submariner/pkg/node"
43-
packetfilter "github.com/submariner-io/submariner/pkg/packetfilter"
44-
iptables "github.com/submariner-io/submariner/pkg/packetfilter/iptables"
45+
pfconfigure "github.com/submariner-io/submariner/pkg/packetfilter/configure"
4546
"github.com/submariner-io/submariner/pkg/routeagent_driver/cabledriver"
4647
"github.com/submariner-io/submariner/pkg/routeagent_driver/environment"
4748
"github.com/submariner-io/submariner/pkg/routeagent_driver/handlers/calico"
@@ -111,8 +112,11 @@ func main() {
111112
restMapper, err := util.BuildRestMapper(cfg)
112113
logger.FatalOnError(err, "Error building the REST mapper")
113114

114-
// Set packetfilter driver to iptables. Once nftables is available, we'll check which driver is supported.
115-
packetfilter.SetNewDriverFn(iptables.New)
115+
globalConfigMap, err := configmap.Get(ctx, resource.ForConfigMap(k8sClientSet, env.Namespace), configmap.Global)
116+
logger.FatalOnError(err, "Error retrieving the global ConfigMap")
117+
118+
err = pfconfigure.DriverFromConfigMap(globalConfigMap)
119+
logger.FatalOnError(err, "Error configuring packet filter driver")
116120

117121
np := os.Getenv("SUBMARINER_NETWORKPLUGIN")
118122

0 commit comments

Comments
 (0)