Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add redirect traffic config and apply it #1432

Merged
merged 10 commits into from
Aug 24, 2022

Conversation

curtbushko
Copy link
Contributor

Changes proposed in this PR:

  • Blatantly most things from Irynas branch
  • Cleaned it up a bit
  • Added tests for redirect traffic and the CNI command

NOTE: CircleCI is failing to build this right now with a weird error (below). I will look at this error when I am back on Thursday. It builds locally for me.

cp: cannot stat '/home/circleci/go/bin//control-plane': No such file or directory

How I've tested this PR:

  • unit tests
  • manually verifying that iptables rules are applied on the kind node

How I expect reviewers to test this PR:

👀

Checklist:

  • Tests added
  • CHANGELOG entry added

    HashiCorp engineers only, community PRs should not add a changelog entry.
    Entries should use present tense (e.g. Add support for...)

@curtbushko curtbushko self-assigned this Aug 17, 2022
@ishustava ishustava changed the base branch from main to cni August 17, 2022 15:13
Copy link
Contributor

@ishustava ishustava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work!! Leaving some comments in-line.

Comment on lines 11 to 15
// If the src file does not exist then either the incorrect command line argument was used or
// the docker container we built is broken somehow.
if _, err := os.Stat(srcFile); os.IsNotExist(err) {
return err
}
Copy link
Contributor

@t-eckert t-eckert Aug 22, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of having this info in a comment, I think it would be valuable to append it to the existing error so that it's useful for debugging.

Suggested change
// If the src file does not exist then either the incorrect command line argument was used or
// the docker container we built is broken somehow.
if _, err := os.Stat(srcFile); os.IsNotExist(err) {
return err
}
// If the src file does not exist then either the incorrect command line argument was used or
// the docker container we built is broken somehow.
if _, err := os.Stat(srcFile); os.IsNotExist(err) {
return fmt.Errorf("%w. Check that the correct command line argument was used and verify that the container image does not contain the source file.", err)
}


// Check if the user bit is enabled in file permission.
if info.Mode().Perm()&(1<<(uint(7))) == 0 {
return fmt.Errorf("cannot write to destination directory %s", destDir)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might change this to say "user does not have permissions to..." so that this doesn't get confused with another failure mode.

Copy link
Contributor

@t-eckert t-eckert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work! Weird that GitHub shows that this PR changes 57 files.

@curtbushko curtbushko force-pushed the curtbushko/cni-redirect-traffic-config branch 2 times, most recently from 8496bd9 to 82e70f6 Compare August 23, 2022 17:41
Copy link
Contributor

@ishustava ishustava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Approving, assuming the init container user will be changed along with the tests for it.

curtbushko and others added 8 commits August 23, 2022 23:24
* Get structure in place and CNI installer & plugin building
* Add file watcher to CNI installer to watch for config file changes and repair breakages.
* Wait for CNI config file to show up on the host file system before attempting to install consul-cni configuration.
* Add some code to get ready for the next PR that applying iptables rules
* Unit tests for installer and plugin scenarios
* Get structure in place and CNI installer & plugin building
* Add file watcher to CNI installer to watch for config file changes and repair breakages.
* Wait for CNI config file to show up on the host file system before attempting to install consul-cni configuration.
* Add some code to get ready for the next PR that applying iptables rules
* Unit tests for installer and plugin scenarios
Add helm charts for CNI installer
* Get structure in place and CNI installer & plugin building
    increase limits for CNI plugin so that it runs on GKE
    add annotations for transparent proxy status (enabled, waiting)
    Initial setup (CNI_ARGS) for getting information to the CNI plugin
    file watcher for config file changes and for when the config file does not exists
    added wait for annotation to be used before applying ipconfig traffic redirection

Co-Authored-By: Thomas Eckert <teckert@hashicorp.com>
…y when a valid annotation is used

Add redirect traffic config and apply it in the plugin
@curtbushko curtbushko force-pushed the curtbushko/cni-redirect-traffic-config branch from 82e70f6 to 9606072 Compare August 24, 2022 03:25
@curtbushko curtbushko merged commit 62edf59 into cni Aug 24, 2022
@curtbushko curtbushko deleted the curtbushko/cni-redirect-traffic-config branch August 24, 2022 13:46
curtbushko added a commit that referenced this pull request Aug 25, 2022
* Add redirect traffic config and apply it
* Unit tests for redirect traffic and webhook changes
curtbushko added a commit that referenced this pull request Aug 26, 2022
* Add redirect traffic config and apply it
* Unit tests for redirect traffic and webhook changes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants