[Multicast] Add precheck on the encryption mode configurations

Mutlicast feature can't work with WireGuard or IPSec configurations with encap
mode. It will return error when Multicast feature gate is enabled and either
Wireguard or IPSec is configured in the initial validations.

Signed-off-by: wenyingd <wenyingd@vmware.com>

build/yamls/chart-values/antrea-ipsec.yml

@@ -1,3 +1,5 @@
 trafficEncryptionMode: "ipsec"
 # change the tunnel type to GRE which works better with IPsec encryption than other types.
 tunnelType: "gre"
+multicast:
+  enabled: false

cmd/antrea-agent/options.go

@@ -320,9 +320,12 @@ func (o *Options) validateFlowExporterConfig() error {
 	return nil
 }
 
-func (o *Options) validateMulticastConfig() error {
-	if features.DefaultFeatureGate.Enabled(features.Multicast) {
+func (o *Options) validateMulticastConfig(encryptionMode config.TrafficEncryptionModeType) error {
+	if features.DefaultFeatureGate.Enabled(features.Multicast) && o.config.Multicast.Enable {
 		var err error
+		if encryptionMode != config.TrafficEncryptionModeNone {
+			return fmt.Errorf("multicast feature doesn't work with the current encryption mode '%s'", encryptionMode)
+		}
 		if o.config.Multicast.IGMPQueryInterval != "" {
 			o.igmpQueryInterval, err = time.ParseDuration(o.config.Multicast.IGMPQueryInterval)
 			if err != nil {
@@ -584,7 +587,7 @@ func (o *Options) validateK8sNodeOptions() error {
 	if err := o.validateFlowExporterConfig(); err != nil {
 		return fmt.Errorf("failed to validate flow exporter config: %v", err)
 	}
-	if err := o.validateMulticastConfig(); err != nil {
+	if err := o.validateMulticastConfig(encryptionMode); err != nil {
 		return fmt.Errorf("failed to validate multicast config: %v", err)
 	}
 	if err := o.validateEgressConfig(encapMode); err != nil {

cmd/antrea-agent/options_linux_test.go

@@ -102,7 +102,7 @@ func TestMulticlusterOptions(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			config := &agentconfig.AgentConfig{
-				FeatureGates:     map[string]bool{"Multicluster": tt.featureGate},
+				FeatureGates:     map[string]bool{"Multicluster": tt.featureGate, "Multicast": false},
 				TrafficEncapMode: tt.encapMode,
 				Multicluster:     tt.mcConfig,
 			}

cmd/antrea-agent/options_test.go

@@ -219,18 +219,42 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 	tests := []struct {
 		name              string
 		igmpQueryVersions []int
+		encryptionMode    config.TrafficEncryptionModeType
 		expectedErr       error
 		expectedVersions  []uint8
 	}{
 		{
 			name:              "wrong versions",
 			igmpQueryVersions: []int{1, 3, 4},
+			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       fmt.Errorf("igmpQueryVersions should be a subset of [1 2 3]"),
 			expectedVersions:  nil,
 		},
+		{
+			name:              "incorrect encryption mode with IPSec",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeIPSec,
+			expectedErr:       fmt.Errorf("multicast feature doesn't work with the current encryption mode 'IPsec'"),
+			expectedVersions:  nil,
+		},
+		{
+			name:              "incorrect encryption mode with WireGuard",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeWireGuard,
+			expectedErr:       fmt.Errorf("multicast feature doesn't work with the current encryption mode 'WireGuard'"),
+			expectedVersions:  nil,
+		},
+		{
+			name:              "incorrect encryption mode with invalid",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeInvalid,
+			expectedErr:       fmt.Errorf("multicast feature doesn't work with the current encryption mode 'invalid'"),
+			expectedVersions:  nil,
+		},
 		{
 			name:              "no error",
 			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       nil,
 			expectedVersions:  []uint8{1, 2},
 		},
@@ -240,11 +264,14 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 			defer featuregatetesting.SetFeatureGateDuringTest(t, features.DefaultFeatureGate, features.Multicast, true)()
 			o := &Options{config: &agentconfig.AgentConfig{
 				Multicast: agentconfig.MulticastConfig{
+					Enable:            true,
 					IGMPQueryVersions: tt.igmpQueryVersions},
 			}}
-			err := o.validateMulticastConfig()
+			err := o.validateMulticastConfig(tt.encryptionMode)
 			assert.Equal(t, tt.expectedErr, err)
-			assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)
+			if err != nil {
+				assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)
+			}
 		})
 	}
 }

hack/generate-manifest.sh

@@ -250,7 +250,7 @@ fi
 TMP_DIR=$(mktemp -d $THIS_DIR/../build/yamls/chart-values.XXXXXXXX)
 
 if $IPSEC; then
-    HELM_VALUES+=("trafficEncryptionMode=ipsec" "tunnelType=gre")
+    HELM_VALUES+=("multicast.enabled=false" "trafficEncryptionMode=ipsec" "tunnelType=gre")
 fi
 
 if $FLEXIBLE_IPAM; then

test/e2e/wireguard_test.go

@@ -45,16 +45,20 @@ func TestWireGuard(t *testing.T) {
 		skipIfMissingKernelModule(t, data, node.name, []string{"wireguard"})
 	}
 	var previousTrafficEncryptionMode string
+	var previousMulticastEnabledState bool
 	ac := func(config *agentconfig.AgentConfig) {
 		previousTrafficEncryptionMode = config.TrafficEncryptionMode
 		config.TrafficEncryptionMode = "wireguard"
+		previousMulticastEnabledState = config.Multicast.Enable
+		config.Multicast.Enable = false
 	}
 	if err := data.mutateAntreaConfigMap(nil, ac, false, true); err != nil {
 		t.Fatalf("Failed to enable WireGuard tunnel: %v", err)
 	}
 	defer func() {
 		ac := func(config *agentconfig.AgentConfig) {
 			config.TrafficEncryptionMode = previousTrafficEncryptionMode
+			config.Multicast.Enable = previousMulticastEnabledState
 		}
 		if err := data.mutateAntreaConfigMap(nil, ac, false, true); err != nil {
 			t.Errorf("Failed to disable WireGuard tunnel: %v", err)