bug: fixing `running antrea-controller --version "outside of K8s" print warnings` #5993

prakrit55 · 2024-02-15T07:29:07Z

added a function getAntreaAgentServiceAccount() which fixes the warnings outside k8s

kubectl exec -it antrea-controller-6b554d9c74-l9ms2 -n kube-system -- /bin/bash root@kind-worker:/# antrea-controller --version
antrea-controller version v2.0.0-dev-43ee1f47 linux/amd64 go1.21.7

docker run antrea/antrea-controller-ubuntu:v2.0.0-dev-43ee1f47 antrea-controll er --version antrea-controller version v2.0.0-dev-43ee1f47 linux/amd64 go1.21.7

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas · 2024-02-15T18:26:38Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

@@ -54,6 +49,22 @@ var ipsecTunnelUsages = sets.New[string](

 var _ approver = (*ipsecCSRApprover)(nil)

+func getAntreaAgentServiceAccount() string {


the function implementation is not correct. If the absence of a POD_NAMESPACE env variable, using kube-system as the default is what we want

the function should just preserve the existing behavior return:

strings.Join([]string{ "system", "serviceaccount", env.GetAntreaNamespace(), "antrea-agent", }, ":")

Hey @antoninbas, need a reconfirmation, here the logic was to see if the namespace is present or not, obviously its absence as a container but as in a pod it would definitely have one. So, in pod it will peacefully execute the env.GetAntreaNamespace() but in container it wont have it and give the warnings. WDYS

the main case scenario in which the namespace is not defined is for unit tests, in this case we prefer to default to kube-system
it may also apply when running the antrea agent in a "simulator" context, outside of a K8s Node. In this case, we also prefer to default to kube-system IMO

antoninbas · 2024-02-15T18:29:43Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

@@ -123,7 +134,7 @@ func (ic *ipsecCSRApprover) verifyCertificateRequest(req *x509.CertificateReques
 }

 func (ic *ipsecCSRApprover) verifyIdentity(nodeName string, csr *certificatesv1.CertificateSigningRequest) error {
-	if csr.Spec.Username != antreaAgentServiceAccountName {
+	if csr.Spec.Username != getAntreaAgentServiceAccount() {


Even though I don't think that verifyIdentity is called very often, we may want to just add antreaAgentServiceAccountName as a field to the ipsecCSRApprover struct, and initialize the field by calling getAntreaAgentServiceAccount() when we instantiate ipsecCSRApprover objects. It may be a good idea to have a newIPsecCSRApprover helper function to instantiate.

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas · 2024-02-20T21:20:41Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

@@ -123,7 +126,7 @@ func (ic *ipsecCSRApprover) verifyCertificateRequest(req *x509.CertificateReques
 }

 func (ic *ipsecCSRApprover) verifyIdentity(nodeName string, csr *certificatesv1.CertificateSigningRequest) error {
-	if csr.Spec.Username != antreaAgentServiceAccountName {
+	if csr.Spec.Username != ic.getAntreaAgentServiceAccount() {


this should be csr.Spec.Username != ic. antreaAgentServiceAccountName

antoninbas · 2024-02-20T21:21:48Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

@@ -54,6 +49,14 @@ var ipsecTunnelUsages = sets.New[string](

 var _ approver = (*ipsecCSRApprover)(nil)

+func (ic *ipsecCSRApprover) getAntreaAgentServiceAccount() string {


this should not be a member function
and ic.antreaAgentServiceAccountName should be populated (by calling getAntreaAgentServiceAccount()) as part of a new "constructor", newIPsecCSRApprover, as I pointed out in my earlier review

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas · 2024-02-21T18:48:51Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

+func newIPsecCSRApprover() *ipsecCSRApprover {
+	return &ipsecCSRApprover{
+		antreaAgentServiceAccountName: getAntreaAgentServiceAccount(),
+	}
+}


this should be:

func newIPsecCSRApprover(client clientset.Interface) *ipsecCSRApprover { return &ipsecCSRApprover{ client: client, antreaAgentServiceAccountName: getAntreaAgentServiceAccount(), } }

antoninbas · 2024-02-21T18:50:13Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

@@ -123,7 +132,8 @@ func (ic *ipsecCSRApprover) verifyCertificateRequest(req *x509.CertificateReques
 }

 func (ic *ipsecCSRApprover) verifyIdentity(nodeName string, csr *certificatesv1.CertificateSigningRequest) error {
-	if csr.Spec.Username != antreaAgentServiceAccountName {
+	c := newIPsecCSRApprover()


the constructor should not be called here
you need to find all places where ipsecCSRApprover is instantiated directly using &ipsecCSRApprover{...}, and replace them with calls to newIPsecCSRApprover(...).

abasSMD6R:antrea abas$ git grep "&ipsecCSRApprover" pkg/controller/certificatesigningrequest/approving_controller.go: &ipsecCSRApprover{ pkg/controller/certificatesigningrequest/ipsec_csr_approver_test.go: ic := &ipsecCSRApprover{ pkg/controller/certificatesigningrequest/ipsec_csr_approver_test.go: ic := &ipsecCSRApprover{ pkg/controller/certificatesigningrequest/ipsec_csr_approver_test.go: ic := &ipsecCSRApprover{ pkg/controller/certificatesigningrequest/ipsec_csr_approver_test.go: ic := &ipsecCSRApprover{

antoninbas · 2024-02-21T18:50:52Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

@@ -123,7 +132,8 @@ func (ic *ipsecCSRApprover) verifyCertificateRequest(req *x509.CertificateReques
 }

 func (ic *ipsecCSRApprover) verifyIdentity(nodeName string, csr *certificatesv1.CertificateSigningRequest) error {
-	if csr.Spec.Username != antreaAgentServiceAccountName {
+	c := newIPsecCSRApprover()


you are creating a new instance of `ipsecCSRApprover, this is not right

will revert and fix : )

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas

one small nit, otherwise LGTM

antoninbas · 2024-02-22T04:08:10Z

pkg/controller/certificatesigningrequest/ipsec_csr_approver.go

+	agentServiceAccountName := strings.Join([]string{
+		"system", "serviceaccount", env.GetAntreaNamespace(), "antrea-agent",
+	}, ":")
+
+	return agentServiceAccountName


nit: it would be more concise not to define an extra variable. You can just return strings.Join(...)

oh I get it

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas · 2024-02-22T04:46:39Z

/test-all

bug: fixing unwanted warnings outside k8s environment

db9e800

Signed-off-by: Griffin <prakritimandal611@gmail.com>

prakrit55 changed the title ~~bug: fixing unwanted warnings outside k8s environment~~ bug: fixing running antrea-controller --version "outside of K8s" print warnings Feb 15, 2024

antoninbas reviewed Feb 15, 2024

View reviewed changes

configured the function

e4f48e7

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas reviewed Feb 20, 2024

View reviewed changes

fix: added constructor newIPsecCSRApprover constructor

6f76989

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas reviewed Feb 21, 2024

View reviewed changes

fix: instantiated constructor

1bcd7f8

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas reviewed Feb 22, 2024

View reviewed changes

clean up

ef7d6bf

Signed-off-by: Griffin <prakritimandal611@gmail.com>

antoninbas approved these changes Feb 22, 2024

View reviewed changes

antoninbas merged commit d7355e8 into antrea-io:main Feb 22, 2024
51 of 54 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bug: fixing `running antrea-controller --version "outside of K8s" print warnings` #5993

bug: fixing `running antrea-controller --version "outside of K8s" print warnings` #5993

prakrit55 commented Feb 15, 2024

antoninbas Feb 15, 2024

prakrit55 Feb 17, 2024

antoninbas Feb 20, 2024

antoninbas Feb 15, 2024

antoninbas Feb 20, 2024

antoninbas Feb 20, 2024

prakrit55 Feb 21, 2024

antoninbas Feb 21, 2024

antoninbas Feb 21, 2024

prakrit55 Feb 22, 2024

antoninbas Feb 21, 2024

prakrit55 Feb 22, 2024

antoninbas left a comment

antoninbas Feb 22, 2024 •

edited

Loading

prakrit55 Feb 22, 2024

antoninbas commented Feb 22, 2024

		@@ -54,6 +49,22 @@ var ipsecTunnelUsages = sets.New[string](

		var _ approver = (*ipsecCSRApprover)(nil)

		func getAntreaAgentServiceAccount() string {

		@@ -54,6 +49,14 @@ var ipsecTunnelUsages = sets.New[string](

		var _ approver = (*ipsecCSRApprover)(nil)

		func (ic *ipsecCSRApprover) getAntreaAgentServiceAccount() string {

bug: fixing running antrea-controller --version "outside of K8s" print warnings #5993

bug: fixing running antrea-controller --version "outside of K8s" print warnings #5993

Conversation

prakrit55 commented Feb 15, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas left a comment

Choose a reason for hiding this comment

antoninbas Feb 22, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas commented Feb 22, 2024

bug: fixing `running antrea-controller --version "outside of K8s" print warnings` #5993

bug: fixing `running antrea-controller --version "outside of K8s" print warnings` #5993

antoninbas Feb 22, 2024 •

edited

Loading