[Bugfix] Install Multicast related iptables rules only on IPv4 chains #6123

wenyingd · 2024-03-20T03:28:10Z

Add a precheck on the Multicast feature gate status with IPv6-only cluster settings in agent Initializer, and install the iptables rules only in the IPv4 related chains.

Fix: #6113

wenyingd · 2024-03-20T07:33:12Z

/test-all

wenyingd · 2024-03-21T05:29:33Z

/test-ipv6-e2e
/test-ipv6-only-conformance
/test-multicluster-e2e

antoninbas

The PR should close #6113 IMO. We can open another issue to track Multicast IPv6 support.

antoninbas · 2024-03-21T16:11:30Z

pkg/agent/agent.go

@@ -130,6 +130,7 @@ type Initializer struct {
 	enableL7FlowExporter  bool
 	connectUplinkToBridge bool
 	enableAntreaProxy     bool
+	enableMulticast       bool


what there an issue with doing the check in mcastController.Initialize to avoid adding this field?

I used to think about placing the check at the step before constructing multicastController instance, then some initial configurations may already be performed at that time, like OpenFlow, routes, cniserver, which seems obey the thought that block at the beginning when configurations is not correct.

I agree with @antoninbas. Other than the validation performed in startup stage, other validation logic should be put in its own module to better encapsulate the specific logic, instead of spreading the logic among multiple places, each of which does a piece of the whole.

Generically, we should avoid making a "common" module include unrelated responsibilies. I'm not sure if AgentInitializer's responsibity is really clear today, but my understanding and expectation is that it is a module that initializes the bridge and the host network, not a validator for other modules.

Think about which is easier to maintain when doing something around Multicast:

add the static config handling in option.go, add runtime config validation in AgentInitializer, then add initialization error handling in Multicast controller

add the static config handling in option.go, add other handling in Multicast controller

And consider what if a config can only be validated after you have made some system calls or API calls, it would be bad to move such business specific system calls or API calls to something like AgentInitializer.

Lastly, it's less redundant to have the validation in multicast controller itself because it doesn't have to check again whether the feature is enabled when doing the validation (the validation doesn't need to run when it's disabled).

Got it, I will update accordingly.

pkg/agent/multicast/mcast_controller.go

wenyingd · 2024-03-25T05:35:08Z

/test-all

tnqn · 2024-03-25T10:14:32Z

pkg/agent/route/route_linux.go

@@ -128,8 +128,6 @@ type Client struct {
 	nodePortsIPv6 sync.Map
 	// clusterNodeIPs stores the IPv4 of all other Nodes in the cluster
 	clusterNodeIPs sync.Map
-	// clusterNodeIP6s stores the IPv6 of all other Nodes in the cluster
-	clusterNodeIP6s sync.Map


Do we need clusterNodeIP6s when implementing Multicast for IPv6 in the future?
If yes, perhaps don't remove it, just remove its consumer code and add a comment that it's retained for future Multicast support to avoid back and forth change?

We shall use it in the future after Multicast is supported with IPv6. Do you mean we can keep the publisher to add Node IPv6 address into this map, but not consume the items?

Yes, just add the comment why it's maintained but not used currently.

wenyingd · 2024-03-26T08:15:08Z

/test-all

antoninbas

only minor comments, otherwise LGTM

pkg/agent/multicast/mcast_controller.go

pkg/agent/multicast/mcast_controller_test.go

antoninbas · 2024-03-26T17:19:39Z

pkg/agent/multicast/mcast_controller_test.go

+				mockController.initMocks()
+			}
+			err := mockController.Initialize()
+			require.Equal(t, err, tc.expErr)


should be assert

update with assert.EqualError as suggested.

pkg/agent/route/route_linux.go

antoninbas · 2024-03-27T03:03:56Z

pkg/agent/multicast/mcast_controller_test.go

+		})
+	}
+}
+
 func (c *Controller) initialize(t *testing.T) error {


The t parameter is unused?

yes, removed in the latest change.

antoninbas · 2024-03-27T03:04:24Z

pkg/agent/multicast/mcast_controller_test.go

+			if tc.expErr == "" {
+				mockController.initMocks()
+			}
+			err := mockController.Initialize()


could we just call err := mockController.initialize() unconditionally here?

No, there are some mock functions inside mockController.initialize(), which are called only when mockController.Initialize() returns nil. If we call it (initialize not Initialize) unconditionally, the IPv6-only case would fail as those mock expects are missing.

antoninbas

LGTM

antoninbas · 2024-03-27T17:00:23Z

@wenyingd Please backport when this is merged

antoninbas · 2024-03-27T17:01:13Z

/test-multicast-e2e

wenyingd · 2024-03-28T02:00:27Z

@wenyingd Please backport when this is merged

Sure, I would do it.

tnqn · 2024-03-28T02:23:39Z

pkg/agent/route/route_linux.go

@@ -128,7 +128,8 @@ type Client struct {
 	nodePortsIPv6 sync.Map
 	// clusterNodeIPs stores the IPv4 of all other Nodes in the cluster
 	clusterNodeIPs sync.Map
-	// clusterNodeIP6s stores the IPv6 of all other Nodes in the cluster
+	// clusterNodeIP6s stores the IPv6 address of all other Nodes in the cluster. It is maintained but not consumed
+	// since Multicast supports IPv6.


Suggested change

// since Multicast supports IPv6.

// since Multicast doesn't support IPv6 yet.

I would update it as It is maintained but not consumed until Multicast supports IPv6. It seems I missed this comment previously.

Add a pre-check on the Multicast feature gate status with IPv6-only cluster settings in agent Initializer, and install the iptables rules only in the IPv4 related chains. Signed-off-by: Wenying Dong <wenyingd@vmware.com>

wenyingd · 2024-03-28T05:29:00Z

/test-all

tnqn

LGTM

…-io#6123) Add a pre-check on the Multicast feature gate status with IPv6-only cluster settings in agent Initializer, and install the iptables rules only in the IPv4 related chains. Signed-off-by: Wenying Dong <wenyingd@vmware.com>

…#6175) Add a pre-check on the Multicast feature gate status with IPv6-only cluster settings in agent Initializer, and install the iptables rules only in the IPv4 related chains. Signed-off-by: Wenying Dong <wenyingd@vmware.com>

…#6174) Add a pre-check on the Multicast feature gate status with IPv6-only cluster settings in agent Initializer, and install the iptables rules only in the IPv4 related chains. Signed-off-by: Wenying Dong <wenyingd@vmware.com>

…#6173) Add a pre-check on the Multicast feature gate status with IPv6-only cluster settings in agent Initializer, and install the iptables rules only in the IPv4 related chains. Signed-off-by: Wenying Dong <wenyingd@vmware.com>

wenyingd changed the title ~~[Bugfix] Install Multicast related iptables rules only on IPv4 cluster~~ [Bugfix] Install Multicast related iptables rules only on IPv4 chains Mar 20, 2024

wenyingd force-pushed the issue_6113 branch 2 times, most recently from 073fe52 to 47585b4 Compare March 20, 2024 06:12

wenyingd requested review from antoninbas and tnqn March 21, 2024 06:06

antoninbas reviewed Mar 21, 2024

View reviewed changes

wenyingd force-pushed the issue_6113 branch 2 times, most recently from a09e2d0 to 7af7f6d Compare March 22, 2024 15:48

antoninbas reviewed Mar 22, 2024

View reviewed changes

pkg/agent/multicast/mcast_controller.go Show resolved Hide resolved

wenyingd force-pushed the issue_6113 branch 3 times, most recently from 0ade0df to 0cfb8ef Compare March 25, 2024 03:54

tnqn reviewed Mar 25, 2024

View reviewed changes

wenyingd force-pushed the issue_6113 branch 2 times, most recently from 7f2a52d to 850d2bc Compare March 26, 2024 05:39

wenyingd requested review from tnqn and antoninbas March 26, 2024 08:15

antoninbas reviewed Mar 26, 2024

View reviewed changes

wenyingd force-pushed the issue_6113 branch from 850d2bc to 54568b1 Compare March 27, 2024 02:01

wenyingd requested a review from antoninbas March 27, 2024 02:01

wenyingd force-pushed the issue_6113 branch from 54568b1 to 4aa6410 Compare March 27, 2024 02:31

antoninbas reviewed Mar 27, 2024

View reviewed changes

wenyingd force-pushed the issue_6113 branch from 4aa6410 to bfd33e8 Compare March 27, 2024 03:42

antoninbas previously approved these changes Mar 27, 2024

View reviewed changes

antoninbas added action/backport Indicates a PR that requires backports. action/release-note Indicates a PR that should be included in release notes. labels Mar 27, 2024

tnqn reviewed Mar 28, 2024

View reviewed changes

wenyingd dismissed antoninbas’s stale review via 29d85b6 March 28, 2024 02:31

wenyingd force-pushed the issue_6113 branch from bfd33e8 to 29d85b6 Compare March 28, 2024 02:31

wenyingd requested a review from tnqn March 28, 2024 05:20

tnqn approved these changes Mar 28, 2024

View reviewed changes

tnqn merged commit fcfbe9d into antrea-io:main Mar 28, 2024
53 of 56 checks passed

wenyingd mentioned this pull request Mar 29, 2024

Automated cherry pick of #6123: Install Multicast related iptables rules only on #6173

Merged

wenyingd mentioned this pull request Mar 29, 2024

Automated cherry pick of #6123: Install Multicast related iptables rules only on #6174

Merged

wenyingd mentioned this pull request Mar 29, 2024

Automated cherry pick of #6123: Install Multicast related iptables rules only on #6175

Merged

wenyingd deleted the issue_6113 branch April 3, 2024 05:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Bugfix] Install Multicast related iptables rules only on IPv4 chains #6123

[Bugfix] Install Multicast related iptables rules only on IPv4 chains #6123

wenyingd commented Mar 20, 2024 •

edited

Loading

wenyingd commented Mar 20, 2024

wenyingd commented Mar 21, 2024

antoninbas left a comment

antoninbas Mar 21, 2024

wenyingd Mar 22, 2024 •

edited

Loading

tnqn Mar 22, 2024

wenyingd Mar 22, 2024

wenyingd commented Mar 25, 2024

tnqn Mar 25, 2024

wenyingd Mar 26, 2024

tnqn Mar 26, 2024

wenyingd Mar 26, 2024

wenyingd commented Mar 26, 2024

antoninbas left a comment

antoninbas Mar 26, 2024

wenyingd Mar 27, 2024

antoninbas Mar 27, 2024

wenyingd Mar 27, 2024

antoninbas Mar 27, 2024

wenyingd Mar 27, 2024

antoninbas left a comment

antoninbas commented Mar 27, 2024

antoninbas commented Mar 27, 2024

wenyingd commented Mar 28, 2024

tnqn Mar 28, 2024

wenyingd Mar 28, 2024

wenyingd commented Mar 28, 2024

tnqn left a comment

	// since Multicast supports IPv6.
	// since Multicast doesn't support IPv6 yet.

[Bugfix] Install Multicast related iptables rules only on IPv4 chains #6123

[Bugfix] Install Multicast related iptables rules only on IPv4 chains #6123

Conversation

wenyingd commented Mar 20, 2024 • edited Loading

wenyingd commented Mar 20, 2024

wenyingd commented Mar 21, 2024

antoninbas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenyingd Mar 22, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenyingd commented Mar 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenyingd commented Mar 26, 2024

antoninbas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas left a comment

Choose a reason for hiding this comment

antoninbas commented Mar 27, 2024

antoninbas commented Mar 27, 2024

wenyingd commented Mar 28, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenyingd commented Mar 28, 2024

tnqn left a comment

Choose a reason for hiding this comment

wenyingd commented Mar 20, 2024 •

edited

Loading

wenyingd Mar 22, 2024 •

edited

Loading