Adds PolicySetupTimeoutSeconds option to CalicoNetwork #3186

aaaaaaaalex · 2024-02-21T12:01:28Z

Description

Adds option to CalicoNetwork to enable a policy-setup timeout in the CNI/Felix.

Felix's new option EndpointStatusPathPrefix gets set to it's /var/run/calico dir to enable the Felix-side feature, where-in it will create a directory "status".

CNI should have its timeout configured according to the CalicoNetwork field, and it's EndpointStatusDir should be set to Felix's /var/run/calico dir plus "/status".

For PR author

Tests for change.
If changing pkg/apis/, run make gen-files
If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- kind/bug if this is a bugfix.
- kind/enhancement if this is a a new feature.
- enterprise if this PR applies to Calico Enterprise only.

aaaaaaaalex · 2024-02-26T14:43:57Z

Going to mark this PR as Ready for Review, although there are still two merge tests that are failing, that I'm a little confused about.

Edit: fixed

caseydavenport

Looks pretty good, left a few comments

caseydavenport · 2024-02-27T23:14:05Z

api/v1/installation_types.go

+	// PolicySetupTimeoutSeconds delays new pods from going ready
+	// until their policy has been programmed in the dataplane.
+	// The specified delay defines the maximum amount of time
+	// that the Calico CNI will wait for policy to be programmed.


"the Calico CNI plugin" or just "Calico"

"CNI plugin" refers to a component, and "Calico" refers to the system as a whole.

api/v1/installation_types.go

caseydavenport · 2024-02-27T23:16:45Z

pkg/controller/installation/validation.go

@@ -349,6 +349,13 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 			}

 		}
+
+		if instance.Spec.CalicoNetwork.PolicySetupTimeoutSeconds != nil {


I think we need validation here to prevent setting this in other invalid scenarios - e.g., when Calico networking isn't being used, or when Calico in eBPF mode is being used.

What about Windows? Do we prevent this option in a cluster with Windows nodes? Do we just ignore it?

I've been working off the assumption that we would ignore this option on Windows, how does the operator deal with the issue of windows compat? Does it know if a windows node exists in the cluster?

I suppose I could accept it in the operator, ignore it in felix/cni, if thats an acceptable paradigm?

Typically, we would expect that if a config option isn't supported in a certain configuration, that we return an error and prevent installation of the code in that configuration. We should probably do that for this if Windows is enabled in the configuration.

Im unfamiliar with this part of the operator resources, but my first thought was to check if the windows dataplane config option was non-nil. But, that would presumably only tell me that some nodes may be windows, and I still may want the feature on for non-windows nodes 🤔 any guidance appreciated

There's no such thing as a "Windows only" cluster - they all have at least one Linux node since the control plane components don't run on Windows.

The usual ideal we strive for is that if configuration is accepted it means it is going to be implemented fully. We don't really have a mechanism to report back "This configuration is sort of working but not entirely"

I think your options are:

Reject the config outright if Windows is enabled.

Add support for this feature to Windows.

Change the config model so that this is very clearly Linux only (e.g., LinuxPolicySetupTimeoutSeconds)

The last one is the least desirable IMO

pkg/render/node.go

pkg/render/node_test.go

pkg/controller/installation/core_controller.go

pkg/render/node_test.go

caseydavenport · 2024-02-29T17:31:16Z

pkg/controller/installation/validation.go

@@ -355,6 +355,9 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 			if *instance.Spec.CalicoNetwork.PolicySetupTimeoutSeconds < 0 {
 				return fmt.Errorf("Installation CNI spec.PolicySetupTimeoutSeconds negative value is not valid")
 			}
+			if instance.Spec.CalicoNetwork.LinuxDataplane != nil && *instance.Spec.CalicoNetwork.LinuxDataplane != operatorv1.LinuxDataplaneIptables {


I think we probably want this?

if instance.Spec.CalicoNetwork.LinuxDataplane == nil || *instance.Spec.CalicoNetwork.LinuxDataplane != operatorv1.LinuxDataplaneIptables {

Basically if the data plane is unset, then we don't know if it's OK to enable this feature or not and we need to wait until it is.

Probably also want a check on WindowsDataplane here

Similar to the question I have above, I think this feature would still be desirable in a mixed cluster with windows and linux, if its possible to continue when that is the case. Maybe I could error if only a Windows dataplane is defined, and no Linux one?

Maybe I could error if only a Windows dataplane is defined, and no Linux one?

Is there a reason we haven't implemented this for Windows?

pkg/controller/installation/validation_test.go

caseydavenport · 2024-03-01T18:39:18Z

pkg/render/node.go

@@ -628,6 +629,10 @@ func (c *nodeComponent) createCalicoPluginConfig() map[string]interface{} {

 	apiRoot := c.cfg.K8sServiceEp.CNIAPIRoot()

+	LinuxpolicySetupTimeoutSeconds := int32(0)


This should be a private variable, and Policy should be capitalized

linuxPolicySetupTimeoutSeconds

marvin-tigera · 2024-03-01T20:59:17Z

Removing "merge-when-ready" label due to new commits

…tartup-delay functionality in Felix/CNI

marvin-tigera added this to the v1.34.0 milestone Feb 21, 2024

marvin-tigera added docs-pr-required release-note-required labels Feb 21, 2024

aaaaaaaalex marked this pull request as ready for review February 26, 2024 14:44

aaaaaaaalex requested a review from a team as a code owner February 26, 2024 14:44

aaaaaaaalex changed the title ~~Adds PolicyProgrammingTimeoutSeconds option to CalicoNetwork~~ Adds PolicySetupTimeoutSeconds option to CalicoNetwork Feb 27, 2024

aaaaaaaalex force-pushed the policy-programming-timeout branch 2 times, most recently from b9422d9 to 362c6bc Compare February 27, 2024 14:21

caseydavenport requested changes Feb 27, 2024

View reviewed changes

caseydavenport reviewed Feb 27, 2024

View reviewed changes

pkg/render/node_test.go Show resolved Hide resolved

aaaaaaaalex requested a review from caseydavenport February 29, 2024 16:26

caseydavenport reviewed Feb 29, 2024

View reviewed changes

pkg/controller/installation/validation_test.go Outdated Show resolved Hide resolved

aaaaaaaalex requested a review from caseydavenport February 29, 2024 18:57

aaaaaaaalex force-pushed the policy-programming-timeout branch from dedcd3b to d60f023 Compare March 1, 2024 18:30

caseydavenport reviewed Mar 1, 2024

View reviewed changes

aaaaaaaalex force-pushed the policy-programming-timeout branch from d60f023 to 2ffebfa Compare March 1, 2024 18:48

caseydavenport added the merge-when-ready label Mar 1, 2024

caseydavenport approved these changes Mar 1, 2024

View reviewed changes

aaaaaaaalex force-pushed the policy-programming-timeout branch from 2ffebfa to b434af5 Compare March 1, 2024 20:59

marvin-tigera removed the merge-when-ready label Mar 1, 2024

adds PolicySetupTimeoutSeconds option to CalicoNetwork; toggles pod s…

dab7623

…tartup-delay functionality in Felix/CNI

aaaaaaaalex force-pushed the policy-programming-timeout branch from b434af5 to dab7623 Compare March 1, 2024 21:01

caseydavenport approved these changes Mar 1, 2024

View reviewed changes

caseydavenport added the merge-when-ready label Mar 1, 2024

marvin-tigera merged commit 984399f into tigera:master Mar 1, 2024
5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds PolicySetupTimeoutSeconds option to CalicoNetwork #3186

Adds PolicySetupTimeoutSeconds option to CalicoNetwork #3186

aaaaaaaalex commented Feb 21, 2024 •

edited

Loading

aaaaaaaalex commented Feb 26, 2024 •

edited

Loading

caseydavenport left a comment

caseydavenport Feb 27, 2024 •

edited

Loading

caseydavenport Feb 27, 2024

caseydavenport Feb 27, 2024

aaaaaaaalex Feb 29, 2024

aaaaaaaalex Feb 29, 2024 •

edited

Loading

caseydavenport Feb 29, 2024

aaaaaaaalex Feb 29, 2024

caseydavenport Mar 1, 2024 •

edited

Loading

caseydavenport Feb 29, 2024

caseydavenport Feb 29, 2024

aaaaaaaalex Feb 29, 2024

caseydavenport Mar 1, 2024

caseydavenport Mar 1, 2024

marvin-tigera commented Mar 1, 2024

		@@ -628,6 +629,10 @@ func (c *nodeComponent) createCalicoPluginConfig() map[string]interface{} {

		apiRoot := c.cfg.K8sServiceEp.CNIAPIRoot()

		LinuxpolicySetupTimeoutSeconds := int32(0)

Adds PolicySetupTimeoutSeconds option to CalicoNetwork #3186

Adds PolicySetupTimeoutSeconds option to CalicoNetwork #3186

Conversation

aaaaaaaalex commented Feb 21, 2024 • edited Loading

Description

For PR author

For PR reviewers

aaaaaaaalex commented Feb 26, 2024 • edited Loading

caseydavenport left a comment

Choose a reason for hiding this comment

caseydavenport Feb 27, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aaaaaaaalex Feb 29, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

caseydavenport Mar 1, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marvin-tigera commented Mar 1, 2024

aaaaaaaalex commented Feb 21, 2024 •

edited

Loading

aaaaaaaalex commented Feb 26, 2024 •

edited

Loading

caseydavenport Feb 27, 2024 •

edited

Loading

aaaaaaaalex Feb 29, 2024 •

edited

Loading

caseydavenport Mar 1, 2024 •

edited

Loading