feat: [CNI] Enable DSR policy for windows singletenancy (AKS) by default

cni/netconfig.go

@@ -8,7 +8,6 @@ import (
 	"strings"
 
 	"github.com/Azure/azure-container-networking/network/policy"
-
 	cniTypes "github.com/containernetworking/cni/pkg/types"
 )
 
@@ -73,9 +72,14 @@ type NetworkConfig struct {
 		Address       string `json:"ipAddress,omitempty"`
 		QueryInterval string `json:"queryInterval,omitempty"`
 	} `json:"ipam,omitempty"`
-	DNS            cniTypes.DNS  `json:"dns,omitempty"`
-	RuntimeConfig  RuntimeConfig `json:"runtimeConfig,omitempty"`
-	AdditionalArgs []KVPair      `json:"AdditionalArgs,omitempty"`
+	DNS             cniTypes.DNS    `json:"dns,omitempty"`
+	RuntimeConfig   RuntimeConfig   `json:"runtimeConfig,omitempty"`
+	WindowsSettings WindowsSettings `json:"windowsSettings,omitempty"`
+	AdditionalArgs  []KVPair        `json:"AdditionalArgs,omitempty"`
+}
+
+type WindowsSettings struct {
+	EnableLoopbackDSR bool `json:"enableLoopbackDSR,omitempty"`
 }
 
 type K8SPodEnvArgs struct {

cni/network/network.go

@@ -76,6 +76,12 @@ type NetPlugin struct {
 	multitenancyClient MultitenancyClient
 }
 
+type PolicyArgs struct {
+	nwInfo    *network.NetworkInfo
+	nwCfg     *cni.NetworkConfig
+	ipconfigs []*cniTypesCurr.IPConfig
+}
+
 // client for node network service
 type NnsClient interface {
 	// Do network port programming for the pod via node network service.
@@ -692,18 +698,18 @@ func (plugin *NetPlugin) createEndpointInternal(opt *createEndpointInternalOpt)
 		err = plugin.Errorf("Failed to getEndpointDNSSettings: %v", err)
 		return epInfo, err
 	}
-
-	if opt.nwCfg.IPV6Mode == network.IPV6Nat {
-		var ipv6Policy policy.Policy
-
-		ipv6Policy, err = addIPV6EndpointPolicy(*opt.nwInfo)
-		if err != nil {
-			err = plugin.Errorf("Failed to set ipv6 endpoint policy: %v", err)
-			return epInfo, err
-		}
-
-		opt.policies = append(opt.policies, ipv6Policy)
+	policyArgs := PolicyArgs{
+		nwInfo:    opt.nwInfo,
+		nwCfg:     opt.nwCfg,
+		ipconfigs: opt.result.IPs,
 	}
+	endpointPolicies, err := getEndpointPolicies(policyArgs)
+	if err != nil {
+		log.Errorf("Failed to get endpoint policies:%v", err)
+		return epInfo, err
+	}
+
+	opt.policies = append(opt.policies, endpointPolicies...)
 
 	vethName := fmt.Sprintf("%s.%s", opt.k8sNamespace, opt.k8sPodName)
 	if opt.nwCfg.Mode != opModeTransparent {

cni/network/network_linux.go

@@ -9,7 +9,6 @@ import (
 	"github.com/Azure/azure-container-networking/log"
 	"github.com/Azure/azure-container-networking/network"
 	"github.com/Azure/azure-container-networking/network/policy"
-
 	cniSkel "github.com/containernetworking/cni/pkg/skel"
 	cniTypes "github.com/containernetworking/cni/pkg/types"
 	cniTypesCurr "github.com/containernetworking/cni/pkg/types/current"
@@ -118,6 +117,10 @@ func getEndpointDNSSettings(nwCfg *cni.NetworkConfig, result *cniTypesCurr.Resul
 	return getNetworkDNSSettings(nwCfg, result)
 }
 
+func getEndpointPolicies(PolicyArgs) ([]policy.Policy, error) {
+	return nil, nil
+}
+
 // getPoliciesFromRuntimeCfg returns network policies from network config.
 // getPoliciesFromRuntimeCfg is a dummy function for Linux platform.
 func getPoliciesFromRuntimeCfg(nwCfg *cni.NetworkConfig) []policy.Policy {

cni/network/network_windows.go

@@ -19,11 +19,11 @@ import (
 	"github.com/Azure/azure-container-networking/network/policy"
 	"github.com/Microsoft/hcsshim"
 	hnsv2 "github.com/Microsoft/hcsshim/hcn"
-	"golang.org/x/sys/windows/registry"
-
 	cniSkel "github.com/containernetworking/cni/pkg/skel"
 	cniTypes "github.com/containernetworking/cni/pkg/types"
 	cniTypesCurr "github.com/containernetworking/cni/pkg/types/current"
+	"github.com/pkg/errors"
+	"golang.org/x/sys/windows/registry"
 )
 
 var (
@@ -296,7 +296,54 @@ func getPoliciesFromRuntimeCfg(nwCfg *cni.NetworkConfig) []policy.Policy {
 	return policies
 }
 
-func addIPV6EndpointPolicy(nwInfo network.NetworkInfo) (policy.Policy, error) {
+func getEndpointPolicies(args PolicyArgs) ([]policy.Policy, error) {
+	var policies []policy.Policy
+
+	if args.nwCfg.IPV6Mode == network.IPV6Nat {
+		ipv6Policy, err := getIPV6EndpointPolicy(args.nwInfo)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to get ipv6 endpoint policy")
+		}
+		policies = append(policies, ipv6Policy)
+	}
+
+	if args.nwCfg.WindowsSettings.EnableLoopbackDSR {
+		dsrPolicies, err := getLoopbackDSRPolicy(args)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to get loopback dsr policy")
+		}
+		policies = append(policies, dsrPolicies...)
+	}
+
+	return policies, nil
+}
+
+func getLoopbackDSRPolicy(args PolicyArgs) ([]policy.Policy, error) {
+	var policies []policy.Policy
+	for _, config := range args.ipconfigs {
+		// consider DSR policy only for ipv4 address. Add for ipv6 when required
+		if config.Address.IP.To4() != nil {
+			dsrData := policy.LoopbackDSR{
+				Type:      policy.LoopbackDSRPolicy,
+				IPAddress: config.Address.IP,
+			}
+
+			dsrDataBytes, err := json.Marshal(dsrData)
+			if err != nil {
+				return nil, errors.Wrap(err, "failed to marshal dsr data")
+			}
+			dsrPolicy := policy.Policy{
+				Type: policy.EndpointPolicy,
+				Data: dsrDataBytes,
+			}
+			policies = append(policies, dsrPolicy)
+		}
+	}
+
+	return policies, nil
+}
+
+func getIPV6EndpointPolicy(nwInfo *network.NetworkInfo) (policy.Policy, error) {
 	var eppolicy policy.Policy
 
 	if len(nwInfo.Subnets) < 2 {

cni/network/network_windows_test.go

@@ -1,18 +1,20 @@
-//+build windows
+//go:build windows
+// +build windows
 
 package network
 
 import (
 	"fmt"
-	"github.com/Azure/azure-container-networking/cns"
 	"net"
 	"testing"
 
 	"github.com/Azure/azure-container-networking/cni"
+	"github.com/Azure/azure-container-networking/cns"
 	"github.com/Azure/azure-container-networking/network"
 	"github.com/Azure/azure-container-networking/network/policy"
 	"github.com/Azure/azure-container-networking/telemetry"
 	"github.com/containernetworking/cni/pkg/skel"
+	cniTypesCurr "github.com/containernetworking/cni/pkg/types/current"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -49,7 +51,7 @@ func TestAddWithRunTimeNetPolicies(t *testing.T) {
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			p, err := addIPV6EndpointPolicy(tt.nwInfo)
+			p, err := getIPV6EndpointPolicy(&tt.nwInfo)
 			if tt.wantErr {
 				require.Error(t, err)
 			} else {
@@ -241,3 +243,57 @@ func TestSetPoliciesFromNwCfg(t *testing.T) {
 		})
 	}
 }
+
+func TestDSRPolciy(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      PolicyArgs
+		wantCount int
+	}{
+		{
+			name: "test enable dsr policy",
+			args: PolicyArgs{
+				nwCfg: &cni.NetworkConfig{
+					WindowsSettings: cni.WindowsSettings{
+						EnableLoopbackDSR: true,
+					},
+				},
+				nwInfo: &network.NetworkInfo{},
+				ipconfigs: []*cniTypesCurr.IPConfig{
+					{
+						Address: func() net.IPNet {
+							_, ipnet, _ := net.ParseCIDR("10.0.0.5/24")
+							return *ipnet
+						}(),
+					},
+				},
+			},
+			wantCount: 1,
+		},
+		{
+			name: "test disable dsr policy",
+			args: PolicyArgs{
+				nwCfg:  &cni.NetworkConfig{},
+				nwInfo: &network.NetworkInfo{},
+				ipconfigs: []*cniTypesCurr.IPConfig{
+					{
+						Address: func() net.IPNet {
+							_, ipnet, _ := net.ParseCIDR("10.0.0.5/24")
+							return *ipnet
+						}(),
+					},
+				},
+			},
+			wantCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			policies, err := getEndpointPolicies(tt.args)
+			require.NoError(t, err)
+			require.Equal(t, tt.wantCount, len(policies))
+		})
+	}
+}

network/policy/policy.go

@@ -12,6 +12,7 @@ const (
 	PortMappingPolicy CNIPolicyType = "NAT"
 	ACLPolicy         CNIPolicyType = "ACL"
 	L4WFPProxyPolicy  CNIPolicyType = "L4WFPPROXY"
+	LoopbackDSRPolicy CNIPolicyType = "LoopbackDSR"
 )
 
 type CNIPolicyType string