npm: enable debug feature parity for v2

build/tools/tools.go

@@ -1,4 +1,5 @@
-//+build tools
+//go:build tools
+// +build tools
 
 package tools
 
@@ -8,8 +9,8 @@ import (
 	_ "github.com/golang/mock/mockgen"
 	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
 	_ "github.com/jstemmer/go-junit-report"
-	_ "mvdan.cc/gofumpt"
-	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
 	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
+	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
+	_ "mvdan.cc/gofumpt"
 	_ "sigs.k8s.io/controller-tools/cmd/controller-gen"
 )

hack/toolbox/server/go.mod

@@ -0,0 +1,3 @@
+module github.com/Azure/azure-container-networking/hack/toolbox/server
+
+go 1.17

npm/azure-npm.yaml

@@ -15,7 +15,7 @@ metadata:
     addonmanager.kubernetes.io/mode: EnsureExists
 rules:
   - apiGroups:
-    - ""
+      - ""
     resources:
       - pods
       - nodes
@@ -25,7 +25,7 @@ rules:
       - list
       - watch
   - apiGroups:
-    - networking.k8s.io
+      - networking.k8s.io
     resources:
       - networkpolicies
     verbs:
@@ -34,7 +34,7 @@ rules:
       - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding  
+kind: ClusterRoleBinding
 metadata:
   name: azure-npm-binding
   namespace: kube-system
@@ -66,20 +66,20 @@ spec:
       labels:
         k8s-app: azure-npm
       annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ''
-        azure.npm/scrapeable: ''
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+        azure.npm/scrapeable: ""
     spec:
       priorityClassName: system-node-critical
       tolerations:
-      - operator: "Exists"
-        effect: NoExecute
-      - operator: "Exists"
-        effect: NoSchedule
-      - key: CriticalAddonsOnly
-        operator: Exists
+        - operator: "Exists"
+          effect: NoExecute
+        - operator: "Exists"
+          effect: NoSchedule
+        - key: CriticalAddonsOnly
+          operator: Exists
       containers:
         - name: azure-npm
-          image: mcr.microsoft.com/containernetworking/azure-npm:v1.4.1
+          image: acnpublic.azurecr.io/azure-npm:v1.4.22-24-g0df7a4d7-dirty-v3
           resources:
             limits:
               cpu: 250m
@@ -97,31 +97,31 @@ spec:
             - name: NPM_CONFIG
               value: /etc/azure-npm/azure-npm.json
           volumeMounts:
-          - name: log
-            mountPath: /var/log
-          - name: xtables-lock
-            mountPath: /run/xtables.lock
-          - name: protocols
-            mountPath: /etc/protocols
-          - name: azure-npm-config
-            mountPath: /etc/azure-npm
+            - name: log
+              mountPath: /var/log
+            - name: xtables-lock
+              mountPath: /run/xtables.lock
+            - name: protocols
+              mountPath: /etc/protocols
+            - name: azure-npm-config
+              mountPath: /etc/azure-npm
       hostNetwork: true
       volumes:
-      - name: log
-        hostPath:
-          path: /var/log
-          type: Directory
-      - name: xtables-lock
-        hostPath:
-          path: /run/xtables.lock
-          type: File
-      - name: protocols
-        hostPath:
-          path: /etc/protocols
-          type: File
-      - name: azure-npm-config
-        configMap:
-          name: azure-npm-config
+        - name: log
+          hostPath:
+            path: /var/log
+            type: Directory
+        - name: xtables-lock
+          hostPath:
+            path: /run/xtables.lock
+            type: File
+        - name: protocols
+          hostPath:
+            path: /etc/protocols
+            type: File
+        - name: azure-npm-config
+          configMap:
+            name: azure-npm-config
       serviceAccountName: azure-npm
 ---
 apiVersion: v1
@@ -153,7 +153,7 @@ data:
             "EnablePrometheusMetrics": true,
             "EnablePprof":             true,
             "EnableHTTPDebugAPI":      true,
-            "EnableV2NPM":             false,
-            "PlaceAzureChainFirst":    false
+            "EnableV2NPM":             true,
+            "PlaceAzureChainFirst":    true
         }
     }

npm/cmd/convertiptable.go

@@ -21,17 +21,23 @@ func newConvertIPTableCmd() *cobra.Command {
 			c := &dataplane.Converter{}
 			switch {
 			case npmCacheF == "" && iptableSaveF == "":
-				ipTableRulesRes, err := c.GetJSONRulesFromIptables(iptableName)
+				ipTableRulesRes, err := c.GetProtobufRulesFromIptable(iptableName)
 				if err != nil {
 					return fmt.Errorf("%w", err)
 				}
-				fmt.Printf("%s\n", ipTableRulesRes)
+
+				if err := prettyPrintIPTables(ipTableRulesRes); err != nil {
+					return fmt.Errorf("error printing iptables: %w", err)
+				}
 			case npmCacheF != "" && iptableSaveF != "":
-				ipTableRulesRes, err := c.GetJSONRulesFromIptableFile(iptableName, npmCacheF, iptableSaveF)
+				ipTableRulesRes, err := c.GetProtobufRulesFromIptableFile(iptableName, npmCacheF, iptableSaveF)
 				if err != nil {
 					return fmt.Errorf("%w", err)
 				}
-				fmt.Printf("%s\n", ipTableRulesRes)
+
+				if err := prettyPrintIPTables(ipTableRulesRes); err != nil {
+					return fmt.Errorf("error printing iptables from file: %w", err)
+				}
 			default:
 				return errSpecifyBothFiles
 			}

npm/cmd/convertiptable_test.go

@@ -44,7 +44,7 @@ func TestConvertIPTableCmd(t *testing.T) {
 		},
 		{
 			name:    "correct files with file order switched",
-			args:    concatArgs(baseArgs, npmCacheFlag, npmCacheFile, iptablesSaveFileFlag, iptableSaveFile),
+			args:    concatArgs(baseArgs, npmCacheFlag, npmCacheFile, iptablesSaveFileFlag, npmCacheFile),
 			wantErr: false,
 		},
 		{

npm/cmd/debug.go

@@ -3,11 +3,25 @@ package main
 import (
 	"fmt"
 
+	"github.com/Azure/azure-container-networking/npm/pkg/dataplane/pb"
 	"github.com/spf13/cobra"
 )
 
 var errSpecifyBothFiles = fmt.Errorf("must specify either no files or both a cache file and an iptables save file")
 
+type IPTablesResponse struct {
+	Rules map[*pb.RuleResponse]struct{} `json:"rules,omitempty"`
+}
+
+func prettyPrintIPTables(iptableRules map[*pb.RuleResponse]struct{}) error {
+	iptresponse := IPTablesResponse{
+		Rules: iptableRules,
+	}
+
+	fmt.Printf("%+v", iptresponse)
+	return nil
+}
+
 func newDebugCmd() *cobra.Command {
 	debugCmd := &cobra.Command{
 		Use:   "debug",

npm/cmd/debug_test.go

@@ -5,12 +5,14 @@ import (
 	"io"
 	"testing"
 
+	dataplane "github.com/Azure/azure-container-networking/npm/pkg/dataplane/debug"
+	"github.com/Azure/azure-container-networking/npm/util"
 	"github.com/stretchr/testify/require"
 )
 
 const (
-	iptableSaveFile = "../pkg/dataplane/testdata/iptablesave"
-	npmCacheFile    = "../pkg/dataplane/testdata/npmcache.json"
+	iptableSaveFile = "../pkg/dataplane/testdata/iptablesave-v1"
+	npmCacheFile    = "../pkg/dataplane/testdata/npmcachev1.json"
 	nonExistingFile = "non-existing-iptables-file"
 
 	npmCacheFlag         = "-c"
@@ -19,8 +21,8 @@ const (
 	srcFlag              = "-s"
 	unknownShorthandFlag = "-z"
 
-	testIP1 = "10.240.0.17" // from npmCacheWithCustomFormat.json
-	testIP2 = "10.240.0.68" // ditto
+	testIP1 = "10.224.0.87" // from npmCacheWithCustomFormat.json
+	testIP2 = "10.224.0.20" // ditto
 
 	debugCmdString          = "debug"
 	convertIPTableCmdString = "convertiptable"
@@ -65,3 +67,16 @@ func testCommand(t *testing.T, tests []*testCases) {
 func concatArgs(baseArgs []string, args ...string) []string {
 	return append(baseArgs, args...)
 }
+
+func TestPrettyPrint(t *testing.T) {
+	c := &dataplane.Converter{}
+
+	iptables, err := c.GetProtobufRulesFromIptableFile(
+		util.IptablesFilterTable,
+		npmCacheFile,
+		iptableSaveFile,
+	)
+
+	require.NoError(t, err)
+	require.NoError(t, prettyPrintIPTables(iptables))
+}

npm/cmd/gettuples.go

@@ -3,9 +3,13 @@ package main
 import (
 	"fmt"
 
-	dataplane "github.com/Azure/azure-container-networking/npm/pkg/dataplane/debug"
+	npmconfig "github.com/Azure/azure-container-networking/npm/config"
+	"github.com/Azure/azure-container-networking/npm/http/api"
+	"github.com/Azure/azure-container-networking/npm/pkg/controlplane/controllers/common"
+	"github.com/Azure/azure-container-networking/npm/pkg/dataplane/debug"
 	"github.com/Azure/azure-container-networking/npm/util/errors"
 	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 )
 
 func newGetTuples() *cobra.Command {
@@ -23,28 +27,46 @@ func newGetTuples() *cobra.Command {
 			}
 			npmCacheF, _ := cmd.Flags().GetString("cache-file")
 			iptableSaveF, _ := cmd.Flags().GetString("iptables-file")
-			srcType := dataplane.GetInputType(src)
-			dstType := dataplane.GetInputType(dst)
-			srcInput := &dataplane.Input{Content: src, Type: srcType}
-			dstInput := &dataplane.Input{Content: dst, Type: dstType}
+			srcType := common.GetInputType(src)
+			dstType := common.GetInputType(dst)
+			srcInput := &common.Input{Content: src, Type: srcType}
+			dstInput := &common.Input{Content: dst, Type: dstType}
+
+			config := &npmconfig.Config{}
+			err := viper.Unmarshal(config)
+			if err != nil {
+				return fmt.Errorf("failed to load config with err %w", err)
+			}
 
 			switch {
 			case npmCacheF == "" && iptableSaveF == "":
-				_, tuples, err := dataplane.GetNetworkTuple(srcInput, dstInput)
+
+				c := &debug.Converter{
+					NPMDebugEndpointHost: "http://localhost",
+					NPMDebugEndpointPort: api.DefaultHttpPort,
+					EnableV2NPM:          config.Toggles.EnableV2NPM, // todo: pass this a different way than param to this
+				}
+
+				_, tuples, srcList, dstList, err := c.GetNetworkTuple(srcInput, dstInput, config)
 				if err != nil {
 					return fmt.Errorf("%w", err)
 				}
-				for _, tuple := range tuples {
-					fmt.Printf("%+v\n", tuple)
-				}
+
+				debug.PrettyPrintTuples(tuples, srcList, dstList)
+
 			case npmCacheF != "" && iptableSaveF != "":
-				_, tuples, err := dataplane.GetNetworkTupleFile(srcInput, dstInput, npmCacheF, iptableSaveF)
+
+				c := &debug.Converter{
+					EnableV2NPM: config.Toggles.EnableV2NPM,
+				}
+
+				_, tuples, srcList, dstList, err := c.GetNetworkTupleFile(srcInput, dstInput, npmCacheF, iptableSaveF)
 				if err != nil {
 					return fmt.Errorf("%w", err)
 				}
-				for _, tuple := range tuples {
-					fmt.Printf("%+v\n", tuple)
-				}
+
+				debug.PrettyPrintTuples(tuples, srcList, dstList)
+
 			default:
 				return errSpecifyBothFiles
 			}

npm/cmd/parseiptable.go

@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 
+	"github.com/Azure/azure-container-networking/common"
 	"github.com/Azure/azure-container-networking/npm/pkg/dataplane/parse"
 	"github.com/spf13/cobra"
 )
@@ -14,7 +15,11 @@ func newParseIPTableCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			iptableSaveF, _ := cmd.Flags().GetString("iptables-file")
 			if iptableSaveF == "" {
-				iptable, err := parse.Iptables("filter")
+				parser := parse.IPTablesParser{
+					IOShim: common.NewIOShim(),
+				}
+
+				iptable, err := parser.Iptables("filter")
 				if err != nil {
 					return fmt.Errorf("%w", err)
 				}

npm/controller/server.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 
 	npmconfig "github.com/Azure/azure-container-networking/npm/config"
+	"github.com/Azure/azure-container-networking/npm/pkg/controlplane/controllers/common"
 	controllersv2 "github.com/Azure/azure-container-networking/npm/pkg/controlplane/controllers/v2"
 	"github.com/Azure/azure-container-networking/npm/pkg/dataplane"
 	"github.com/Azure/azure-container-networking/npm/pkg/models"
@@ -87,7 +88,7 @@ func NewNetworkPolicyServer(
 		},
 	}
 
-	n.NpmNamespaceCacheV2 = &controllersv2.NpmNamespaceCache{NsMap: make(map[string]*controllersv2.Namespace)}
+	n.NpmNamespaceCacheV2 = &controllersv2.NpmNamespaceCache{NsMap: make(map[string]*common.Namespace)}
 	n.PodControllerV2 = controllersv2.NewPodController(n.PodInformer, dp, n.NpmNamespaceCacheV2)
 	n.NamespaceControllerV2 = controllersv2.NewNamespaceController(n.NsInformer, dp, n.NpmNamespaceCacheV2)
 	n.NetPolControllerV2 = controllersv2.NewNetworkPolicyController(n.NpInformer, dp)

npm/http/server/server.go

@@ -32,9 +32,8 @@ func NPMRestServerListenAndServe(config npmconfig.Config, npmEncoder json.Marsha
 		rs.router.Handle(api.ClusterMetricsPath, metrics.GetHandler(metrics.ClusterMetrics))
 	}
 
-	// TODO support the debug CLI for v2
 	// the nil check is for fan-out npm
-	if config.Toggles.EnableHTTPDebugAPI && npmEncoder != nil && !config.Toggles.EnableV2NPM {
+	if config.Toggles.EnableHTTPDebugAPI && npmEncoder != nil {
 		// ACN CLI debug handlers
 		rs.router.Handle(api.NPMMgrPath, rs.npmCacheHandler(npmEncoder)).Methods(http.MethodGet)
 	}