Skip to content

Prevent Namespace Race #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Prevent Namespace Race #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e18958e
Adding namespace to npMgr if it doesn't exist. This fixes reboot bug …
jaer-tsun Dec 17, 2019
63dd9d5
poll api-server version for a minute before panicking
jaer-tsun Dec 18, 2019
82784c2
addressing Mat's comments
jaer-tsun Dec 18, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions npm/namespace.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,11 +86,8 @@ func (npMgr *NetworkPolicyManager) UninitAllNsList() error {
return nil
}

// AddNamespace handles adding namespace to ipset.
// AddNamespace handles adding namespace to ipset
func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
npMgr.Lock()
defer npMgr.Unlock()

var err error

nsName, nsLabel := "ns-" + nsObj.ObjectMeta.Name, nsObj.ObjectMeta.Labels
Expand Down Expand Up @@ -135,6 +132,14 @@ func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
return nil
}

// AddNamespaceWithLock acquires NetworkPolicyManager lock before adding namespace to ipset
Copy link
Contributor

@saiyan86 saiyan86 Dec 19, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think a cleaner way to do this is to unlock & lock in the caller instead of having this function.

Copy link
Member

@matmerr matmerr Dec 19, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/Azure/azure-container-networking/pull/461/files/63dd9d5784f75c11d09d573d5274d90a773bd646#diff-88c55b4ac2573a453141838261b6b413R91

AddNamespace used to take a bool to determine that, but having every signature with a bool seemed a bit like an antipattern, but it can be changed back

Copy link
Contributor Author

@jaer-tsun jaer-tsun Dec 19, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That was the pattern I had it in before. And I don't feel strongly about either to change it back and forth

func (npMgr *NetworkPolicyManager) AddNamespaceWithLock(nsObj *corev1.Namespace) error {
npMgr.Lock()
defer npMgr.Unlock()

return npMgr.AddNamespace(nsObj)
}

// UpdateNamespace handles updating namespace in ipset.
func (npMgr *NetworkPolicyManager) UpdateNamespace(oldNsObj *corev1.Namespace, newNsObj *corev1.Namespace) error {
var err error
Expand All @@ -151,7 +156,7 @@ func (npMgr *NetworkPolicyManager) UpdateNamespace(oldNsObj *corev1.Namespace, n
}

if newNsObj.ObjectMeta.DeletionTimestamp == nil && newNsObj.ObjectMeta.DeletionGracePeriodSeconds == nil {
if err = npMgr.AddNamespace(newNsObj); err != nil {
if err = npMgr.AddNamespaceWithLock(newNsObj); err != nil {
return err
}
}
Expand Down
6 changes: 3 additions & 3 deletions npm/namespace_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ func TestAddNamespace(t *testing.T) {
},
}

if err := npMgr.AddNamespace(nsObj); err != nil {
if err := npMgr.AddNamespaceWithLock(nsObj); err != nil {
t.Errorf("TestAddNamespace @ npMgr.AddNamespace")
}
}
Expand Down Expand Up @@ -130,7 +130,7 @@ func TestUpdateNamespace(t *testing.T) {
},
}

if err := npMgr.AddNamespace(oldNsObj); err != nil {
if err := npMgr.AddNamespaceWithLock(oldNsObj); err != nil {
t.Errorf("TestUpdateNamespace failed @ npMgr.AddNamespace")
}

Expand Down Expand Up @@ -175,7 +175,7 @@ func TestDeleteNamespace(t *testing.T) {
},
}

if err := npMgr.AddNamespace(nsObj); err != nil {
if err := npMgr.AddNamespaceWithLock(nsObj); err != nil {
t.Errorf("TestDeleteNamespace @ npMgr.AddNamespace")
}

Expand Down
20 changes: 15 additions & 5 deletions npm/npm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,11 +136,21 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
iptMgr := iptm.NewIptablesManager()
iptMgr.UninitNpmChains()

podInformer := informerFactory.Core().V1().Pods()
nsInformer := informerFactory.Core().V1().Namespaces()
npInformer := informerFactory.Networking().V1().NetworkPolicies()
var (
podInformer = informerFactory.Core().V1().Pods()
nsInformer = informerFactory.Core().V1().Namespaces()
npInformer = informerFactory.Networking().V1().NetworkPolicies()
serverVersion *version.Info
err error
)

serverVersion, err := clientset.ServerVersion()
for ticker, start := time.NewTicker(1 * time.Second).C, time.Now(); time.Since(start) < time.Minute * 1; {
<-ticker
serverVersion, err = clientset.ServerVersion()
if err == nil {
break
}
}
if err != nil {
log.Logf("Error: failed to retrieving kubernetes version")
panic(err.Error)
Expand Down Expand Up @@ -207,7 +217,7 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
// Namespace event handlers
cache.ResourceEventHandlerFuncs{
AddFunc: func(obj interface{}) {
npMgr.AddNamespace(obj.(*corev1.Namespace))
npMgr.AddNamespaceWithLock(obj.(*corev1.Namespace))
},
UpdateFunc: func(old, new interface{}) {
npMgr.UpdateNamespace(old.(*corev1.Namespace), new.(*corev1.Namespace))
Expand Down
19 changes: 15 additions & 4 deletions npm/nwpolicy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,10 @@ import (
"github.com/Azure/azure-container-networking/log"
"github.com/Azure/azure-container-networking/npm/iptm"
"github.com/Azure/azure-container-networking/npm/util"

corev1 "k8s.io/api/core/v1"
networkingv1 "k8s.io/api/networking/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

func (npMgr *NetworkPolicyManager) canCleanUpNpmChains() bool {
Expand Down Expand Up @@ -36,13 +39,21 @@ func (npMgr *NetworkPolicyManager) AddNetworkPolicy(npObj *networkingv1.NetworkP
npNs, npName := "ns-"+npObj.ObjectMeta.Namespace, npObj.ObjectMeta.Name
log.Printf("NETWORK POLICY CREATING: %v", npObj)

// Add policy namespace if it doesn't exist
var exists bool
if ns, exists = npMgr.nsMap[npNs]; !exists {
ns, err = newNs(npNs)
if err != nil {
log.Printf("Error creating namespace %s\n", npNs)
nsObj := &corev1.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: npObj.ObjectMeta.Namespace,
Labels: make(map[string]string),
},
}
npMgr.nsMap[npNs] = ns

if err = npMgr.AddNamespace(nsObj); err != nil {
return err
}

ns = npMgr.nsMap[npNs]
}

if ns.policyExists(npObj) {
Expand Down
6 changes: 3 additions & 3 deletions npm/nwpolicy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ func TestAddNetworkPolicy(t *testing.T) {
},
}

if err := npMgr.AddNamespace(nsObj); err != nil {
if err := npMgr.AddNamespaceWithLock(nsObj); err != nil {
t.Errorf("TestAddNetworkPolicy @ npMgr.AddNamespace")
}

Expand Down Expand Up @@ -177,7 +177,7 @@ func TestUpdateNetworkPolicy(t *testing.T) {
},
}

if err := npMgr.AddNamespace(nsObj); err != nil {
if err := npMgr.AddNamespaceWithLock(nsObj); err != nil {
t.Errorf("TestUpdateNetworkPolicy @ npMgr.AddNamespace")
}

Expand Down Expand Up @@ -289,7 +289,7 @@ func TestDeleteNetworkPolicy(t *testing.T) {
},
}

if err := npMgr.AddNamespace(nsObj); err != nil {
if err := npMgr.AddNamespaceWithLock(nsObj); err != nil {
t.Errorf("TestDeleteNetworkPolicy @ npMgr.AddNamespace")
}

Expand Down
22 changes: 15 additions & 7 deletions npm/pod.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"github.com/Azure/azure-container-networking/npm/util"

corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

func isValidPod(podObj *corev1.Pod) bool {
Expand Down Expand Up @@ -35,6 +36,20 @@ func (npMgr *NetworkPolicyManager) AddPod(podObj *corev1.Pod) error {
podIP := podObj.Status.PodIP
log.Printf("POD CREATING: [%s/%s/%s%+v%s]", podNs, podName, podNodeName, podLabels, podIP)

// Add pod namespace if it doesn't exist
if _, exists := npMgr.nsMap[podNs]; !exists {
nsObj := &corev1.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: podObj.ObjectMeta.Namespace,
Labels: make(map[string]string),
},
}

if err = npMgr.AddNamespace(nsObj); err != nil {
return err
}
}

// Add the pod to ipset
ipsMgr := npMgr.nsMap[util.KubeAllNamespacesFlag].ipsMgr
// Add the pod to its namespace's ipset.
Expand All @@ -60,13 +75,6 @@ func (npMgr *NetworkPolicyManager) AddPod(podObj *corev1.Pod) error {
}
}

ns, err := newNs(podNs)
if err != nil {
log.Errorf("Error: failed to create namespace %s", podNs)
return err
}
npMgr.nsMap[podNs] = ns

return nil
}

Expand Down