clustermesh: Add an infrastructure for connect time parameter exchange and capability negotiation #22553
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
YutaroHayakawa
added
release-note/minor
github-actions
bot
added
the
kind/community-contribution
YutaroHayakawa
force-pushed
the
yutaro/clustermesh-overlapping-podcidr-oss-cluster-config
branch
from
49c7848
to
7292a6f
Compare
YutaroHayakawa
removed
the
kind/community-contribution
YutaroHayakawa
changed the title
YutaroHayakawa
force-pushed
the
yutaro/clustermesh-overlapping-podcidr-oss-cluster-config
branch
2 times, most recently
from
7692323
to
eff723a
Compare
aanm
requested changes
Dec 6, 2022
YutaroHayakawa
force-pushed
the
yutaro/clustermesh-overlapping-podcidr-oss-cluster-config
branch
3 times, most recently
from
bc48cb1
to
4c75c5b
Compare
aanm
approved these changes
Dec 9, 2022
There was a problem hiding this comment.
LGTM @YutaroHayakawa just a heads-up that since we have branched v1.13, this PR will not be part of the 1.13 unless it is set with the needs-backport/1.13 label.
|
Ok, let me put it. Thanks for the heads up. |
YutaroHayakawa
added
the
needs-backport/1.13
|
/test |
Add a new type CiliumClusterConfig which represents a cluster configuration. This will be serialized and stored into kvstore during the clustermesh-apiserver startup time. Later on, cilium-agent on each node reads it when connecting to new clusters. The current use case of this is getting ClusterID at connect time, but by exposing the cluster configuration, we can also do some useful validation such as - Make sure the cluster id is not conflicting with existing clusters. - Make sure the new cluster doesn't have any capability mismatch. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
Add hepler functions to set/get cluster information on kvstore. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
Implement a basic connect-time validation using CiliumClusterConfig. clustermesh-apiserver is modified to set local CiliumClusterConfig on start-up time and cilium-agent is modified to get CiliumClusterConfig of remote clusters and validates it. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
For compatibility with an old Cilium that doesn't support cluster configuration feature, we should be able to connect to the remote cluster even if the configuration is missing. Test it. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
YutaroHayakawa
force-pushed
the
yutaro/clustermesh-overlapping-podcidr-oss-cluster-config
branch
from
4c75c5b
to
d95f03f
Compare
|
/test |
|
Failed tests |
|
/ci-aks |
|
All tests have passed. Making this ready-to-merge. |
YutaroHayakawa
added
the
ready-to-merge
|
Should @aanm become a member of @cilium/sig-clustermesh? |
joestringer
added
backport-pending/1.13
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.13
in 1.13.0-rc4
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.13
in 1.13.0-rc4
maintainer-s-little-helper
bot
removed
ready-to-merge
joestringer
added
backport-done/1.13
joestringer
moved this from Backport pending to v1.13
to Backport done to v1.10
in 1.13.0-rc4
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a new kvstore object
CiliumClusterConfigwith pathcilium/cluster-config/<cluster name>. The object is created per cluster by clustermesh-apiserver and obtained by cilium-agent at start-up time. The use cases of the objects areGetting per-cluster parameter
ClusterMesh with overlapping PodCIDR support needs this for getting ClusterID on connect time and setup kvstore observers to annotate incoming objects with remote ClusterID. We can put such parameters to
CiliumClusterConfig.Capability negotiation and configuration validation
When there's a capability mismatch or configuration mismatch between clusters, we may not be able to connect those clusters correctly. Currently, we don't have any mechanism to check such a mismatch. With
CiliumClusterConfig, we can check that on connect time. Currently, we only check ClusterID duplication but can add any capabilities/configuration in the future.