Slirp hook sidecar

BUILD.bazel

@@ -192,6 +192,7 @@ container_bundle(
         "$(container_prefix)/$(image_prefix)example-hook-sidecar:$(container_tag)": "//cmd/example-hook-sidecar:example-hook-sidecar-image",
         "$(container_prefix)/$(image_prefix)example-disk-mutation-hook-sidecar:$(container_tag)": "//cmd/example-disk-mutation-hook-sidecar:example-disk-mutation-hook-sidecar-image",
         "$(container_prefix)/$(image_prefix)example-cloudinit-hook-sidecar:$(container_tag)": "//cmd/example-cloudinit-hook-sidecar:example-cloudinit-hook-sidecar-image",
+        "$(container_prefix)/$(image_prefix)network-slirp-binding:$(container_tag)": "//cmd/network-slirp-binding:network-slirp-binding-image",
         # container-disk images
         "$(container_prefix)/$(image_prefix)alpine-container-disk-demo:$(container_tag)": "//containerimages:alpine-container-disk-image",
         "$(container_prefix)/$(image_prefix)cirros-container-disk-demo:$(container_tag)": "//containerimages:cirros-container-disk-image",
@@ -329,6 +330,15 @@ container_push(
     tag = "$(container_tag)",
 )
 
+container_push(
+    name = "push-network-slirp-binding",
+    format = "Docker",
+    image = "//cmd/network-slirp-binding:network-slirp-binding-image",
+    registry = "$(container_prefix)",
+    repository = "$(image_prefix)network-slirp-binding",
+    tag = "$(container_tag)",
+)
+
 container_push(
     name = "push-example-hook-sidecar",
     format = "Docker",

cmd/network-slirp-binding/BUILD.bazel

@@ -0,0 +1,48 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "kubevirt.io/kubevirt/cmd/network-slirp-binding",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//cmd/network-slirp-binding/dns:go_default_library",
+        "//cmd/network-slirp-binding/server:go_default_library",
+        "//pkg/hooks:go_default_library",
+        "//pkg/hooks/info:go_default_library",
+        "//pkg/hooks/v1alpha2:go_default_library",
+        "//staging/src/kubevirt.io/client-go/log:go_default_library",
+        "@org_golang_google_grpc//:go_default_library",
+    ],
+)
+
+go_binary(
+    name = "network-slirp-binding",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
+
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_image",
+)
+
+container_image(
+    name = "version-container",
+    base = "//:passwd-image",
+    directory = "/",
+    files = ["//:get-version"],
+)
+
+container_image(
+    name = "network-slirp-binding-image",
+    architecture = select({
+        "@io_bazel_rules_go//go/platform:linux_arm64": "arm64",
+        "//conditions:default": "amd64",
+    }),
+    base = ":version-container",
+    directory = "/",
+    entrypoint = ["/network-slirp-binding"],
+    files = [":network-slirp-binding"],
+    visibility = ["//visibility:public"],
+)

cmd/network-slirp-binding/README.md

@@ -0,0 +1,50 @@
+# KubeVirt Network Slirp Binding Plugin
+
+## Summary
+
+Slirp network binding plugin configures VMs Slirp interface using Kubevirts hook sidecar interface.
+
+It will be used by Kubevirt to offload slirp networking configuration.
+
+> _NOTE_:
+> Slirp network binding is supported for pod network interfaces only.
+
+# How to use
+
+Register the `slirp` binding plugin with its sidecar image:
+
+```yaml
+apiVersion: kubevirt.io/v1
+kind: KubeVirt
+metadata:
+  name: kubevirt
+  namespace: kubevirt
+spec:
+  configuration:
+    network:
+      binding:
+        slirp:
+          sidecarImage: registry:5000/kubevirt/network-slirp-binding:devel
+  ...
+```
+
+In the VM spec, set interface to use `slirp` binding plugin:
+
+```yaml
+apiVersion: kubevirt.io/v1
+kind: VirtualMachineInstance
+metadata:
+  name: vmi-slirp
+spec:
+  domain:
+    devices:
+      interfaces:
+      - name: slirp
+        binding:
+          name: slirp
+  ...
+  networks:
+  - name: slirp-net
+    pod: {}
+  ...
+```

cmd/network-slirp-binding/callback/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["callback.go"],
+    importpath = "kubevirt.io/kubevirt/cmd/network-slirp-binding/callback",
+    visibility = ["//visibility:public"],
+    deps = ["//pkg/virt-launcher/virtwrap/api:go_default_library"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "callback_suite_test.go",
+        "callback_test.go",
+    ],
+    deps = [
+        ":go_default_library",
+        "//pkg/virt-launcher/virtwrap/api:go_default_library",
+        "//staging/src/kubevirt.io/client-go/testutils:go_default_library",
+        "//vendor/github.com/onsi/ginkgo/v2:go_default_library",
+        "//vendor/github.com/onsi/gomega:go_default_library",
+    ],
+)

cmd/network-slirp-binding/callback/callback.go

@@ -0,0 +1,58 @@
+/*
+ * This file is part of the KubeVirt project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2023 Red Hat, Inc.
+ *
+ */
+
+package callback
+
+import (
+	"encoding/xml"
+	"fmt"
+
+	domainschema "kubevirt.io/kubevirt/pkg/virt-launcher/virtwrap/api"
+)
+
+// TODO: move to Kubevirt domain API package
+const libvirtDomainQemuSchema = "http://libvirt.org/schemas/domain/qemu/1.0"
+
+type DomainSpecMutator interface {
+	Mutate(*domainschema.DomainSpec) (*domainschema.DomainSpec, error)
+}
+
+func OnDefineDomain(domainXML []byte, domSpecMutator DomainSpecMutator) ([]byte, error) {
+	domainSpec := &domainschema.DomainSpec{
+		// Unmarshalling domain spec makes the XML namespace attribute empty.
+		// Some domain parameters requires namespace to be defined.
+		// e.g: https://libvirt.org/drvqemu.html#pass-through-of-arbitrary-qemu-commands
+		XmlNS: libvirtDomainQemuSchema,
+	}
+	if err := xml.Unmarshal(domainXML, domainSpec); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal given domain spec: %v", err)
+	}
+
+	updatedDomainSpec, err := domSpecMutator.Mutate(domainSpec)
+	if err != nil {
+		return nil, err
+	}
+
+	updatedDomainSpecXML, err := xml.Marshal(updatedDomainSpec)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal updated domain spec: %v", err)
+	}
+
+	return updatedDomainSpecXML, nil
+}

cmd/network-slirp-binding/callback/callback_suite_test.go

@@ -0,0 +1,30 @@
+/*
+ * This file is part of the KubeVirt project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2023 Red Hat, Inc.
+ *
+ */
+
+package callback_test
+
+import (
+	"testing"
+
+	"kubevirt.io/client-go/testutils"
+)
+
+func TestCallback(t *testing.T) {
+	testutils.KubeVirtTestSuiteSetup(t)
+}

cmd/network-slirp-binding/callback/callback_test.go

@@ -0,0 +1,92 @@
+/*
+ * This file is part of the KubeVirt project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2023 Red Hat, Inc.
+ *
+ */
+
+package callback_test
+
+import (
+	"encoding/xml"
+	"fmt"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	domainschema "kubevirt.io/kubevirt/pkg/virt-launcher/virtwrap/api"
+
+	"kubevirt.io/kubevirt/cmd/network-slirp-binding/callback"
+)
+
+var _ = Describe("hook callback handler", func() {
+	Context("on define domain", func() {
+		It("should fail given empty byte slice stream", func() {
+			_, err := callback.OnDefineDomain([]byte{}, mutatorStub{})
+			Expect(err).To(HaveOccurred())
+		})
+
+		It("should fail given invalid domain XML", func() {
+			_, err := callback.OnDefineDomain([]byte("invalid-domain-xml"), mutatorStub{})
+			Expect(err).To(HaveOccurred())
+		})
+
+		It("should fail when domain spec mutator fails", func() {
+			domain := domainschema.NewMinimalDomain("test")
+			originalDomainSpecXML, err := xml.Marshal(domain.Spec)
+			Expect(err).ToNot(HaveOccurred())
+
+			expectedErr := fmt.Errorf("test error")
+			domSpecMutator := mutatorStub{failMutate: expectedErr}
+
+			_, err = callback.OnDefineDomain(originalDomainSpecXML, domSpecMutator)
+			Expect(err).To(Equal(expectedErr))
+		})
+
+		It("given no-op mutator, domain spec should not change", func() {
+			domain := domainschema.NewMinimalDomain("test")
+			domainSpecXML, err := xml.Marshal(domain.Spec)
+			Expect(err).ToNot(HaveOccurred())
+			domSpecMutator := mutatorStub{domSpec: &domain.Spec}
+
+			Expect(callback.OnDefineDomain(domainSpecXML, domSpecMutator)).To(Equal(domainSpecXML))
+		})
+
+		It("domain spec should mutate successfully", func() {
+			domain := domainschema.NewMinimalDomain("test")
+			domainSpecXML, err := xml.Marshal(domain.Spec)
+			Expect(err).ToNot(HaveOccurred())
+
+			mutatedDomainSpec := domain.Spec.DeepCopy()
+			mutatedDomainSpec.Devices.Interfaces = append(mutatedDomainSpec.Devices.Interfaces,
+				domainschema.Interface{Alias: domainschema.NewUserDefinedAlias("test")})
+			domSpecMutator := mutatorStub{domSpec: mutatedDomainSpec}
+
+			mutatedDomainSpecXML, err := xml.Marshal(mutatedDomainSpec)
+			Expect(err).ToNot(HaveOccurred())
+
+			Expect(callback.OnDefineDomain(domainSpecXML, domSpecMutator)).To(Equal(mutatedDomainSpecXML))
+		})
+	})
+})
+
+type mutatorStub struct {
+	domSpec    *domainschema.DomainSpec
+	failMutate error
+}
+
+func (s mutatorStub) Mutate(_ *domainschema.DomainSpec) (*domainschema.DomainSpec, error) {
+	return s.domSpec, s.failMutate
+}

cmd/network-slirp-binding/dns/BUILD.bazel

@@ -0,0 +1,12 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["resolvconf.go"],
+    importpath = "kubevirt.io/kubevirt/cmd/network-slirp-binding/dns",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/network/dns:go_default_library",
+        "//staging/src/kubevirt.io/client-go/log:go_default_library",
+    ],
+)

cmd/network-slirp-binding/dns/resolvconf.go

@@ -0,0 +1,50 @@
+/*
+ * This file is part of the KubeVirt project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2023 Red Hat, Inc.
+ *
+ */
+
+package dns
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"kubevirt.io/client-go/log"
+
+	"kubevirt.io/kubevirt/pkg/network/dns"
+)
+
+const resolvConf = "/etc/resolv.conf"
+
+func ReadResolvConfSearchDomains() ([]string, error) {
+
+	// #nosec No risk for path injection. resolvConf is static "/etc/resolve.conf"
+	resolvConfRaw, err := os.ReadFile(resolvConf)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read resolv.conf at %q: %v", resolvConf, err)
+	}
+
+	searchDomains, err := dns.ParseSearchDomains(string(resolvConfRaw))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse search domains out of %q: %v", resolvConf, err)
+	}
+
+	log.Log.Infof("Found search domains in %s: %s", resolvConf, strings.Join(searchDomains, " "))
+
+	return searchDomains, nil
+}