Skip to content

Commit

Permalink
Configure router for IPv6
Browse files Browse the repository at this point in the history 
Configure the router deployment to enable IPv4, IPv6, or both in accordance
with the cluster network config.

* manifests/00-cluster-role.yaml: Allow the operator to get the networks
config resource.
* pkg/manifests/bindata.go: Regenerate.
* pkg/operator/controller/ingress/controller.go (Reconcile): Get the
cluster network config and pass it to ensureIngressController.
(ensureIngressController): Add parameter for network config.  Pass the
network config to ensureRouterDeployment.
* pkg/operator/controller/ingress/deployment.go (ensureRouterDeployment):
Add parameter for network config.  Pass the network config to
desiredRouterDeployment.
(desiredRouterDeployment): Add parameter for network config.  Use the
network config to determine whether the cluster network uses IPv4, IPv6, or
both, and set the ROUTER_IP_V4_V6_MODE environment variable accordingly.
* pkg/operator/controller/ingress/deployment_test.go
(TestDesiredRouterDeployment): Define a network config for the test input,
and verify that desiredRouterDeployment sets ROUTER_IP_V4_V6_MODE as
appropriate.
  • Loading branch information
@Miciah
Miciah committed Dec 17, 2019
1 parent 81e9c5c commit 9cfd4c2
Show file tree
Hide file tree
Showing 5 changed files with 95 additions and 13 deletions.
1 change: 1 addition & 0 deletions manifests/00-cluster-role.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ rules:
- ingresses
- dnses
- apiservers
- networks
verbs:
- get

Expand Down
8 changes: 4 additions & 4 deletions pkg/manifests/bindata.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 7 additions & 3 deletions pkg/operator/controller/ingress/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,10 @@ func (r *reconciler) Reconcile(request reconcile.Request) (reconcile.Result, err
if err := r.client.Get(context.TODO(), types.NamespacedName{Name: "cluster"}, ingressConfig); err != nil {
return reconcile.Result{}, fmt.Errorf("failed to get ingress 'cluster': %v", err)
}
networkConfig := &configv1.Network{}
if err := r.client.Get(context.TODO(), types.NamespacedName{Name: "cluster"}, networkConfig); err != nil {
return reconcile.Result{}, fmt.Errorf("failed to get network 'cluster': %v", err)
}

// Admit if necessary. Don't process until admission succeeds. If admission is
// successful, immediately re-queue to refresh state.
Expand All @@ -193,7 +197,7 @@ func (r *reconciler) Reconcile(request reconcile.Request) (reconcile.Result, err
}

// The ingresscontroller is safe to process, so ensure it.
if err := r.ensureIngressController(ingress, dnsConfig, infraConfig, ingressConfig, apiConfig); err != nil {
if err := r.ensureIngressController(ingress, dnsConfig, infraConfig, ingressConfig, apiConfig, networkConfig); err != nil {
switch e := err.(type) {
case retryable.Error:
log.Error(e, "got retryable error; requeueing", "after", e.After())
Expand Down Expand Up @@ -544,7 +548,7 @@ func (r *reconciler) ensureIngressDeleted(ingress *operatorv1.IngressController)
// given ingresscontroller. Any error values are collected into either a
// retryable.Error value, if any of the error values are retryable, or else an
// Aggregate error value.
func (r *reconciler) ensureIngressController(ci *operatorv1.IngressController, dnsConfig *configv1.DNS, infraConfig *configv1.Infrastructure, ingressConfig *configv1.Ingress, apiConfig *configv1.APIServer) error {
func (r *reconciler) ensureIngressController(ci *operatorv1.IngressController, dnsConfig *configv1.DNS, infraConfig *configv1.Infrastructure, ingressConfig *configv1.Ingress, apiConfig *configv1.APIServer, networkConfig *configv1.Network) error {
// Before doing anything at all with the controller, ensure it has a finalizer
// so we can clean up later.
if !slice.ContainsString(ci.Finalizers, manifests.IngressControllerFinalizer) {
Expand All @@ -563,7 +567,7 @@ func (r *reconciler) ensureIngressController(ci *operatorv1.IngressController, d
return fmt.Errorf("failed to ensure namespace: %v", err)
}

deployment, err := r.ensureRouterDeployment(ci, infraConfig, ingressConfig, apiConfig)
deployment, err := r.ensureRouterDeployment(ci, infraConfig, ingressConfig, apiConfig, networkConfig)
if err != nil {
return fmt.Errorf("failed to ensure deployment: %v", err)
}
Expand Down
28 changes: 25 additions & 3 deletions pkg/operator/controller/ingress/deployment.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"fmt"
"hash"
"hash/fnv"
"net"
"path/filepath"
"reflect"
"sort"
Expand All @@ -31,8 +32,8 @@ import (

// ensureRouterDeployment ensures the router deployment exists for a given
// ingresscontroller.
func (r *reconciler) ensureRouterDeployment(ci *operatorv1.IngressController, infraConfig *configv1.Infrastructure, ingressConfig *configv1.Ingress, apiConfig *configv1.APIServer) (*appsv1.Deployment, error) {
desired, err := desiredRouterDeployment(ci, r.Config.IngressControllerImage, infraConfig, ingressConfig, apiConfig)
func (r *reconciler) ensureRouterDeployment(ci *operatorv1.IngressController, infraConfig *configv1.Infrastructure, ingressConfig *configv1.Ingress, apiConfig *configv1.APIServer, networkConfig *configv1.Network) (*appsv1.Deployment, error) {
desired, err := desiredRouterDeployment(ci, r.Config.IngressControllerImage, infraConfig, ingressConfig, apiConfig, networkConfig)
if err != nil {
return nil, fmt.Errorf("failed to build router deployment: %v", err)
}
Expand Down Expand Up @@ -71,7 +72,7 @@ func (r *reconciler) ensureRouterDeleted(ci *operatorv1.IngressController) error
}

// desiredRouterDeployment returns the desired router deployment.
func desiredRouterDeployment(ci *operatorv1.IngressController, ingressControllerImage string, infraConfig *configv1.Infrastructure, ingressConfig *configv1.Ingress, apiConfig *configv1.APIServer) (*appsv1.Deployment, error) {
func desiredRouterDeployment(ci *operatorv1.IngressController, ingressControllerImage string, infraConfig *configv1.Infrastructure, ingressConfig *configv1.Ingress, apiConfig *configv1.APIServer, networkConfig *configv1.Network) (*appsv1.Deployment, error) {
deployment := manifests.RouterDeployment()
name := controller.RouterDeploymentName(ci)
deployment.Name = name.Name
Expand Down Expand Up @@ -408,6 +409,27 @@ func desiredRouterDeployment(ci *operatorv1.IngressController, ingressController
}
env = append(env, corev1.EnvVar{Name: "SSL_MIN_VERSION", Value: minTLSVersion})

usingIPv4 := false
usingIPv6 := false
for _, clusterNetworkEntry := range networkConfig.Status.ClusterNetwork {
addr, _, err := net.ParseCIDR(clusterNetworkEntry.CIDR)
if err != nil {
continue
}
if addr.To4() != nil {
usingIPv4 = true
} else {
usingIPv6 = true
}
}
if usingIPv6 {
mode := "v4v6"
if !usingIPv4 {
mode = "v6_only"
}
env = append(env, corev1.EnvVar{Name: "ROUTER_IP_V4_V6_MODE", Value: mode})
}

deployment.Spec.Template.Spec.Volumes = volumes
deployment.Spec.Template.Spec.Containers[0].VolumeMounts = routerVolumeMounts
deployment.Spec.Template.Spec.Containers[0].Env = append(deployment.Spec.Template.Spec.Containers[0].Env, env...)
Expand Down
61 changes: 58 additions & 3 deletions pkg/operator/controller/ingress/deployment_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,15 @@ func TestDesiredRouterDeployment(t *testing.T) {
},
},
}
networkConfig := &configv1.Network{
Status: configv1.NetworkStatus{
ClusterNetwork: []configv1.ClusterNetworkEntry{
{CIDR: "10.0.0.1/8"},
},
},
}

deployment, err := desiredRouterDeployment(ci, ingressControllerImage, infraConfig, ingressConfig, apiConfig)
deployment, err := desiredRouterDeployment(ci, ingressControllerImage, infraConfig, ingressConfig, apiConfig, networkConfig)
if err != nil {
t.Errorf("invalid router Deployment: %v", err)
}
Expand Down Expand Up @@ -213,6 +220,19 @@ func TestDesiredRouterDeployment(t *testing.T) {
t.Errorf("router Deployment has unexpected minimum TLS version: expected %q, got %q", expectedTLSMinVersion, tlsMinVersion)
}

var ipv4v6Mode string
foundIPv4V6Mode := false
for _, envVar := range deployment.Spec.Template.Spec.Containers[0].Env {
if envVar.Name == "ROUTER_IP_V4_V6_MODE" {
foundIPv4V6Mode = true
ipv4v6Mode = envVar.Value
break
}
}
if foundIPv4V6Mode {
t.Errorf("router Deployment has unexpected ROUTER_IP_V4_V6_MODE setting: %q", ipv4v6Mode)
}

ingressConfig.Annotations = map[string]string{
EnableLoggingAnnotation: "debug",
}
Expand All @@ -225,9 +245,13 @@ func TestDesiredRouterDeployment(t *testing.T) {
},
},
}
networkConfig.Status.ClusterNetwork = []configv1.ClusterNetworkEntry{
{CIDR: "10.0.0.1/8"},
{CIDR: "2620:0:2d0:200::7/32"},
}
ci.Status.Domain = "example.com"
ci.Status.EndpointPublishingStrategy.Type = operatorv1.LoadBalancerServiceStrategyType
deployment, err = desiredRouterDeployment(ci, ingressControllerImage, infraConfig, ingressConfig, apiConfig)
deployment, err = desiredRouterDeployment(ci, ingressControllerImage, infraConfig, ingressConfig, apiConfig, networkConfig)
if err != nil {
t.Errorf("invalid router Deployment: %v", err)
}
Expand Down Expand Up @@ -309,6 +333,20 @@ func TestDesiredRouterDeployment(t *testing.T) {
t.Errorf("router Deployment has unexpected minimum TLS version: expected %q, got %q", expectedTLSMinVersion, tlsMinVersion)
}

foundIPv4V6Mode = false
for _, envVar := range deployment.Spec.Template.Spec.Containers[0].Env {
if envVar.Name == "ROUTER_IP_V4_V6_MODE" {
foundIPv4V6Mode = true
ipv4v6Mode = envVar.Value
break
}
}
if !foundIPv4V6Mode {
t.Error("router Deployment is missing ROUTER_IP_V4_V6_MODE setting")
} else if ipv4v6Mode != "v4v6" {
t.Errorf("router Deployment has unexpected ROUTER_IP_V4_V6_MODE setting: %q", ipv4v6Mode)
}

secretName := fmt.Sprintf("secret-%v", time.Now().UnixNano())
ci.Spec.DefaultCertificate = &corev1.LocalObjectReference{
Name: secretName,
Expand All @@ -328,7 +366,10 @@ func TestDesiredRouterDeployment(t *testing.T) {
ci.Annotations = map[string]string{
EnableLoggingAnnotation: "debug",
}
deployment, err = desiredRouterDeployment(ci, ingressControllerImage, infraConfig, ingressConfig, apiConfig)
networkConfig.Status.ClusterNetwork = []configv1.ClusterNetworkEntry{
{CIDR: "2620:0:2d0:200::7/32"},
}
deployment, err = desiredRouterDeployment(ci, ingressControllerImage, infraConfig, ingressConfig, apiConfig, networkConfig)
if err != nil {
t.Errorf("invalid router Deployment: %v", err)
}
Expand Down Expand Up @@ -383,6 +424,20 @@ func TestDesiredRouterDeployment(t *testing.T) {
if !foundSyslogContainer {
t.Error("router Deployment has no syslog container")
}

foundIPv4V6Mode = false
for _, envVar := range deployment.Spec.Template.Spec.Containers[0].Env {
if envVar.Name == "ROUTER_IP_V4_V6_MODE" {
foundIPv4V6Mode = true
ipv4v6Mode = envVar.Value
break
}
}
if !foundIPv4V6Mode {
t.Error("router Deployment is missing ROUTER_IP_V4_V6_MODE setting")
} else if ipv4v6Mode != "v6_only" {
t.Errorf("router Deployment has unexpected ROUTER_IP_V4_V6_MODE setting: %q", ipv4v6Mode)
}
}

func TestInferTLSProfileSpecFromDeployment(t *testing.T) {
Expand Down

0 comments on commit 9cfd4c2

Please sign in to comment.