nat: Create SNAT maps only if BPF NodePort is enabled

[ upstream commit 602e5ce ]

The IPv4 and IPv6 SNAT maps are only used if BPF NodePort is enabled.
Commit cac5218 ("datapath: remove SNAT maps entries when kube-proxy is
enabled") removed the maps on startup if BPF NodePort is disabled.

We were however still creating them regardless of the BPF NodePort
status. The creation started a controller which then fails once the
actual map is removed. This commit fixes the issue by not creating the
userspace object, including the controller, for the SNAT maps when BPF
NodePort is disabled.

Fixes: cac5218 ("datapath: remove SNAT maps entries when kube-proxy is
enabled")
Fixes: cilium#15141
Signed-off-by: Paul Chaignon <paul@cilium.io>

cilium/cmd/bpf_nat_flush.go

@@ -39,7 +39,7 @@ func init() {
 }
 
 func flushNat() {
-	ipv4, ipv6 := nat.GlobalMaps(true, true)
+	ipv4, ipv6 := nat.GlobalMaps(true, true, true)
 
 	for _, m := range []*nat.Map{ipv4, ipv6} {
 		if m == nil {

cilium/cmd/bpf_nat_list.go

@@ -33,7 +33,7 @@ var bpfNatListCmd = &cobra.Command{
 	Short:   "List all NAT mapping entries",
 	Run: func(cmd *cobra.Command, args []string) {
 		common.RequireRootPrivilege("cilium bpf nat list")
-		ipv4, ipv6 := nat.GlobalMaps(true, true)
+		ipv4, ipv6 := nat.GlobalMaps(true, true, true)
 		globalMaps := make([]interface{}, 2)
 		globalMaps[0] = ipv4
 		globalMaps[1] = ipv6

daemon/cmd/daemon.go

@@ -289,7 +289,7 @@ func NewDaemon(ctx context.Context, epMgr *endpointmanager.EndpointManager, dp d
 	isKubeProxyReplacementStrict := initKubeProxyReplacementOptions()
 
 	ctmap.InitMapInfo(option.Config.CTMapEntriesGlobalTCP, option.Config.CTMapEntriesGlobalAny,
-		option.Config.EnableIPv4, option.Config.EnableIPv6)
+		option.Config.EnableIPv4, option.Config.EnableIPv6, option.Config.EnableNodePort)
 	policymap.InitMapInfo(option.Config.PolicyMapEntries)
 	lbmap.Init(lbmap.InitParams{
 		IPv4: option.Config.EnableIPv4,

daemon/cmd/datapath.go

@@ -395,13 +395,13 @@ func (d *Daemon) initMaps() error {
 	}
 
 	ipv4Nat, ipv6Nat := nat.GlobalMaps(option.Config.EnableIPv4,
-		option.Config.EnableIPv6)
-	if option.Config.EnableIPv4 {
+		option.Config.EnableIPv6, option.Config.EnableNodePort)
+	if ipv4Nat != nil {
 		if _, err := ipv4Nat.Create(); err != nil {
 			return err
 		}
 	}
-	if option.Config.EnableIPv6 {
+	if ipv6Nat != nil {
 		if _, err := ipv6Nat.Create(); err != nil {
 			return err
 		}

pkg/maps/ctmap/ctmap.go

@@ -151,10 +151,10 @@ func setupMapInfo(m mapType, define string, mapKey bpf.MapKey, keySize int, maxE
 // InitMapInfo builds the information about different CT maps for the
 // combination of L3/L4 protocols, using the specified limits on TCP vs non-TCP
 // maps.
-func InitMapInfo(tcpMaxEntries, anyMaxEntries int, v4, v6 bool) {
+func InitMapInfo(tcpMaxEntries, anyMaxEntries int, v4, v6, nodeport bool) {
 	mapInfo = make(map[mapType]mapAttributes, mapTypeMax)
 
-	global4Map, global6Map := nat.GlobalMaps(v4, v6)
+	global4Map, global6Map := nat.GlobalMaps(v4, v6, nodeport)
 
 	// SNAT also only works if the CT map is global so all local maps will be nil
 	natMaps := map[mapType]*nat.Map{
@@ -202,7 +202,7 @@ func InitMapInfo(tcpMaxEntries, anyMaxEntries int, v4, v6 bool) {
 }
 
 func init() {
-	InitMapInfo(option.CTMapEntriesGlobalTCPDefault, option.CTMapEntriesGlobalAnyDefault, true, true)
+	InitMapInfo(option.CTMapEntriesGlobalTCPDefault, option.CTMapEntriesGlobalAnyDefault, true, true, true)
 }
 
 // CtEndpoint represents an endpoint for the functions required to manage

pkg/maps/ctmap/ctmap_test.go

@@ -40,7 +40,7 @@ func Test(t *testing.T) {
 }
 
 func (t *CTMapTestSuite) TestInit(c *C) {
-	InitMapInfo(option.CTMapEntriesGlobalTCPDefault, option.CTMapEntriesGlobalAnyDefault, true, true)
+	InitMapInfo(option.CTMapEntriesGlobalTCPDefault, option.CTMapEntriesGlobalAnyDefault, true, true, true)
 	for mapType := mapType(0); mapType < mapTypeMax; mapType++ {
 		info := mapInfo[mapType]
 		if mapType.isIPv6() {

pkg/maps/nat/nat.go

@@ -298,7 +298,10 @@ func (m *Map) DeleteMapping(key tuple.TupleKey) error {
 }
 
 // GlobalMaps returns all global NAT maps.
-func GlobalMaps(ipv4, ipv6 bool) (ipv4Map, ipv6Map *Map) {
+func GlobalMaps(ipv4, ipv6, nodeport bool) (ipv4Map, ipv6Map *Map) {
+	if !nodeport {
+		return
+	}
 	entries := option.Config.NATMapEntriesGlobal
 	if entries == 0 {
 		entries = option.LimitTableMax