4810

Committed 11 May 2021 07:35PM UTC coverage: 58.476% (+0.3%) from 58.181%

Build # 4810

Build Type

push

travis-ci-com

Committed by Apoorva

Commit Message

<a href="https://github.com/noironetworks/aci-containers/commit/<a class=hub.com/noironetworks/aci-containers/commit/a018c7b55b30c3630eb6100c0ad27b49405b7590">a018c7b55<a href="https://github.com/noironetworks/aci-containers/commit/a018c7b55b30c3630eb6100c0ad27b49405b7590">&quot;&gt;Fix SNAT testing inside controller and add UT for periodic globalcache sync

Additional changes:
1. Make the time intervals for global sync method configurable
2. Change method name from enableGlobalSync to snatGlobalInfoSync for better readability
3. Modify logs in snatGlobalInfoSync to be more user-friendly
4. Add check for comparing policy names in SNAT UTs

(cherry picked from commit </a><a class="double-link" href="https://github.com/noironetworks/aci-containers/commit/<a class="double-link" href="https://github.com/noironetworks/aci-containers/commit/67d08c673e66ca0c66b9d2746d5b55e065207843">67d08c673</a>">67d08c673</a><a href="https://github.com/noironetworks/aci-containers/commit/a018c7b55b30c3630eb6100c0ad27b49405b7590">)

Run Details

8 of 8 new or added lines in 2 files covered. (100.0%)

11235 of 19213 relevant lines covered (58.48%)

0.65 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

76.0

/pkg/controller/config.go

// Copyright 2017 Cisco Systems, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package controller

import (
        "flag"

        "github.com/noironetworks/aci-containers/pkg/ipam"
)

const (
        lbTypeAci = "aci-nlb"
)

type OpflexGroup struct {
        PolicySpace string `json:"policy-space,omitempty"`
        Name        string `json:"name,omitempty"`
}

// Configuration for the controller
type ControllerConfig struct {
        // Log level
        LogLevel string `json:"log-level,omitempty"`

        // Absolute path to a kubeconfig file
        KubeConfig string `json:"kubeconfig,omitempty"`

        // TCP port to run status server on (or 0 to disable)
        StatusPort int `json:"status-port,omitempty"`

        // Default endpoint group annotation value
        DefaultEg OpflexGroup `json:"default-endpoint-group,omitempty"`

        // Default security group annotation value
        DefaultSg []OpflexGroup `json:"default-security-group,omitempty"`

        // Override default endpoint group assignments for a namespace
        // map ns name -> group
        NamespaceDefaultEg map[string]OpflexGroup `json:"namespace-default-endpoint-group,omitempty"`

        // Override default security group assignments for namespaces
        // map ns name -> slice of groups
        NamespaceDefaultSg map[string][]OpflexGroup `json:"namespace-default-security-group,omitempty"`

        // The hostnames or IPs for connecting to apic
        ApicHosts []string `json:"apic-hosts,omitempty"`

        // The username for connecting to APIC
        ApicUsername string `json:"apic-username,omitempty"`

        // The password for connecting to APIC
        ApicPassword string `json:"apic-password,omitempty"`

        // The number of seconds that APIC should wait before timing
        // out a subscription on a websocket connection. If not
        // explicitly set, then a default of 900 seconds will
        // be sent in websocket subscriptions. If it is set to 0,
        // then a timeout will not be sent in websocket
        // subscriptions, and APIC will use it's default timeout
        // of 80 seconds. If set to a non-zero value, then the
        // timeout value will be provided when we subscribe to
        // a URL on APIC. NOTE: the subscription timeout is not
        // supported by APIC versions before 3.2(3), so this
        // value must not be set when used with APIC versions
        // older than that release.
        // Also, note that this is a string.
        ApicRefreshTimer string `json:"apic-refreshtime,omitempty"`

        // How early (seconds) the subscriptions to be refreshed than
        // actual subscription refresh-timeout. Will be defaulted to 5Seconds.
        ApicRefreshTickerAdjust string `json:"apic-refreshticker-adjust,omitempty"`

        // A path for a PEM-encoded private key for client certificate
        // authentication for APIC API
        ApicPrivateKeyPath string `json:"apic-private-key-path,omitempty"`

        // A path for a PEM-encoded public certificate for APIC server to
        // enable secure TLS server verifification
        ApicCertPath string `json:"apic-cert-path,omitempty"`

        // The type of the ACI VMM domain: either "kubernetes",
        // "openshift"
        AciVmmDomainType string `json:"aci-vmm-type,omitempty"`

        // The name of the ACI VMM domain
        AciVmmDomain string `json:"aci-vmm-domain,omitempty"`

        // The name of the ACI VMM domain controller instance
        AciVmmController string `json:"aci-vmm-controller,omitempty"`

        // Name prefix to use when creating policy to avoid namespace
        // collisions
        AciPrefix string `json:"aci-prefix,omitempty"`

        // Tenant to use when creating policy objects in APIC
        AciPolicyTenant string `json:"aci-policy-tenant,omitempty"`

        // Load Balancer Type
        LBType string `json:"lb-type,omitempty"`

        // Physical domain used for service device clusters
        AciServicePhysDom string `json:"aci-service-phys-dom,omitempty"`

        // Encap used for service device clusters
        AciServiceEncap string `json:"aci-service-encap,omitempty"`

        // Time in seconds between service node ICMP probes for more
        // quickly removing failed nodes from service pools
        // 0 (default) means don't monitor
        AciServiceMonitorInterval int `json:"aci-service-monitor-interval,omitempty"`

        // Whether to enable PBR tracking for non-SNAT services
        // when AciServiceMonitorInterval is set to non-zero, PBR tracking
        // is enabled for snat
        AciPbrTrackingNonSnat bool `json:"aci-pbr-tracking-non-snat,omitempty"`

        // The tenants related to AciVrf where BDs/EPGs/Subnets could exist.
        // Usually AciVrfTenant and AciPolicyTenant
        AciVrfRelatedTenants []string `json:"aci-vrf-related-tenants,omitempty"`

        // ACI Pod-BD for this kubernetes instance
        AciPodBdDn string `json:"aci-podbd-dn,omitempty"`

        // ACI Node-BD for this kubernetes instance
        AciNodeBdDn string `json:"aci-nodebd-dn,omitempty"`

        // ACI VRF for this kubernetes instance
        AciVrf string `json:"aci-vrf,omitempty"`

        // ACI VRF for this kubernetes instance
        AciVrfDn string `json:"aci-vrf-dn,omitempty"`

        // Tenant containing the ACI VRF for this kubernetes instance
        AciVrfTenant string `json:"aci-vrf-tenant,omitempty"`

        // L3 out to use for services, service device clusters need to be
        // created in this tenant
        AciL3Out string `json:"aci-l3out,omitempty"`

        // L3 external networks (within the l3out) that will be able to
        // access the service IPs
        AciExtNetworks []string `json:"aci-ext-networks,omitempty"`

        // IP addresses used for pod network
        PodIpPool []ipam.IpRange `json:"pod-ip-pool,omitempty"`

        // The number of IP addresses to allocate when a pod starts to run low
        PodIpPoolChunkSize int `json:"pod-subnet-chunk-size,omitempty"`

        // Pod subnet CIDRs in the form <gateway-address>/<prefix-length> that
        // cover all pod-ip-pools
        PodSubnets []string `json:"pod-subnets,omitempty"`

        // Whether to allocate service IPs or to assume they will be
        // allocated by another controller
        AllocateServiceIps *bool `json:"allocate-service-ips,omitempty"`

        // IP addresses used for externally exposed load balanced services
        ServiceIpPool []ipam.IpRange `json:"service-ip-pool,omitempty"`

        // IP addresses that can be requested as static service IPs in
        // service spec
        StaticServiceIpPool []ipam.IpRange `json:"static-service-ip-pool,omitempty"`

        // IP addresses to use for node service endpoints
        NodeServiceIpPool []ipam.IpRange `json:"node-service-ip-pool,omitempty"`

        // a list of subnet/gateway CIDR addresses that cover the
        // addresses in the node service IP pool
        NodeServiceSubnets []string `json:"node-service-subnets,omitempty"`

        // default port range to use for SNAT svc graph filter
        SnatDefaultPortRangeStart int `json:"snat-default-port-range-start,omitempty"`
        SnatDefaultPortRangeEnd   int `json:"snat-default-port-range-end,omitempty"`

        // Contract scope used for SNAT svc graph
        SnatSvcContractScope string `json:"snat-contract-scope,omitempty"`

        // Maximum number of nodes permitted in a svc graph
        MaxSvcGraphNodes int `json:"max-nodes-svc-graph,omitempty"`

        // Disable routine to sync snatglobalinfo with nodeinfo
        // periodically
        DisablePeriodicSnatGlobalInfoSync bool `json:"disable-periodic-snat-global-info-sync,omitempty"`

        // Install Istio ControlPlane components
        InstallIstio bool `json:"install-istio,omitempty"`

        // Maximum CSR tunnels
        MaxCSRTunnels   int `json:"max-csr-tunnels,omitempty"`
        CSRTunnelIDBase int `json:"csr-tunnel-id-base,omitempty"`
        // enable EndpointSlice
        EnabledEndpointSlice bool `json:"enable_endpointslice,omitempty"`
}

type netIps struct {
        V4 *ipam.IpAlloc
        V6 *ipam.IpAlloc
}

func newNetIps() *netIps {
        return &netIps{
                V4: ipam.New(),
                V6: ipam.New(),
        }
}

func NewConfig() *ControllerConfig {
        t := true
        return &ControllerConfig{
                DefaultSg:          make([]OpflexGroup, 0),
                NamespaceDefaultEg: make(map[string]OpflexGroup),
                NamespaceDefaultSg: make(map[string][]OpflexGroup),
                AciVmmDomainType:   "Kubernetes",
                AciPolicyTenant:    "kubernetes",
                AciPrefix:          "kube",
                AllocateServiceIps: &t,
                LBType:             lbTypeAci,
        }
}

func InitFlags(config *ControllerConfig) {
        flag.StringVar(&config.LogLevel, "log-level", "info", "Log level")

        flag.StringVar(&config.KubeConfig, "kube-config", "", "Absolute path to a kubeconfig file")

        flag.IntVar(&config.StatusPort, "status-port", 8091, " TCP port to run status server on (or 0 to disable)")
        flag.StringVar(&config.LBType, "loadbalancer", lbTypeAci, "Loadbalancer")
        flag.IntVar(&config.MaxCSRTunnels, "max-csr-tunnels", 16, "Number of CSR tunnels")
        flag.IntVar(&config.CSRTunnelIDBase, "csr-tunnel-id-base", 4001, "CSR starting tunnel ID")
}

func (cont *AciController) loadIpRanges(v4 *ipam.IpAlloc, v6 *ipam.IpAlloc,
        ipranges []ipam.IpRange) {

        for _, r := range ipranges {
                if r.Start.To4() != nil && r.End.To4() != nil {
                        v4.AddRange(r.Start, r.End)
                } else if r.Start.To16() != nil && r.End.To16() != nil {
                        v6.AddRange(r.Start, r.End)
                } else {
                        cont.log.Warn("Range invalid: ", r)
                }
        }
}

func (cont *AciController) initIpam() {
        cont.loadIpRanges(cont.configuredPodNetworkIps.V4, cont.configuredPodNetworkIps.V6,
                cont.config.PodIpPool)
        cont.podNetworkIps.V4.AddAll(cont.configuredPodNetworkIps.V4)
        cont.podNetworkIps.V6.AddAll(cont.configuredPodNetworkIps.V6)
        cont.serviceIps.LoadRanges(cont.config.ServiceIpPool)
        cont.loadIpRanges(cont.staticServiceIps.V4, cont.staticServiceIps.V6,
                cont.config.StaticServiceIpPool)
        cont.loadIpRanges(cont.nodeServiceIps.V4, cont.nodeServiceIps.V6,
                cont.config.NodeServiceIpPool)
}

1	// Copyright 2017 Cisco Systems, Inc.
2	//
3	// Licensed under the Apache License, Version 2.0 (the "License");
4	// you may not use this file except in compliance with the License.
5	// You may obtain a copy of the License at
6	//
7	// http://www.apache.org/licenses/LICENSE-2.0
8	//
9	// Unless required by applicable law or agreed to in writing, software
10	// distributed under the License is distributed on an "AS IS" BASIS,
11	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	// See the License for the specific language governing permissions and
13	// limitations under the License.
14
15	package controller
16
17	import (
18	"flag"
19
20	"github.com/noironetworks/aci-containers/pkg/ipam"
21	)
22
23	const (
24	lbTypeAci = "aci-nlb"
25	)
26
27	type OpflexGroup struct {
28	PolicySpace string `json:"policy-space,omitempty"`
29	Name string `json:"name,omitempty"`
30	}
31
32	// Configuration for the controller
33	type ControllerConfig struct {
34	// Log level
35	LogLevel string `json:"log-level,omitempty"`
36
37	// Absolute path to a kubeconfig file
38	KubeConfig string `json:"kubeconfig,omitempty"`
39
40	// TCP port to run status server on (or 0 to disable)
41	StatusPort int `json:"status-port,omitempty"`
42
43	// Default endpoint group annotation value
44	DefaultEg OpflexGroup `json:"default-endpoint-group,omitempty"`
45
46	// Default security group annotation value
47	DefaultSg []OpflexGroup `json:"default-security-group,omitempty"`
48
49	// Override default endpoint group assignments for a namespace
50	// map ns name -> group
51	NamespaceDefaultEg map[string]OpflexGroup `json:"namespace-default-endpoint-group,omitempty"`
52
53	// Override default security group assignments for namespaces
54	// map ns name -> slice of groups
55	NamespaceDefaultSg map[string][]OpflexGroup `json:"namespace-default-security-group,omitempty"`
56
57	// The hostnames or IPs for connecting to apic
58	ApicHosts []string `json:"apic-hosts,omitempty"`
59
60	// The username for connecting to APIC
61	ApicUsername string `json:"apic-username,omitempty"`
62
63	// The password for connecting to APIC
64	ApicPassword string `json:"apic-password,omitempty"`
65
66	// The number of seconds that APIC should wait before timing
67	// out a subscription on a websocket connection. If not
68	// explicitly set, then a default of 900 seconds will
69	// be sent in websocket subscriptions. If it is set to 0,
70	// then a timeout will not be sent in websocket
71	// subscriptions, and APIC will use it's default timeout
72	// of 80 seconds. If set to a non-zero value, then the
73	// timeout value will be provided when we subscribe to
74	// a URL on APIC. NOTE: the subscription timeout is not
75	// supported by APIC versions before 3.2(3), so this
76	// value must not be set when used with APIC versions
77	// older than that release.
78	// Also, note that this is a string.
79	ApicRefreshTimer string `json:"apic-refreshtime,omitempty"`
80
81	// How early (seconds) the subscriptions to be refreshed than
82	// actual subscription refresh-timeout. Will be defaulted to 5Seconds.
83	ApicRefreshTickerAdjust string `json:"apic-refreshticker-adjust,omitempty"`
84
85	// A path for a PEM-encoded private key for client certificate
86	// authentication for APIC API
87	ApicPrivateKeyPath string `json:"apic-private-key-path,omitempty"`
88
89	// A path for a PEM-encoded public certificate for APIC server to
90	// enable secure TLS server verifification
91	ApicCertPath string `json:"apic-cert-path,omitempty"`
92
93	// The type of the ACI VMM domain: either "kubernetes",
94	// "openshift"
95	AciVmmDomainType string `json:"aci-vmm-type,omitempty"`
96
97	// The name of the ACI VMM domain
98	AciVmmDomain string `json:"aci-vmm-domain,omitempty"`
99
100	// The name of the ACI VMM domain controller instance
101	AciVmmController string `json:"aci-vmm-controller,omitempty"`
102
103	// Name prefix to use when creating policy to avoid namespace
104	// collisions
105	AciPrefix string `json:"aci-prefix,omitempty"`
106
107	// Tenant to use when creating policy objects in APIC
108	AciPolicyTenant string `json:"aci-policy-tenant,omitempty"`
109
110	// Load Balancer Type
111	LBType string `json:"lb-type,omitempty"`
112
113	// Physical domain used for service device clusters
114	AciServicePhysDom string `json:"aci-service-phys-dom,omitempty"`
115
116	// Encap used for service device clusters
117	AciServiceEncap string `json:"aci-service-encap,omitempty"`
118
119	// Time in seconds between service node ICMP probes for more
120	// quickly removing failed nodes from service pools
121	// 0 (default) means don't monitor
122	AciServiceMonitorInterval int `json:"aci-service-monitor-interval,omitempty"`
123
124	// Whether to enable PBR tracking for non-SNAT services
125	// when AciServiceMonitorInterval is set to non-zero, PBR tracking
126	// is enabled for snat
127	AciPbrTrackingNonSnat bool `json:"aci-pbr-tracking-non-snat,omitempty"`
128
129	// The tenants related to AciVrf where BDs/EPGs/Subnets could exist.
130	// Usually AciVrfTenant and AciPolicyTenant
131	AciVrfRelatedTenants []string `json:"aci-vrf-related-tenants,omitempty"`
132
133	// ACI Pod-BD for this kubernetes instance
134	AciPodBdDn string `json:"aci-podbd-dn,omitempty"`
135
136	// ACI Node-BD for this kubernetes instance
137	AciNodeBdDn string `json:"aci-nodebd-dn,omitempty"`
138
139	// ACI VRF for this kubernetes instance
140	AciVrf string `json:"aci-vrf,omitempty"`
141
142	// ACI VRF for this kubernetes instance
143	AciVrfDn string `json:"aci-vrf-dn,omitempty"`
144
145	// Tenant containing the ACI VRF for this kubernetes instance
146	AciVrfTenant string `json:"aci-vrf-tenant,omitempty"`
147
148	// L3 out to use for services, service device clusters need to be
149	// created in this tenant
150	AciL3Out string `json:"aci-l3out,omitempty"`
151
152	// L3 external networks (within the l3out) that will be able to
153	// access the service IPs
154	AciExtNetworks []string `json:"aci-ext-networks,omitempty"`
155
156	// IP addresses used for pod network
157	PodIpPool []ipam.IpRange `json:"pod-ip-pool,omitempty"`
158
159	// The number of IP addresses to allocate when a pod starts to run low
160	PodIpPoolChunkSize int `json:"pod-subnet-chunk-size,omitempty"`
161
162	// Pod subnet CIDRs in the form <gateway-address>/<prefix-length> that
163	// cover all pod-ip-pools
164	PodSubnets []string `json:"pod-subnets,omitempty"`
165
166	// Whether to allocate service IPs or to assume they will be
167	// allocated by another controller
168	AllocateServiceIps *bool `json:"allocate-service-ips,omitempty"`
169
170	// IP addresses used for externally exposed load balanced services
171	ServiceIpPool []ipam.IpRange `json:"service-ip-pool,omitempty"`
172
173	// IP addresses that can be requested as static service IPs in
174	// service spec
175	StaticServiceIpPool []ipam.IpRange `json:"static-service-ip-pool,omitempty"`
176
177	// IP addresses to use for node service endpoints
178	NodeServiceIpPool []ipam.IpRange `json:"node-service-ip-pool,omitempty"`
179
180	// a list of subnet/gateway CIDR addresses that cover the
181	// addresses in the node service IP pool
182	NodeServiceSubnets []string `json:"node-service-subnets,omitempty"`
183
184	// default port range to use for SNAT svc graph filter
185	SnatDefaultPortRangeStart int `json:"snat-default-port-range-start,omitempty"`
186	SnatDefaultPortRangeEnd int `json:"snat-default-port-range-end,omitempty"`
187
188	// Contract scope used for SNAT svc graph
189	SnatSvcContractScope string `json:"snat-contract-scope,omitempty"`
190
191	// Maximum number of nodes permitted in a svc graph
192	MaxSvcGraphNodes int `json:"max-nodes-svc-graph,omitempty"`
193
194	// Disable routine to sync snatglobalinfo with nodeinfo
195	// periodically
196	DisablePeriodicSnatGlobalInfoSync bool `json:"disable-periodic-snat-global-info-sync,omitempty"`
197
198	// Install Istio ControlPlane components
199	InstallIstio bool `json:"install-istio,omitempty"`
200
201	// Maximum CSR tunnels
202	MaxCSRTunnels int `json:"max-csr-tunnels,omitempty"`
203	CSRTunnelIDBase int `json:"csr-tunnel-id-base,omitempty"`
204	// enable EndpointSlice
205	EnabledEndpointSlice bool `json:"enable_endpointslice,omitempty"`
206	}
207
208	type netIps struct {
209	V4 *ipam.IpAlloc
210	V6 *ipam.IpAlloc
211	}
212
213	func newNetIps() *netIps {	1✔
214	return &netIps{	1✔
215	V4: ipam.New(),	1✔
216	V6: ipam.New(),	1✔
217	}	1✔
218	}	1✔
219
220	func NewConfig() *ControllerConfig {	1✔
221	t := true	1✔
222	return &ControllerConfig{	1✔
223	DefaultSg: make([]OpflexGroup, 0),	1✔
224	NamespaceDefaultEg: make(map[string]OpflexGroup),	1✔
225	NamespaceDefaultSg: make(map[string][]OpflexGroup),	1✔
226	AciVmmDomainType: "Kubernetes",	1✔
227	AciPolicyTenant: "kubernetes",	1✔
228	AciPrefix: "kube",	1✔
229	AllocateServiceIps: &t,	1✔
230	LBType: lbTypeAci,	1✔
231	}	1✔
232	}	1✔
233
234	func InitFlags(config *ControllerConfig) {	×
235	flag.StringVar(&config.LogLevel, "log-level", "info", "Log level")	×
236		×
237	flag.StringVar(&config.KubeConfig, "kube-config", "", "Absolute path to a kubeconfig file")	×
238		×
239	flag.IntVar(&config.StatusPort, "status-port", 8091, " TCP port to run status server on (or 0 to disable)")	×
240	flag.StringVar(&config.LBType, "loadbalancer", lbTypeAci, "Loadbalancer")	×
241	flag.IntVar(&config.MaxCSRTunnels, "max-csr-tunnels", 16, "Number of CSR tunnels")	×
242	flag.IntVar(&config.CSRTunnelIDBase, "csr-tunnel-id-base", 4001, "CSR starting tunnel ID")	×
243	}	×
244
245	func (cont AciController) loadIpRanges(v4 ipam.IpAlloc, v6 *ipam.IpAlloc,
246	ipranges []ipam.IpRange) {	1✔
247		1✔
248	for _, r := range ipranges {	2✔
249	if r.Start.To4() != nil && r.End.To4() != nil {	2✔
250	v4.AddRange(r.Start, r.End)	1✔
251	} else if r.Start.To16() != nil && r.End.To16() != nil {	3✔
252	v6.AddRange(r.Start, r.End)	1✔
253	} else {	1✔
254	cont.log.Warn("Range invalid: ", r)	×
255	}	×
256	}
257	}
258
259	func (cont *AciController) initIpam() {	1✔
260	cont.loadIpRanges(cont.configuredPodNetworkIps.V4, cont.configuredPodNetworkIps.V6,	1✔
261	cont.config.PodIpPool)	1✔
262	cont.podNetworkIps.V4.AddAll(cont.configuredPodNetworkIps.V4)	1✔
263	cont.podNetworkIps.V6.AddAll(cont.configuredPodNetworkIps.V6)	1✔
264	cont.serviceIps.LoadRanges(cont.config.ServiceIpPool)	1✔
265	cont.loadIpRanges(cont.staticServiceIps.V4, cont.staticServiceIps.V6,	1✔
266	cont.config.StaticServiceIpPool)	1✔
267	cont.loadIpRanges(cont.nodeServiceIps.V4, cont.nodeServiceIps.V6,	1✔
268	cont.config.NodeServiceIpPool)	1✔
269	}	1✔

noironetworks / aci-containers / 4810

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous