kubeovn / kube-ovn / 27389982525

27%

Build Type

push

github

Committed by web-flow

Commit Message

fix: misc bug fixes from code audit (#6856)

* fix(controller): gc all stale reserved vips in one pass

gcVip returned nil right after releasing the first stale reserved VIP,
so the remaining stale VIPs in the list were never processed. Since gc
runs only once at controller startup, those VIPs kept their ip_reserved
label for the whole controller lifetime, blocking new pods from reusing
them via the ovn.kubernetes.io/vip annotation.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(controller): use resolved IP CR name in update failure error

The update branch of createOrUpdateIPCR formatted the error with
ipCRName, which is empty for the node/u2o/mcast querier IP paths;
use the resolved ipName like the create branch does.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(controller): avoid mutating conditions slice while iterating it

resyncProviderNetworkStatus called RemoveNodeConditions inside a range
over pn.Status.Conditions; slices.Delete shifts elements in the shared
backing array, so the condition adjacent to a removed one was skipped
and tail iterations read zeroed entries. Collect the stale node names
first, then remove them after the loop.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(daemon): guard DefaultEncapIP access with node networks lock

loopEncapIPCheck wrote config.DefaultEncapIP without holding
nodeNetworksMutex while setEncapIPs reads it under RLock from the
updateNode worker goroutine, which is a data race. Add a locked setter
and use it there. Also move the networkName=="" early return in
GetEncapIPByNetwork under the RLock, which had the same unguarded read.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(daemon): add missing path separator in ipsec CSR file path

ipsecReqPath was built without the separator, producing
/etc/ovs_ipsec_keysipsec-req.pem outside the keys directory, so
clearIPSecKeysDir could never clean the CSR up after rotation.

Signed-off-by: Mengxin Liu <liu... (continued)

Coverage Stats

3 of 27 new or added lines in 7 files covered. (11.11%)

2 existing lines in 2 files now uncovered.

15451 of 58655 relevant lines covered (26.34%)

0.31 hits per line