kubeovn / kube-ovn / 28423571543

27%

Build Type

push

github

Committed by web-flow

Commit Message

fix(daemon): make tproxy work with kube-ovn as secondary CNI (#6850)

* fix(daemon): make tproxy work with kube-ovn as secondary CNI

The tproxy health check probe hardcoded the default provider when
building the OVS iface-id, so pods whose primary network is provided
by a kube-ovn attachment network (e.g. via the multus default-network
annotation) never got their netns resolved and kubelet probes
intercepted by TPROXY were dropped.

Worse, when another CNI provides the primary network, TPROXY iptables
rules were still generated from pod.Status.PodIPs, actively breaking
health checks that would otherwise work.

Match pod.Status.PodIPs against the ip_address annotations to find the
kube-ovn provider that actually owns the pod's primary network:

- no provider matches (kube-ovn is a pure secondary CNI): skip the pod
  so tproxy does not intercept its probes;
- a provider matches: use it to build the OVS iface-id and check its
  logical switch subnet for the custom VPC condition, so probes work
  for attachment networks used as the multus default network.

Also skip pods referencing a deleted subnet instead of failing the
whole tproxy reconciliation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(daemon): use provider-scoped virtualmachine annotation for tproxy iface-id

The controller writes the virtualmachine annotation per provider, so the
default-provider-only key fails to resolve the VM port name when the
primary network provider is not the default one.

Addresses Copilot review feedback on #6850.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

---------

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

46 of 57 new or added lines in 3 files covered. (80.7%)

9 existing lines in 3 files now uncovered.

16355 of 60267 relevant lines covered (27.14%)

0.32 hits per line