noironetworks / aci-containers / 12055

64%

master: 64%

Build Type

push

travis-pro

Committed by jeffinkottaram

Commit Message

Rework hpp direct mode for scale, restart safety and correctness

hpp-direct rebuilt and rewrote state on every event with no idempotency
or actual-state reconcile, did agent-side label filtering to resolve
remote IPs, and had no sync checkpoint on restart. At scale this meant
redundant renders, CR writes and netpol-file churn, and on restart it
prematurely deleted CRs/files that were still being rebuilt.

CRD:
- Simplify the HostprotPol (HPP) / HostprotRemoteIpContainer (RIC)
  schema: a rule references a single RIC and carries flat pre-resolved
  IPs; drop the label/filter-container types the agent used to filter
  on. Fix the API group (aci.snat -> aci.hpp) and regenerate clients.

Controller:
- Resolve peer IPs up front and hash NetworkPolicies canonically
  (order-independent) so equivalent policies share one HPP CR; keep a
  RIC reverse index for targeted updates.
- Read HPP/RIC through informers instead of live client Gets, and
  reconcile desired-vs-actual idempotently on dedicated work queues
  (create/update/delete only on real diffs).
- Gate stale HPP/RIC deletion on an initial NetworkPolicy sync
  checkpoint so a restart no longer removes CRs still being rebuilt.
- Merge sibling-NP named-port rules and de-dupe rules by content-derived
  name; scope named-port egress per destination IP; emit service-augment
  rules on the CR path.

Hostagent:
- Render off the informer callback onto a rate-limited, deduped,
  node-locality-gated queue, keeping a RIC->HPP reverse index instead of
  rescanning every HPP per RIC event.
- Write netpol files atomically (tmp + rename) with a content-based
  skip, and defer stale-file pruning until the initial render batch
  completes; static/node policies still write eagerly.
- Fix remote-IP CIDR normalization to use net.ParseIP so bare IPv6
  addresses get /128 instead of an incorrect /32, and make protocol
  matching case-insensitive with an added icmpv6 case.
- Track hpp as its own sync type gating taint remova... (continued)

Coverage Stats

552 of 707 new or added lines in 11 files covered. (78.08%)

56 existing lines in 2 files now uncovered.

13743 of 21471 relevant lines covered (64.01%)

0.73 hits per line