pass portmappings to cni if hostport mapping disabled on CRI-O #7216

girishsg24 · 2023-08-15T14:12:19Z

The feature to disable hostport mapping on CRI-O expects the CNI to handle hostport mapping but CRI-O is not passing the mappings, this commit fixes the bug

What type of PR is this?

/kind bug

What this PR does / why we need it:

With the new feature to disable hostport mapping on CRI-O to delegate the functionality to CNI, the expectation is to send the portmappings into the CNIPlugin.SetUpPodWithContext which is missing. This commit fixes the bug and handles both pod create and delete scenario

// pod spec
 ports:
    - containerPort: 50001
      hostPort: 50001
      name: extserver
      protocol: TCP

journalctl -u crio --since '10 minutes ago' | grep 'Got pod network' | grep foo
Aug 15 06:37:33 node1 crio.bin[1117391]: time="2023-08-15 06:37:33.865572528Z" level=info msg="Got pod network &{Name:foo-0 Namespace:foo ID:9892968458c4fb057d03cfda1f5aebf68081cbdf8505effee9a72302694e41c8 UID:7b44b270-917c-4517-a6c5-819abc7e2557 NetNS:/var/run/netns/80a1f624-a394-453e-8d8f-f13c097c1603 Networks:[] RuntimeConfig:map[multus-cni:{IP: MAC: PortMappings:[] Bandwidth:<nil> IpRanges:[] CgroupPath:kubepods-burstable-pod7b44b270_917c_4517_a6c5_819abc7e2557.slice}] Aliases:map[]}" file="ocicni/ocicni.go:795"
Aug 15 06:37:34 node1 crio.bin[1117391]: time="2023-08-15 06:37:34.027172910Z" level=info msg="Got pod network &{Name:foo-0 Namespace:foo ID:9892968458c4fb057d03cfda1f5aebf68081cbdf8505effee9a72302694e41c8 UID:7b44b270-917c-4517-a6c5-819abc7e2557 NetNS:/var/run/netns/80a1f624-a394-453e-8d8f-f13c097c1603 Networks:[] RuntimeConfig:map[multus-cni:{IP: MAC: PortMappings:[] Bandwidth:<nil> IpRanges:[] CgroupPath:kubepods-burstable-pod7b44b270_917c_4517_a6c5_819abc7e2557.slice}] Aliases:map[]}" file="ocicni/ocicni.go:795"

PortMappings:[] is empty regardless

// After the fix
Aug 15 14:49:19 node1 crio.bin[2724298]: time="2023-08-15 14:49:19.332286443Z" level=info msg="Got pod network &{Name:foo-0 Namespace:foo ID:f95f82f357fcb765ce0e2eef34500c4e04722067411d52b835c99827f1900c19 UID:2ac8f5af-1fc7-469f-a892-79251fb7d59f NetNS:/var/run/netns/7f96cb59-6535-4fdd-8cf0-26b1e383c9cd Networks:[] RuntimeConfig:map[multus-cni:{IP: MAC: PortMappings:[{HostPort:50001 ContainerPort:50001 Protocol:TCP HostIP:}] Bandwidth:<nil> IpRanges:[] CgroupPath:kubepods-burstable-pod2ac8f5af_1fc7_469f_a892_79251fb7d59f.slice}] Aliases:map[]}" file="ocicni/ocicni.go:795"

PortMappings:[{HostPort:50001 ContainerPort:50001 Protocol:TCP HostIP:}]

IPtable rules are created in the NAT table by portmap plugin

Which issue(s) this PR fixes:

#7217

Special notes for your reviewer:

Does this PR introduce a user-facing change?

None

The feature to disable hostport mapping on CRI-O expects the CNI to handle hostport mapping but CRI-O is not passing the mappings, this commit fixes the bug Signed-off-by: Girish Siddananjappa Gangappa <[email protected]>

openshift-ci · 2023-08-15T14:12:26Z

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-08-15T14:12:34Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: girishsg24
Once this PR has been reviewed and has the lgtm label, please assign mrunalp for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-08-15T14:12:36Z

Hi @girishsg24. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

saschagrunert

I think we need an integration test for that use case.

codecov · 2023-08-15T14:25:04Z

Codecov Report

Merging #7216 (fb3d1b2) into main (f1bb831) will decrease coverage by 0.04%.
Report is 21 commits behind head on main.
The diff coverage is 30.76%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7216      +/-   ##
==========================================
- Coverage   49.23%   49.20%   -0.04%     
==========================================
  Files         136      136              
  Lines       15517    15528      +11     
==========================================
  Hits         7640     7640              
- Misses       6973     6982       +9     
- Partials      904      906       +2

girishsg24 · 2023-08-16T04:35:01Z

I think we need an integration test for that use case.

I can add one. any pointers?
Also i see the metrics container test 181 failed and looks like its failing for other pr too (#7219)

saschagrunert · 2023-08-16T07:16:18Z

Yeah we have a hostport connection test here:

cri-o/test/network.bats

Lines 77 to 101 in 032e17f

    
           @test "Connect to pod hostport from the host" { 
        
           	if is_cgroup_v2; then 
        
           		skip "node configured with cgroupv2 flakes this test sometimes" 
        
           	fi 
        
           	start_crio 
        
           	pod_config="$TESTDIR"/sandbox_config.json 
        
           	jq '	  .port_mappings = [ { 
        
           			protocol: 0, 
        
           			container_port: 80, 
        
           			host_port: 4888 
        
           		} ] 
        
           		| .hostname = "very.unique.name" ' \ 
        
           		"$TESTDATA"/sandbox_config.json > "$pod_config" 
        
           	ctr_config="$TESTDIR"/container_config.json 
        
           	jq '	  .command = [ "/bin/nc", "-ll", "-p", "80", "-e", "/bin/hostname" ]' \ 
        
           		"$TESTDATA"/container_config.json > "$ctr_config" 
        
           	crictl run "$ctr_config" "$pod_config" 
        
           	host_ip=$(get_host_ip) 
        
           	output=$(nc -w 5 "$host_ip" 4888 < /dev/null) 
        
           	[ "$output" = "very.unique.name" ] 
        
           }

We can also specify the CNI plugin and type in the tests directly, like there:

cri-o/test/network.bats

Line 63 in 032e17f

    
           CNI_DEFAULT_NETWORK="crio-${TESTDIR: -10}" CNI_TYPE="cni_plugin_helper.bash" start_crio

haircommander · 2023-08-16T16:45:08Z

/ok-to-test

haircommander · 2023-08-21T15:55:48Z

/retest

github-actions · 2023-09-21T00:02:20Z

A friendly reminder that this PR had no activity for 30 days.

github-actions · 2023-12-21T00:02:54Z

Closing this PR since it had no activity in the past 90 days.

EmilyShepherd · 2024-04-08T04:41:09Z

This change is good - it would be a shame if it were not merged in some form or another at some point.

cri-o's current behaviour, of not passing portMappings onto the CNI plugins under any circumstances, is not the behaviour I would have expected.

pass portmappings to cni if hostport mapping disabled on CRI-O

fb3d1b2

The feature to disable hostport mapping on CRI-O expects the CNI to handle hostport mapping but CRI-O is not passing the mappings, this commit fixes the bug Signed-off-by: Girish Siddananjappa Gangappa <[email protected]>

girishsg24 requested a review from mrunalp as a code owner August 15, 2023 14:12

openshift-ci bot requested review from hasan4791 and sohankunkerkar August 15, 2023 14:12

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 15, 2023

saschagrunert reviewed Aug 15, 2023

View reviewed changes

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 16, 2023

haircommander added this to the 1.28 milestone Aug 16, 2023

haircommander removed this from the 1.28 milestone Aug 21, 2023

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 21, 2023

github-actions bot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Dec 21, 2023

github-actions bot closed this Dec 21, 2023

pass portmappings to cni if hostport mapping disabled on CRI-O #7216

pass portmappings to cni if hostport mapping disabled on CRI-O #7216

Uh oh!

Conversation

girishsg24 commented Aug 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci bot commented Aug 15, 2023

Uh oh!

openshift-ci bot commented Aug 15, 2023

Uh oh!

openshift-ci bot commented Aug 15, 2023

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Aug 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

girishsg24 commented Aug 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

saschagrunert commented Aug 16, 2023

Uh oh!

haircommander commented Aug 16, 2023

Uh oh!

haircommander commented Aug 21, 2023

Uh oh!

github-actions bot commented Sep 21, 2023

Uh oh!

github-actions bot commented Dec 21, 2023

Uh oh!

EmilyShepherd commented Apr 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

girishsg24 commented Aug 15, 2023 •

edited

Loading

codecov bot commented Aug 15, 2023 •

edited

Loading

girishsg24 commented Aug 16, 2023 •

edited

Loading