Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

If the NetNS path does not exist, error should not be returned, otherwise it may cause ip leakage #685

Closed
silenceper opened this issue Jan 6, 2022 · 0 comments · Fixed by #686
Closed

If the NetNS path does not exist, error should not be returned, otherwise it may cause ip leakage #685

silenceper opened this issue Jan 6, 2022 · 0 comments · Fixed by #686

Comments

@silenceper
Copy link
Contributor

There are some situations that may cause the netns file (/proc/xxx/net/ns) to not exist, such as when the upper-level kubelet component cleans up pods.

Related discussion： kubernetes/kubernetes#43014 (comment)

if NetNs is passed down by the Cloud Orchestration Engine, or if it called multiple times, so don't return an error if the device is already removed.

ip release failed, resulting in ip leak :
kubernetes/kubernetes#107371

multus-cni also fixed this problem:
k8snetworkplumbingwg/multus-cni#120
silenceper added a commit to silenceper/plugins that referenced this issue Jan 6, 2022
@silenceper
fix containernetworking#685
1d9f1a9
silenceper added a commit to silenceper/plugins that referenced this issue Jan 6, 2022
@silenceper
fix containernetworking#685
67110e0 
Signed-off-by: silenceper <silenceper@gmail.com>
@silenceper silenceper mentioned this issue Jan 6, 2022
Merged
MikeZappa87 pushed a commit to MikeZappa87/plugins that referenced this issue Jan 20, 2022
@silenceper
fix containernetworking#685
dabbbc9 
Signed-off-by: silenceper <silenceper@gmail.com>
@wedaly wedaly mentioned this issue Jul 21, 2022
Merged
6 tasks
aanm pushed a commit to cilium/cilium that referenced this issue Jul 28, 2022
@wedaly @aanm
cilium-cni: delegated IPAM DEL even when netns does not exist
645c8d5 
If the network namespace has been deleted before CNI DEL is invoked,
Cilium CNI should still invoke the delegated IPAM plugin to
release the IP address.

This matches the behavior of the "bridge" reference plugin,
which invokes delegated plugin DEL when the network
namespace has been deleted:
containernetworking/plugins#685
containernetworking/plugins#686

I tested the changes in a kind cluster configuring Cilium CNI
to use the reference host-local plugin for IPAM. The cilium
connectivity tests pass. I also repeatedly deleted pods
from a deployment to trigger the "Unable to enter namespace"
warning in the Cilium CNI logs, then verified that the
delegated IPAM plugin DEL was invoked to release the IPs.

Signed-off-by: Will Daly <widaly@microsoft.com>
dezmodue pushed a commit to dezmodue/cilium that referenced this issue Aug 10, 2022
@wedaly @dezmodue
cilium-cni: delegated IPAM DEL even when netns does not exist
261cc3c 
If the network namespace has been deleted before CNI DEL is invoked,
Cilium CNI should still invoke the delegated IPAM plugin to
release the IP address.

This matches the behavior of the "bridge" reference plugin,
which invokes delegated plugin DEL when the network
namespace has been deleted:
containernetworking/plugins#685
containernetworking/plugins#686

I tested the changes in a kind cluster configuring Cilium CNI
to use the reference host-local plugin for IPAM. The cilium
connectivity tests pass. I also repeatedly deleted pods
from a deployment to trigger the "Unable to enter namespace"
warning in the Cilium CNI logs, then verified that the
delegated IPAM plugin DEL was invoked to release the IPs.

Signed-off-by: Will Daly <widaly@microsoft.com>
nbusseneau pushed a commit to nbusseneau/cilium that referenced this issue Aug 10, 2022
@wedaly @nbusseneau
cilium-cni: delegated IPAM DEL even when netns does not exist
26f66d6 
[ upstream commit 645c8d5 ]

If the network namespace has been deleted before CNI DEL is invoked,
Cilium CNI should still invoke the delegated IPAM plugin to
release the IP address.

This matches the behavior of the "bridge" reference plugin,
which invokes delegated plugin DEL when the network
namespace has been deleted:
containernetworking/plugins#685
containernetworking/plugins#686

I tested the changes in a kind cluster configuring Cilium CNI
to use the reference host-local plugin for IPAM. The cilium
connectivity tests pass. I also repeatedly deleted pods
from a deployment to trigger the "Unable to enter namespace"
warning in the Cilium CNI logs, then verified that the
delegated IPAM plugin DEL was invoked to release the IPs.

Signed-off-by: Will Daly <widaly@microsoft.com>
Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
tklauser pushed a commit to cilium/cilium that referenced this issue Aug 11, 2022
@wedaly @tklauser
cilium-cni: delegated IPAM DEL even when netns does not exist
54cadf8 
[ upstream commit 645c8d5 ]

If the network namespace has been deleted before CNI DEL is invoked,
Cilium CNI should still invoke the delegated IPAM plugin to
release the IP address.

This matches the behavior of the "bridge" reference plugin,
which invokes delegated plugin DEL when the network
namespace has been deleted:
containernetworking/plugins#685
containernetworking/plugins#686

I tested the changes in a kind cluster configuring Cilium CNI
to use the reference host-local plugin for IPAM. The cilium
connectivity tests pass. I also repeatedly deleted pods
from a deployment to trigger the "Unable to enter namespace"
warning in the Cilium CNI logs, then verified that the
delegated IPAM plugin DEL was invoked to release the IPs.

Signed-off-by: Will Daly <widaly@microsoft.com>
Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
tjjh89017 pushed a commit to tjjh89017/plugins that referenced this issue Aug 18, 2022
@silenceper
fix containernetworking#685
651b658 
Signed-off-by: silenceper <silenceper@gmail.com>
mccv1r0 pushed a commit to mccv1r0/plugins that referenced this issue Jan 4, 2023
@silenceper @mccv1r0
fix containernetworking#685
c77b397 
Signed-off-by: silenceper <silenceper@gmail.com>
mccv1r0 pushed a commit to mccv1r0/plugins that referenced this issue Jan 10, 2023
@silenceper @mccv1r0
fix containernetworking#685
a1afd0d 
Signed-off-by: silenceper <silenceper@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Ignore NetNS path errors on delete silenceper/plugins
1 participant
@silenceper