Skip to content

Commit 0bb52d9

Browse files
zbb88888zbb88888
committed
fix conflict after cherry-pick
Signed-off-by: bobz965 <zhangbingbing2_yewu@cmss.chinamobile.com>
1 parent 87779e1 commit 0bb52d9

File tree

3 files changed

+40
-80
lines changed

3 files changed

+40
-80
lines changed

‎pkg/controller/controller.go

+3-26
Original file line numberDiff line numberDiff line change
@@ -789,10 +789,6 @@ func (c *Controller) Run(ctx context.Context) {
789789
util.LogFatalAndExit(err, "failed to initialize default vpc")
790790
}
791791

792-
if err := c.initNodeChassis(); err != nil {
793-
util.LogFatalAndExit(err, "failed to initialize node chassis")
794-
}
795-
796792
// sync ip crd before initIPAM since ip crd will be used to restore vm and statefulset pod in initIPAM
797793
if err := c.initSyncCrdIPs(); err != nil {
798794
util.LogFatalAndExit(err, "failed to sync crd ips")
@@ -806,41 +802,22 @@ func (c *Controller) Run(ctx context.Context) {
806802
util.LogFatalAndExit(err, "failed to initialize node routes")
807803
}
808804

809-
if err := c.initDenyAllSecurityGroup(); err != nil {
810-
util.LogFatalAndExit(err, "failed to initialize 'deny_all' security group")
811-
}
812-
813-
// remove resources in ovndb that not exist any more in kubernetes resources
814-
if err := c.gc(); err != nil {
815-
util.LogFatalAndExit(err, "failed to run gc")
816-
}
817-
818-
c.registerSubnetMetrics()
819805
if err := c.initSyncCrdSubnets(); err != nil {
820806
util.LogFatalAndExit(err, "failed to sync crd subnets")
821807
}
808+
822809
if err := c.initSyncCrdVlans(); err != nil {
823810
util.LogFatalAndExit(err, "failed to sync crd vlans")
824811
}
825812

826-
if c.config.PodDefaultFipType == util.IptablesFip {
827-
if err := c.initSyncCrdVpcNatGw(); err != nil {
828-
util.LogFatalAndExit(err, "failed to sync crd vpc nat gateways")
829-
}
830-
}
831-
832-
if c.config.EnableLb {
833-
if err := c.initVpcDnsConfig(); err != nil {
834-
util.LogFatalAndExit(err, "failed to initialize vpc-dns")
835-
}
836-
}
837-
838813
if err := c.addNodeGwStaticRoute(); err != nil {
839814
util.LogFatalAndExit(err, "failed to add static route for node gateway")
840815
}
841816

842817
// start workers to do all the network operations
843818
c.startWorkers(ctx)
819+
820+
c.initResourceOnce()
844821
<-ctx.Done()
845822
klog.Info("Shutting down workers")
846823
}

‎pkg/controller/subnet.go

-13
Original file line numberDiff line numberDiff line change
@@ -751,19 +751,6 @@ func (c *Controller) handleAddOrUpdateSubnet(key string) error {
751751
return err
752752
}
753753

754-
multicastSnoopFlag := map[string]string{"mcast_snoop": "true", "mcast_querier": "false"}
755-
if subnet.Spec.EnableMulicastSnoop {
756-
if err := c.OVNNbClient.LogicalSwitchUpdateOtherConfig(subnet.Name, ovsdb.MutateOperationInsert, multicastSnoopFlag); err != nil {
757-
klog.Errorf("enable logical switch multicast snoop %s: %v", subnet.Name, err)
758-
return err
759-
}
760-
} else {
761-
if err := c.OVNNbClient.LogicalSwitchUpdateOtherConfig(subnet.Name, ovsdb.MutateOperationDelete, multicastSnoopFlag); err != nil {
762-
klog.Errorf("disable logical switch multicast snoop %s: %v", subnet.Name, err)
763-
return err
764-
}
765-
}
766-
767754
subnet.Status.EnsureStandardConditions()
768755

769756
if err := c.updateSubnetDHCPOption(subnet, needRouter); err != nil {

‎pkg/ovs/ovn-nb-acl.go

+37-41
Original file line numberDiff line numberDiff line change
@@ -22,28 +22,32 @@ import (
2222
func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
2323
acls := make([]*ovnnb.ACL, 0)
2424

25-
ipSuffix := "ip4"
26-
if protocol == kubeovnv1.ProtocolIPv6 {
27-
ipSuffix = "ip6"
28-
}
25+
if strings.HasSuffix(asIngressName, ".0") || strings.HasSuffix(asIngressName, ".all") {
26+
// create the default drop rule for only once
27+
ipSuffix := "ip4"
28+
if protocol == kubeovnv1.ProtocolIPv6 {
29+
ipSuffix = "ip6"
30+
}
2931

30-
/* default drop acl */
31-
allIPMatch := NewAndACLMatch(
32-
NewACLMatch("outport", "==", "@"+pgName, ""),
33-
NewACLMatch(ipSuffix, "", "", ""),
34-
)
35-
options := func(acl *ovnnb.ACL) {
36-
if logEnable {
37-
acl.Log = true
38-
acl.Severity = &ovnnb.ACLSeverityWarning
32+
/* default drop acl */
33+
allIPMatch := NewAndACLMatch(
34+
NewACLMatch("outport", "==", "@"+pgName, ""),
35+
NewACLMatch(ipSuffix, "", "", ""),
36+
)
37+
options := func(acl *ovnnb.ACL) {
38+
if logEnable {
39+
acl.Log = true
40+
acl.Severity = &ovnnb.ACLSeverityWarning
41+
}
3942
}
4043

41-
defaultDropACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIPMatch.String(), ovnnb.ACLActionDrop, options)
42-
if err != nil {
43-
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %v", pgName, err)
44-
}
44+
defaultDropACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIPMatch.String(), ovnnb.ACLActionDrop, options)
45+
if err != nil {
46+
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %v", pgName, err)
47+
}
4548

46-
acls = append(acls, defaultDropACL)
49+
acls = append(acls, defaultDropACL)
50+
}
4751

4852
/* allow acl */
4953
matches := newNetworkPolicyACLMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, namedPortMap)
@@ -68,26 +72,17 @@ func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, p
6872
func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol string, npp []netv1.NetworkPolicyPort, logEnable bool, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
6973
acls := make([]*ovnnb.ACL, 0)
7074

71-
ipSuffix := "ip4"
72-
if protocol == kubeovnv1.ProtocolIPv6 {
73-
ipSuffix = "ip6"
74-
}
75-
76-
/* default drop acl */
77-
allIPMatch := NewAndACLMatch(
78-
NewACLMatch("inport", "==", "@"+pgName, ""),
79-
NewACLMatch(ipSuffix, "", "", ""),
80-
)
81-
options := func(acl *ovnnb.ACL) {
82-
if logEnable {
83-
acl.Log = true
84-
acl.Severity = &ovnnb.ACLSeverityWarning
75+
if strings.HasSuffix(asEgressName, ".0") || strings.HasSuffix(asEgressName, ".all") {
76+
// create the default drop rule for only once
77+
ipSuffix := "ip4"
78+
if protocol == kubeovnv1.ProtocolIPv6 {
79+
ipSuffix = "ip6"
8580
}
8681

8782
/* default drop acl */
88-
allIpMatch := NewAndAclMatch(
89-
NewAclMatch("inport", "==", "@"+pgName, ""),
90-
NewAclMatch(ipSuffix, "", "", ""),
83+
allIPMatch := NewAndACLMatch(
84+
NewACLMatch("inport", "==", "@"+pgName, ""),
85+
NewACLMatch(ipSuffix, "", "", ""),
9186
)
9287
options := func(acl *ovnnb.ACL) {
9388
if logEnable {
@@ -101,13 +96,14 @@ func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, pro
10196
acl.Options["apply-after-lb"] = "true"
10297
}
10398

104-
defaultDropACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIPMatch.String(), ovnnb.ACLActionDrop, options)
105-
if err != nil {
106-
klog.Error(err)
107-
return nil, fmt.Errorf("new default drop egress acl for port group %s: %v", pgName, err)
108-
}
99+
defaultDropACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIPMatch.String(), ovnnb.ACLActionDrop, options)
100+
if err != nil {
101+
klog.Error(err)
102+
return nil, fmt.Errorf("new default drop egress acl for port group %s: %v", pgName, err)
103+
}
109104

110-
acls = append(acls, defaultDropACL)
105+
acls = append(acls, defaultDropACL)
106+
}
111107

112108
/* allow acl */
113109
matches := newNetworkPolicyACLMatch(pgName, asEgressName, asExceptName, protocol, ovnnb.ACLDirectionFromLport, npp, namedPortMap)

0 commit comments

Comments
 (0)