Skip to content

Commit cbe4299

Browse files
alpebalpeb
committed
Simplified change, undo the delete event refactoring and the removal of the linkerd-cni.conf.default file
1 parent 765591c commit cbe4299

File tree

3 files changed

+64
-28
lines changed

3 files changed

+64
-28
lines changed

‎Dockerfile-cni-plugin‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ COPY --from=go /go/bin/linkerd-cni /opt/cni/bin/
4848
COPY --from=cni-repair-controller /build/linkerd-cni-repair-controller /usr/lib/linkerd/
4949
COPY LICENSE .
5050
COPY cni-plugin/deployment/scripts/install-cni.sh .
51+
COPY cni-plugin/deployment/linkerd-cni.conf.default .
5152
COPY cni-plugin/deployment/scripts/filter.jq .
5253
ENV PATH=/linkerd:/opt/cni/bin:$PATH
5354
CMD ["install-cni.sh"]

‎cni-plugin/deployment/linkerd-cni.conf.default‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"name": "linkerd-cni",
3+
"type": "linkerd-cni",
4+
"log_level": "info",
5+
"policy": {
6+
"type": "k8s",
7+
"k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
8+
"k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
9+
},
10+
"kubernetes": {
11+
"kubeconfig": "__KUBECONFIG_FILEPATH__"
12+
},
13+
"linkerd": {
14+
"incoming-proxy-port": 4143,
15+
"outgoing-proxy-port": 4140,
16+
"proxy-uid": 2102,
17+
"proxy-gid": 2102,
18+
"ports-to-redirect": [],
19+
"inbound-ports-to-ignore": [],
20+
"outbound-ports-to-ignore": [],
21+
"simulate": false,
22+
"use-wait-flag": false
23+
}
24+
}

‎cni-plugin/deployment/scripts/install-cni.sh‎

Lines changed: 39 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ HOST_CNI_NET="${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}"
5656
# Location of legacy "interface mode" file, to be automatically deleted
5757
DEFAULT_CNI_CONF_PATH="${HOST_CNI_NET}/01-linkerd-cni.conf"
5858
KUBECONFIG_FILE_NAME=${KUBECONFIG_FILE_NAME:-ZZZ-linkerd-cni-kubeconfig}
59-
SERVICEACCOUNT_PATH=/var/run/secrets/kubernetes.io/serviceaccount
59+
SERVICE_ACCOUNT_PATH=/var/run/secrets/kubernetes.io/serviceaccount
6060

6161
############################
6262
### Function definitions ###
@@ -121,31 +121,32 @@ install_cni_bin() {
121121
}
122122

123123
create_kubeconfig() {
124-
KUBE_CA_FILE=${KUBE_CA_FILE:-${SERVICEACCOUNT_PATH}/ca.crt}
124+
KUBE_CA_FILE=${KUBE_CA_FILE:-${SERVICE_ACCOUNT_PATH}/ca.crt}
125125
SKIP_TLS_VERIFY=${SKIP_TLS_VERIFY:-false}
126-
SERVICEACCOUNT_TOKEN=$(cat ${SERVICEACCOUNT_PATH}/token)
127-
128-
# Check if we're not running as a k8s pod.
129-
if [[ ! -f "${SERVICEACCOUNT_PATH}/token" ]]; then
130-
return
131-
fi
132-
133-
if [ -z "${KUBERNETES_SERVICE_HOST}" ]; then
134-
log 'KUBERNETES_SERVICE_HOST not set'; exit 1;
135-
fi
136-
if [ -z "${KUBERNETES_SERVICE_PORT}" ]; then
137-
log 'KUBERNETES_SERVICE_PORT not set'; exit 1;
138-
fi
126+
# Pull out service account token.
127+
SERVICEACCOUNT_TOKEN=$(cat ${SERVICE_ACCOUNT_PATH}/token)
128+
129+
# Check if we're running as a k8s pod.
130+
# The check will assert whether token exists and is a regular file
131+
if [ -f "${SERVICE_ACCOUNT_PATH}/token" ]; then
132+
# We're running as a k8d pod - expect some variables.
133+
# If the variables are null, exit
134+
if [ -z "${KUBERNETES_SERVICE_HOST}" ]; then
135+
log 'KUBERNETES_SERVICE_HOST not set'; exit 1;
136+
fi
137+
if [ -z "${KUBERNETES_SERVICE_PORT}" ]; then
138+
log 'KUBERNETES_SERVICE_PORT not set'; exit 1;
139+
fi
139140

140-
if [ "${SKIP_TLS_VERIFY}" = 'true' ]; then
141-
TLS_CFG='insecure-skip-tls-verify: true'
142-
elif [ -f "${KUBE_CA_FILE}" ]; then
143-
TLS_CFG="certificate-authority-data: $(base64 "${KUBE_CA_FILE}" | tr -d '\n')"
144-
fi
141+
if [ "${SKIP_TLS_VERIFY}" = 'true' ]; then
142+
TLS_CFG='insecure-skip-tls-verify: true'
143+
elif [ -f "${KUBE_CA_FILE}" ]; then
144+
TLS_CFG="certificate-authority-data: $(base64 "${KUBE_CA_FILE}" | tr -d '\n')"
145+
fi
145146

146-
touch "${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}/${KUBECONFIG_FILE_NAME}"
147-
chmod "${KUBECONFIG_MODE:-600}" "${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}/${KUBECONFIG_FILE_NAME}"
148-
cat > "${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}/${KUBECONFIG_FILE_NAME}" <<EOF
147+
touch "${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}/${KUBECONFIG_FILE_NAME}"
148+
chmod "${KUBECONFIG_MODE:-600}" "${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}/${KUBECONFIG_FILE_NAME}"
149+
cat > "${CONTAINER_MOUNT_PREFIX}${DEST_CNI_NET_DIR}/${KUBECONFIG_FILE_NAME}" <<EOF
149150
# Kubeconfig file for linkerd CNI plugin.
150151
apiVersion: v1
151152
kind: Config
@@ -165,6 +166,8 @@ contexts:
165166
user: linkerd-cni
166167
current-context: linkerd-cni-context
167168
EOF
169+
170+
fi
168171
}
169172

170173
create_cni_conf() {
@@ -239,7 +242,14 @@ sync() {
239242

240243
local config_file_count
241244
local new_sha
242-
if [ "$ev" = 'CREATE' ] || [ "$ev" = 'MOVED_TO' ] || [ "$ev" = 'MODIFY' ]; then
245+
if [ "$ev" = 'DELETE' ]; then
246+
# When the event type is 'DELETE', we check to see if there are any `*conf` or `*conflist`
247+
# files on the host's filesystem.
248+
config_file_count=$(find "${HOST_CNI_NET}" -maxdepth 1 -type f \( -iname '*conflist' -o -iname '*conf' \) | sort | wc -l)
249+
if [ "$config_file_count" -eq 0 ]; then
250+
log "No active CNI configuration file found after $ev event"
251+
fi
252+
elif [ "$ev" = 'CREATE' ] || [ "$ev" = 'MOVED_TO' ] || [ "$ev" = 'MODIFY' ]; then
243253
# When the event type is 'CREATE', 'MOVED_TO' or 'MODIFY', we check the
244254
# previously observed SHA (updated with each file watch) and compare it
245255
# against the new file's SHA. If they differ, it means something has
@@ -264,13 +274,14 @@ sync() {
264274
265275
# monitor_cni_config starts a watch on the host's CNI config directory
266276
monitor_cni_config() {
267-
inotifywait -m "${HOST_CNI_NET}" -e create,moved_to,modify |
277+
inotifywait -m "${HOST_CNI_NET}" -e create,delete,moved_to,modify |
268278
while read -r directory action filename; do
269279
if [[ "$filename" =~ .*.(conflist|conf)$ ]]; then
270280
log "Detected change in $directory: $action $filename"
271281
sync "$filename" "$action" "$cni_conf_sha"
272-
# calculate file SHA to use in the next iteration
273-
if [[ -e "$directory/$filename" ]]; then
282+
# When file exists (i.e we didn't deal with a DELETE ev)
283+
# then calculate its sha to be used the next turn.
284+
if [[ -e "$directory/$filename" && "$action" != 'DELETE' ]]; then
274285
cni_conf_sha="$(sha256sum "$directory/$filename" | while read -r s _; do echo "$s"; done)"
275286
fi
276287
fi
@@ -284,7 +295,7 @@ monitor_cni_config() {
284295
# only reacting to direct creation of a "token" file, or creation of
285296
# directories containing a "token" file.
286297
monitor_service_account_token() {
287-
inotifywait -m "${SERVICEACCOUNT_PATH}" -e create |
298+
inotifywait -m "${SERVICE_ACCOUNT_PATH}" -e create |
288299
while read -r directory _ filename; do
289300
target=$(realpath "$directory/$filename")
290301
if [[ (-f "$target" && "${target##*/}" == "token") || (-d "$target" && -e "$target/token") ]]; then

0 commit comments

Comments
 (0)