Donavan Fritz
eb1f5e0d8d
Build flock Image / build (push) Has been cancelled
Code (Linux build, with no-op stubs for macOS dev):
- pkg/agent/netns_linux.go: ensureVeth → host-side configure (addrgenmode
none, fe80::1/64, proxy_arp, forwarding) → move peer to pod ns →
configure pod side (addr, default route via fe80::1, v4 169.254.1.1
on-link gateway) → host /128 + /32 routes. Idempotent.
- pkg/agent/hostiface.go: deterministic host iface name flock<8hex> from
FNV-1a-32(containerID).
- pkg/agent/annotations.go: parse flock.fritzlab.net/{ipv6,ipv4,cidr6,
cidr4,ip-algo,anycast} with design-doc defaults; ParseCNIArgs for the
K8S_POD_* keys kubelet sets.
- pkg/agent/podinfo.go: shared informer scoped to spec.nodeName==NODE,
WaitForPod helper for ADD-vs-informer-sync race.
- pkg/agent/handlers.go: PodHandler does
cache lookup → annotations → IPAM → store(pending) → SetupFunc →
store(committed) → Result. Idempotent on retry. Del symmetric.
- pkg/routing/bird/config.go: text/template render with stable ordering;
golden tests for host001 + anycast injection + sort stability.
- pkg/agent/bird.go: writes /etc/flock/bird/bird.conf, debounces 500ms,
execs `birdc -s /run/flock/bird.ctl configure`. Installs blackhole
kernel routes for the node summary CIDRs so BIRD's protocol kernel
imports them.
- pkg/agent/runtime_linux.go: at startup, waits up to 60s for the per-
node NodeConfig, reconciles committed allocations into IPAM.used,
garbage-collects pending entries, builds PodHandler, swaps RPC
handlers in.
- cmd/flock-installer: init-container binary that copies /opt/cni/bin/
flock and writes 01-flock.conflist (lex-first so kubelet picks it
over Calico's 10-calico.conflist on flock-labeled nodes).
Deploy:
- Dockerfile: alpine + iproute2 + bird2; multi-binary image.
- deploy/daemonset.yaml: install-cni init container; bird sidecar
sharing /etc/flock/bird + /run/flock with the agent; ConfigMap-seeded
bootstrap bird.conf so the sidecar boots before the agent renders.
Privileged on flock-agent + install-cni; bird sidecar uses
NET_ADMIN/RAW only.
- RBAC: pods + networkpolicies get/list/watch (the latter is reserved
for M8 — harmless to grant now).
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
72 lines
1.7 KiB
Go
72 lines
1.7 KiB
Go
// Command flock-installer is the DaemonSet init container. It copies
|
|
// /usr/local/bin/flock to /opt/cni/bin/flock on the host, and writes the
|
|
// CNI conflist to /etc/cni/net.d/01-flock.conflist. The init container
|
|
// then exits; kubelet picks up the conflist on its next CNI scan.
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"io"
|
|
"log"
|
|
"os"
|
|
"path/filepath"
|
|
)
|
|
|
|
const conflistTemplate = `{
|
|
"cniVersion": "1.0.0",
|
|
"name": "flock",
|
|
"plugins": [
|
|
{
|
|
"type": "flock"
|
|
}
|
|
]
|
|
}
|
|
`
|
|
|
|
func main() {
|
|
var (
|
|
src = flag.String("src", "/usr/local/bin/flock", "source binary path")
|
|
binDst = flag.String("bin", "/host/opt/cni/bin/flock", "destination CNI binary path")
|
|
confDst = flag.String("conflist", "/host/etc/cni/net.d/01-flock.conflist", "destination conflist path")
|
|
)
|
|
flag.Parse()
|
|
|
|
if err := copyFile(*src, *binDst, 0o755); err != nil {
|
|
log.Fatalf("install binary: %v", err)
|
|
}
|
|
if err := os.MkdirAll(filepath.Dir(*confDst), 0o755); err != nil {
|
|
log.Fatalf("conflist mkdir: %v", err)
|
|
}
|
|
if err := os.WriteFile(*confDst, []byte(conflistTemplate), 0o644); err != nil {
|
|
log.Fatalf("write conflist: %v", err)
|
|
}
|
|
fmt.Printf("flock-installer: installed %s and %s\n", *binDst, *confDst)
|
|
}
|
|
|
|
func copyFile(src, dst string, mode os.FileMode) error {
|
|
if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
|
|
return err
|
|
}
|
|
in, err := os.Open(src)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer in.Close()
|
|
tmp := dst + ".tmp"
|
|
out, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, mode)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if _, err := io.Copy(out, in); err != nil {
|
|
out.Close()
|
|
os.Remove(tmp)
|
|
return err
|
|
}
|
|
if err := out.Close(); err != nil {
|
|
os.Remove(tmp)
|
|
return err
|
|
}
|
|
return os.Rename(tmp, dst)
|
|
}
|