Donavan Fritz
eb1f5e0d8d
Build flock Image / build (push) Has been cancelled
Code (Linux build, with no-op stubs for macOS dev):
- pkg/agent/netns_linux.go: ensureVeth → host-side configure (addrgenmode
none, fe80::1/64, proxy_arp, forwarding) → move peer to pod ns →
configure pod side (addr, default route via fe80::1, v4 169.254.1.1
on-link gateway) → host /128 + /32 routes. Idempotent.
- pkg/agent/hostiface.go: deterministic host iface name flock<8hex> from
FNV-1a-32(containerID).
- pkg/agent/annotations.go: parse flock.fritzlab.net/{ipv6,ipv4,cidr6,
cidr4,ip-algo,anycast} with design-doc defaults; ParseCNIArgs for the
K8S_POD_* keys kubelet sets.
- pkg/agent/podinfo.go: shared informer scoped to spec.nodeName==NODE,
WaitForPod helper for ADD-vs-informer-sync race.
- pkg/agent/handlers.go: PodHandler does
cache lookup → annotations → IPAM → store(pending) → SetupFunc →
store(committed) → Result. Idempotent on retry. Del symmetric.
- pkg/routing/bird/config.go: text/template render with stable ordering;
golden tests for host001 + anycast injection + sort stability.
- pkg/agent/bird.go: writes /etc/flock/bird/bird.conf, debounces 500ms,
execs `birdc -s /run/flock/bird.ctl configure`. Installs blackhole
kernel routes for the node summary CIDRs so BIRD's protocol kernel
imports them.
- pkg/agent/runtime_linux.go: at startup, waits up to 60s for the per-
node NodeConfig, reconciles committed allocations into IPAM.used,
garbage-collects pending entries, builds PodHandler, swaps RPC
handlers in.
- cmd/flock-installer: init-container binary that copies /opt/cni/bin/
flock and writes 01-flock.conflist (lex-first so kubelet picks it
over Calico's 10-calico.conflist on flock-labeled nodes).
Deploy:
- Dockerfile: alpine + iproute2 + bird2; multi-binary image.
- deploy/daemonset.yaml: install-cni init container; bird sidecar
sharing /etc/flock/bird + /run/flock with the agent; ConfigMap-seeded
bootstrap bird.conf so the sidecar boots before the agent renders.
Privileged on flock-agent + install-cni; bird sidecar uses
NET_ADMIN/RAW only.
- RBAC: pods + networkpolicies get/list/watch (the latter is reserved
for M8 — harmless to grant now).
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
89 lines
2.1 KiB
Go
89 lines
2.1 KiB
Go
package bird
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestRender_Host001(t *testing.T) {
|
|
out, err := Render(NodeBGP{
|
|
NodeName: "host001",
|
|
RouterID: "172.25.25.101",
|
|
LocalASN: 65101,
|
|
Peers: []Peer{
|
|
{Family: "v6", Address: "2602:817:3000:a25::1", ASN: 65000},
|
|
{Family: "v4", Address: "172.25.25.1", ASN: 65000},
|
|
},
|
|
CIDR6: []string{"2602:817:3000:f001::/64"},
|
|
CIDR4: []string{"172.25.210.0/24"},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, want := range []string{
|
|
"router id 172.25.25.101",
|
|
"local as 65101;",
|
|
"neighbor 2602:817:3000:a25::1 as 65000;",
|
|
"neighbor 172.25.25.1 as 65000;",
|
|
"if net = 2602:817:3000:f001::/64 then accept;",
|
|
"if net = 172.25.210.0/24 then accept;",
|
|
"graceful restart;",
|
|
} {
|
|
if !strings.Contains(out, want) {
|
|
t.Errorf("missing %q in output:\n%s", want, out)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestRender_AnycastInjection(t *testing.T) {
|
|
out, err := Render(NodeBGP{
|
|
RouterID: "10.0.0.1",
|
|
LocalASN: 65101,
|
|
Peers: []Peer{{Family: "v6", Address: "2001:db8::1", ASN: 65000}},
|
|
CIDR6: []string{"2001:db8:f001::/64"},
|
|
Anycast6: []string{"2001:db8:a::1"},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(out, "if net = 2001:db8:a::1/128 then accept;") {
|
|
t.Fatalf("anycast /128 not advertised:\n%s", out)
|
|
}
|
|
}
|
|
|
|
func TestRender_StableOutput(t *testing.T) {
|
|
in := NodeBGP{
|
|
RouterID: "10.0.0.1",
|
|
LocalASN: 65101,
|
|
Peers: []Peer{
|
|
{Family: "v4", Address: "10.0.0.2", ASN: 65000},
|
|
{Family: "v6", Address: "2001:db8::1", ASN: 65000},
|
|
},
|
|
CIDR6: []string{"2001:db8:f002::/64", "2001:db8:f001::/64"},
|
|
CIDR4: []string{"10.1.1.0/24", "10.0.1.0/24"},
|
|
}
|
|
a, _ := Render(in)
|
|
b, _ := Render(in)
|
|
if a != b {
|
|
t.Fatalf("render not deterministic")
|
|
}
|
|
// Sorted ordering of CIDR6.
|
|
i1 := strings.Index(a, "2001:db8:f001::/64")
|
|
i2 := strings.Index(a, "2001:db8:f002::/64")
|
|
if !(i1 < i2) {
|
|
t.Fatalf("CIDR6 not sorted")
|
|
}
|
|
}
|
|
|
|
func TestFamilyOf(t *testing.T) {
|
|
if FamilyOf("2001:db8::1") != "v6" {
|
|
t.Fatal("v6 detection broken")
|
|
}
|
|
if FamilyOf("10.0.0.1") != "v4" {
|
|
t.Fatal("v4 detection broken")
|
|
}
|
|
if FamilyOf("not-an-ip") != "" {
|
|
t.Fatal("garbage should return empty")
|
|
}
|
|
}
|