def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.ipset.max_elem = 1234 self.ipset.set_name = "felix-a_set_name" self.ipset.temp_set_name = "felix-a_set_name-tmp" self.actor = IpsetActor(self.ipset)
class TestIpsetActor(BaseTestCase): def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.actor = IpsetActor(self.ipset) def test_sync_to_ipset(self): members1 = set(["1.2.3.4", "2.3.4.5"]) members2 = set(["10.1.2.3"]) members3 = set(["9.9.9.9"]) # Cause a full update - first time. self.actor.members = members1 self.actor._sync_to_ipset() self.ipset.replace_members.assert_called_once_with(members1) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertEqual(self.actor.members, members1) self.ipset.reset_mock() # Calls update_member self.actor.members = members2 self.actor._sync_to_ipset() self.assertFalse(self.ipset.replace_members.called) self.ipset.update_members.assert_called_once_with(members1, members2) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertEqual(self.actor.members, members2) self.ipset.reset_mock() # Does nothing - already in correct state self.actor.members = members2 self.actor._sync_to_ipset() self.assertFalse(self.ipset.replace_members.called) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertEqual(self.actor.members, members2) self.ipset.reset_mock() # Cause a full update - forced. self.actor._force_reprogram = True self.actor.members = members3 self.actor._sync_to_ipset() self.ipset.replace_members.assert_called_once_with(members3) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertEqual(self.actor.members, members3) self.ipset.reset_mock()
def _main_greenlet(config): """ The root of our tree of greenlets. Responsible for restarting its children if desired. """ try: _log.info("Connecting to etcd to get our configuration.") hosts_ipset_v4 = IpsetActor(HOSTS_IPSET_V4) etcd_api = EtcdAPI(config, hosts_ipset_v4) etcd_api.start() # Ask the EtcdAPI to fill in the global config object before we # proceed. We don't yet support config updates. config_loaded = etcd_api.load_config(async=False) config_loaded.wait() _log.info("Main greenlet: Configuration loaded, starting remaining " "actors...") v4_filter_updater = IptablesUpdater("filter", ip_version=4) v4_nat_updater = IptablesUpdater("nat", ip_version=4) v4_ipset_mgr = IpsetManager(IPV4) v4_masq_manager = MasqueradeManager(IPV4, v4_nat_updater) v4_rules_manager = RulesManager(4, v4_filter_updater, v4_ipset_mgr) v4_dispatch_chains = DispatchChains(config, 4, v4_filter_updater) v4_ep_manager = EndpointManager(config, IPV4, v4_filter_updater, v4_dispatch_chains, v4_rules_manager) v6_filter_updater = IptablesUpdater("filter", ip_version=6) v6_ipset_mgr = IpsetManager(IPV6) v6_rules_manager = RulesManager(6, v6_filter_updater, v6_ipset_mgr) v6_dispatch_chains = DispatchChains(config, 6, v6_filter_updater) v6_ep_manager = EndpointManager(config, IPV6, v6_filter_updater, v6_dispatch_chains, v6_rules_manager) update_splitter = UpdateSplitter(config, [v4_ipset_mgr, v6_ipset_mgr], [v4_rules_manager, v6_rules_manager], [v4_ep_manager, v6_ep_manager], [v4_filter_updater, v6_filter_updater], v4_masq_manager) iface_watcher = InterfaceWatcher(update_splitter) _log.info("Starting actors.") hosts_ipset_v4.start() update_splitter.start() v4_filter_updater.start() v4_nat_updater.start() v4_ipset_mgr.start() v4_masq_manager.start() v4_rules_manager.start() v4_dispatch_chains.start() v4_ep_manager.start() v6_filter_updater.start() v6_ipset_mgr.start() v6_rules_manager.start() v6_dispatch_chains.start() v6_ep_manager.start() iface_watcher.start() top_level_actors = [ hosts_ipset_v4, update_splitter, v4_nat_updater, v4_filter_updater, v4_nat_updater, v4_ipset_mgr, v4_masq_manager, v4_rules_manager, v4_dispatch_chains, v4_ep_manager, v6_filter_updater, v6_ipset_mgr, v6_rules_manager, v6_dispatch_chains, v6_ep_manager, iface_watcher, etcd_api, ] monitored_items = [actor.greenlet for actor in top_level_actors] # Install the global rules before we start polling for updates. _log.info("Installing global rules.") install_global_rules(config, v4_filter_updater, v6_filter_updater, v4_nat_updater) # Start polling for updates. These kicks make the actors poll # indefinitely. _log.info("Starting polling for interface and etcd updates.") f = iface_watcher.watch_interfaces(async=True) monitored_items.append(f) etcd_api.start_watch(update_splitter, async=True) # Register a SIG_USR handler to trigger a diags dump. def dump_top_level_actors(log): for a in top_level_actors: # The output will include queue length and the like. log.info("%s", a) futils.register_diags("Top-level actors", dump_top_level_actors) try: gevent.signal(signal.SIGUSR1, functools.partial(futils.dump_diags)) except AttributeError: # It doesn't matter too much if we fail to do this. _log.warning("Unable to install diag dump handler") pass # Wait for something to fail. _log.info("All top-level actors started, waiting on failures...") stopped_greenlets_iter = gevent.iwait(monitored_items) stopped_greenlet = next(stopped_greenlets_iter) try: stopped_greenlet.get() except Exception: _log.exception("Greenlet failed: %s", stopped_greenlet) raise else: _log.error("Greenlet %s unexpectedly returned.", stopped_greenlet) raise AssertionError("Greenlet unexpectedly returned") except: _log.exception("Exception killing main greenlet") raise
class TestIpsetActor(BaseTestCase): def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.ipset.max_elem = 1234 self.ipset.set_name = "felix-a_set_name" self.ipset.temp_set_name = "felix-a_set_name-tmp" self.actor = IpsetActor(self.ipset) def test_sync_to_ipset(self): members1 = ["1.2.3.4", "2.3.4.5"] members2 = ["1.2.3.6", "2.3.4.5"] # Each call to replace members causes a full update. _log.info("Calling replace_members() once...") self.actor.replace_members(members1, async=True) self.step_actor(self.actor) self.ipset.replace_members.assert_called_once_with(set(members1)) self.assertFalse(self.ipset.apply_changes.called) self.assertEqual(self.actor.members, set(members1)) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling replace_members() second time..") self.actor.replace_members(members2, async=True) self.step_actor(self.actor) self.ipset.replace_members.assert_called_once_with(set(members2)) self.assertFalse(self.ipset.apply_changes.called) self.assertEqual(self.actor.members, set(members2)) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling replace_members() third time with mixed " "add/remove..") self.actor.add_members(["5.6.7.8"], async=True) # Ignored self.actor.remove_members(["1.2.3.6"], async=True) self.actor.replace_members(members1, async=True) self.actor.add_members(["6.7.8.9"], async=True) # Should apply self.actor.remove_members(["2.3.4.5"], async=True) self.step_actor(self.actor) self.ipset.replace_members.assert_called_once_with( set([ "6.7.8.9", "1.2.3.4", ])) self.assertFalse(self.ipset.apply_changes.called) self.assertEqual(self.actor.members, set([ "6.7.8.9", "1.2.3.4", ])) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling add/remove.") self.actor.add_members(["5.6.7.8"], async=True) self.actor.remove_members(["1.2.3.4"], async=True) self.step_actor(self.actor) self.assertFalse(self.ipset.replace_members.called) self.assertEqual(self.ipset.apply_changes.mock_calls, [call(set(["5.6.7.8"]), set(["1.2.3.4"]))]) self.assertEqual(self.actor.members, set([ "6.7.8.9", "5.6.7.8", ])) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling add/remove with failure.") self.ipset.apply_changes.side_effect = FailedSystemCall( "", [], 1, "", "") self.actor.add_members(["6.7.8.10"], async=True) self.actor.remove_members(["5.6.7.8"], async=True) self.step_actor(self.actor) self.assertEqual(self.ipset.replace_members.mock_calls, [call(set(["6.7.8.9", "6.7.8.10"]))]) self.assertEqual(self.actor.members, set(["6.7.8.9", "6.7.8.10"])) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() def test_members_too_big(self): members = set([str(IPAddress(x)) for x in range(2000)]) self.actor.replace_members(members, async=True) self.step_actor(self.actor) # Check we return early without updating programmed_members. self.assertTrue(self.actor._force_reprogram) def test_owned_ipset_names(self): self.assertEqual(self.actor.owned_ipset_names(), set(["felix-a_set_name", "felix-a_set_name-tmp"]))
def _main_greenlet(config): """ The root of our tree of greenlets. Responsible for restarting its children if desired. """ try: _log.info("Connecting to etcd to get our configuration.") hosts_ipset_v4 = IpsetActor(HOSTS_IPSET_V4) etcd_api = EtcdAPI(config, hosts_ipset_v4) etcd_api.start() # Ask the EtcdAPI to fill in the global config object before we # proceed. We don't yet support config updates. config_loaded = etcd_api.load_config(async=False) config_loaded.wait() # Ensure the Kernel's global options are correctly configured for # Calico. devices.configure_global_kernel_config() _log.info("Main greenlet: Configuration loaded, starting remaining " "actors...") v4_filter_updater = IptablesUpdater("filter", ip_version=4, config=config) v4_nat_updater = IptablesUpdater("nat", ip_version=4, config=config) v4_ipset_mgr = IpsetManager(IPV4) v4_masq_manager = MasqueradeManager(IPV4, v4_nat_updater) v4_rules_manager = RulesManager(4, v4_filter_updater, v4_ipset_mgr) v4_dispatch_chains = DispatchChains(config, 4, v4_filter_updater) v4_ep_manager = EndpointManager(config, IPV4, v4_filter_updater, v4_dispatch_chains, v4_rules_manager, etcd_api.status_reporter) v6_raw_updater = IptablesUpdater("raw", ip_version=6, config=config) v6_filter_updater = IptablesUpdater("filter", ip_version=6, config=config) v6_ipset_mgr = IpsetManager(IPV6) v6_rules_manager = RulesManager(6, v6_filter_updater, v6_ipset_mgr) v6_dispatch_chains = DispatchChains(config, 6, v6_filter_updater) v6_ep_manager = EndpointManager(config, IPV6, v6_filter_updater, v6_dispatch_chains, v6_rules_manager, etcd_api.status_reporter) update_splitter = UpdateSplitter(config, [v4_ipset_mgr, v6_ipset_mgr], [v4_rules_manager, v6_rules_manager], [v4_ep_manager, v6_ep_manager], [v4_filter_updater, v6_filter_updater, v6_raw_updater, v4_nat_updater], v4_masq_manager) iface_watcher = InterfaceWatcher(update_splitter) _log.info("Starting actors.") hosts_ipset_v4.start() update_splitter.start() v4_filter_updater.start() v4_nat_updater.start() v4_ipset_mgr.start() v4_masq_manager.start() v4_rules_manager.start() v4_dispatch_chains.start() v4_ep_manager.start() v6_raw_updater.start() v6_filter_updater.start() v6_ipset_mgr.start() v6_rules_manager.start() v6_dispatch_chains.start() v6_ep_manager.start() iface_watcher.start() top_level_actors = [ hosts_ipset_v4, update_splitter, v4_nat_updater, v4_filter_updater, v4_nat_updater, v4_ipset_mgr, v4_masq_manager, v4_rules_manager, v4_dispatch_chains, v4_ep_manager, v6_raw_updater, v6_filter_updater, v6_ipset_mgr, v6_rules_manager, v6_dispatch_chains, v6_ep_manager, iface_watcher, etcd_api, ] monitored_items = [actor.greenlet for actor in top_level_actors] # Install the global rules before we start polling for updates. _log.info("Installing global rules.") install_global_rules(config, v4_filter_updater, v6_filter_updater, v4_nat_updater, v6_raw_updater) # Start polling for updates. These kicks make the actors poll # indefinitely. _log.info("Starting polling for interface and etcd updates.") f = iface_watcher.watch_interfaces(async=True) monitored_items.append(f) etcd_api.start_watch(update_splitter, async=True) # Register a SIG_USR handler to trigger a diags dump. def dump_top_level_actors(log): for a in top_level_actors: # The output will include queue length and the like. log.info("%s", a) futils.register_diags("Top-level actors", dump_top_level_actors) futils.register_process_statistics() try: gevent.signal(signal.SIGUSR1, functools.partial(futils.dump_diags)) except AttributeError: # It doesn't matter too much if we fail to do this. _log.warning("Unable to install diag dump handler") pass # Wait for something to fail. _log.info("All top-level actors started, waiting on failures...") stopped_greenlets_iter = gevent.iwait(monitored_items) stopped_greenlet = next(stopped_greenlets_iter) try: stopped_greenlet.get() except Exception: _log.exception("Greenlet failed: %s", stopped_greenlet) raise else: _log.error("Greenlet %s unexpectedly returned.", stopped_greenlet) raise AssertionError("Greenlet unexpectedly returned") except: _log.exception("Exception killing main greenlet") raise
def _main_greenlet(config): """ The root of our tree of greenlets. Responsible for restarting its children if desired. """ try: _log.info("Connecting to etcd to get our configuration.") hosts_ipset_v4 = IpsetActor(HOSTS_IPSET_V4) etcd_api = EtcdAPI(config, hosts_ipset_v4) etcd_api.start() # Ask the EtcdAPI to fill in the global config object before we # proceed. We don't yet support config updates. config_loaded = etcd_api.load_config(async=False) config_loaded.wait() # Ensure the Kernel's global options are correctly configured for # Calico. devices.configure_global_kernel_config() _log.info("Main greenlet: Configuration loaded, starting remaining " "actors...") monitored_items = [] if config.PROM_METRICS_ENABLED: httpd = HTTPServer(("0.0.0.0", config.PROM_METRICS_PORT), MetricsHandler) stats_server = gevent.Greenlet(httpd.serve_forever) stats_server.start() monitored_items.append(stats_server) v4_filter_updater = IptablesUpdater("filter", ip_version=4, config=config) v4_nat_updater = IptablesUpdater("nat", ip_version=4, config=config) v4_ipset_mgr = IpsetManager(IPV4, config) v4_masq_manager = MasqueradeManager(IPV4, v4_nat_updater) v4_rules_manager = RulesManager(config, 4, v4_filter_updater, v4_ipset_mgr) v4_dispatch_chains = DispatchChains(config, 4, v4_filter_updater) v4_fip_manager = FloatingIPManager(config, 4, v4_nat_updater) v4_ep_manager = EndpointManager(config, IPV4, v4_filter_updater, v4_dispatch_chains, v4_rules_manager, v4_fip_manager, etcd_api.status_reporter) cleanup_updaters = [v4_filter_updater, v4_nat_updater] cleanup_ip_mgrs = [v4_ipset_mgr] update_splitter_args = [v4_ipset_mgr, v4_rules_manager, v4_ep_manager, v4_masq_manager, v4_nat_updater] v6_enabled = os.path.exists("/proc/sys/net/ipv6") if v6_enabled: v6_raw_updater = IptablesUpdater("raw", ip_version=6, config=config) v6_filter_updater = IptablesUpdater("filter", ip_version=6, config=config) v6_nat_updater = IptablesUpdater("nat", ip_version=6, config=config) v6_ipset_mgr = IpsetManager(IPV6, config) v6_rules_manager = RulesManager(config, 6, v6_filter_updater, v6_ipset_mgr) v6_dispatch_chains = DispatchChains(config, 6, v6_filter_updater) v6_fip_manager = FloatingIPManager(config, 6, v6_nat_updater) v6_ep_manager = EndpointManager(config, IPV6, v6_filter_updater, v6_dispatch_chains, v6_rules_manager, v6_fip_manager, etcd_api.status_reporter) cleanup_updaters.append(v6_filter_updater) cleanup_ip_mgrs.append(v6_ipset_mgr) update_splitter_args += [v6_ipset_mgr, v6_rules_manager, v6_ep_manager, v6_raw_updater, v6_nat_updater] cleanup_mgr = CleanupManager(config, cleanup_updaters, cleanup_ip_mgrs) update_splitter_args.append(cleanup_mgr) update_splitter = UpdateSplitter(update_splitter_args) iface_watcher = InterfaceWatcher(update_splitter) _log.info("Starting actors.") hosts_ipset_v4.start() cleanup_mgr.start() v4_filter_updater.start() v4_nat_updater.start() v4_ipset_mgr.start() v4_masq_manager.start() v4_rules_manager.start() v4_dispatch_chains.start() v4_ep_manager.start() v4_fip_manager.start() if v6_enabled: v6_raw_updater.start() v6_filter_updater.start() v6_ipset_mgr.start() v6_nat_updater.start() v6_rules_manager.start() v6_dispatch_chains.start() v6_ep_manager.start() v6_fip_manager.start() iface_watcher.start() top_level_actors = [ hosts_ipset_v4, cleanup_mgr, v4_filter_updater, v4_nat_updater, v4_ipset_mgr, v4_masq_manager, v4_rules_manager, v4_dispatch_chains, v4_ep_manager, v4_fip_manager, iface_watcher, etcd_api, ] if v6_enabled: top_level_actors += [ v6_raw_updater, v6_filter_updater, v6_nat_updater, v6_ipset_mgr, v6_rules_manager, v6_dispatch_chains, v6_ep_manager, v6_fip_manager, ] monitored_items += [actor.greenlet for actor in top_level_actors] # Try to ensure that the nf_conntrack_netlink kernel module is present. # This works around an issue[1] where the first call to the "conntrack" # command fails while waiting for the module to load. # [1] https://github.com/projectcalico/calico/issues/986 load_nf_conntrack() # Install the global rules before we start polling for updates. _log.info("Installing global rules.") install_global_rules(config, v4_filter_updater, v4_nat_updater, ip_version=4) if v6_enabled: install_global_rules(config, v6_filter_updater, v6_nat_updater, ip_version=6, raw_updater=v6_raw_updater) # Start polling for updates. These kicks make the actors poll # indefinitely. _log.info("Starting polling for interface and etcd updates.") f = iface_watcher.watch_interfaces(async=True) monitored_items.append(f) etcd_api.start_watch(update_splitter, async=True) # Register a SIG_USR handler to trigger a diags dump. def dump_top_level_actors(log): for a in top_level_actors: # The output will include queue length and the like. log.info("%s", a) futils.register_diags("Top-level actors", dump_top_level_actors) futils.register_process_statistics() try: gevent.signal(signal.SIGUSR1, functools.partial(futils.dump_diags)) except AttributeError: # It doesn't matter too much if we fail to do this. _log.warning("Unable to install diag dump handler") pass # Wait for something to fail. _log.info("All top-level actors started, waiting on failures...") stopped_greenlets_iter = gevent.iwait(monitored_items) stopped_greenlet = next(stopped_greenlets_iter) try: stopped_greenlet.get() except Exception: _log.exception("Greenlet failed: %s", stopped_greenlet) raise else: _log.error("Greenlet %s unexpectedly returned.", stopped_greenlet) raise AssertionError("Greenlet unexpectedly returned") except: _log.exception("Exception killing main greenlet") raise
def _main_greenlet(config): """ The root of our tree of greenlets. Responsible for restarting its children if desired. """ try: _log.info("Connecting to etcd to get our configuration.") hosts_ipset_v4 = IpsetActor(HOSTS_IPSET_V4) etcd_api = EtcdAPI(config, hosts_ipset_v4) etcd_api.start() # Ask the EtcdAPI to fill in the global config object before we # proceed. We don't yet support config updates. config_loaded = etcd_api.load_config(async=False) config_loaded.wait() # Ensure the Kernel's global options are correctly configured for # Calico. devices.configure_global_kernel_config() _log.info("Main greenlet: Configuration loaded, starting remaining " "actors...") monitored_items = [] if config.PROM_METRICS_ENABLED: httpd = HTTPServer(("0.0.0.0", config.PROM_METRICS_PORT), MetricsHandler) stats_server = gevent.Greenlet(httpd.serve_forever) stats_server.start() monitored_items.append(stats_server) v4_filter_updater = IptablesUpdater("filter", ip_version=4, config=config) v4_nat_updater = IptablesUpdater("nat", ip_version=4, config=config) v4_ipset_mgr = IpsetManager(IPV4, config) v4_masq_manager = MasqueradeManager(IPV4, v4_nat_updater) v4_rules_manager = RulesManager(config, 4, v4_filter_updater, v4_ipset_mgr) v4_dispatch_chains = DispatchChains(config, 4, v4_filter_updater) v4_fip_manager = FloatingIPManager(config, 4, v4_nat_updater) v4_ep_manager = EndpointManager( config, IPV4, v4_filter_updater, v4_dispatch_chains, v4_rules_manager, v4_fip_manager, etcd_api.status_reporter, ) cleanup_updaters = [v4_filter_updater, v4_nat_updater] cleanup_ip_mgrs = [v4_ipset_mgr] update_splitter_args = [v4_ipset_mgr, v4_rules_manager, v4_ep_manager, v4_masq_manager, v4_nat_updater] v6_enabled = os.path.exists("/proc/sys/net/ipv6") if v6_enabled: v6_raw_updater = IptablesUpdater("raw", ip_version=6, config=config) v6_filter_updater = IptablesUpdater("filter", ip_version=6, config=config) v6_nat_updater = IptablesUpdater("nat", ip_version=6, config=config) v6_ipset_mgr = IpsetManager(IPV6, config) v6_rules_manager = RulesManager(config, 6, v6_filter_updater, v6_ipset_mgr) v6_dispatch_chains = DispatchChains(config, 6, v6_filter_updater) v6_fip_manager = FloatingIPManager(config, 6, v6_nat_updater) v6_ep_manager = EndpointManager( config, IPV6, v6_filter_updater, v6_dispatch_chains, v6_rules_manager, v6_fip_manager, etcd_api.status_reporter, ) cleanup_updaters.append(v6_filter_updater) cleanup_ip_mgrs.append(v6_ipset_mgr) update_splitter_args += [v6_ipset_mgr, v6_rules_manager, v6_ep_manager, v6_raw_updater, v6_nat_updater] cleanup_mgr = CleanupManager(config, cleanup_updaters, cleanup_ip_mgrs) update_splitter_args.append(cleanup_mgr) update_splitter = UpdateSplitter(update_splitter_args) iface_watcher = InterfaceWatcher(update_splitter) _log.info("Starting actors.") hosts_ipset_v4.start() cleanup_mgr.start() v4_filter_updater.start() v4_nat_updater.start() v4_ipset_mgr.start() v4_masq_manager.start() v4_rules_manager.start() v4_dispatch_chains.start() v4_ep_manager.start() v4_fip_manager.start() if v6_enabled: v6_raw_updater.start() v6_filter_updater.start() v6_ipset_mgr.start() v6_nat_updater.start() v6_rules_manager.start() v6_dispatch_chains.start() v6_ep_manager.start() v6_fip_manager.start() iface_watcher.start() top_level_actors = [ hosts_ipset_v4, cleanup_mgr, v4_filter_updater, v4_nat_updater, v4_ipset_mgr, v4_masq_manager, v4_rules_manager, v4_dispatch_chains, v4_ep_manager, v4_fip_manager, iface_watcher, etcd_api, ] if v6_enabled: top_level_actors += [ v6_raw_updater, v6_filter_updater, v6_nat_updater, v6_ipset_mgr, v6_rules_manager, v6_dispatch_chains, v6_ep_manager, v6_fip_manager, ] monitored_items += [actor.greenlet for actor in top_level_actors] # Try to ensure that the nf_conntrack_netlink kernel module is present. # This works around an issue[1] where the first call to the "conntrack" # command fails while waiting for the module to load. # [1] https://github.com/projectcalico/calico/issues/986 load_nf_conntrack() # Install the global rules before we start polling for updates. _log.info("Installing global rules.") install_global_rules(config, v4_filter_updater, v4_nat_updater, ip_version=4) if v6_enabled: install_global_rules(config, v6_filter_updater, v6_nat_updater, ip_version=6, raw_updater=v6_raw_updater) # Start polling for updates. These kicks make the actors poll # indefinitely. _log.info("Starting polling for interface and etcd updates.") f = iface_watcher.watch_interfaces(async=True) monitored_items.append(f) etcd_api.start_watch(update_splitter, async=True) # Register a SIG_USR handler to trigger a diags dump. def dump_top_level_actors(log): for a in top_level_actors: # The output will include queue length and the like. log.info("%s", a) futils.register_diags("Top-level actors", dump_top_level_actors) futils.register_process_statistics() try: gevent.signal(signal.SIGUSR1, functools.partial(futils.dump_diags)) except AttributeError: # It doesn't matter too much if we fail to do this. _log.warning("Unable to install diag dump handler") pass # Wait for something to fail. _log.info("All top-level actors started, waiting on failures...") stopped_greenlets_iter = gevent.iwait(monitored_items) stopped_greenlet = next(stopped_greenlets_iter) try: stopped_greenlet.get() except Exception: _log.exception("Greenlet failed: %s", stopped_greenlet) raise else: _log.error("Greenlet %s unexpectedly returned.", stopped_greenlet) raise AssertionError("Greenlet unexpectedly returned") except: _log.exception("Exception killing main greenlet") raise
class TestIpsetActor(BaseTestCase): def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.ipset.max_elem = 1234 self.ipset.set_name = "felix-a_set_name" self.ipset.temp_set_name = "felix-a_set_name-tmp" self.actor = IpsetActor(self.ipset) def test_sync_to_ipset(self): members1 = ["1.2.3.4", "2.3.4.5"] members2 = ["1.2.3.6", "2.3.4.5"] # Each call to replace members causes a full update. _log.info("Calling replace_members() once...") self.actor.replace_members(members1, async=True) self.step_actor(self.actor) self.ipset.replace_members.assert_called_once_with(set(members1)) self.assertFalse(self.ipset.apply_changes.called) self.assertEqual(self.actor.members, set(members1)) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling replace_members() second time..") self.actor.replace_members(members2, async=True) self.step_actor(self.actor) self.ipset.replace_members.assert_called_once_with(set(members2)) self.assertFalse(self.ipset.apply_changes.called) self.assertEqual(self.actor.members, set(members2)) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling replace_members() third time with mixed " "add/remove..") self.actor.add_members(["5.6.7.8"], async=True) # Ignored self.actor.remove_members(["1.2.3.6"], async=True) self.actor.replace_members(members1, async=True) self.actor.add_members(["6.7.8.9"], async=True) # Should apply self.actor.remove_members(["2.3.4.5"], async=True) self.step_actor(self.actor) self.ipset.replace_members.assert_called_once_with(set([ "6.7.8.9", "1.2.3.4", ])) self.assertFalse(self.ipset.apply_changes.called) self.assertEqual(self.actor.members, set([ "6.7.8.9", "1.2.3.4", ])) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling add/remove.") self.actor.add_members(["5.6.7.8"], async=True) self.actor.remove_members(["1.2.3.4"], async=True) self.step_actor(self.actor) self.assertFalse(self.ipset.replace_members.called) self.assertEqual(self.ipset.apply_changes.mock_calls, [ call(set(["5.6.7.8"]), set(["1.2.3.4"])) ]) self.assertEqual(self.actor.members, set([ "6.7.8.9", "5.6.7.8", ])) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() _log.info("Calling add/remove with failure.") self.ipset.apply_changes.side_effect = FailedSystemCall( "", [], 1, "", "" ) self.actor.add_members(["6.7.8.10"], async=True) self.actor.remove_members(["5.6.7.8"], async=True) self.step_actor(self.actor) self.assertEqual(self.ipset.replace_members.mock_calls, [ call(set(["6.7.8.9", "6.7.8.10"])) ]) self.assertEqual(self.actor.members, set(["6.7.8.9", "6.7.8.10"])) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() def test_members_too_big(self): members = set([str(IPAddress(x)) for x in range(2000)]) self.actor.replace_members(members, async=True) self.step_actor(self.actor) # Check we return early without updating programmed_members. self.assertTrue(self.actor._force_reprogram) def test_owned_ipset_names(self): self.assertEqual(self.actor.owned_ipset_names(), set(["felix-a_set_name", "felix-a_set_name-tmp"]))
def _main_greenlet(): """ The root of our tree of greenlets. Responsible for restarting its children if desired. """ try: _log.info("Connecting to etcd to get our configuration.") hosts_ipset_v4 = IpsetActor(HOSTS_IPSET_V4) monitored_items = [] # The parent process sends us communication pipes as FD 3 and 4. Open # those as files. Wrap the resulting files in a FileObject to make # them cooperate with gevent. pipe_from_parent = FileObject(os.fdopen(3, 'rb', -1), 'rb') pipe_to_parent = FileObject(os.fdopen(4, 'wb', -1), 'wb') config = Config() datastore = DatastoreAPI(config, pipe_from_parent, pipe_to_parent, hosts_ipset_v4) datastore.start() monitored_items.append(datastore.greenlet) # Ask the DatastoreAPI to fill in the global config object before we # proceed. We don't yet support config updates. config_loaded = datastore.load_config(async=False) config_loaded.wait() # Ensure the Kernel's global options are correctly configured for # Calico. devices.configure_global_kernel_config(config) # Check the commands we require are present. futils.check_command_deps() _log.info("Main greenlet: Configuration loaded, starting remaining " "actors...") if config.PROM_METRICS_ENABLED: httpd = HTTPServer(("0.0.0.0", config.PROM_METRICS_DRIVER_PORT), MetricsHandler) stats_server = gevent.Greenlet(httpd.serve_forever) stats_server.start() monitored_items.append(stats_server) v4_filter_updater = IptablesUpdater("filter", ip_version=4, config=config) v4_nat_updater = IptablesUpdater("nat", ip_version=4, config=config) v4_ipset_mgr = IpsetManager(IPV4, config) v4_masq_manager = MasqueradeManager(IPV4, v4_nat_updater) v4_rules_manager = RulesManager(config, 4, v4_filter_updater, v4_ipset_mgr) v4_ep_dispatch_chains = WorkloadDispatchChains(config, 4, v4_filter_updater) v4_if_dispatch_chains = HostEndpointDispatchChains( config, 4, v4_filter_updater) v4_fip_manager = FloatingIPManager(config, 4, v4_nat_updater) v4_ep_manager = EndpointManager(config, IPV4, v4_filter_updater, v4_ep_dispatch_chains, v4_if_dispatch_chains, v4_rules_manager, v4_fip_manager, datastore.write_api) cleanup_updaters = [v4_filter_updater, v4_nat_updater] cleanup_ip_mgrs = [v4_ipset_mgr] managers = [ v4_ipset_mgr, v4_rules_manager, v4_ep_manager, v4_masq_manager, v4_nat_updater ] actors_to_start = [ hosts_ipset_v4, v4_filter_updater, v4_nat_updater, v4_ipset_mgr, v4_masq_manager, v4_rules_manager, v4_ep_dispatch_chains, v4_if_dispatch_chains, v4_ep_manager, v4_fip_manager, ] # Determine if ipv6 is enabled using the config option. if config.IPV6_SUPPORT == "true": v6_enabled = True ipv6_reason = None elif config.IPV6_SUPPORT == "auto": v6_enabled, ipv6_reason = futils.detect_ipv6_supported() else: v6_enabled = False ipv6_reason = "Ipv6Support is 'false'" if v6_enabled: v6_raw_updater = IptablesUpdater("raw", ip_version=6, config=config) v6_filter_updater = IptablesUpdater("filter", ip_version=6, config=config) v6_nat_updater = IptablesUpdater("nat", ip_version=6, config=config) v6_ipset_mgr = IpsetManager(IPV6, config) v6_rules_manager = RulesManager(config, 6, v6_filter_updater, v6_ipset_mgr) v6_ep_dispatch_chains = WorkloadDispatchChains( config, 6, v6_filter_updater) v6_if_dispatch_chains = HostEndpointDispatchChains( config, 6, v6_filter_updater) v6_fip_manager = FloatingIPManager(config, 6, v6_nat_updater) v6_ep_manager = EndpointManager(config, IPV6, v6_filter_updater, v6_ep_dispatch_chains, v6_if_dispatch_chains, v6_rules_manager, v6_fip_manager, datastore.write_api) cleanup_updaters.append(v6_filter_updater) cleanup_ip_mgrs.append(v6_ipset_mgr) managers += [ v6_ipset_mgr, v6_rules_manager, v6_ep_manager, v6_raw_updater, v6_nat_updater ] actors_to_start += [ v6_raw_updater, v6_filter_updater, v6_nat_updater, v6_ipset_mgr, v6_rules_manager, v6_ep_dispatch_chains, v6_if_dispatch_chains, v6_ep_manager, v6_fip_manager, ] else: # Keep the linter happy. _log.warn("IPv6 support disabled: %s.", ipv6_reason) v6_filter_updater = None v6_nat_updater = None v6_raw_updater = None v6_if_dispatch_chains = None cleanup_mgr = CleanupManager(config, cleanup_updaters, cleanup_ip_mgrs) managers.append(cleanup_mgr) update_splitter = UpdateSplitter(managers) iface_watcher = InterfaceWatcher(update_splitter) actors_to_start += [ cleanup_mgr, iface_watcher, ] _log.info("Starting actors.") for actor in actors_to_start: actor.start() monitored_items += [actor.greenlet for actor in actors_to_start] # Try to ensure that the nf_conntrack_netlink kernel module is present. # This works around an issue[1] where the first call to the "conntrack" # command fails while waiting for the module to load. # [1] https://github.com/projectcalico/felix/issues/986 load_nf_conntrack() # Install the global rules before we start polling for updates. _log.info("Installing global rules.") # Dispatch chain needs to make its configuration before we insert the # top-level chains. v4_if_dispatch_chains.configure_iptables(async=False) install_global_rules(config, v4_filter_updater, v4_nat_updater, ip_version=4) if v6_enabled: # Dispatch chain needs to make its configuration before we insert # the top-level chains. v6_if_dispatch_chains.configure_iptables(async=False) install_global_rules(config, v6_filter_updater, v6_nat_updater, ip_version=6, raw_updater=v6_raw_updater) # Start polling for updates. These kicks make the actors poll # indefinitely. _log.info("Starting polling for interface and etcd updates.") f = iface_watcher.watch_interfaces(async=True) monitored_items.append(f) datastore.start_watch(update_splitter, async=True) # Register a SIG_USR handler to trigger a diags dump. def dump_top_level_actors(log): for a in actors_to_start: # The output will include queue length and the like. log.info("%s", a) futils.register_diags("Top-level actors", dump_top_level_actors) futils.register_process_statistics() try: gevent.signal(signal.SIGUSR1, functools.partial(futils.dump_diags)) except AttributeError: # It doesn't matter too much if we fail to do this. _log.warning("Unable to install diag dump handler") pass gevent.signal(signal.SIGTERM, functools.partial(shut_down, datastore)) gevent.signal(signal.SIGINT, functools.partial(shut_down, datastore)) # Wait for something to fail. _log.info("All top-level actors started, waiting on failures...") stopped_greenlets_iter = gevent.iwait(monitored_items) stopped_greenlet = next(stopped_greenlets_iter) try: stopped_greenlet.get() except Exception: _log.exception("Greenlet failed: %s", stopped_greenlet) raise else: _log.error("Greenlet %s unexpectedly returned.", stopped_greenlet) raise AssertionError("Greenlet unexpectedly returned") except: _log.exception("Exception killing main greenlet") raise
def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.actor = IpsetActor(self.ipset)
class TestIpsetActor(BaseTestCase): def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.actor = IpsetActor(self.ipset) def test_sync_to_ipset(self): members1 = set(["1.2.3.4", "2.3.4.5"]) members2 = set(["10.1.2.3"]) members3 = set(["9.9.9.9"]) # Cause a full update - first time. _log.debug("Initial resync of ipset will happen") self.actor.members = members1 self.actor._sync_to_ipset() self.ipset.replace_members.assert_called_once_with(members1) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.members, members1) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Calls update_members _log.debug("Call to update_members should happen") self.actor.programmed_members = members1 self.actor.members = members2 self.actor._sync_to_ipset() self.assertFalse(self.ipset.replace_members.called) self.ipset.update_members.assert_called_once_with(members1, members2) self.assertEqual(self.actor.members, members2) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Does nothing - already in correct state _log.debug("Already in correct state (programmed_members matches)") self.actor.programmed_members = members2 self.actor.members = members2 self.actor._sync_to_ipset() self.assertFalse(self.ipset.replace_members.called) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.members, members2) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Cause a full update - forced. _log.debug("Force a full ipset update") self.actor._force_reprogram = True self.actor.members = members3 self.actor._sync_to_ipset() self.ipset.replace_members.assert_called_once_with(members3) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.members, members3) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Cause an assert - programmed_members is None, but no resync required. _log.debug("Force a full ipset update") self.actor._force_reprogram = False self.actor.members = members3 self.actor.programmed_members = None with self.assertRaises(AssertionError): self.actor._sync_to_ipset() self.ipset.reset_mock()
class TestIpsetActor(BaseTestCase): def setUp(self): super(TestIpsetActor, self).setUp() self.ipset = Mock(spec=Ipset) self.ipset.max_elem = 1234 self.ipset.set_name = "felix-a_set_name" self.actor = IpsetActor(self.ipset) def test_sync_to_ipset(self): members1 = set(["1.2.3.4", "2.3.4.5"]) members2 = set(["10.1.2.3"]) members3 = set(["9.9.9.9"]) # Cause a full update - first time. _log.debug("Initial resync of ipset will happen") self.actor.members = members1 self.actor._sync_to_ipset() self.ipset.replace_members.assert_called_once_with(members1) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.members, members1) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Calls update_members _log.debug("Call to update_members should happen") self.actor.programmed_members = members1 self.actor.members = members2 self.actor._sync_to_ipset() self.assertFalse(self.ipset.replace_members.called) self.ipset.update_members.assert_called_once_with(members1, members2) self.assertEqual(self.actor.members, members2) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Does nothing - already in correct state _log.debug("Already in correct state (programmed_members matches)") self.actor.programmed_members = members2 self.actor.members = members2 self.actor._sync_to_ipset() self.assertFalse(self.ipset.replace_members.called) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.members, members2) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Cause a full update - forced. _log.debug("Force a full ipset update") self.actor._force_reprogram = True self.actor.members = members3 self.actor._sync_to_ipset() self.ipset.replace_members.assert_called_once_with(members3) self.assertFalse(self.ipset.update_members.called) self.assertEqual(self.actor.members, members3) self.assertEqual(self.actor.programmed_members, self.actor.members) self.assertFalse(self.actor._force_reprogram) self.ipset.reset_mock() # Cause an assert - programmed_members is None, but no resync required. _log.debug("Force a full ipset update") self.actor._force_reprogram = False self.actor.members = members3 self.actor.programmed_members = None with self.assertRaises(AssertionError): self.actor._sync_to_ipset() self.ipset.reset_mock() def test_members_too_big(self): self.actor.members = ["1.2.3.4"] * 2000 self.actor._sync_to_ipset() # Check we return early without updating programmed_members. self.assertEqual(self.actor.programmed_members, None)