mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
24fa7439df
When a Nomad host reboots, the network namespace files in the tmpfs in `/var/run` are wiped out. So when we restore allocations after a host reboot, we need to be able to restore both the network namespace and the network configuration. But because the netns is newly created and we need to run the CNI plugins again, this create potential conflicts with the IPAM plugin which has written state to persistent disk at `/var/lib/cni`. These IPs aren't the ones advertised to Consul, so there's no particular reason to keep them around after a host reboot because all virtual interfaces need to be recreated too. Reconfigure the CNI bridge configuration to use `/var/run/cni` as its state directory. We already expect this location to be created by CNI because the netns files are hard-coded to be created there too in `libcni`. Note this does not fix the problem described for Docker in #24292 because that appears to be related to the netns itself being restored unexpectedly from Docker's state. Ref: https://github.com/hashicorp/nomad/issues/24292#issuecomment-2537078584 Ref: https://www.cni.dev/plugins/current/ipam/host-local/#files
60 lines
1.7 KiB
Go
60 lines
1.7 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package cni
|
|
|
|
// Generic has the one key that all plugins must have: "type"
|
|
type Generic struct {
|
|
Type string `json:"type"`
|
|
}
|
|
|
|
// Bridge is the subset of options that we use to configure the "bridge" plugin.
|
|
// https://www.cni.dev/plugins/current/main/bridge/
|
|
type Bridge struct {
|
|
Type string `json:"type"`
|
|
Bridgename string `json:"bridge"`
|
|
IpMasq bool `json:"ipMasq"`
|
|
IsGateway bool `json:"isGateway"`
|
|
ForceAddress bool `json:"forceAddress"`
|
|
HairpinMode bool `json:"hairpinMode"`
|
|
Ipam IPAM `json:"ipam"`
|
|
}
|
|
type IPAM struct {
|
|
Type string `json:"type"`
|
|
Ranges [][]Range `json:"ranges"`
|
|
Routes []Route `json:"routes"`
|
|
DataDir string `json:"dataDir"`
|
|
}
|
|
type Range struct {
|
|
Subnet string `json:"subnet"`
|
|
}
|
|
type Route struct {
|
|
Dst string `json:"dst"`
|
|
}
|
|
|
|
// Firewall is the "firewall" plugin.
|
|
// https://www.cni.dev/plugins/current/meta/firewall/
|
|
type Firewall struct {
|
|
Type string `json:"type"`
|
|
Backend string `json:"backend"`
|
|
AdminChainName string `json:"iptablesAdminChainName"`
|
|
}
|
|
|
|
// Portmap is the "portmap" plugin.
|
|
// https://www.cni.dev/plugins/current/meta/portmap/
|
|
type Portmap struct {
|
|
Type string `json:"type"`
|
|
Capabilities PortmapCapabilities `json:"capabilities"`
|
|
Snat bool `json:"snat"`
|
|
}
|
|
type PortmapCapabilities struct {
|
|
Portmappings bool `json:"portMappings"`
|
|
}
|
|
|
|
// ConsulCNI is the "consul-cni" plugin used for transparent proxy.
|
|
// https://github.com/hashicorp/consul-k8s/blob/main/control-plane/cni/main.go
|
|
type ConsulCNI struct {
|
|
Type string `json:"type"`
|
|
LogLevel string `json:"log_level"`
|
|
}
|