Skip to content

Commit 2e910e3

Browse files
npolshakovanpolshakova
committed
address feedback
Signed-off-by: npolshakova <nina.polshakova@solo.io>
1 parent 0747816 commit 2e910e3

21 files changed

Lines changed: 447 additions & 649 deletions

File tree

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ build-atenet:
5858
.PHONY: build-demos
5959
build-demos:
6060
GOFLAGS='"-ldflags=$(LDFLAGS)"' \
61-
$(KO) build ./demos/counter
61+
$(KO) build ./demos/counter ./demos/egress
6262

6363
.PHONY: test
6464
test:

‎cmd/atecontroller/internal/controllers/workerpool_apply.go‎

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import (
2424
metav1ac "k8s.io/client-go/applyconfigurations/meta/v1"
2525

2626
"github.com/agent-substrate/substrate/internal/ateompath"
27-
"github.com/agent-substrate/substrate/internal/egresscapture"
27+
"github.com/agent-substrate/substrate/internal/egress"
2828
atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
2929
)
3030

@@ -89,33 +89,21 @@ func buildDeploymentApplyConfig(wp *atev1alpha1.WorkerPool) *appsv1ac.Deployment
8989
}
9090

9191
func egressCaptureEnvFromController() []*corev1ac.EnvVarApplyConfiguration {
92-
enabled, _ := strconv.ParseBool(os.Getenv(egresscapture.EnvCaptureEnabled))
92+
enabled, _ := strconv.ParseBool(os.Getenv(egress.EnvCaptureEnabled))
9393
if !enabled {
9494
return nil
9595
}
9696

9797
env := []*corev1ac.EnvVarApplyConfiguration{
9898
corev1ac.EnvVar().
99-
WithName(egresscapture.EnvCaptureEnabled).
99+
WithName(egress.EnvCaptureEnabled).
100100
WithValue("true"),
101101
}
102-
if v := os.Getenv(egresscapture.EnvPEPAddress); v != "" {
102+
if v := os.Getenv(egress.EnvPEPAddress); v != "" {
103103
env = append(env, corev1ac.EnvVar().
104-
WithName(egresscapture.EnvPEPAddress).
104+
WithName(egress.EnvPEPAddress).
105105
WithValue(v))
106106
}
107-
if v := os.Getenv(egresscapture.EnvTunnelProtocol); v != "" {
108-
env = append(env, corev1ac.EnvVar().
109-
WithName(egresscapture.EnvTunnelProtocol).
110-
WithValue(v))
111-
}
112-
for _, name := range egresscapture.OptionalEnvNames {
113-
if v := os.Getenv(name); v != "" {
114-
env = append(env, corev1ac.EnvVar().
115-
WithName(name).
116-
WithValue(v))
117-
}
118-
}
119107
return env
120108
}
121109

‎cmd/atecontroller/internal/controllers/workerpool_apply_test.go‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
metav1ac "k8s.io/client-go/applyconfigurations/meta/v1"
2727

2828
"github.com/agent-substrate/substrate/internal/ateompath"
29-
"github.com/agent-substrate/substrate/internal/egresscapture"
29+
"github.com/agent-substrate/substrate/internal/egress"
3030
atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
3131
)
3232

@@ -263,12 +263,8 @@ func TestMicroVMPodShape(t *testing.T) {
263263
}
264264

265265
func TestWorkerPoolEgressCaptureEnvPropagation(t *testing.T) {
266-
t.Setenv(egresscapture.EnvCaptureEnabled, "1")
267-
t.Setenv(egresscapture.EnvPEPAddress, "ate-egress.agentgateway-system.svc.cluster.local:15008")
268-
t.Setenv(egresscapture.EnvTunnelProtocol, egresscapture.TunnelProtocolConnectTLS)
269-
t.Setenv(egresscapture.EnvConnectTLSServerName, "ate-egress.agentgateway-system.svc.cluster.local")
270-
t.Setenv(egresscapture.EnvConnectTLSCAFile, "/run/egress-ca/ca.crt")
271-
t.Setenv(egresscapture.EnvConnectTLSInsecureSkipVerify, "true")
266+
t.Setenv(egress.EnvCaptureEnabled, "1")
267+
t.Setenv(egress.EnvPEPAddress, "ate-egress.agentgateway-system.svc.cluster.local:15008")
272268

273269
wp := testWorkerPoolApplyConfig(nil)
274270
deployment := buildDeploymentApplyConfig(wp)
@@ -285,12 +281,8 @@ func TestWorkerPoolEgressCaptureEnvPropagation(t *testing.T) {
285281
}
286282

287283
want := map[string]string{
288-
egresscapture.EnvCaptureEnabled: "true",
289-
egresscapture.EnvPEPAddress: "ate-egress.agentgateway-system.svc.cluster.local:15008",
290-
egresscapture.EnvTunnelProtocol: egresscapture.TunnelProtocolConnectTLS,
291-
egresscapture.EnvConnectTLSServerName: "ate-egress.agentgateway-system.svc.cluster.local",
292-
egresscapture.EnvConnectTLSCAFile: "/run/egress-ca/ca.crt",
293-
egresscapture.EnvConnectTLSInsecureSkipVerify: "true",
284+
egress.EnvCaptureEnabled: "true",
285+
egress.EnvPEPAddress: "ate-egress.agentgateway-system.svc.cluster.local:15008",
294286
}
295287
for name, value := range want {
296288
if got[name] != value {

‎cmd/ateom-gvisor/egress_proxy.go‎

Lines changed: 7 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -24,40 +24,22 @@ import (
2424
"syscall"
2525
"unsafe"
2626

27-
"github.com/agent-substrate/substrate/internal/egresscapture"
27+
"github.com/agent-substrate/substrate/internal/egress"
2828
"github.com/google/nftables"
2929
"github.com/google/nftables/binaryutil"
3030
"github.com/google/nftables/expr"
3131
"golang.org/x/sys/unix"
3232
)
3333

34-
const (
35-
egressCapturePort = uint16(15001)
36-
egressOriginalHTTPPort = uint16(80)
37-
egressOriginalHTTPSPort = uint16(443)
38-
)
39-
40-
var defaultEgressCaptureRedirects = []struct {
41-
originalPort uint16
42-
capturePort uint16
43-
}{
44-
{originalPort: egressOriginalHTTPPort, capturePort: egressCapturePort},
45-
{originalPort: egressOriginalHTTPSPort, capturePort: egressCapturePort},
46-
}
47-
48-
var defaultEgressCaptureListeners = []egresscapture.Listener{
49-
{Port: egressCapturePort},
50-
}
51-
52-
func (s *AteomService) startEgressCaptureIfEnabled(ctx context.Context, identity egresscapture.ActorIdentity) error {
53-
if !egresscapture.EnabledFromEnv() {
34+
func (s *AteomService) startEgressCaptureIfEnabled(ctx context.Context, identity egress.ActorIdentity) error {
35+
if !egress.EnabledFromEnv() {
5436
return nil
5537
}
56-
cfg, err := egresscapture.ConfigFromEnv(defaultEgressCaptureListeners)
38+
cfg, err := egress.ConfigFromEnv(egress.DefaultCaptureListeners)
5739
if err != nil {
5840
return err
5941
}
60-
capture, err := egresscapture.Start(ctx, identity, cfg, originalDestination)
42+
capture, err := egress.Start(ctx, identity, cfg, originalDestination)
6143
if err != nil {
6244
return fmt.Errorf("while starting actor egress capture: %w", err)
6345
}
@@ -66,11 +48,11 @@ func (s *AteomService) startEgressCaptureIfEnabled(ctx context.Context, identity
6648
}
6749

6850
func addEgressCaptureRedirectRules(c *nftables.Conn, table *nftables.Table, prerouting *nftables.Chain, sourceIP string) {
69-
for _, redirect := range defaultEgressCaptureRedirects {
51+
for _, redirect := range egress.DefaultCaptureRedirects {
7052
c.AddRule(&nftables.Rule{
7153
Table: table,
7254
Chain: prerouting,
73-
Exprs: tcpRedirectExprs(sourceIP, redirect.originalPort, redirect.capturePort),
55+
Exprs: tcpRedirectExprs(sourceIP, redirect.OriginalPort, redirect.CapturePort),
7456
})
7557
}
7658
}

‎cmd/ateom-gvisor/main.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ import (
3232
"github.com/agent-substrate/substrate/internal/ateinterceptors"
3333
"github.com/agent-substrate/substrate/internal/ateompath"
3434
"github.com/agent-substrate/substrate/internal/contextlogging"
35-
"github.com/agent-substrate/substrate/internal/egresscapture"
35+
"github.com/agent-substrate/substrate/internal/egress"
3636
"github.com/agent-substrate/substrate/internal/proto/ateompb"
3737
"github.com/agent-substrate/substrate/internal/readyz"
3838
"github.com/agent-substrate/substrate/internal/serverboot"
@@ -165,7 +165,7 @@ type AteomService struct {
165165

166166
interiorNetNS netns.NsHandle
167167
actorLogger *actorlog.ActorLogger
168-
egressCapture *egresscapture.Capture
168+
egressCapture *egress.Capture
169169
}
170170

171171
var _ ateompb.AteomServer = (*AteomService)(nil)
@@ -444,7 +444,7 @@ func (s *AteomService) RestoreWorkload(ctx context.Context, req *ateompb.Restore
444444
return &ateompb.RestoreWorkloadResponse{}, nil
445445
}
446446

447-
func (s *AteomService) setupActorNetwork(ctx context.Context, identity egresscapture.ActorIdentity) (retErr error) {
447+
func (s *AteomService) setupActorNetwork(ctx context.Context, identity egress.ActorIdentity) (retErr error) {
448448
// Build a fresh point-to-point network between the worker pod netns and the
449449
// gVisor interior netns. The worker side keeps the pod's real eth0, creates
450450
// ateom0 as the gateway, and moves only the veth peer into the actor netns.
@@ -863,16 +863,16 @@ func tcpDestinationPortEqual(port uint16) []expr.Any {
863863
}
864864
}
865865

866-
func actorIdentityFromRun(req *ateompb.RunWorkloadRequest) egresscapture.ActorIdentity {
867-
return egresscapture.ActorIdentity{
866+
func actorIdentityFromRun(req *ateompb.RunWorkloadRequest) egress.ActorIdentity {
867+
return egress.ActorIdentity{
868868
Namespace: req.GetActorTemplateNamespace(),
869869
Template: req.GetActorTemplateName(),
870870
ActorID: req.GetActorId(),
871871
}
872872
}
873873

874-
func actorIdentityFromRestore(req *ateompb.RestoreWorkloadRequest) egresscapture.ActorIdentity {
875-
return egresscapture.ActorIdentity{
874+
func actorIdentityFromRestore(req *ateompb.RestoreWorkloadRequest) egress.ActorIdentity {
875+
return egress.ActorIdentity{
876876
Namespace: req.GetActorTemplateNamespace(),
877877
Template: req.GetActorTemplateName(),
878878
ActorID: req.GetActorId(),

‎cmd/ateom-microvm/egress_proxy.go‎

Lines changed: 11 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -24,41 +24,23 @@ import (
2424
"syscall"
2525
"unsafe"
2626

27-
"github.com/agent-substrate/substrate/internal/egresscapture"
27+
"github.com/agent-substrate/substrate/internal/egress"
2828
"github.com/agent-substrate/substrate/internal/proto/ateompb"
2929
"github.com/google/nftables"
3030
"github.com/google/nftables/binaryutil"
3131
"github.com/google/nftables/expr"
3232
"golang.org/x/sys/unix"
3333
)
3434

35-
const (
36-
egressCapturePort = uint16(15001)
37-
egressOriginalHTTPPort = uint16(80)
38-
egressOriginalHTTPSPort = uint16(443)
39-
)
40-
41-
var defaultEgressCaptureRedirects = []struct {
42-
originalPort uint16
43-
capturePort uint16
44-
}{
45-
{originalPort: egressOriginalHTTPPort, capturePort: egressCapturePort},
46-
{originalPort: egressOriginalHTTPSPort, capturePort: egressCapturePort},
47-
}
48-
49-
var defaultEgressCaptureListeners = []egresscapture.Listener{
50-
{Port: egressCapturePort},
51-
}
52-
53-
func (s *AteomService) startEgressCaptureIfEnabled(ctx context.Context, identity egresscapture.ActorIdentity) error {
54-
if !egresscapture.EnabledFromEnv() {
35+
func (s *AteomService) startEgressCaptureIfEnabled(ctx context.Context, identity egress.ActorIdentity) error {
36+
if !egress.EnabledFromEnv() {
5537
return nil
5638
}
57-
cfg, err := egresscapture.ConfigFromEnv(defaultEgressCaptureListeners)
39+
cfg, err := egress.ConfigFromEnv(egress.DefaultCaptureListeners)
5840
if err != nil {
5941
return err
6042
}
61-
capture, err := egresscapture.Start(ctx, identity, cfg, originalDestination)
43+
capture, err := egress.Start(ctx, identity, cfg, originalDestination)
6244
if err != nil {
6345
return fmt.Errorf("while starting actor egress capture: %w", err)
6446
}
@@ -67,11 +49,11 @@ func (s *AteomService) startEgressCaptureIfEnabled(ctx context.Context, identity
6749
}
6850

6951
func addEgressCaptureRedirectRules(c *nftables.Conn, table *nftables.Table, prerouting *nftables.Chain, sourceIP string) {
70-
for _, redirect := range defaultEgressCaptureRedirects {
52+
for _, redirect := range egress.DefaultCaptureRedirects {
7153
c.AddRule(&nftables.Rule{
7254
Table: table,
7355
Chain: prerouting,
74-
Exprs: tcpRedirectExprs(sourceIP, redirect.originalPort, redirect.capturePort),
56+
Exprs: tcpRedirectExprs(sourceIP, redirect.OriginalPort, redirect.CapturePort),
7557
})
7658
}
7759
}
@@ -138,16 +120,16 @@ func originalDstFromFD(fd int) (*net.TCPAddr, error) {
138120
}, nil
139121
}
140122

141-
func actorIdentityFromRun(req *ateompb.RunWorkloadRequest) egresscapture.ActorIdentity {
142-
return egresscapture.ActorIdentity{
123+
func actorIdentityFromRun(req *ateompb.RunWorkloadRequest) egress.ActorIdentity {
124+
return egress.ActorIdentity{
143125
Namespace: req.GetActorTemplateNamespace(),
144126
Template: req.GetActorTemplateName(),
145127
ActorID: req.GetActorId(),
146128
}
147129
}
148130

149-
func actorIdentityFromRestore(req *ateompb.RestoreWorkloadRequest) egresscapture.ActorIdentity {
150-
return egresscapture.ActorIdentity{
131+
func actorIdentityFromRestore(req *ateompb.RestoreWorkloadRequest) egress.ActorIdentity {
132+
return egress.ActorIdentity{
151133
Namespace: req.GetActorTemplateNamespace(),
152134
Template: req.GetActorTemplateName(),
153135
ActorID: req.GetActorId(),

‎cmd/ateom-microvm/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ import (
3636
"github.com/agent-substrate/substrate/internal/actorlog"
3737
"github.com/agent-substrate/substrate/internal/ateinterceptors"
3838
"github.com/agent-substrate/substrate/internal/ateompath"
39-
"github.com/agent-substrate/substrate/internal/egresscapture"
39+
"github.com/agent-substrate/substrate/internal/egress"
4040
"github.com/agent-substrate/substrate/internal/proto/ateompb"
4141
"github.com/agent-substrate/substrate/internal/serverboot"
4242
"github.com/agent-substrate/substrate/internal/version"
@@ -208,7 +208,7 @@ type AteomService struct {
208208

209209
// egressCapture owns the per-activation capture listener when egress capture is
210210
// enabled for this worker pod.
211-
egressCapture *egresscapture.Capture
211+
egressCapture *egress.Capture
212212

213213
// running maps actor id -> the live micro-VM, kept so CheckpointWorkload can
214214
// pause+snapshot+teardown the same sandbox (and RestoreWorkload can track the

‎cmd/ateom-microvm/net.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ import (
4848
"github.com/vishvananda/netns"
4949
"golang.org/x/sys/unix"
5050

51-
"github.com/agent-substrate/substrate/internal/egresscapture"
51+
"github.com/agent-substrate/substrate/internal/egress"
5252
"github.com/agent-substrate/substrate/internal/serverboot"
5353
)
5454

@@ -121,7 +121,7 @@ func mustParseIP(s string) net.IP {
121121
// pod netns and the kata interior netns (see the package comment). Idempotent
122122
// via cleanup-before-setup; also sweeps stale kata taps out of the interior
123123
// netns so the sandbox always builds on a clean slate.
124-
func (s *AteomService) setupActorNetwork(ctx context.Context, identity egresscapture.ActorIdentity) (retErr error) {
124+
func (s *AteomService) setupActorNetwork(ctx context.Context, identity egress.ActorIdentity) (retErr error) {
125125
s.cleanupActorNetworkOrExit(ctx, "Failed to clean up stale actor network before setup")
126126
defer func() {
127127
if retErr != nil {

0 commit comments

Comments
 (0)