ipam: Wait for ENI netlink interface before configuring routes#41954
Merged
pippolo84 merged 3 commits intocilium:mainfrom Oct 9, 2025
Merged
ipam: Wait for ENI netlink interface before configuring routes#41954pippolo84 merged 3 commits intocilium:mainfrom
pippolo84 merged 3 commits intocilium:mainfrom
Conversation
Member
Author
|
/ci-eks |
7f8802f to
e76518c
Compare
Member
Author
|
/ci-eks |
1 similar comment
Contributor
|
/ci-eks |
e76518c to
230a590
Compare
230a590 to
65dd618
Compare
Member
Author
|
/ci-eks |
d9ed7d7 to
6447718
Compare
Member
Author
|
/ci-eks |
Member
Author
|
Completed 15 successful runs of |
Member
Author
|
/test |
gandro
reviewed
Oct 6, 2025
Member
gandro
left a comment
There was a problem hiding this comment.
Thanks for the fix! One question/comment w.r.t. the approach
c14be69 to
01b159e
Compare
This comment was marked as outdated.
This comment was marked as outdated.
01b159e to
c76330d
Compare
Member
Author
|
/test |
gandro
approved these changes
Oct 8, 2025
This comment was marked as outdated.
This comment was marked as outdated.
Accepting a context from the caller instead of hard-coding a context.TODO() allows for early termination of the IMDS queries when needed. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
In ENI IPAM mode, the ENIs are created by the operator. At the same time, on each node, the agents configure the v4 and v6 rules and routes for the Cilium router, after retrieving its IPs from either k8s or the filesystem. In order to do so, each agent query netlink to get the ifindex of the interface with the router IP, given its MAC address. Unfortunately this behavior is racy, since the agent might query netlink too soon, when the ENI is not yet up and running. This leads to the following error from netlink: "daemon creation failed: failed to configure router IP rules and routes: unable to find ifindex for interface MAC: interface with MAC ... not found" that ultimately stops the daemon startup. To address this, let's poll netlink and wait for the ENI netlink interface to show up before going ahead with routes and rules configuration. Fixes: cilium#37948 Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Now that the waitForENI function accepts a context, pass the daemon context as an argument. This way the startup procedure remains responsive to a context cancellation. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
c76330d to
304fa29
Compare
Member
Author
|
/test |
Member
Author
|
Removed review request to Tim since sig-agent has been covered by Sebastian |
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In ENI IPAM mode, the ENIs are created by the operator. At the same
time, on each node, the agents configure the v4 and v6 rules and routes
for the Cilium router, after retrieving its IPs from either k8s or the
filesystem. In order to do so, each agent query netlink to get the
ifindex of the interface with the router IP, given its MAC address.
Unfortunately this behavior is racy, since the agent might query netlink
too soon, when the ENI is not yet up and running. This leads to the
following error from netlink:
"daemon creation failed: failed to configure router IP rules and routes:
unable to find ifindex for interface MAC: interface with MAC ... not
found"
that ultimately stops the daemon startup.
To address this, let's poll netlink and wait for the ENI netlink
interface to show up before going ahead with routes and rules
configuration.
Fixes: #37948
Depends on #41783