Support to apply network policies to multiple interfaces #432
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR extends eBPF probe attachment to support multi-NIC pods by determining interface counts and iterating attachments across all interfaces.
- Introduces
numInterfacesparameter andgetInterfaceCountForPodlogic backed by IPAM cache. - Loads IPAM allocations from JSON at startup when multi-NIC is enabled.
- Updates probe attachment to loop over each interface and share BPF programs.
Reviewed Changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/utils/utils.go | Modify GetHostVethName signature to accept interfaceIndex |
| pkg/rpc/rpc_handler.go | Pass InterfaceCount into AttacheBPFProbes call |
| pkg/ebpf/bpf_client.go | Load IPAM JSON, determine interface count, and attach probes in loop |
| pkg/ebpf/bpf_client_test.go | Add tests for multi-NIC scenarios and getInterfaceCountForPod |
| pkg/ebpf/bpf_client_mock.go | Update mock client to new AttacheBPFProbes signature and mode API |
| controllers/policyendpoints_controller.go | Call updated AttacheBPFProbes with unknown count constant |
| go.mod | Bump various dependencies |
Comments suppressed due to low confidence (2)
pkg/utils/utils.go:176
- The variable name
errorsis ambiguous and shadows the built-in error type; consider renaming it toerroraggErrfor clarity.
var errors error
pkg/ebpf/bpf_client.go:638
- The
podIdentifierparameter is not used in this function body; consider removing it to simplify the signature.
func (l *bpfClient) getInterfaceCountForPod(pod types.NamespacedName, podIdentifier string, providedCount int) (int, error) {
| if err != nil { | ||
| log().Errorf("Attaching eBPF probe failed for pod %s namespace %s : %v", pod.Name, pod.Namespace, err) | ||
| log().Errorf("Failed to attach eBPF probes for pod %s: %v", pod.Name, err) |
There was a problem hiding this comment.
This error log omits the pod's namespace, which can be useful for debugging; include both name and namespace, e.g., pod %s/%s.
| log().Errorf("Failed to attach eBPF probes for pod %s: %v", pod.Name, err) | |
| log().Errorf("Failed to attach eBPF probes for pod %s/%s: %v", pod.Namespace, pod.Name, err) |
Copilot uses AI. Check for mistakes.
| return 0, errors.New("Skipping probe attach: multiNIC enabled and interface count is unknown") | ||
| } | ||
|
|
||
| func (l *bpfClient) AttacheBPFProbes(pod types.NamespacedName, podIdentifier string, numInterfaces int) error { |
There was a problem hiding this comment.
[nitpick] This method combines interface count logic and a looped attachment flow, making it lengthy; consider extracting helper functions (e.g., for count determination and per-interface attachment) to improve readability.
Copilot uses AI. Check for mistakes.
Issue #, if available:
This PR supports attaching probes and applying policies to all interfaces of a pod that has multi-NIC enabled and multi-NIC-attachment annotation. The same policies will be applied to all interfaces of the pod. BPF programs are shared across all interfaces. Probes needs to be attached to all interfaces of the pod.
Description of changes:
Testing
On allowed port
On not allowed port
Allow 8080 port now and see if updates are applied
normal pod probes attach
multi-nic pod on restart
normal pod on restart
if reconcile request comes first
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.