Skip to content

Conversation

giorio94
Copy link
Member

@giorio94 giorio94 commented May 28, 2024

Extend the validation performed upon retrieval of node and service entries from a remote cluster, to ensure improved consistency and prevent the propagation of corrupted data. In particular, let's ensure that the cluster and (namespaced) name fields are always set, that the cluster name matches that of the cluster we are connected to, and that the (namespaced) name corresponds to the kvstore key. Additionally, let's provide the possibility of validating the clusterID correspondence as well.

Please review commit by commit, and refer to the individual descriptions for additional details.
Related: #29602

@giorio94 giorio94 added kind/enhancement This would improve or streamline existing functionality. area/clustermesh Relates to multi-cluster routing functionality in Cilium. release-note/misc This PR makes changes that have no direct user impact. area/kvstore Impacts the KVStore package interactions. labels May 28, 2024
@giorio94 giorio94 force-pushed the mio/clustermesh-nodes-services-validation branch from 589f499 to 4d177b5 Compare May 28, 2024 09:47
@giorio94
Copy link
Member Author

/test

@giorio94 giorio94 marked this pull request as ready for review May 28, 2024 11:52
@giorio94 giorio94 requested review from a team as code owners May 28, 2024 11:52
giorio94 added 7 commits May 28, 2024 15:15
The NodeObserver does not depend on the NodeSync method. Hence,
let's move it to a separate interface, to avoid having to implement
it needlessly, e.g., in tests.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
As a preparation for the subsequent commits, let's hard-code the node
key creator and observer implementations, rather than propagating them
through hive, given that they are just tiny wrappers. This simplifies
further extensions, and ensures that we use the same approach in tests
as well, allowing to early catch possible issues.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Extend the validation performed upon retrieval of node entries from
a remote cluster, to ensure improved consistency and prevent the
propagation of corrupted data. In particular, let's ensure that the
cluster and name fields are always set, that the cluster name matches
that of the cluster we are connected to, and that the name corresponds
to the kvstore key. Additionally, let's provide the possibility of
validating the clusterID correspondence as well.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Extract and generalize the clustermesh service observer logic,
to additionally reduce code duplication and ensure that the two
usages are always synchronized. While being there, let's also
slightly improve the log messages, and drop the type check, as
always guaranteed to be correct.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Let's generate the kvstore key and value data representing a shared
service marshalling the ClusterService structure, rather than by
means of strings concatentation. That makes it easier to understand
and extend in the future.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Extend the validation performed upon retrieval of shared services from
a remote cluster, to ensure improved consistency and prevent the
propagation of corrupted data. In particular, let's ensure that the
cluster, namespace and name fields are always set, that the cluster
name matches that of the cluster we are connected to, and that the
namespaced name corresponds to the kvstore key. Additionally, let's
provide the possibility of validating the clusterID correspondence
as well.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Now that we enforce the correspondence of the advertised clusterID with
the one present as part of node and service objects, let's add an extra
test to ensure that node and service entries associated with the old
clusterID are eventually drained upon reconnection.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
@giorio94 giorio94 force-pushed the mio/clustermesh-nodes-services-validation branch from 4d177b5 to 2a52f8a Compare May 28, 2024 13:19
@giorio94
Copy link
Member Author

Rebased onto main to fix conflicts

@giorio94
Copy link
Member Author

/test

@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label May 31, 2024
@julianwiedmann julianwiedmann added this pull request to the merge queue May 31, 2024
Merged via the queue into cilium:main with commit d91e18c May 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/clustermesh Relates to multi-cluster routing functionality in Cilium. area/kvstore Impacts the KVStore package interactions. kind/enhancement This would improve or streamline existing functionality. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants