summaryrefslogtreecommitdiff
path: root/libpod/network
Commit message (Collapse)AuthorAge
* Document to not set K8S envars for CNIPaul Holzinger2021-11-12
| | | | | | | Setting these environment variables can cause issues with custom CNI plugins, see #12083. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Replace 'an user' => 'a user'Stefan Weil2021-11-12
| | | | Signed-off-by: Stefan Weil <sw@weilnetz.de>
* rootful: do not set XDG_RUNTIME_DIR for cni pluginsPaul Holzinger2021-09-29
| | | | | | | | | | | | | | | The dnsname plugin tries to use XDG_RUNTIME_DIR to store files. podman run will have XDG_RUNTIME_DIR set and thus the cni plugin can use it. The problem is that XDG_RUNTIME_DIR is unset for the conmon process for rootful users. This causes issues since the cleanup process is spawned by conmon and thus not have XDG_RUNTIME_DIR set to same value as podman run. Because of it dnsname will not find the config files and cannot correctly cleanup. To fix this we should also unset XDG_RUNTIME_DIR for the cni plugins as rootful. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Drop dependency on iproutePaul Holzinger2021-09-02
| | | | | | | | | | | We only use the `ip` util to remove a network interface. We can do this directly via the netlink lib, no need to call a external binary. [NO TESTS NEEDED] Fixes #11403 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Globally replace http:// with https://Daniel J Walsh2021-08-27
| | | | | | [NO TESTS NEEDED] Hopefully existing tests will find issues. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Network interfacePaul Holzinger2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement a new network interface to abstract CNI from libpod. The interface is implemented for the CNI backend but in the future we can add more backends. The code is structured in three new packages: - `libpod/network/types`: contains the interface definition and the necessary types for it. - `libpod/network/cni` contains the interface implementation for the CNI backend. - `libpod/network/util` a set of utility functions related to networking. The CNI package uses ginkgo style unit tests. To test Setup/Teardown the test must be run as root. Each test will run in their own namespace to make the test independent from the host environment. New features with the CNI backend: - The default network will be created in memory if it does not exists on disk. - It can set more than one static IP per container network. - Networks are loaded once from disk and only if this interface is used, e.g. for commands such as `podman info` networks are not loaded. This reduces unnecessary disk IO. This commit only adds the interface it is not wired into libpod. This requires a lot of breaking changes which will be done in a followup commit. Once this is integrated into libpod the current network code under `libpod/network` should be removed. Also the dependency on OCICNI should be dropped. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* dual-stack network: fix duplicated subnet assignmentPaul Holzinger2021-07-26
| | | | | | | | | Make sure podman network create reads all subnets from existing cni configs and not only the first one. Fixes #11032 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Fix network create macvlan with subnet optionPaul Holzinger2021-05-20
| | | | | | | | | | Creating a macvlan network with the subnet or ipRange option should set the ipam plugin type to `host-local`. We also have to insert the default route. Fixes #10283 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Detect if in podman machine virtual vmBrent Baude2021-04-30
| | | | | | | | | | | | When in podman machine virtual machines, podman needs to be able to detect as such. One implementation for this is when creating networks, the podman-machine cni plugin needs to be added to the configuration. This PR also includes the latest containers-common. [NO TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* rootless cni without infra containerPaul Holzinger2021-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of creating an extra container create a network and mount namespace inside the podman user namespace. This ns is used to for rootless cni operations. This helps to align the rootless and rootful network code path. If we run as rootless we just have to set up a extra net ns and initialize slirp4netns in it. The ocicni lib will be called in that net ns. This design allows allows easier maintenance, no extra container with pause processes, support for rootless cni with --uidmap and possibly more. The biggest problem is backwards compatibility. I don't think live migration can be possible. If the user reboots or restart all cni containers everything should work as expected again. The user is left with the rootless-cni-infa container and image but this can safely be removed. To make the existing cni configs work we need execute the cni plugins in a extra mount namespace. This ensures that we can safely mount over /run and /var which have to be writeable for the cni plugins without removing access to these files by the main podman process. One caveat is that we need to keep the netns files at `XDG_RUNTIME_DIR/netns` accessible. `XDG_RUNTIME_DIR/rootless-cni/{run,var}` will be mounted to `/{run,var}`. To ensure that we keep the netns directory we bind mount this relative to the new root location, e.g. XDG_RUNTIME_DIR/rootless-cni/run/user/1000/netns before we mount the run directory. The run directory is mounted recursive, this makes the netns directory at the same path accessible as before. This also allows iptables-legacy to work because /run/xtables.lock is now writeable. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Unification of until filter across list/prune endpointsJakub Guzik2021-03-24
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Unification of label filter across list/prune endpointsJakub Guzik2021-03-24
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* network prune filters for http compat and libpod apiJakub Guzik2021-03-18
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Split libpod/network packagePaul Holzinger2021-03-15
| | | | | | | | | | | | The `libpod/network` package should only be used on the backend and not the client. The client used this package only for two functions so move them into a new `pkg/network` package. This is needed so we can put linux only code into `libpod/network`, see #9710. [NO TESTS NEEDED] Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Fix podman network IDs handlingPaul Holzinger2021-02-22
| | | | | | | | | | | | | The libpod network logic knows about networks IDs but OCICNI does not. We cannot pass the network ID to OCICNI. Instead we need to make sure we only use network names internally. This is also important for libpod since we also only store the network names in the state. If we would add a ID there the same networks could accidentally be added twice. Fixes #9451 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* bump go module to v3Valentin Rothberg2021-02-22
| | | | | | | | | We missed bumping the go module, so let's do it now :) * Automated go code with github.com/sirkon/go-imports-rename * Manually via `vgrep podman/v2` the rest Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Enable whitespace linterPaul Holzinger2021-02-11
| | | | | | | | Use the whitespace linter and fix the reported problems. [NO TESTS NEEDED] Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* add network prunebaude2021-02-06
| | | | | | | | | add the ability to prune unused cni networks. filters are not implemented but included both compat and podman api endpoints. Fixes :#8673 Signed-off-by: baude <bbaude@redhat.com>
* Honor network options for macvlan networksbaude2021-02-02
| | | | | | | | | when creating a macvlan network, we should honor gateway, subnet, and mtu as provided by the user. Fixes: #9167 Signed-off-by: baude <bbaude@redhat.com>
* add macvlan as a supported network driverbaude2021-02-01
| | | | | | | | | | | | instead of using the --macvlan to indicate that you want to make a macvlan network, podman network create now honors the driver name of *macvlan*. Any options to macvlan, like the parent device, should be specified as a -o option. For example, -o parent=eth0. the --macvlan option was marked as deprecated in the man page but is still supported for the duration of 3.0. Signed-off-by: baude <bbaude@redhat.com>
* disable dnsname when --internalbaude2021-01-25
| | | | | | | | when doing a network creation, the dnsname plugin should be disabled when the --internal bool is set. a warning is displayed if this happens and docs are updated. Signed-off-by: baude <bbaude@redhat.com>
* Move the cni lock file into the cni config dirPaul Holzinger2021-01-21
| | | | | | | | | | | | | | Commit(fe3faa517e1b) introduced a lock file for network create/rm calls. There is a problem with the location of the lock file. The lock file was stored in the tmpdir. Running multiple podman network create/remove commands in parallel with different tmpdirs made the lockfile inaccessible to the other process, and so parallel read/write operations to the cni config directory continued to occur. This scenario happened frequently during the e2e tests and caused some flakes. Fixes #9041 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Fix problems reported by staticcheckPaul Holzinger2021-01-12
| | | | | | | | | | | | | | `staticcheck` is a golang code analysis tool. https://staticcheck.io/ This commit fixes a lot of problems found in our code. Common problems are: - unnecessary use of fmt.Sprintf - duplicated imports with different names - unnecessary check that a key exists before a delete call There are still a lot of reported problems in the test files but I have not looked at those. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* SpellingJosh Soref2020-12-22
| | | | Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
* Always add the default gateway to the cni config filePaul Holzinger2020-12-16
| | | | | | | | | | | | `podman network create` should always add a gateway to the cni config. If no gateway is given use the first ip in the subnet. CNI does not require the gateway field but we need it because of network inspect. This worked with previous version but was dropped in Commit(e7a72d72fd59). Fixes #8748 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Add support for network idsPaul Holzinger2020-12-02
| | | | | | | | | | | | | | | | | | | The network ID is not stored. It is just the sha256 hash from the network name. There is a risk of a potential hash collision. However it's very unlikely and even if we hit this it will complain that more than network with this ID exists. The main benefit is that the compat api can have proper network ID support. Also this adds the support for `podman network ls --format "{{.ID}}"` and `--filter id=<ID>`. It also ensures that we can do network rm <ID> and network inspect <ID>. Since we use a hash this commit is backwards compatible even for already existing networks. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Validate that the bridge option is supportedAnders F Björklund2020-12-01
| | | | | | Thanks Luap99 for the validation suggestion Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
* Add podman network create option for bridge vlanAnders F Björklund2020-12-01
| | | | Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
* Add podman network create option for bridge mtuAnders F Björklund2020-12-01
| | | | Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
* Merge pull request #8505 from Luap99/network-labelsOpenShift Merge Robot2020-12-01
|\ | | | | podman network label support
| * podman network label supportPaul Holzinger2020-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add label support for podman network create. Use the `args` field in the cni config file to store the podman labels. Use `podman_labels` as key name and store the labels as map[string]string. For reference: https://github.com/containernetworking/cni/blob/master/CONVENTIONS.md#args-in-network-config https://github.com/containernetworking/cni/blob/spec-v0.4.0/SPEC.md#network-configuration Example snippet: ``` ... "args": { "podman_labels": { "key1":"value1", "key2":"value2" } } ... ``` Make podman network list support several filters. Supported filters are name, plugin, driver and label. Filters with different keys work exclusive. Several label filters work exclusive and the other filter keys are working inclusive. Also adjust the compat api to support labels in network create and list. Breaking changes: - podman network ls -f shortform is used for --filter instead --format This matches docker and other podman commands (container ps, volume ps) - libpod network list endpoint filter parameter is removed. Instead the filters paramter should be used as json encoded map[string][]string. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Fix problems with network removePaul Holzinger2020-11-26
|/ | | | | | | | | First, make sure we are only trying to remove the network interface if we are root. Second, if we cannot get the interface name (e.g macvlan config) then we should not fail. Just remove the config file. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Fix custom mac address with a custom cni networkPaul Holzinger2020-11-24
| | | | | | | | | | | The cni plugin `tuning` is required to set a custom mac address. This plugin is configured in the default cni config file which is packaged with podman but was not included the generated config form `podman network create`. Fixes #8385 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Fix ip-range for classless subnet masksPaul Holzinger2020-11-23
| | | | | | | | | | | The `LastIPInSubnet` function worked only for classful subnet masks (e.g. /8, /16, /24). For non standard subnet masks this returned the wrong ip address. This works now for all subnet mask. A unit test is added to ensure this. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* add network connect|disconnect compat endpointsbaude2020-11-17
| | | | | | | | | | | this enables the ability to connect and disconnect a container from a given network. it is only for the compatibility layer. some code had to be refactored to avoid circular imports. additionally, tests are being deferred temporarily due to some incompatibility/bug in either docker-py or our stack. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #8251 from baude/networkaliasesOpenShift Merge Robot2020-11-10
|\ | | | | network aliases for container creation
| * network aliases for container creationbaude2020-11-09
| | | | | | | | | | | | | | | | podman can now support adding network aliases when running containers (--network-alias). It requires an updated dnsname plugin as well as an updated ocicni to work properly. Signed-off-by: baude <bbaude@redhat.com>
* | enable ipv6 network configuration optionsAntonio Ojea2020-11-10
|/ | | | | | | | | | | | | enable the ipv6 flag in podman network to be able to create dual-stack networks for containers. This is required to be compatible with docker, where --ipv6 really means dual stack. podman, unlike docker, support IPv6 only containers since 07e3f1bba9674c0cb93a0fa260930bfebbf75728. Signed-off-by: Antonio Ojea <aojea@redhat.com>
* Always add the dnsname plugin to the config for rootlessPaul Holzinger2020-10-17
| | | | | | | | The rootless-cni-infra container always has the dnsname plugin installed. It makes no sense to check if it is present on the host. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* prevent unpredictable results with network create|removebaude2020-10-07
due to a lack of "locking" on cni operations, we could get ourselves in trouble when doing rapid creation or removal of networks. added a simple file lock to deal with the collision and because it is not considered a performent path, use of the file lock should be ok. if proven otherwise in the future, some generic shared memory lock should be implemented for libpod and also used here. moved pkog/network to libpod/network because libpod is now being pulled into the package and it has therefore lost its generic nature. this will make it easier to absorb into libpod as we try to make the network closer to core operations. Fixes: #7807 Signed-off-by: baude <bbaude@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-27 11:17:14 +0000