awslabs / tc-redirect-tap

tc-redirect-tap

tc-redirect-tap is a CNI plugin. This plugin allows you to adapt pre-existing CNI plugins/configuration to a tap device.

The plugin was initially developed as a part of firecracker-microvm/firecracker-go-sdk and can be used with Firecracker.

Questions?

Please use GitHub issues to report problems, discuss roadmap items, or make feature requests.

Security disclosures

If you think you’ve found a potential security issue, please do not post it in the Issues. Instead, please follow the instructions here or email AWS security directly.

License

This project is licensed under the Apache-2.0 License.

tc-redirect-tap's Issues

Update README.md

Stable tap name for use with CNI?

Hi, I've been trying to use firecracker's snapshot and restore functionality, but one of the challenges is that the current version of the Firecracker Go SDK doesn't support loading from a snapshot. It does integrate well with CNI and has been setting up IPs and adapters really well.

So one workaround appears to be to use HTTP requests to the unix socket to restore a snapshot taken with the Go SDK. The only outstanding issue is getting a stable tap device name, otherwise Firecracker panics when trying to load the snapshot either with no output at all, or the equivalent of "tap not found".

What would you suggest? Is there a way to do this, or is CNI not suited to this task due to the way it allocates tap names? Could the tap name be passed in or configured from some other metadata from the host-local / ptp plugin?

@Kern-- @kzys

Release binaries

We have multiple customers who want to download the binaries rather than building the plugin from source (see firecracker-microvm/firecracker-go-sdk#174).

Update golangci-lint to 1.50.0

Enable GitHub Actions

Add CodeQL scanning workflow

Add golangci linter to make lint target

Today's make lint does nothing. I'd like to at least do a spot check using golangci-lint.

Update pipeline matrix to build with latest Go versions.

Today the GitHub action matrix builds with 1.13 and 1.14.

I'd like to move forward using 1.17 and 1.18 in the pipeline builds.

Add CODEOWNERs and require review for merge

Add Go 1.19 to GitHub actions matrix.

Enable dependabot for Go dependency updates

Our dependency list is small but I think it will be good to get the PRs to encourage us to stay up-to-date.

Update Ubuntu image in GitHub actions.

Ubuntu 18 has been marked deprecated with full support to end in 4/1/2023.

Reference: actions/runner-images#6002

Chaining with Cilium CNI returns a nil interface

This is my CNI conf

{
  "name": "cilium",
  "cniVersion": "0.3.1",
  "plugins": [
    {
      "type": "cilium-cni",
      "enable-debug": false
    },
    {
      "type": "tc-redirect-tap"
    }
  ]
}

Cilium here handles the IPAM.

I cannot run Firecracker because I get the error:

expected to find 1 IP on redirect interface "eth0", but instead found []

I bit of debug of the plugin and I get this result into the tc-redirect-tap func here

tc-redirect-tap/internal/cniutil.go

Line 25 in a030097

func InterfaceIPs(result *current.Result, ifaceName string, sandbox string) []*current.IPConfig {

CNI Result: Interfaces:[{Name:eth0 Mac:c6:28:3f:e7:71:34 Sandbox:/var/run/netns/05673121-d177-11ea-b4db-005056848dc3}], IP:[{Version:4 Interface:<nil> Address:{IP:10.14.199.37 Mask:ffffffff} Gateway:10.14.24.19}], Routes:[{Dst:{IP:10.14.24.19 Mask:ffffffff} GW:<nil>} {Dst:{IP:0.0.0.0 Mask:00000000} GW:10.14.24.19}], DNS:{Nameservers:[] Domain: Search:[] Options:[]}

The function InterfaceIPs then cannot find any IPs because it checks under IP if the Interface is different than nil but in my case, it is nil, and then it fails.

Not sure if it is a bug of Cilium or we could move the check somewhere else.

Add official github releases

Hi there,
Would it be possible to set up github releases? This would
1.make it easier to download a pre-built artifact, and doesn't require golang to be installed
2. Let people subscribe to releases so they could see when new changes are released

Let me know if you want help setting it up

Remove pkg/errors

https://github.com/pkg/errors has been archived. We can use fmt.Errorf instead.