Skip to content

Commit

Permalink
bridge, del: timeout after 30 secs of trying to list rules
Browse files Browse the repository at this point in the history
Making sure the exec'ed nft command is executed in 30 secs allows for
CNI to fail early, thus preventing CRI from sending another CNI DEL
while the previous NFT call is still being processed.

This fix prevents part of the behavior described in [0], in which:
> cnv-bridge and nft comes pile up in a loop, increasing every 60, never
completes

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>
  • Loading branch information
maiqueb committed Apr 20, 2023
1 parent f77f0a8 commit 6a3eb15
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion pkg/link/spoofcheck.go
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,10 @@
package link

import (
"context"
"fmt"
"os"
"time"

"github.com/networkplumbing/go-nft/nft"
"github.com/networkplumbing/go-nft/nft/schema"
Expand Down Expand Up @@ -46,7 +48,9 @@ func (dnc defaultNftConfigurer) Apply(cfg *nft.Config) error {
}

func (dnc defaultNftConfigurer) Read(filterCommands ...string) (*nft.Config, error) {
return nft.ReadConfig(filterCommands...)
ctxWithTimeout, cancelFunc := context.WithTimeout(context.Background(), time.Second)
defer cancelFunc()
return nft.ReadConfigContext(ctxWithTimeout, filterCommands...)
}

func NewSpoofChecker(iface, macAddress, refID string) *SpoofChecker {
Expand Down

0 comments on commit 6a3eb15

Please sign in to comment.