ipam

host-local

以入参为例

{
    "name": "networks",
    "cniVersion": "0.4.0",
    "ipam": {
        "type": "host-local",
        "subnet": "10.250.7.0/24",
        "dataDir": "/var/lib/cni/",
        "routes": [
            { "dst": "0.0.0.0/0" }
        ]
    }
}

看看这个ipam插件是怎么挑选容器IP的

解析参数

入参中ipam部分参数对应的host-local插件会解析处理的，这里重点看下网段这部分的解析逻辑

func (r *Range) Canonicalize() error {
    if err := canonicalizeIP(&r.Subnet.IP); err != nil {
        return err
    }

    // Ensure Subnet IP is the network address, not some other address
    networkIP := r.Subnet.IP.Mask(r.Subnet.Mask)
    if !r.Subnet.IP.Equal(networkIP) {
        return fmt.Errorf("Network has host bits set. For a subnet mask of length %d the network address is %s", ones, networkIP.String())
    }

    // If the gateway is nil, claim .1
    if r.Gateway == nil {
        r.Gateway = ip.NextIP(r.Subnet.IP)
    } else {
        if err := canonicalizeIP(&r.Gateway); err != nil {
            return err
        }
    }

    // RangeStart: If specified, make sure it's sane (inside the subnet),
    // otherwise use the first free IP (i.e. .1) - this will conflict with the
    // gateway but we skip it in the iterator
    if r.RangeStart != nil {
        if err := canonicalizeIP(&r.RangeStart); err != nil {
            return err
        }

        if !r.Contains(r.RangeStart) {
            return fmt.Errorf("RangeStart %s not in network %s", r.RangeStart.String(), (*net.IPNet)(&r.Subnet).String())
        }
    } else {
        r.RangeStart = ip.NextIP(r.Subnet.IP)
    }

    // RangeEnd: If specified, verify sanity. Otherwise, add a sensible default
    // (e.g. for a /24: .254 if IPv4, ::255 if IPv6)
    if r.RangeEnd != nil {
        if err := canonicalizeIP(&r.RangeEnd); err != nil {
            return err
        }

        if !r.Contains(r.RangeEnd) {
            return fmt.Errorf("RangeEnd %s not in network %s", r.RangeEnd.String(), (*net.IPNet)(&r.Subnet).String())
        }
    } else {
        r.RangeEnd = lastIP(r.Subnet)
    }

    return nil
}

对于网段10.250.7.0/24

• 首先会解析出子网掩码信息255.255.255.0

• 然后取网段内的第一个IP作为网关，即10.250.7.1

• 同样取网段内的第一个IP作为分配IP的起始IP地址，即10.250.7.1，这里起始IP虽然和网关一样，但是后面分配IP的时候会判断如果和网关一样的话就跳过

• 取网段内的最后一个IP作为分配IP的结尾IP地址，即10.250.7.254，忽略广播地址255

分配IP

func (a *IPAllocator) Get(id string, ifname string, requestedIP net.IP) (*current.IPConfig, error) {

       else {
        iter, err := a.GetIter()

        for {
            reservedIP, gw = iter.Next()
            if reservedIP == nil {
                break
            }

            reserved, err := a.store.Reserve(id, ifname, reservedIP.IP, a.rangeID)
            if err != nil {
                return nil, err
            }

            if reserved {
                break
            }
        }
    }
}

这里会初始化一个迭代器，初始下标是0，起始IP就是上面解析出来的起始IP，即10.250.7.1，迭代内容就是网段10.250.7.0/24

iter := RangeIter{
        rangeset: a.rangeset,
                rangeIdx: 0
                startIP: (*a.rangeset)[0].RangeStart
    }

迭代过程就是从起始IP开始，如果起始IP和网关相同，就跳过这个起始IP，将IP+1获取下一个IP，直到结尾IP

func (i *RangeIter) Next() (*net.IPNet, net.IP) {
    r := (*i.rangeset)[i.rangeIdx]

    // If this is the first time iterating and we're not starting in the middle
    // of the range, then start at rangeStart, which is inclusive
    if i.cur == nil {
        i.cur = r.RangeStart
        i.startIP = i.cur
        if i.cur.Equal(r.Gateway) {
            return i.Next()
        }
        return &net.IPNet{IP: i.cur, Mask: r.Subnet.Mask}, r.Gateway
    }

    // If we've reached the end of this range, we need to advance the range
    // RangeEnd is inclusive as well
    if i.cur.Equal(r.RangeEnd) {
        i.rangeIdx += 1
        i.rangeIdx %= len(*i.rangeset)
        r = (*i.rangeset)[i.rangeIdx]

        i.cur = r.RangeStart
    } else {
        i.cur = ip.NextIP(i.cur)
    }

    if i.startIP == nil {
        i.startIP = i.cur
    } else if i.cur.Equal(i.startIP) {
        // IF we've looped back to where we started, give up
        return nil, nil
    }

    if i.cur.Equal(r.Gateway) {
        return i.Next()
    }

    return &net.IPNet{IP: i.cur, Mask: r.Subnet.Mask}, r.Gateway
}

最终如果结尾IP也分配出去了，则又会回到起始IP，这时候会失败，没有IP可分配了

记录IP

再分配IP是怎么知道哪个IP已经分配过了呢？

host-local插件是通过记录文件的形式来记录的

func New(network, dataDir string) (*Store, error) {
    if dataDir == "" {
        dataDir = defaultDataDir
    }
    dir := filepath.Join(dataDir, network)
    if err := os.MkdirAll(dir, 0755); err != nil {
        return nil, err
    }

    lk, err := NewFileLock(dir)
    if err != nil {
        return nil, err
    }
    return &Store{lk, dir}, nil
}

这里会创建目录/var/lib/cni/networks/，这里目录取自入参中的dataDir字段和name字段拼接而成

当一个IP分配出去之后

func (s *Store) Reserve(id string, ifname string, ip net.IP, rangeID string) (bool, error) {
    fname := GetEscapedPath(s.dataDir, ip.String())

    f, err := os.OpenFile(fname, os.O_RDWR|os.O_EXCL|os.O_CREATE, 0644)
    
    if _, err := f.WriteString(strings.TrimSpace(id) + LineBreak + ifname); err != nil {
    
    // store the reserved ip in lastIPFile
    ipfile := GetEscapedPath(s.dataDir, lastIPFilePrefix+rangeID)
    err = ioutil.WriteFile(ipfile, []byte(ip.String()), 0644)
    if err != nil {
        return false, err
    }
    return true, nil
}

就会在目录/var/lib/cni/networks/下创建一个文件/var/lib/cni/networks/10.250.7.2，并写入内容

0
eth0

同时记录文件/var/lib/cni/networks/last_reserved_ip.0，写入内容

10.250.7.2

表示上一次分配出去的IP地址是10.250.7.2

这样在构造迭代器的时候会首先读文件/var/lib/cni/networks/last_reserved_ip.0获取上一次分配出去的IP，然后把上一次分配出去的IP作为起始IP即可

func (a *IPAllocator) GetIter() (*RangeIter, error) {
    iter := RangeIter{
        rangeset: a.rangeset,
    }

    // Round-robin by trying to allocate from the last reserved IP + 1
    startFromLastReservedIP := false

    // We might get a last reserved IP that is wrong if the range indexes changed.
    // This is not critical, we just lose round-robin this one time.
    lastReservedIP, err := a.store.LastReservedIP(a.rangeID)
    if err != nil && !os.IsNotExist(err) {
        log.Printf("Error retrieving last reserved ip: %v", err)
    } else if lastReservedIP != nil {
        startFromLastReservedIP = a.rangeset.Contains(lastReservedIP)
    }

    // Find the range in the set with this IP
    if startFromLastReservedIP {
        for i, r := range *a.rangeset {
            if r.Contains(lastReservedIP) {
                iter.rangeIdx = i

                // We advance the cursor on every Next(), so the first call
                // to next() will return lastReservedIP + 1
                iter.cur = lastReservedIP
                break
            }
        }
    } else {
        iter.rangeIdx = 0
        iter.startIP = (*a.rangeset)[0].RangeStart
    }
    return &iter, nil
}