beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Don't enforce new validation rules for existing networks

Browse source 
Non-swarm networks created before network-creation-time validation
was added in 25.0.0 continued working, because the checks are not
re-run.

But, swarm creates networks when needed (with 'agent=true'), to
ensure they exist on each agent - ignoring the NetworkNameError
that says the network already existed.

By ignoring validation errors on creation of a network with
agent=true, pre-existing swarm networks with IPAM config that would
fail the new checks will continue to work too.

New swarm (overlay) networks are still validated, because they are
initially created with 'agent=false'.

Signed-off-by: Rob Murray <rob.murray@docker.com>
This commit is contained in:
Rob Murray 2024-02-08 17:40:54 +00:00
parent 9e075f3808
commit 571af915d5
1 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
daemon/network.go
View file

@ -332,8 +332,28 @@ func (daemon *Daemon) createNetwork(cfg *config.Config, create types.NetworkCrea
}
if err := network.ValidateIPAM(create.IPAM, create.EnableIPv6); err != nil {
if agent {
// This function is called with agent=false for all networks. For swarm-scoped
// networks, the configuration is validated but ManagerRedirectError is returned
// and the network is not created. Then, each time a swarm-scoped network is
// needed, this function is called again with agent=true.
//
// Non-swarm networks created before ValidateIPAM was introduced continue to work
// as they did before-upgrade, even if they would fail the new checks on creation
// (for example, by having host-bits set in their subnet). Those networks are not
// seen again here.
//
// By dropping errors for agent networks, existing swarm-scoped networks also
// continue to behave as they did before upgrade - but new networks are still
// validated.
log.G(context.TODO()).WithFields(log.Fields{
"error": err,
"network": create.Name,
}).Warn("Continuing with validation errors in agent IPAM")
} else {
return nil, errdefs.InvalidParameter(err)
}
}
if create.IPAM != nil {
ipam := create.IPAM