alibabacloud.go

// SPDX-License-Identifier: Apache-2.0
// Copyright Authors of Cilium

package alibabacloud

import (
	"context"
	"fmt"
	"log/slog"

	"github.com/aliyun/alibaba-cloud-sdk-go/services/ecs"
	"github.com/aliyun/alibaba-cloud-sdk-go/services/vpc"

	operatorOption "github.com/cilium/cilium/operator/option"
	"github.com/cilium/cilium/operator/pkg/ipam/allocator"
	"github.com/cilium/cilium/operator/pkg/ipam/nodemanager"
	"github.com/cilium/cilium/pkg/alibabacloud/api"
	"github.com/cilium/cilium/pkg/alibabacloud/ipam"
	"github.com/cilium/cilium/pkg/alibabacloud/ipam/limits"
	"github.com/cilium/cilium/pkg/alibabacloud/metadata"
	"github.com/cilium/cilium/pkg/logging/logfields"
)

// Maximum number of tags for exact search of ECS resources.
// https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-listtagresources
const MaxInstanceTags = 20

var subsysLogAttr = []any{logfields.LogSubsys, "ipam-allocator-alibaba-cloud"}

// AllocatorAlibabaCloud is an implementation of IPAM allocator interface for AlibabaCloud ENI
type AllocatorAlibabaCloud struct {
	AlibabaCloudVPCID            string
	AlibabaCloudReleaseExcessIPs bool
	ExcessIPReleaseDelay         int
	ParallelAllocWorkers         int64
	LimitIPAMAPIBurst            int
	LimitIPAMAPIQPS              float64
	AlibabaMetrics               api.MetricsAPI

	rootLogger *slog.Logger
	logger     *slog.Logger
	client     *api.Client
}

// Init sets up ENI limits based on given options
// Credential ref https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/docs/2-Client-EN.md
func (a *AllocatorAlibabaCloud) Init(ctx context.Context, logger *slog.Logger) error {
	a.rootLogger = logger
	a.logger = logger.With(subsysLogAttr...)

	if len(operatorOption.Config.IPAMInstanceTags) > MaxInstanceTags {
		return fmt.Errorf("number of tags in instance-tags-filter exceeds the limit %d", MaxInstanceTags)
	}

	var err error
	regionID, err := metadata.GetRegionID(ctx)
	if err != nil {
		return err
	}

	vpcClient, err := vpc.NewClientWithProvider(regionID)
	if err != nil {
		return err
	}
	ecsClient, err := ecs.NewClientWithProvider(regionID)
	if err != nil {
		return err
	}
	// Send API requests to "vpc" network endpoints instead of the default "public" network
	// endpoints, so the ECS instance hosting cilium-operator doesn't require public network access
	// to reach alibabacloud API.
	// vpc endpoints are spliced to the format: <product>-<network>.<region_id>.aliyuncs.com
	// e.g. ecs-vpc.cn-shanghai.aliyuncs.com
	// ref https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/docs/11-Endpoint-EN.md
	vpcClient.Network = "vpc"
	ecsClient.Network = "vpc"

	vpcClient.GetConfig().WithScheme("HTTPS")
	ecsClient.GetConfig().WithScheme("HTTPS")

	a.client = api.NewClient(a.rootLogger, vpcClient, ecsClient, a.AlibabaMetrics, a.LimitIPAMAPIQPS,
		a.LimitIPAMAPIBurst, operatorOption.Config.IPAMInstanceTags)

	if err := limits.UpdateFromAPI(ctx, a.client); err != nil {
		return fmt.Errorf("unable to update instance type to adapter limits from AlibabaCloud API: %w", err)
	}

	return nil
}

// Start kicks off ENI allocation, the initial connection to AlibabaCloud
// APIs is done in a blocking manner. Provided this is successful, a controller is
// started to manage allocation based on CiliumNode custom resources
func (a *AllocatorAlibabaCloud) Start(ctx context.Context, getterUpdater allocator.CiliumNodeGetterUpdater, iMetrics nodemanager.MetricsAPI) (allocator.NodeEventHandler, error) {
	a.logger.Info("Starting AlibabaCloud ENI allocator...")

	instances := ipam.NewInstancesManager(a.rootLogger, a.client)
	nodeManager, err := nodemanager.NewNodeManager(a.logger, instances, getterUpdater, iMetrics,
		a.ParallelAllocWorkers, a.AlibabaCloudReleaseExcessIPs, a.ExcessIPReleaseDelay, false)
	if err != nil {
		return nil, fmt.Errorf("unable to initialize AlibabaCloud node manager: %w", err)
	}

	if err := nodeManager.Start(ctx); err != nil {
		return nil, err
	}

	return nodeManager, nil
}