pkg/ipam: Hold agent IPAM while static IP is not assigned

This gates readiness of the agent by holding the constructor of the IPAM allocator if a static IP is requested and not assigned yet. This applies for CRD and multi-pool backed allocators.

Signed-off-by: Alex Melhem <alex.melhem@datadoghq.com>

Author: 41ks

pkg/ipam/crd.go

@@ -207,7 +207,10 @@ func newNodeStore(logger *slog.Logger, nodeName string, conf *option.DaemonConfi
 			logfields.Required, required,
 			logfields.Available, numAvailable,
 		)
-		if minimumReached {
+		requestedStaticIP, assignedStaticIP := store.staticIPStatus()
+		staticIPReady := !requestedStaticIP || assignedStaticIP != ""
+
+		if minimumReached && staticIPReady {
 			scopedLog.Info(
 				"All required IPs are available in CRD-backed allocation pool",
 			)
@@ -358,6 +361,17 @@ func (n *nodeStore) hasMinimumIPsInPool(localNodeStore *node.LocalNodeStore) (mi
 	return
 }
 
+func (n *nodeStore) staticIPStatus() (requested bool, assigned string) {
+	n.mutex.RLock()
+	defer n.mutex.RUnlock()
+
+	if n.ownNode == nil {
+		return false, ""
+	}
+
+	return len(n.ownNode.Spec.IPAM.StaticIPTags) > 0, n.ownNode.Status.IPAM.AssignedStaticIP
+}
+
 // deleteLocalNodeResource is called when the CiliumNode resource representing
 // the local node has been deleted.
 func (n *nodeStore) deleteLocalNodeResource() {

pkg/ipam/crd_test.go

@@ -143,6 +143,56 @@ func TestMarkForReleaseNoAllocate(t *testing.T) {
 	require.Equal(t, ipamOption.IPAMDoNotRelease, string(cn.Status.IPAM.ReleaseIPs["1.1.1.3"]))
 }
 
+func TestNodeStoreStaticIPStatus(t *testing.T) {
+	newNode := func(tags map[string]string, assigned string) *ciliumv2.CiliumNode {
+		cn := newCiliumNode("node1", 0, 0, 0)
+		cn.Spec.IPAM.StaticIPTags = tags
+		cn.Status.IPAM.AssignedStaticIP = assigned
+		return cn
+	}
+
+	tests := []struct {
+		name                  string
+		ownNode               *ciliumv2.CiliumNode
+		wantRequestedStaticIP bool
+		wantAssignedStaticIP  string
+	}{
+		{
+			name:                  "nil node",
+			ownNode:               nil,
+			wantRequestedStaticIP: false,
+			wantAssignedStaticIP:  "",
+		},
+		{
+			name:                  "no static IP requested",
+			ownNode:               newNode(nil, ""),
+			wantRequestedStaticIP: false,
+			wantAssignedStaticIP:  "",
+		},
+		{
+			name:                  "static IP requested but not yet assigned",
+			ownNode:               newNode(map[string]string{"env": "prod"}, ""),
+			wantRequestedStaticIP: true,
+			wantAssignedStaticIP:  "",
+		},
+		{
+			name:                  "static IP requested and assigned",
+			ownNode:               newNode(map[string]string{"env": "prod"}, "1.2.3.4"),
+			wantRequestedStaticIP: true,
+			wantAssignedStaticIP:  "1.2.3.4",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := &nodeStore{ownNode: tt.ownNode}
+			requested, assigned := store.staticIPStatus()
+			assert.Equal(t, tt.wantRequestedStaticIP, requested)
+			assert.Equal(t, tt.wantAssignedStaticIP, assigned)
+		})
+	}
+}
+
 type ipMasqMapDummy struct{}
 
 func (m ipMasqMapDummy) Update(netip.Prefix) error { return nil }