Repository: istio/istio
File: cni/pkg/nodeagent/server_linux.go (Go)

Code before:
	}

	hostTrafficManager, podTrafficManager, err := trafficmanager.NewTrafficRuleManager(&trafficmanager.TrafficRuleManagerConfig{
		NativeNftables: useNftables,
		HostConfig:     hostCfg,
		PodConfig:      podCfg,
		HostDeps:       realDependenciesHost(args.ForceIptablesBinary),
		PodDeps:        realDependenciesInpod(UseScopedIptablesLegacyLocking, args.ForceIptablesBinary),
		NlDeps:         iptables.RealNlDeps(),
	})
	if err != nil {
		return nil, fmt.Errorf("error creating traffic managers: %w", err)
	}

	err = backoff.Retry(func() error {
		if !useNftables {
			// The nftables implementation will automatically flush any pre-existing chains when programming
			// the rules, so we skip the DeleteHostRules for nftables backend.

			// Not infallible, this can silently fail so we should retry it as well
			hostTrafficManager.DeleteHostRules()
		}

		// Create hostprobe rules now, in the host netns
		if innerErr := hostTrafficManager.CreateHostRulesForHealthChecks(); innerErr != nil {
			log.Debugf("CreateHostRulesForHealthCheck inner loop received error: %w", innerErr)
			return innerErr
		}
		return nil
	}, backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Duration(2)*time.Second), uint64(10)))
	if err != nil {
		return nil, fmt.Errorf("error initializing the host rules for health checks: %w", err)
	}

	podNetns, err := NewPodNetnsProcFinder(os.DirFS(filepath.Join(pconstants.HostMountsPath, "proc")))
	if err != nil {
		return nil, err
	}
	netServer := newNetServer(ztunnelServer, podNsMap, podTrafficManager, podNetns)

	return &meshDataplane{
		kubeClient:         client.Kube(),
		netServer:          netServer,
		hostTrafficManager: hostTrafficManager,
		hostAddrSet:        setManager,
	}, nil
}

// createHostNetworkAddrSetManager creates a host network addressSet manager. This is designed to be called from the host netns.
// Note that if the set already exists by name, Create will not return an error.
//

Review comment (bug):
```suggestion
			log.Debugf("CreateHostRulesForHealthCheck inner loop received error: %v", innerErr)
```

Code after:
	}

	hostTrafficManager, podTrafficManager, err := trafficmanager.NewTrafficRuleManager(&trafficmanager.TrafficRuleManagerConfig{
		NativeNftables: useNftables,
		HostConfig:     hostCfg,
		PodConfig:      podCfg,
		HostDeps:       realDependenciesHost(args.ForceIptablesBinary),
		PodDeps:        realDependenciesInpod(UseScopedIptablesLegacyLocking, args.ForceIptablesBinary),
		NlDeps:         iptables.RealNlDeps(),
	})
	if err != nil {
		return nil, fmt.Errorf("error creating traffic managers: %w", err)
	}

	err = backoff.Retry(func() error {
		if !useNftables {
			// The nftables implementation will automatically flush any pre-existing chains when programming
			// the rules, so we skip the DeleteHostRules for nftables backend.

			// Not infallible, this can silently fail so we should retry it as well
			hostTrafficManager.DeleteHostRules()
		}

		// Create hostprobe rules now, in the host netns
		if innerErr := hostTrafficManager.CreateHostRulesForHealthChecks(); innerErr != nil {
			log.Debugf("CreateHostRulesForHealthCheck inner loop received error: %v", innerErr)
			return innerErr
		}
		return nil
	}, backoff.WithMaxRetries(backoff.NewConstantBackOff(2*time.Second), 10))
	if err != nil {
		return nil, fmt.Errorf("error initializing the host rules for health checks, final retry error was: %w", err)
	}

	podNetns, err := NewPodNetnsProcFinder(os.DirFS(filepath.Join(pconstants.HostMountsPath, "proc")))
	if err != nil {
		return nil, err
	}
	netServer := newNetServer(ztunnelServer, podNsMap, podTrafficManager, podNetns)

	return &meshDataplane{
		kubeClient:         client.Kube(),
		netServer:          netServer,
		hostTrafficManager: hostTrafficManager,
		hostAddrSet:        setManager,
	}, nil
}

// createHostNetworkAddrSetManager creates a host network addressSet manager. This is designed to be called from the host netns.
// Note that if the set already exists by name, Create will not return an error.
//