Repository: istio/istio
File: cni/pkg/install/cniconfig.go (Go)

Code before:
		return "", err
	}

	if cfg.ChainedCNIPlugin {
		// If useIstioOwnedCNIConfig is true then we are copying the configuration from the primary CNI config file
		// otherwise, we are overwriting the existing primary cni config
		if !file.Exists(cniConfigFilepath) {
			return "", fmt.Errorf("CNI config file %s removed during configuration", cniConfigFilepath)
		}
		// This section overwrites an existing plugins list entry for istio-cni
		existingCNIConfig, err := os.ReadFile(cniConfigFilepath)
		if err != nil {
			return "", err
		}
		pluginConfig, err = insertCNIConfig(pluginConfig, existingCNIConfig)
		if err != nil {
			return "", err
		}
	}

	if useIstioOwnedCNIConfig(cfg) {
		// If useIstioOwnedCNIConfig is true, write to the istio owned CNI config path
		cniConfigFilepath = filepath.Join(cfg.MountedCNINetDir, cfg.IstioOwnedCNIConfigFilename)
	}

	if err = file.AtomicWrite(cniConfigFilepath, pluginConfig, os.FileMode(0o600)); err != nil {
		installLog.Errorf("Failed to write CNI config file %v: %v", cniConfigFilepath, err)
		return cniConfigFilepath, err
	}

	if cfg.ChainedCNIPlugin && strings.HasSuffix(cniConfigFilepath, ".conf") {
		// If the old CNI config filename ends with .conf, rename it to .conflist, because it has to be changed to a list
		installLog.Infof("Renaming %s extension to .conflist", cniConfigFilepath)
		err = os.Rename(cniConfigFilepath, cniConfigFilepath+"list")
		if err != nil {
			installLog.Errorf("Failed to rename CNI config file %v: %v", cniConfigFilepath, err)
			return cniConfigFilepath, err
		}
		cniConfigFilepath += "list"
	}

	installLog.Infof("Wrote CNI config to %s", cniConfigFilepath)
	return cniConfigFilepath, nil
}

// If configured as chained CNI plugin, waits indefinitely for a main CNI config file to exist before returning
// Or until cancelled by parent context
func getCNIConfigFilepath(ctx context.Context, cniConfName, mountedCNINetDir string, chained bool) (string, error) {
	if !chained {
		if len(cniConfName) == 0 {
			cniConfName = "YYY-istio-cni.conf"

Review comment (security):
This could break someone who is relying on the old perms for some reason. Can we add a flag for this?  We can probably default to the more restrictive permissions by default but a flag allows someone to go back to the old behavior.

Code after:
		return "", err
	}

	if cfg.ChainedCNIPlugin {
		// If useIstioOwnedCNIConfig is true then we are copying the configuration from the primary CNI config file
		// otherwise, we are overwriting the existing primary cni config
		if !file.Exists(cniConfigFilepath) {
			return "", fmt.Errorf("CNI config file %s removed during configuration", cniConfigFilepath)
		}
		// This section overwrites an existing plugins list entry for istio-cni
		existingCNIConfig, err := os.ReadFile(cniConfigFilepath)
		if err != nil {
			return "", err
		}
		pluginConfig, err = insertCNIConfig(pluginConfig, existingCNIConfig)
		if err != nil {
			return "", err
		}
	}

	if useIstioOwnedCNIConfig(cfg) {
		// If useIstioOwnedCNIConfig is true, write to the istio owned CNI config path
		cniConfigFilepath = filepath.Join(cfg.MountedCNINetDir, cfg.IstioOwnedCNIConfigFilename)
	}

	// Determine the file mode: when modifying the primary CNI config (chained, non-istio-owned),
	// preserve the existing file's permissions. Otherwise, use the configured mode.
	fileMode := cfg.CNIConfFileMode()
	if cfg.ChainedCNIPlugin && !useIstioOwnedCNIConfig(cfg) {
		if info, statErr := os.Stat(cniConfigFilepath); statErr == nil {
			fileMode = info.Mode()
		}
	}

	if err = file.AtomicWrite(cniConfigFilepath, pluginConfig, fileMode); err != nil {
		installLog.Errorf("Failed to write CNI config file %v: %v", cniConfigFilepath, err)
		return cniConfigFilepath, err
	}

	if cfg.ChainedCNIPlugin && strings.HasSuffix(cniConfigFilepath, ".conf") {
		// If the old CNI config filename ends with .conf, rename it to .conflist, because it has to be changed to a list
		installLog.Infof("Renaming %s extension to .conflist", cniConfigFilepath)
		err = os.Rename(cniConfigFilepath, cniConfigFilepath+"list")
		if err != nil {
			installLog.Errorf("Failed to rename CNI config file %v: %v", cniConfigFilepath, err)
			return cniConfigFilepath, err
		}
		cniConfigFilepath += "list"
	}

	installLog.Infof("Wrote CNI config to %s", cniConfigFilepath)