Repository: istio/istio
File: cni/pkg/nodeagent/server_linux.go (Go)

Code before:
		HostDeps:       realDependenciesHost(args.ForceIptablesBinary),
		PodDeps:        realDependenciesInpod(UseScopedIptablesLegacyLocking, args.ForceIptablesBinary),
		NlDeps:         iptables.RealNlDeps(),
	})
	if err != nil {
		return nil, fmt.Errorf("error creating traffic managers: %w", err)
	}

	err = backoff.Retry(func() error {
		if !useNftables {
			// The nftables implementation will automatically flush any pre-existing chains when programming
			// the rules, so we skip the DeleteHostRules for nftables backend.

			// Not infallible, this can silently fail so we should retry it as well
			hostTrafficManager.DeleteHostRules()
		}

		// Create hostprobe rules now, in the host netns
		if innerErr := hostTrafficManager.CreateHostRulesForHealthChecks(); innerErr != nil {
			log.Debugf("CreateHostRulesForHealthCheck inner loop received error: %w", innerErr)
			return innerErr
		}
		return nil
	}, backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Duration(2)*time.Second), uint64(10)))
	if err != nil {
		return nil, fmt.Errorf("error initializing the host rules for health checks: %w", err)
	}

	podNetns, err := NewPodNetnsProcFinder(os.DirFS(filepath.Join(pconstants.HostMountsPath, "proc")))
	if err != nil {
		return nil, err
	}
	netServer := newNetServer(ztunnelServer, podNsMap, podTrafficManager, podNetns)

	return &meshDataplane{
		kubeClient:         client.Kube(),
		netServer:          netServer,
		hostTrafficManager: hostTrafficManager,
		hostAddrSet:        setManager,
	}, nil
}

// createHostNetworkAddrSetManager creates a host network addressSet manager. This is designed to be called from the host netns.
// Note that if the set already exists by name, Create will not return an error.
//
// We will unconditionally flush our set before use here, so it shouldn't matter.
func createHostNetworkAddrSetManager(useNftables bool, isV6 bool) (set.AddressSetManager, error) {
	var setManager set.AddressSetManager
	runErr := util.RunAsHost(func() error {
		var err error
		setManager, err = set.New(useNftables, isV6)

Review comment (suggestion):
```suggestion
		return nil, fmt.Errorf("error initializing the host rules for health checks even after multiple retries: %w", err)
```

Code after:
		HostDeps:       realDependenciesHost(args.ForceIptablesBinary),
		PodDeps:        realDependenciesInpod(UseScopedIptablesLegacyLocking, args.ForceIptablesBinary),
		NlDeps:         iptables.RealNlDeps(),
	})
	if err != nil {
		return nil, fmt.Errorf("error creating traffic managers: %w", err)
	}

	err = backoff.Retry(func() error {
		if !useNftables {
			// The nftables implementation will automatically flush any pre-existing chains when programming
			// the rules, so we skip the DeleteHostRules for nftables backend.

			// Not infallible, this can silently fail so we should retry it as well
			hostTrafficManager.DeleteHostRules()
		}

		// Create hostprobe rules now, in the host netns
		if innerErr := hostTrafficManager.CreateHostRulesForHealthChecks(); innerErr != nil {
			log.Debugf("CreateHostRulesForHealthCheck inner loop received error: %v", innerErr)
			return innerErr
		}
		return nil
	}, backoff.WithMaxRetries(backoff.NewConstantBackOff(2*time.Second), 10))
	if err != nil {
		return nil, fmt.Errorf("error initializing the host rules for health checks, final retry error was: %w", err)
	}

	podNetns, err := NewPodNetnsProcFinder(os.DirFS(filepath.Join(pconstants.HostMountsPath, "proc")))
	if err != nil {
		return nil, err
	}
	netServer := newNetServer(ztunnelServer, podNsMap, podTrafficManager, podNetns)

	return &meshDataplane{
		kubeClient:         client.Kube(),
		netServer:          netServer,
		hostTrafficManager: hostTrafficManager,
		hostAddrSet:        setManager,
	}, nil
}

// createHostNetworkAddrSetManager creates a host network addressSet manager. This is designed to be called from the host netns.
// Note that if the set already exists by name, Create will not return an error.
//
// We will unconditionally flush our set before use here, so it shouldn't matter.
func createHostNetworkAddrSetManager(useNftables bool, isV6 bool) (set.AddressSetManager, error) {
	var setManager set.AddressSetManager
	runErr := util.RunAsHost(func() error {
		var err error
		setManager, err = set.New(useNftables, isV6)