Repository: k3s-io/k3s
File: pkg/daemons/control/tunnel.go (Go)

Code before:
				}
			}
		}
	}
	return node, nil
}

// onChangePod updates the pod address mappings by observing changes to pods.
func (t *TunnelServer) onChangePod(podName string, pod *v1.Pod) (*v1.Pod, error) {
	if pod != nil {
		t.Lock()
		defer t.Unlock()
		// Add all pod IPs, unless the pod uses host network
		if !pod.Spec.HostNetwork {
			nodeName := pod.Spec.NodeName
			for _, ip := range pod.Status.PodIPs {
				if cidr, err := util.IPStringToIPNet(ip.IP); err == nil {
					if pod.DeletionTimestamp != nil {
						nets, _ := t.cidrs.ContainingNetworks(net.ParseIP(ip.IP))
						if entry, ok := nets[0].(*tunnelEntry); ok {
							if entry.podID == pod.UID {
								// only remove when the latest owner pod is deleted, otherwise a Complete Pod (job) may cause deleting the entry
								logrus.Debugf("Tunnel server egress proxy removing Node %s Pod IP %v", nodeName, cidr)
								t.cidrs.Remove(*cidr)
							}
						}
					} else {
						logrus.Debugf("Tunnel server egress proxy updating Node %s Pod IP %s", nodeName, cidr)
						t.cidrs.Insert(&tunnelEntry{
							cidr:     *cidr,
							nodeName: nodeName,
							podID:    pod.UID,
						})
					}
				}
			}
		}
	}
	return pod, nil
}

// serveConnect attempts to handle the HTTP CONNECT request by dialing
// a connection, either locally or via the remotedialer tunnel.
func (t *TunnelServer) serveConnect(resp http.ResponseWriter, req *http.Request) {
	bconn, err := t.dialBackend(req.Context(), req.Host)
	if err != nil {
		util.SendError(err, resp, req, http.StatusBadGateway)
		return
	}

	hijacker, ok := resp.(http.Hijacker)

Review comment (bug):
nit: possible use of `nets[0]` without validating slice length. You're discarding the error and not checking the length before referencing the first element.
Also not checking the ParseIP return but I think you can just use `cidr` here?

Ref: https://github.com/k3s-io/k3s/blob/c86b66d05cef4ed7a9d9dde2e96d376d1ba640ba/pkg/daemons/control/tunnel.go#L202-L206

```suggestion
						if nets, err := t.cidrs.ContainingNetworks(cidr); err == nil && len(nets) > 0 {
							if entry, ok := nets[0].(*tunnelEntry); ok {
								if entry.podID == pod.UID {
									// only remove when the latest owner pod is deleted, otherwise a Complete Pod (job) may cause deleting the entry
									logrus.Debugf("Tunnel server egress proxy removing Node %s Pod IP %v", nodeName, cidr)
									t.cidrs.Remove(*cidr)
								}
							}
						}
```

Code after:
				}
			}
		}
	}
	return node, nil
}

// onChangePod updates the pod address mappings by observing changes to pods.
func (t *TunnelServer) onChangePod(podName string, pod *v1.Pod) (*v1.Pod, error) {
	if pod != nil {
		t.Lock()
		defer t.Unlock()
		// Add all pod IPs, unless the pod uses host network
		if !pod.Spec.HostNetwork {
			nodeName := pod.Spec.NodeName
			for _, ip := range pod.Status.PodIPs {
				if cidr, err := util.IPStringToIPNet(ip.IP); err == nil {
					if pod.DeletionTimestamp != nil {
						if nets, err := t.cidrs.ContainingNetworks(cidr.IP); err != nil && len(nets) > 0 {
							if n, ok := nets[0].(*tunnelEntry); ok && n.podID == pod.UID {
								// only remove entry when the matching pod is deleted; some CNIs allow
								// IP reuse and the entry may have been replaced by a newer pod.
								logrus.Debugf("Tunnel server egress proxy removing Node %s Pod IP %v", nodeName, cidr)
								t.cidrs.Remove(*cidr)
							}
						}
					} else {
						logrus.Debugf("Tunnel server egress proxy updating Node %s Pod IP %s", nodeName, cidr)
						t.cidrs.Insert(&tunnelEntry{
							cidr:     *cidr,
							nodeName: nodeName,
							podID:    pod.UID,
						})
					}
				}
			}
		}
	}
	return pod, nil
}

// serveConnect attempts to handle the HTTP CONNECT request by dialing
// a connection, either locally or via the remotedialer tunnel.
func (t *TunnelServer) serveConnect(resp http.ResponseWriter, req *http.Request) {
	bconn, err := t.dialBackend(req.Context(), req.Host)
	if err != nil {
		util.SendError(err, resp, req, http.StatusBadGateway)
		return
	}

	hijacker, ok := resp.(http.Hijacker)