Repository: istio/istio
File: cni/pkg/install/cniconfig.go (Go)

Code before:
		return "", err
	}

	if cfg.ChainedCNIPlugin {
		// If useIstioOwnedCNIConfig is true then we are copying the configuration from the primary CNI config file
		// otherwise, we are overwriting the existing primary cni config
		if !file.Exists(cniConfigFilepath) {
			return "", fmt.Errorf("CNI config file %s removed during configuration", cniConfigFilepath)
		}
		// This section overwrites an existing plugins list entry for istio-cni
		existingCNIConfig, err := os.ReadFile(cniConfigFilepath)
		if err != nil {
			return "", err
		}
		pluginConfig, err = insertCNIConfig(pluginConfig, existingCNIConfig)
		if err != nil {
			return "", err
		}
	}

	if useIstioOwnedCNIConfig(cfg) {
		// If useIstioOwnedCNIConfig is true, write to the istio owned CNI config path
		cniConfigFilepath = filepath.Join(cfg.MountedCNINetDir, cfg.IstioOwnedCNIConfigFilename)
	}

	if err = file.AtomicWrite(cniConfigFilepath, pluginConfig, cfg.CNIConfFileMode()); err != nil {
		installLog.Errorf("Failed to write CNI config file %v: %v", cniConfigFilepath, err)
		return cniConfigFilepath, err
	}

	if cfg.ChainedCNIPlugin && strings.HasSuffix(cniConfigFilepath, ".conf") {
		// If the old CNI config filename ends with .conf, rename it to .conflist, because it has to be changed to a list
		installLog.Infof("Renaming %s extension to .conflist", cniConfigFilepath)
		err = os.Rename(cniConfigFilepath, cniConfigFilepath+"list")
		if err != nil {
			installLog.Errorf("Failed to rename CNI config file %v: %v", cniConfigFilepath, err)
			return cniConfigFilepath, err
		}
		cniConfigFilepath += "list"
	}

	installLog.Infof("Wrote CNI config to %s", cniConfigFilepath)
	return cniConfigFilepath, nil
}

// If configured as chained CNI plugin, waits indefinitely for a main CNI config file to exist before returning
// Or until cancelled by parent context
func getCNIConfigFilepath(ctx context.Context, cniConfName, mountedCNINetDir string, chained bool) (string, error) {
	if !chained {
		if len(cniConfName) == 0 {
			cniConfName = "YYY-istio-cni.conf"

Review comment (security):
If we are overwriting the primary cni config, should we try to preserve the settings from the primary CNI instead of forcing our own?

Consider some cni which requires 660 permissions. We have no way of expressing this and so we just break them. This is perhaps contrived, but it seems like generally better behavior to not force our own opinion if we can avoid it.

Code after:
		return "", err
	}

	if cfg.ChainedCNIPlugin {
		// If useIstioOwnedCNIConfig is true then we are copying the configuration from the primary CNI config file
		// otherwise, we are overwriting the existing primary cni config
		if !file.Exists(cniConfigFilepath) {
			return "", fmt.Errorf("CNI config file %s removed during configuration", cniConfigFilepath)
		}
		// This section overwrites an existing plugins list entry for istio-cni
		existingCNIConfig, err := os.ReadFile(cniConfigFilepath)
		if err != nil {
			return "", err
		}
		pluginConfig, err = insertCNIConfig(pluginConfig, existingCNIConfig)
		if err != nil {
			return "", err
		}
	}

	if useIstioOwnedCNIConfig(cfg) {
		// If useIstioOwnedCNIConfig is true, write to the istio owned CNI config path
		cniConfigFilepath = filepath.Join(cfg.MountedCNINetDir, cfg.IstioOwnedCNIConfigFilename)
	}

	// Determine the file mode: when modifying the primary CNI config (chained, non-istio-owned),
	// preserve the existing file's permissions. Otherwise, use the configured mode.
	fileMode := cfg.CNIConfFileMode()
	if cfg.ChainedCNIPlugin && !useIstioOwnedCNIConfig(cfg) {
		if info, statErr := os.Stat(cniConfigFilepath); statErr == nil {
			fileMode = info.Mode()
		}
	}

	if err = file.AtomicWrite(cniConfigFilepath, pluginConfig, fileMode); err != nil {
		installLog.Errorf("Failed to write CNI config file %v: %v", cniConfigFilepath, err)
		return cniConfigFilepath, err
	}

	if cfg.ChainedCNIPlugin && strings.HasSuffix(cniConfigFilepath, ".conf") {
		// If the old CNI config filename ends with .conf, rename it to .conflist, because it has to be changed to a list
		installLog.Infof("Renaming %s extension to .conflist", cniConfigFilepath)
		err = os.Rename(cniConfigFilepath, cniConfigFilepath+"list")
		if err != nil {
			installLog.Errorf("Failed to rename CNI config file %v: %v", cniConfigFilepath, err)
			return cniConfigFilepath, err
		}
		cniConfigFilepath += "list"
	}

	installLog.Infof("Wrote CNI config to %s", cniConfigFilepath)