fix: let NNCResonciler process update events with different generations when IPAMv2 is enabled

cns/kubecontroller/nodenetworkconfig/reconciler.go

@@ -5,6 +5,7 @@ import (
 	"sync"
 
 	"github.com/Azure/azure-container-networking/cns"
+	"github.com/Azure/azure-container-networking/cns/configuration"
 	"github.com/Azure/azure-container-networking/cns/logger"
 	"github.com/Azure/azure-container-networking/cns/restserver"
 	cnstypes "github.com/Azure/azure-container-networking/cns/types"
@@ -157,29 +158,32 @@ func (r *Reconciler) Started(ctx context.Context) (bool, error) {
 }
 
 // SetupWithManager Sets up the reconciler with a new manager, filtering using NodeNetworkConfigFilter on nodeName.
-func (r *Reconciler) SetupWithManager(mgr ctrl.Manager, node *v1.Node) error {
+func (r *Reconciler) SetupWithManager(mgr ctrl.Manager, node *v1.Node, cnsconfig *configuration.CNSConfig) error {
 	r.nnccli = nodenetworkconfig.NewClient(mgr.GetClient())
+	ipamV2Enabled := cnsconfig != nil && cnsconfig.EnableIPAMv2
 	err := ctrl.NewControllerManagedBy(mgr).
 		For(&v1alpha.NodeNetworkConfig{}).
 		WithEventFilter(predicate.Funcs{
 			// ignore delete events.
 			DeleteFunc: func(event.DeleteEvent) bool {
 				return false
 			},
-		}).
-		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
-			// match on node controller ref for all other events.
-			return metav1.IsControlledBy(object, node)
-		})).
-		WithEventFilter(predicate.Funcs{
-			// check that the generation is the same - status changes don't update generation.
+			// check that the generation is the same if IPAMv1 - status changes don't update generation.
 			UpdateFunc: func(ue event.UpdateEvent) bool {
 				if ue.ObjectOld == nil || ue.ObjectNew == nil {
 					return false
 				}
+				// IPAMv2 is idempotent and can process every update event.
+				if ipamV2Enabled {
+					return true
+				}
 				return ue.ObjectOld.GetGeneration() == ue.ObjectNew.GetGeneration()
 			},
 		}).
+		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
+			// match on node controller ref for all other events.
+			return metav1.IsControlledBy(object, node)
+		})).
 		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
 			// only process events on objects that are not being deleted.
 			return object.GetDeletionTimestamp().IsZero()

cns/service/main.go

@@ -981,7 +981,7 @@ func main() {
 		// Start fs watcher here
 		z.Info("AsyncPodDelete is enabled")
 		logger.Printf("AsyncPodDelete is enabled")
-		cnsclient, err := cnsclient.New("", cnsReqTimeout) //nolint
+		cnsclient, err := cnsclient.New("", cnsReqTimeout) // nolint
 		if err != nil {
 			z.Error("failed to create cnsclient", zap.Error(err))
 		}
@@ -1412,7 +1412,7 @@ func InitializeCRDState(ctx context.Context, httpRestService cns.HTTPService, cn
 	nodeIP := configuration.NodeIP()
 	nncReconciler := nncctrl.NewReconciler(httpRestServiceImplementation, poolMonitor, nodeIP)
 	// pass Node to the Reconciler for Controller xref
-	if err := nncReconciler.SetupWithManager(manager, node); err != nil { //nolint:govet // intentional shadow
+	if err := nncReconciler.SetupWithManager(manager, node, cnsconfig); err != nil { //nolint:govet // intentional shadow
 		return errors.Wrapf(err, "failed to setup nnc reconciler with manager")
 	}
 
@@ -1482,7 +1482,7 @@ func InitializeCRDState(ctx context.Context, httpRestService cns.HTTPService, cn
 		// wait for the Reconciler to run once on a NNC that was made for this Node.
 		// the nncReadyCtx has a timeout of 15 minutes, after which we will consider
 		// this false and the NNC Reconciler stuck/failed, log and retry.
-		nncReadyCtx, cancel := context.WithTimeout(ctx, 15*time.Minute) //nolint // it will time out and not leak
+		nncReadyCtx, cancel := context.WithTimeout(ctx, 15*time.Minute) // nolint // it will time out and not leak
 		if started, err := nncReconciler.Started(nncReadyCtx); !started {
 			logger.Errorf("NNC reconciler has not started, does the NNC exist? err: %v", err)
 			nncReconcilerStartFailures.Inc()