From 1dcbea52b92e656835b41441c4fb1acf3d7c1446 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Wed, 3 Apr 2024 09:42:46 +0200
Subject: [PATCH] confd: handle ip/route additions to container networks at
 runtime

On any change to a container network interface we should schedule a
restart of the container to activate the changes.  This code triggers
also at boot, when applying the whole startup-config, which initctl
handles by queuing any create/touch events for services.

This patch depends on the two previous commtis backporing fixes to
Finit's initctl tool and an upgrade of the k8s-logger.

Fixes #375

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 board/common/rootfs/usr/sbin/container | 36 +++++++++++++++++++++++---
 src/confd/src/cni.c                    | 11 ++++++--
 2 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/board/common/rootfs/usr/sbin/container b/board/common/rootfs/usr/sbin/container
index 67a80357..920aa6ba 100755
--- a/board/common/rootfs/usr/sbin/container
+++ b/board/common/rootfs/usr/sbin/container
@@ -217,6 +217,20 @@ netwrm()
     done
 }
 
+# Schedule restart of (any) container using network $1 to activate network changes
+netrestart()
+{
+    net=$1
+
+    for c in $(podman ps $all --format "{{.Names}}"); do
+	for n in $(podman inspect "$c" |jq -r '.[].NetworkSettings.Networks | keys[]'); do
+	    if [ "$n" = "$net" ]; then
+		initctl -nbq touch "container@$c"
+	    fi
+	done
+    done
+}
+
 usage()
 {
 	cat <<EOF
@@ -262,7 +276,7 @@ commands:
   list    [image | oci]    List names (only) of containers, images, or OCI archives
   load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
   remove   IMAGE           Remove an (unused) container image
-  restart [NAME]           Restart a crashed container
+  restart [network] NAME   Restart a (crashed) container or container(s) using network
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
   shell                    Start a shell inside a container
@@ -552,8 +566,24 @@ case $cmd in
 	if [ -n "$name" ]; then
 	    wrap "$name" restart
 	elif [ -n "$1" ]; then
-	    stop  "$1"
-	    start "$1"
+	    cmd=$1
+	    name=$2
+	    if [ "$cmd" = "network" ] && [ -n "$name" ]; then
+		netrestart "$name"
+	    else
+		name=$1
+		stop "$name"
+		timeout=20
+		while running "$name"; do
+		    _=$((timeoute -= 1))
+		    if [ $timeout -le 0 ]; then
+			log "Timeout waiting for container $1 to stop before restarting it."
+			exit 1
+		    fi
+		    sleep 1
+		done
+		start "$name"
+	    fi
 	else
 	    usage
 	    exit 1
diff --git a/src/confd/src/cni.c b/src/confd/src/cni.c
index 3f6547b9..c7f8edcd 100644
--- a/src/confd/src/cni.c
+++ b/src/confd/src/cni.c
@@ -387,18 +387,25 @@ int cni_netdag_gen_iface(struct dagger *net, const char *ifname,
 			 struct lyd_node *dif, struct lyd_node *cif)
 {
 	const char *cni_type = NULL;
+	FILE *fp;
 
 	if (iface_is_cni(ifname, cif, &cni_type)) {
 		int err;
 
+		fp = dagger_fopen_next(net, "init", ifname, 30, "cni.sh");
+		if (!fp)
+			return -EIO;
+
+		/* Must restart container(s) using this modified network to bite. */
+		fprintf(fp, "container -a restart network %s\n", ifname);
+		fclose(fp);
+
 		err = iface_gen_cni(ifname, cif);
 		if (err)
 			return err;
 		if (cni_type && !strcmp(cni_type, "bridge"))
 			return 1; /* CNI bridges are managed by podman */
 	} else if (iface_is_cni(ifname, dif, &cni_type)) {
-		FILE *fp;
-
 		/* No longer a container-network, clean up. */
 		fp = dagger_fopen_current(net, "exit", ifname, 30, "cni.sh");
 		if (!fp)