Antrea

Term 1 · Mar-May · 1 project

• Compare Antrea BPF generation for PacketCapture to tcpdump / libpcap

  LFX Mentorship · Listed in the official cohort

  @antoninbasSource IssueLFX portal

  Antrea's PacketCapture feature includes custom BPF code generation for packet filters defined in the PacketCapture CRD. The code is currently tested using manually-generated test cases, which is tedious, error-prone, and limits testing coverage. Given that the code attempts to mimic the BPF generation done by tcpdump, we should improve the testing approach by: 1) using AI to generate comprehensive test inputs, 2) using tcpdump to generate reference BPF code for the inputs, 3) comparing our generated BPF with the tcpdump reference, 4) analyzing any differences to determine if our BPF is incorrect or equivalent, 5) updating our BPF generation to match tcpdump when possible, and 6) committing all test cases to run in CI.

  • Go
  • familiarity with BPF (Berkeley Packet Filter)
  • basic understanding of packet filtering and tcpdump/libpcap. We encourage using AI tools to generate test cases and improve the BPF code generation
  • but we expect careful review of generated artifacts before submitting them for review.

Term 2 · Jun-Aug · 2 projects

• Improvements to the PacketCapture feature

  LFX Mentorship · Listed in the official cohort

  @hangyanSource IssueLFX portal

  As a Kubernetes (K8s) network plugin (CNI plugin), Antrea provides networking functions for K8s Pods and includes various troubleshooting tools for cluster administrators and application developers to diagnose networking issues. The PacketCapture feature was introduced recently (Antrea v2.2) and allows capturing network traffic for specific endpoints using predefined filters similar to those supported by libpcap/tcpdump. Users can initiate a packet capture through a Kubernetes Custom Resource Definition (CRD) or a CLI command. The Antrea control plane then generates and injects the corresponding BPF program, and the captured packets can be exported as a pcap file. In the last iteration of the LFX mentorship program, we added support for L4 filters (TCP flags, ICMP type & code) to the PacketCapture API, to enable Antrea users to target network traffic more precisely. We would like to keep improving the PacketCapture feature with 1) IPv6 support, 2) more flexibility when providing the source and destination, 3) the ability to specify the capture point for traffic (source or destination Pod).

  • familiarity with Golang
  • some knowledge about the K8s architecture and APIs
  • basic knowledge about networking protocols (IP/TCP/UDP/ICMP).

• Replace Dependabot with Renovate for automatic dependency updates

  LFX Mentorship · Listed in the official cohort

  @tnqnSource IssueLFX portal

  Antrea currently relies on Github's Dependabot to automatically updated dependencies (Go modules / Github Actions) on the main branch. There is a key limitation with Dependabot, which is that it doesn't support automatically updating dependencies with security vulnerabilities in "active" release branches (for Antrea minor versions which are currently actively supported). This limitation means that maintainers have to manually backport Dependabot patches when they address security vulnerabilities, which has become a burden. Renovate is an alternative tool for dependency management, and it seems that it offers richer configuration options and may not suffer from the same limitation as Dependabot.

  • familiarity with the Github ecosystem
  • including Github Actions
  • and with the standard Github dev workflows.

Term 1 · Mar-May · 1 project

• Support L4 protocol filters in PacketCapture API

  LFX Mentorship · Listed in the official cohort

  @antoninbasSource IssueLFX portal

  As a Kubernetes (K8s) network plugin (CNI plugin), Antrea provides networking functions for K8s Pods and includes various troubleshooting tools for cluster administrators and application developers to diagnose networking issues. The PacketCapture feature was introduced recently and allows capturing network traffic for specific endpoints using predefined filters similar to those supported by libpcap/tcpdump. Users can initiate a packet capture through a Kubernetes Custom Resource Definition (CRD) or a CLI command. The Antrea control plane then generates and injects the corresponding BPF program, and the captured packets can be exported as a pcap file. Currently, only a limited set of filters is supported. With this project, we aim to introduce additional filters, particularly Layer 4 protocol filters, such as TCP flags for the TCP transport protocol. These new filters will enable Antrea users to target network traffic more precisely.

  • familiarity with Golang
  • some knowledge about the K8s architecture and APIs
  • basic knowledge about networking protocols (IP/TCP/UDP/ICMP).

Term 3 · Sep-Nov · 1 project

• Support application-level DNS caches when using FQDN-based security rules

  LFX Mentorship · Listed in the official cohort

  @tnqnSource IssueLFX portal

  Antrea provides Network Policy APIs (in the form of K8s CRDs) for K8s cluster administrators and application developers to declare security rules in order to protect workloads. These APIs complement the Network Policies supported natively in K8s. When using the Antrea-specific Network Policy APIs, it is possible to use Fully Qualified Domain Names (FQDNs) in order to select the list of external domains with which a K8s application is allowed to communicate, or forbidden from communicating. The current implementation of this feature is not compatible with applications which directly cache the result of DNS queries. We have found that this type of caching is frequent for Java applications, which greatly impacts the usability of FQDN-based security rules. We believe that by defining a new configuration parameter for the Antrea implementation, we can bypass the issue and ensure that the feature can be used even with such applications, providing of course that the parameter is set correctly by users.

  • familiarity with Golang
  • some knowledge about the K8s architecture and APIs
  • basic knowledge about networking in particular of the DNS protocol.

Term 1 · Mar-May · 3 projects

• Ability to install / upgrade Antrea using the CLI

  LFX Mentorship · Listed in the official cohort

  @tnqnSource IssueLFX portal

  Currently Antrea can be installed using a K8s YAML manifest or through the provided Helm chart. We believe there is value in providing a 3rd installation method, using the "antctl" CLI. The CLI installation / upgrade method would have the following advantages: a) more user-friendly, with support for command-line options to customize the installation, b) ability to run sanity checks on the K8s cluster before comitting to the installation, c) when upgrading, the CLI will ensure that Antrea components are upgraded in the optimal order, to minimize workload disruption.

  • familiarity with Golang
  • some knowledge about the K8s architecture and APIs
  • UX experience would be great but not required.

• East-west connectivity monitoring tool for Pod network

  LFX Mentorship · Listed in the official cohort

  @DyannggSource IssueLFX portal

  As a K8s network plugin (CNI plugin), Antrea provides networking functions for K8s Pods. These Pods are located on different Nodes, which can be in different availability zones, or even different geos. We would like to provide as part of Antrea (built-in capability) a tool to monitor Pod connectivity across the cluster. This tool should be able to report the average network latency between any 2 Nodes in the cluster. The latency information could then be visualized using a heatmap representation in the Antrea web UI.

  • familiarity with Golang
  • some knowledge about the K8s architecture and APIs
  • some basic networking knowledge (TCP/IP stack)
  • frontend development experience (React
  • TypeScript) would be great but not required.

• Replace deprecated bincover with golang built-in coverage profiling tool

  LFX Mentorship · Listed in the official cohort

  @antoninbasSource IssueLFX portal

  Currently Antrea uses a third-party tool called bincover to measure code coverage when running end-to-end (e2e) tests. This tool has been deprecated in favor of the built-in Go coverage profiling tool ( starting with Go 1.20, and it is no longer maintained. We would like to remove usage of bincover from the Antrea project and start using the built-in Go tool.

  • familiarity with Golang and the Golang testing framework.