// limitations under the License.

package repair

import (
	"context"

	"istio.io/istio/cni/pkg/config"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/log"
)

var repairLog = log.RegisterScope("repair", "CNI race condition repair")

func StartRepair(ctx context.Context, cfg config.RepairConfig) {
	if !cfg.Enabled {
		repairLog.Info("CNI repair is disable.")
		return
	}

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package repair

import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/istio/tools/istio-iptables/pkg/constants"
)

type makePodArgs struct {
	PodName             string

	AmbientIPv6          = "ambient-ipv6"

	// Repair
	RepairEnabled            = "repair-enabled"
	RepairDeletePods         = "repair-delete-pods"
	RepairRepairPods         = "repair-repair-pods"
	RepairLabelPods          = "repair-label-pods"
	RepairLabelKey           = "repair-broken-pod-label-key"
	RepairLabelValue         = "repair-broken-pod-label-value"
	RepairNodeName           = "repair-node-name"

              value: "{{.Values.cni.repair.deletePods}}"
            - name: REPAIR_REPAIR_PODS
              value: "{{.Values.cni.repair.repairPods}}"
            - name: REPAIR_RUN_AS_DAEMON
              value: "true"
            - name: REPAIR_SIDECAR_ANNOTATION
              value: "sidecar.istio.io/status"
            - name: REPAIR_INIT_CONTAINER_NAME
              value: "{{ .Values.cni.repair.initContainerName }}"

subjects:
- kind: ServiceAccount
  name: istio-cni
  namespace: {{ .Release.Namespace }}
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-cni-repair-rolebinding
  labels:
    k8s-app: istio-cni-repair
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}

// See the License for the specific language governing permissions and
// limitations under the License.

package repair

import (
	"istio.io/istio/pkg/monitoring"
)

var (
	typeLabel  = monitoring.CreateLabel("type")
	deleteType = "delete"
	repairType = "repair"
	labelType  = "label"

	resultLabel   = monitoring.CreateLabel("result")
	resultSuccess = "success"
	resultSkip    = "skip"

  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["watch", "get", "list"]
{{- if .Values.cni.repair.repairPods }}
{{- /*  No privileges needed*/}}
{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]

Par exemple, il était clair que l'idéal était de se baser sur les annotations de type Python standard.

De plus, la meilleure approche était d'utiliser des normes déjà existantes.

	AmbientDNSCapture bool

	// Whether ipv6 is enabled for ambient capture
	AmbientIPv6 bool
}

// RepairConfig struct defines the Istio CNI race repair configuration
type RepairConfig struct {
	// Whether to enable CNI race repair
	Enabled bool

	// The node name that the CNI DaemonSet runs on
	NodeName string

	// Key and value for broken pod label
	LabelKey   string
	LabelValue string

      dnsCapture: false
      # UNSTABLE: If enabled, and ambient is enabled, enables ipv6 support
      ipv6: false


    repair:
      enabled: true
      hub: ""
      tag: ""

      # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
      # This defines the action the controller will take when a pod is detected as broken.