Skip to content

architecture.md

Latest commit

 

History

History
33 lines (21 loc) · 2.48 KB

architecture.md

File metadata and controls

33 lines (21 loc) · 2.48 KB
Raw

Architecture

Architecture Diagram

Funke has two main components: a Controller and an Agent. The Controller lives in the control plane and orchestrates test execution. Agents run on every node and perform the actual network tests from inside your workloads' network namespaces.

Components

Controller (Deployment)

A single-replica Deployment that watches Funke CRDs (PingTest, HttpTest, TcpTest, DnsTest, IperfTest) using the kube-rs framework. When a test CRD is created or updated, the Controller:

  1. Resolves the source — looks up the container ID and node name for the specified source (Pod, Deployment, StatefulSet, DaemonSet, or Node) via the Kubernetes API
  2. Resolves the target — translates the target (Pod, Service, Node, IP, or Hostname) into an IP address
  3. Finds the Agent — queries for the funke-agent pod running on the source's node
  4. Dispatches via gRPC — calls the appropriate test RPC (e.g., RunPing, RunHttp) on that Agent, streaming results back
  5. Updates CRD status — writes the test result, phase, and next scheduled run time back to the CRD

For scheduled tests, the Controller computes the next run time from the cron expression and re-queues reconciliation accordingly.

Agent (DaemonSet)

A DaemonSet that runs one pod per node, exposing a gRPC server on port 50051. The Agent requires hostPID: true and SYS_ADMIN + NET_RAW capabilities. When it receives a test request:

  1. Looks up the container PID — queries the containerd socket (/run/containerd/containerd.sock) to get the PID of the source container
  2. Enters the network namespace — uses the setns() syscall on /proc/{pid}/ns/net to switch into the container's network namespace
  3. Executes the test — runs the actual network test (ping, HTTP request, TCP connect, DNS lookup, or iPerf) from within that namespace
  4. Streams results back — sends test phases (Pending, Running, Succeeded/Failed) and results back to the Controller over the gRPC stream
  5. Restores its namespace — automatically switches back to its own network namespace (RAII guard pattern)

This means test traffic originates with the same source IP, routes, and network policies as the workload itself.

The Controller and Agent communicate over gRPC streaming (port 50051), with one RPC per test type. Each request includes the source container and target address. Results are streamed back as the test progresses through phases (Pending, Running, Succeeded/Failed).