LFX Mentorship 2025_02 test task

[antoninbas]

First, we'd like to thank everyone who is interested in taking part to the LFX Mentorship program with us, and we are excited to welcome new contributors to Project Antrea.

We submitted 2 projects for this iteration of the LFX Mentorship program:

• Enhance PacketCapture API with IPv6 and flexible filters
  • https://mentorship.lfx.linuxfoundation.org/project/7dc05f9c-b90d-4fe0-bf43-d6bf10ea29a2
  • Issues: IPv6 support for PacketCapture #6861, Support PacketCapture for arbitrary source / destination #6976, Support capture at dest in PacketCapture #6863
• Automate dependency updates with Renovate
  • https://mentorship.lfx.linuxfoundation.org/project/62d69fd5-6c90-4ba1-b260-a5dc247fc3cf
  • Issue: Replace Dependabot with Renovate for automatic dependency updates #7155

In order to help us find the right candidate, we have prepared simple tasks. It's a good opportunity for you to get familiar with the project proposals, and for us to ensure that you have some of the required skills for a successful mentorship. We do not expect these tasks to take more than a couple of hours.

Remember to apply at https://lfx.linuxfoundation.org/tools/mentorship/ in addition to completing the task.

Task details

For the PacketCapture proposal (#6861)

Steps:

1. Create a Kind cluster locally with 1 control-plane Node and 1 worker Node. You will need to disable the default CNI, as we will later deploy Antrea for networking. Refer to the Kind documentation for information.
2. Install Helm on your machine.
3. Fork the Antrea Github repository (https://github.com/antrea-io/antrea) to your personal Github account, and clone the fork to your local machine. This is a standard Github workflow, but you can refer to our CONTRIBUTING.md for assistance. More generally, this document may be helpful for later steps as well.
4. Modify the Antrea source code as follows:
   • Add a test log entry to the antrea-agent program and the antrea-controller programs. The source code for these programs can be found here: https://github.com/antrea-io/antrea/tree/main/cmd. Hint: look for the run(o *Options) function.
   • Each of the 2 log entries should be a call to klog.InfoS (look at the rest of the source code for examples).
   • In both cases, the call should happen early in the execution of the program. Ideally it should be one of the first entries to be logged after the program starts.
   • klog.InfoS is a "structured logging" primitive and lets you include key-value pairs with your log message. Your log message should include the following data: 1) your Github username, and 2) the name of the K8s Pod executing the program (antrea-agent and antrea-controller are meant to be run as Pods). Hint: You will need the env.GetPodName() function from the antrea.io/antrea/pkg/util/env package.
5. Build Antrea locally with make. Again you may find it useful to refer to CONTRIBUTING.md.
6. Deploy your Antrea build to the Kind cluster that you created in the first step. Use these 2 steps:

# load the local Antrea Docker images in the Nodes; these are the custom images that you built in the previous step
kind load docker-image antrea/antrea-controller-ubuntu:latest antrea/antrea-agent-ubuntu:latest
# deploy Antrea using Helm: this command will use your custom images and enable the PacketCapture feature
helm install -n kube-system antrea --set featureGates.PacketCapture=true ./build/charts/antrea

7. Using kubectl, dump the logs for each antrea Pod (1 controller Pod and 2 agent Pods) and copy the first 10 lines of each log to a local file at the root of the repository: (controller.txt, agent1.txt, agent2.txt). Among the log lines should be the one you added in step 3.
8. Using kubectl, exec into the antrea-ovs container of the antrea-agent Pod (any one of them) and find out the version of OVS which is installed, using the appropriate OVS command. Write it to to a local file (ovs-version.txt) at the root of the repository. To get the OVS version, you will need to use the ovs-vsctl command-line utility (find the documentation online).
9. Using kubectl, exec into the antrea-agent container of the antrea-agent Pod (any one of them) and run antctl get featuregates. Write the output to a local file (antrea-agent-features.txt) at the root of the repository.
10. Create the lfx-mentorship Namespace.
11. Using kubectl and a YAML manifest named deployment.yml, create a single-replica Deployment in the lfx-mentorship Namespace, using the antrea/toolbox:1.6 container image.
12. Create a PacketCapture Custom Resource (CR) to capture TCP traffic from the toolbox Pod (source) created in the previous step to external IP address 8.8.8.8 (destination). Write the CR definition to a local YAML manifest file (capture.yml) at the root of the repository and apply it using kubectl. You will need to refer to the Antrea documentation: https://github.com/antrea-io/antrea/blob/main/docs/packetcapture-guide.md. Your PacketCapture should be configured as follows:
    • only capture TCP traffic with the SYN flag destined to port 53
    • only capture in the direction SourceToDestination
    • use a long enough timeout - we suggest 300s
    • only capture the first 5 packets
13. Using kubectl, exec into the toolbox Pod and run the following bash command: for i in {1..10}; do dig +tcp @8.8.8.8 www.google.com; sleep 1; done
14. Using kubectl, check the status of your PacketCapture CR. More precisely, run kubectl get pcap <name> -o yaml and save the result to a local file (capture-status.yml) at the root of the repository. If everything went well, you should see the PacketCaptureComplete condition under status set to "True". if not, figure out what went wrong and go back to step 12. The status also includes a filePath field, which indicates the location of the pcapng file storing the results of the capture. For example: filePath: antrea-agent-8lnp8:/tmp/antrea/packetcapture/packets/pc.pcapng. The file is currently stored in the filesystem of the antrea-agent Pod which ran the capture.
15. Copy the pcapng file from the Pod to your local filesystem using kubectl cp. Place the local file at the root of the repository and name it capture.pcapng.
16. Read the pcapng file using tcpdump -r (you may have to install tcpdump first), and save the output to a local file (capture.txt) at the root of the repository.
17. Commit all your changes (changes to the Antrea source code + the 6 .txt files + the 3 .yml files + the .pcapng file) as a single commit. All the new files should be at the root of the repository. We ask that you:
    • sign your commit: see https://github.com/antrea-io/antrea/blob/main/CONTRIBUTING.md#sign-off-your-work
    • follow best practices when writing your commit message: see https://cbea.ms/git-commit/
18. Push the changes to your fork, using branch name antrea-lfx-mentorship-2025_02-6861.

For the Renovate proposal (#7155)

Note that this task is quite open-ended. It is meant to demonstrate usage of Renovate for a Go project. Please try to keep your submission as simple as possible.

Steps:

1. Create a new Github repository.
2. In this repository, create a new Go module with a single command / program. We encourage you to follow https://go.dev/doc/modules/layout. The program can do whatever you want, and should be easily runnable with go run. The only constraint is that the program should have an external dependency on a third-party module for which a Critical or High vulnerability was reported in the past. The dependency should actually be used by your program so pick wisely! Make sure that your program uses an older version of the dependency, which suffers from the vulnerability.
3. Add a README.md file describing what your program does (it does not need to be fancy!), how to run it, what external dependency you chose, and a link to a CVE that was reported for this dependency.
4. Add Renovate to your Github repository. It should be configured so that Go dependencies are only updated when they suffer from a known vulnerability. We recommend taking a look at https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts.
5. Wait for Renovate to submit a PR to update the dependency.

Submissions

Upon completing the appropriate task(s), reply to the thread below with the following information:

Name: [Your name, as it appears in your LFX mentorship profile]
Applied Issue: [Indicate the issue number(s) you are applying for]
Antrea GitHub Repo: [Provide a link to your GitHub repository containing the completed task for #6861 IF APPLICABLE]
Renovate Playground Github Repo: [Provide a link to your GitHub repository containing the completed task for #7155 IF APPLICABLE]

Make sure that your Antrea Github repository use the correct branch name, as specified above in the task description.

For any queries, please reply reply to this discussion below or post in the #antrea channel in the K8s Slack workspace. Do not send emails or DMs to ask for assistance, use public channels only. We are happy to provide some assistance if you get stuck or if some instructions are not clear enough.

Deadlines

Task Deadline: Submissions must be completed by May 29, 5:00 PM PDT.
LFX Application Deadline: LFX applicants must submit by May 27, 5:00 PM PDT.

[antoninbas]

For submissions, please reply to this thread with the requested information

[sratslla]

Name: Shubh Gaur
Applied Issue: #6861
Antrea GitHub Repo: https://github.com/sratslla/antrea/tree/antrea-lfx-mentorship-2025_02-6861

[AdityaVardhanSingh]

Name: Aditya Singh
Applied Issue: #7155
Renovate Playground Github Repo: https://github.com/AdityaVardhanSingh/Antrea-Task-7155

[Jay2006sawant]

Name : Jay Sawant
Applied Issue: #7155
Renovate Playground Github Repo: https://github.com/Jay2006sawant/jwt-security-renovate-demo.git

[dibasdas02]

Name : Dibas Das
Applied Issue: #6861
Antrea GitHub Repo: https://github.com/dibasdas02/antrea/tree/antrea-lfx-mentorship-2025_02-6861

[Emidowojo]

Name: Emidowojo Opaluwa
Applied Issue: #7155
Renovate Playground Github Repo: https://github.com/Emidowojo/lfx-mentorship-renovate

[antoninbas]

I removed the link for past Antrea vulnerabilities (https://github.com/antrea-io/antrea/security/dependabot?q=is%3Aclosed) from the instructions. It is not actually accessible publicly.

[animeshk923]

Thank you for the clarification Antonin. It was indeed a bit confusing for me (and for other people as well) 😅