feat: dhcp server use grpc instead of http (#138)

2025-12-24 11:51:13 +08:00 · 2024-01-28 14:42:37 +08:00
parent f9ef4c8dad
commit 9be04cc149
14 changed files with 885 additions and 225 deletions
--- a/pkg/webhook/dhcp.go
+++ b/pkg/webhook/dhcp.go
@@ -1,75 +0,0 @@
-package webhook
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/kubectl/pkg/cmd/util"
-
-	"github.com/wencaiwulue/kubevpn/v2/pkg/config"
-	"github.com/wencaiwulue/kubevpn/v2/pkg/handler"
-)
-
-type dhcpServer struct {
-	sync.Mutex
-	f         util.Factory
-	clientset *kubernetes.Clientset
-}
-
-func (d *dhcpServer) rentIP(w http.ResponseWriter, r *http.Request) {
-	d.Lock()
-	defer d.Unlock()
-
-	podName := r.Header.Get(config.HeaderPodName)
-	namespace := r.Header.Get(config.HeaderPodNamespace)
-	ctx := context.Background()
-
-	log.Infof("handling rent ip request, pod name: %s, ns: %s", podName, namespace)
-	cmi := d.clientset.CoreV1().ConfigMaps(namespace)
-	dhcp := handler.NewDHCPManager(cmi, namespace)
-	v4, v6, err := dhcp.RentIPRandom(ctx)
-	if err != nil {
-		log.Errorf("rent ip failed, err: %v", err)
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	w.WriteHeader(http.StatusOK)
-	// todo patch annotation
-	_, err = w.Write([]byte(fmt.Sprintf("%s,%s", v4.String(), v6.String())))
-	if err != nil {
-		log.Errorf("write response failed, err: %v", err)
-	}
-}
-
-func (d *dhcpServer) releaseIP(w http.ResponseWriter, r *http.Request) {
-	d.Lock()
-	defer d.Unlock()
-
-	podName := r.Header.Get(config.HeaderPodName)
-	namespace := r.Header.Get(config.HeaderPodNamespace)
-
-	var ips []net.IP
-	for _, s := range []string{r.Header.Get(config.HeaderIPv4), r.Header.Get(config.HeaderIPv6)} {
-		ip, _, err := net.ParseCIDR(s)
-		if err != nil {
-			log.Errorf("ip is invailed, ip: %s, err: %v", ip.String(), err)
-			continue
-		}
-		ips = append(ips, ip)
-	}
-
-	log.Infof("handling release ip request, pod name: %s, ns: %s", podName, namespace)
-	cmi := d.clientset.CoreV1().ConfigMaps(namespace)
-	dhcp := handler.NewDHCPManager(cmi, namespace)
-	if err := dhcp.ReleaseIP(context.Background(), ips...); err != nil {
-		log.Errorf("release ip failed, err: %v", err)
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	w.WriteHeader(http.StatusOK)
-}
--- a/pkg/webhook/dhcpserver.go
+++ b/pkg/webhook/dhcpserver.go
@@ -0,0 +1,66 @@
+package webhook
+
+import (
+	"context"
+	"net"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/kubectl/pkg/cmd/util"
+
+	"github.com/wencaiwulue/kubevpn/v2/pkg/handler"
+	"github.com/wencaiwulue/kubevpn/v2/pkg/webhook/rpc"
+)
+
+type dhcpServer struct {
+	rpc.UnimplementedDHCPServer
+
+	sync.Mutex
+	f         util.Factory
+	clientset *kubernetes.Clientset
+}
+
+func (d *dhcpServer) RentIP(ctx context.Context, req *rpc.RentIPRequest) (*rpc.RentIPResponse, error) {
+	d.Lock()
+	defer d.Unlock()
+
+	log.Infof("handling rent ip request, pod name: %s, ns: %s", req.PodName, req.PodNamespace)
+	cmi := d.clientset.CoreV1().ConfigMaps(req.PodNamespace)
+	dhcp := handler.NewDHCPManager(cmi, req.PodNamespace)
+	v4, v6, err := dhcp.RentIPRandom(ctx)
+	if err != nil {
+		log.Errorf("rent ip failed, err: %v", err)
+		return nil, err
+	}
+	// todo patch annotation
+	resp := &rpc.RentIPResponse{
+		IPv4CIDR: v4.String(),
+		IPv6CIDR: v6.String(),
+	}
+	return resp, nil
+}
+
+func (d *dhcpServer) ReleaseIP(ctx context.Context, req *rpc.ReleaseIPRequest) (*rpc.ReleaseIPResponse, error) {
+	d.Lock()
+	defer d.Unlock()
+
+	log.Infof("handling release ip request, pod name: %s, ns: %s, ipv4: %s, ipv6: %s", req.PodName, req.PodNamespace, req.IPv4CIDR, req.IPv6CIDR)
+	var ips []net.IP
+	for _, s := range []string{req.IPv4CIDR, req.IPv6CIDR} {
+		ip, _, err := net.ParseCIDR(s)
+		if err != nil {
+			log.Errorf("ip is invailed, ip: %s, err: %v", ip.String(), err)
+			continue
+		}
+		ips = append(ips, ip)
+	}
+
+	cmi := d.clientset.CoreV1().ConfigMaps(req.PodNamespace)
+	dhcp := handler.NewDHCPManager(cmi, req.PodNamespace)
+	if err := dhcp.ReleaseIP(context.Background(), ips...); err != nil {
+		log.Errorf("release ip failed, err: %v", err)
+		return nil, err
+	}
+	return &rpc.ReleaseIPResponse{}, nil
+}
--- a/pkg/webhook/main.go
+++ b/pkg/webhook/main.go
@@ -0,0 +1,89 @@
+package webhook
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/http"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/admin"
+	"google.golang.org/grpc/health"
+	"google.golang.org/grpc/health/grpc_health_v1"
+	"google.golang.org/grpc/reflection"
+	"k8s.io/kubectl/pkg/cmd/util"
+
+	"github.com/wencaiwulue/kubevpn/v2/pkg/config"
+	"github.com/wencaiwulue/kubevpn/v2/pkg/daemon"
+	"github.com/wencaiwulue/kubevpn/v2/pkg/webhook/rpc"
+)
+
+func Main(f util.Factory) error {
+	clientset, err := f.KubernetesClientSet()
+	if err != nil {
+		return err
+	}
+
+	h := &admissionReviewHandler{f: f, clientset: clientset}
+	http.HandleFunc("/pods", func(w http.ResponseWriter, r *http.Request) {
+		serve(w, r, newDelegateToV1AdmitHandler(h.admitPods))
+	})
+	http.HandleFunc("/readyz", func(w http.ResponseWriter, req *http.Request) {
+		_, _ = w.Write([]byte("ok"))
+	})
+
+	var pairs []tls.Certificate
+	pairs, err = getSSLKeyPairs()
+	if err != nil {
+		return err
+	}
+
+	grpcServer := grpc.NewServer()
+	cleanup, err := admin.Register(grpcServer)
+	if err != nil {
+		log.Errorf("failed to register admin: %v", err)
+		return err
+	}
+	grpc_health_v1.RegisterHealthServer(grpcServer, health.NewServer())
+	defer cleanup()
+	reflection.Register(grpcServer)
+	http.DefaultTransport.(*http.Transport).MaxIdleConnsPerHost = 100
+	// startup a http server
+	// With downgrading-capable gRPC server, which can also handle HTTP.
+	downgradingServer := &http.Server{
+		Addr:      fmt.Sprintf(":%d", 80),
+		TLSConfig: &tls.Config{Certificates: pairs},
+	}
+	defer downgradingServer.Close()
+	var h2Server http2.Server
+	err = http2.ConfigureServer(downgradingServer, &h2Server)
+	if err != nil {
+		log.Errorf("failed to configure http2 server: %v", err)
+		return err
+	}
+	handler := daemon.CreateDowngradingHandler(grpcServer, http.HandlerFunc(http.DefaultServeMux.ServeHTTP))
+	downgradingServer.Handler = h2c.NewHandler(handler, &h2Server)
+	defer downgradingServer.Close()
+	rpc.RegisterDHCPServer(grpcServer, &dhcpServer{f: f, clientset: clientset})
+	return downgradingServer.ListenAndServeTLS("", "")
+}
+
+func getSSLKeyPairs() ([]tls.Certificate, error) {
+	cert, ok := os.LookupEnv(config.TLSCertKey)
+	if !ok {
+		return nil, fmt.Errorf("can not get %s from env", config.TLSCertKey)
+	}
+	var key string
+	key, ok = os.LookupEnv(config.TLSPrivateKeyKey)
+	if !ok {
+		return nil, fmt.Errorf("can not get %s from env", config.TLSPrivateKeyKey)
+	}
+	pair, err := tls.X509KeyPair([]byte(cert), []byte(key))
+	if err != nil {
+		return nil, fmt.Errorf("failed to load certificate and key ,err: %v", err)
+	}
+	return []tls.Certificate{pair}, nil
+}
--- a/pkg/webhook/mutateadmissionwebhook.go
+++ b/pkg/webhook/mutateadmissionwebhook.go
@@ -1,12 +1,10 @@
 package webhook

 import (
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
-	"os"
 	"sync"

 	log "github.com/sirupsen/logrus"
@@ -17,8 +15,6 @@ import (
 	"k8s.io/client-go/kubernetes"
 	cmdutil "k8s.io/kubectl/pkg/cmd/util"
 	"k8s.io/utils/ptr"
-
-	"github.com/wencaiwulue/kubevpn/v2/pkg/config"
 )

 // admissionReviewHandler is a handler to handle business logic, holding an util.Factory
@@ -142,62 +138,15 @@ func serve(w http.ResponseWriter, r *http.Request, admit admitHandler) {
 		return
 	}

-	log.Infof("sending response: %v", responseObj)
 	respBytes, err := json.Marshal(responseObj)
 	if err != nil {
 		log.Errorf("Unable to encode response: %v", err)
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+	log.Infof("sending response: %v", string(respBytes))
 	w.Header().Set("Content-Type", "application/json")
-	if _, err := w.Write(respBytes); err != nil {
+	if _, err = w.Write(respBytes); err != nil {
 		log.Errorf("Unable to write response: %v", err)
 	}
 }
-
-func Main(f cmdutil.Factory) error {
-	clientset, err := f.KubernetesClientSet()
-	if err != nil {
-		return err
-	}
-
-	h := &admissionReviewHandler{f: f, clientset: clientset}
-	http.HandleFunc("/pods", func(w http.ResponseWriter, r *http.Request) {
-		serve(w, r, newDelegateToV1AdmitHandler(h.admitPods))
-	})
-	http.HandleFunc("/readyz", func(w http.ResponseWriter, req *http.Request) {
-		_, _ = w.Write([]byte("ok"))
-	})
-
-	svr := &dhcpServer{f: f, clientset: clientset}
-	http.HandleFunc(config.APIRentIP, svr.rentIP)
-	http.HandleFunc(config.APIReleaseIP, svr.releaseIP)
-
-	var pairs []tls.Certificate
-	pairs, err = getSSLKeyPairs()
-	if err != nil {
-		return err
-	}
-	server := &http.Server{
-		Addr:      fmt.Sprintf(":%d", 80),
-		TLSConfig: &tls.Config{Certificates: pairs},
-	}
-	return server.ListenAndServeTLS("", "")
-}
-
-func getSSLKeyPairs() ([]tls.Certificate, error) {
-	cert, ok := os.LookupEnv(config.TLSCertKey)
-	if !ok {
-		return nil, fmt.Errorf("can not get %s from env", config.TLSCertKey)
-	}
-	var key string
-	key, ok = os.LookupEnv(config.TLSPrivateKeyKey)
-	if !ok {
-		return nil, fmt.Errorf("can not get %s from env", config.TLSPrivateKeyKey)
-	}
-	pair, err := tls.X509KeyPair([]byte(cert), []byte(key))
-	if err != nil {
-		return nil, fmt.Errorf("failed to load certificate and key ,err: %v", err)
-	}
-	return []tls.Certificate{pair}, nil
-}
--- a/pkg/webhook/pods.go
+++ b/pkg/webhook/pods.go
@@ -185,7 +185,7 @@ func (h *admissionReviewHandler) handleDelete(ar v1.AdmissionReview) *v1.Admissi
 		if err != nil {
 			log.Errorf("release ip to dhcp err: %v, ips: %v", err, ips)
 		} else {
-			log.Errorf("release ip to dhcp ok, ip: %v", ips)
+			log.Debugf("release ip to dhcp ok, ip: %v", ips)
 		}
 	}
 	return &v1.AdmissionResponse{Allowed: true}
--- a/pkg/webhook/rpc/dhcpserver.pb.go
+++ b/pkg/webhook/rpc/dhcpserver.pb.go
@@ -0,0 +1,392 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        v3.21.2
+// source: dhcpserver.proto
+
+package rpc
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type RentIPRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PodName      string `protobuf:"bytes,1,opt,name=PodName,proto3" json:"PodName,omitempty"`
+	PodNamespace string `protobuf:"bytes,2,opt,name=PodNamespace,proto3" json:"PodNamespace,omitempty"`
+}
+
+func (x *RentIPRequest) Reset() {
+	*x = RentIPRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dhcpserver_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RentIPRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RentIPRequest) ProtoMessage() {}
+
+func (x *RentIPRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_dhcpserver_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RentIPRequest.ProtoReflect.Descriptor instead.
+func (*RentIPRequest) Descriptor() ([]byte, []int) {
+	return file_dhcpserver_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RentIPRequest) GetPodName() string {
+	if x != nil {
+		return x.PodName
+	}
+	return ""
+}
+
+func (x *RentIPRequest) GetPodNamespace() string {
+	if x != nil {
+		return x.PodNamespace
+	}
+	return ""
+}
+
+type RentIPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IPv4CIDR string `protobuf:"bytes,1,opt,name=IPv4CIDR,proto3" json:"IPv4CIDR,omitempty"`
+	IPv6CIDR string `protobuf:"bytes,2,opt,name=IPv6CIDR,proto3" json:"IPv6CIDR,omitempty"`
+}
+
+func (x *RentIPResponse) Reset() {
+	*x = RentIPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dhcpserver_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RentIPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RentIPResponse) ProtoMessage() {}
+
+func (x *RentIPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_dhcpserver_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RentIPResponse.ProtoReflect.Descriptor instead.
+func (*RentIPResponse) Descriptor() ([]byte, []int) {
+	return file_dhcpserver_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RentIPResponse) GetIPv4CIDR() string {
+	if x != nil {
+		return x.IPv4CIDR
+	}
+	return ""
+}
+
+func (x *RentIPResponse) GetIPv6CIDR() string {
+	if x != nil {
+		return x.IPv6CIDR
+	}
+	return ""
+}
+
+type ReleaseIPRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PodName      string `protobuf:"bytes,1,opt,name=PodName,proto3" json:"PodName,omitempty"`
+	PodNamespace string `protobuf:"bytes,2,opt,name=PodNamespace,proto3" json:"PodNamespace,omitempty"`
+	IPv4CIDR     string `protobuf:"bytes,3,opt,name=IPv4CIDR,proto3" json:"IPv4CIDR,omitempty"`
+	IPv6CIDR     string `protobuf:"bytes,4,opt,name=IPv6CIDR,proto3" json:"IPv6CIDR,omitempty"`
+}
+
+func (x *ReleaseIPRequest) Reset() {
+	*x = ReleaseIPRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dhcpserver_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReleaseIPRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReleaseIPRequest) ProtoMessage() {}
+
+func (x *ReleaseIPRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_dhcpserver_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReleaseIPRequest.ProtoReflect.Descriptor instead.
+func (*ReleaseIPRequest) Descriptor() ([]byte, []int) {
+	return file_dhcpserver_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ReleaseIPRequest) GetPodName() string {
+	if x != nil {
+		return x.PodName
+	}
+	return ""
+}
+
+func (x *ReleaseIPRequest) GetPodNamespace() string {
+	if x != nil {
+		return x.PodNamespace
+	}
+	return ""
+}
+
+func (x *ReleaseIPRequest) GetIPv4CIDR() string {
+	if x != nil {
+		return x.IPv4CIDR
+	}
+	return ""
+}
+
+func (x *ReleaseIPRequest) GetIPv6CIDR() string {
+	if x != nil {
+		return x.IPv6CIDR
+	}
+	return ""
+}
+
+type ReleaseIPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
+}
+
+func (x *ReleaseIPResponse) Reset() {
+	*x = ReleaseIPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dhcpserver_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReleaseIPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReleaseIPResponse) ProtoMessage() {}
+
+func (x *ReleaseIPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_dhcpserver_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReleaseIPResponse.ProtoReflect.Descriptor instead.
+func (*ReleaseIPResponse) Descriptor() ([]byte, []int) {
+	return file_dhcpserver_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ReleaseIPResponse) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+var File_dhcpserver_proto protoreflect.FileDescriptor
+
+var file_dhcpserver_proto_rawDesc = []byte{
+	0x0a, 0x10, 0x64, 0x68, 0x63, 0x70, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x03, 0x72, 0x70, 0x63, 0x22, 0x4d, 0x0a, 0x0d, 0x52, 0x65, 0x6e, 0x74, 0x49,
+	0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x6f, 0x64, 0x4e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x50, 0x6f, 0x64, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x50, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x50, 0x6f, 0x64, 0x4e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x22, 0x48, 0x0a, 0x0e, 0x52, 0x65, 0x6e, 0x74, 0x49, 0x50,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x49, 0x50, 0x76, 0x34,
+	0x43, 0x49, 0x44, 0x52, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x49, 0x50, 0x76, 0x34,
+	0x43, 0x49, 0x44, 0x52, 0x12, 0x1a, 0x0a, 0x08, 0x49, 0x50, 0x76, 0x36, 0x43, 0x49, 0x44, 0x52,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x49, 0x50, 0x76, 0x36, 0x43, 0x49, 0x44, 0x52,
+	0x22, 0x88, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x50, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x50, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x22, 0x0a, 0x0c, 0x50, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x50, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x49, 0x50, 0x76, 0x34, 0x43, 0x49, 0x44, 0x52, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x49, 0x50, 0x76, 0x34, 0x43, 0x49, 0x44, 0x52, 0x12,
+	0x1a, 0x0a, 0x08, 0x49, 0x50, 0x76, 0x36, 0x43, 0x49, 0x44, 0x52, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x49, 0x50, 0x76, 0x36, 0x43, 0x49, 0x44, 0x52, 0x22, 0x2d, 0x0a, 0x11, 0x52,
+	0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x32, 0x79, 0x0a, 0x04, 0x44, 0x48,
+	0x43, 0x50, 0x12, 0x33, 0x0a, 0x06, 0x52, 0x65, 0x6e, 0x74, 0x49, 0x50, 0x12, 0x12, 0x2e, 0x72,
+	0x70, 0x63, 0x2e, 0x52, 0x65, 0x6e, 0x74, 0x49, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x13, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x52, 0x65, 0x6e, 0x74, 0x49, 0x50, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3c, 0x0a, 0x09, 0x52, 0x65, 0x6c, 0x65, 0x61,
+	0x73, 0x65, 0x49, 0x50, 0x12, 0x15, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x52, 0x65, 0x6c, 0x65, 0x61,
+	0x73, 0x65, 0x49, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x72, 0x70,
+	0x63, 0x2e, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x07, 0x5a, 0x05, 0x2e, 0x3b, 0x72, 0x70, 0x63, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_dhcpserver_proto_rawDescOnce sync.Once
+	file_dhcpserver_proto_rawDescData = file_dhcpserver_proto_rawDesc
+)
+
+func file_dhcpserver_proto_rawDescGZIP() []byte {
+	file_dhcpserver_proto_rawDescOnce.Do(func() {
+		file_dhcpserver_proto_rawDescData = protoimpl.X.CompressGZIP(file_dhcpserver_proto_rawDescData)
+	})
+	return file_dhcpserver_proto_rawDescData
+}
+
+var file_dhcpserver_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_dhcpserver_proto_goTypes = []interface{}{
+	(*RentIPRequest)(nil),     // 0: rpc.RentIPRequest
+	(*RentIPResponse)(nil),    // 1: rpc.RentIPResponse
+	(*ReleaseIPRequest)(nil),  // 2: rpc.ReleaseIPRequest
+	(*ReleaseIPResponse)(nil), // 3: rpc.ReleaseIPResponse
+}
+var file_dhcpserver_proto_depIdxs = []int32{
+	0, // 0: rpc.DHCP.RentIP:input_type -> rpc.RentIPRequest
+	2, // 1: rpc.DHCP.ReleaseIP:input_type -> rpc.ReleaseIPRequest
+	1, // 2: rpc.DHCP.RentIP:output_type -> rpc.RentIPResponse
+	3, // 3: rpc.DHCP.ReleaseIP:output_type -> rpc.ReleaseIPResponse
+	2, // [2:4] is the sub-list for method output_type
+	0, // [0:2] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_dhcpserver_proto_init() }
+func file_dhcpserver_proto_init() {
+	if File_dhcpserver_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_dhcpserver_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RentIPRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_dhcpserver_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RentIPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_dhcpserver_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReleaseIPRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_dhcpserver_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReleaseIPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_dhcpserver_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_dhcpserver_proto_goTypes,
+		DependencyIndexes: file_dhcpserver_proto_depIdxs,
+		MessageInfos:      file_dhcpserver_proto_msgTypes,
+	}.Build()
+	File_dhcpserver_proto = out.File
+	file_dhcpserver_proto_rawDesc = nil
+	file_dhcpserver_proto_goTypes = nil
+	file_dhcpserver_proto_depIdxs = nil
+}
--- a/pkg/webhook/rpc/dhcpserver.proto
+++ b/pkg/webhook/rpc/dhcpserver.proto
@@ -0,0 +1,30 @@
+syntax = "proto3";
+
+option go_package = ".;rpc";
+
+package rpc;
+
+service DHCP {
+  rpc RentIP (RentIPRequest) returns (RentIPResponse) {}
+  rpc ReleaseIP (ReleaseIPRequest) returns (ReleaseIPResponse) {}
+}
+
+message RentIPRequest {
+  string PodName = 1;
+  string PodNamespace = 2;
+}
+
+message RentIPResponse {
+  string IPv4CIDR = 1;
+  string IPv6CIDR = 2;
+}
+
+message ReleaseIPRequest {
+  string PodName = 1;
+  string PodNamespace = 2;
+  string IPv4CIDR = 3;
+  string IPv6CIDR = 4;
+}
+message ReleaseIPResponse {
+  string message = 1;
+}
--- a/pkg/webhook/rpc/dhcpserver_grpc.pb.go
+++ b/pkg/webhook/rpc/dhcpserver_grpc.pb.go
@@ -0,0 +1,146 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v3.21.2
+// source: dhcpserver.proto
+
+package rpc
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	DHCP_RentIP_FullMethodName    = "/rpc.DHCP/RentIP"
+	DHCP_ReleaseIP_FullMethodName = "/rpc.DHCP/ReleaseIP"
+)
+
+// DHCPClient is the client API for DHCP service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type DHCPClient interface {
+	RentIP(ctx context.Context, in *RentIPRequest, opts ...grpc.CallOption) (*RentIPResponse, error)
+	ReleaseIP(ctx context.Context, in *ReleaseIPRequest, opts ...grpc.CallOption) (*ReleaseIPResponse, error)
+}
+
+type dHCPClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewDHCPClient(cc grpc.ClientConnInterface) DHCPClient {
+	return &dHCPClient{cc}
+}
+
+func (c *dHCPClient) RentIP(ctx context.Context, in *RentIPRequest, opts ...grpc.CallOption) (*RentIPResponse, error) {
+	out := new(RentIPResponse)
+	err := c.cc.Invoke(ctx, DHCP_RentIP_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dHCPClient) ReleaseIP(ctx context.Context, in *ReleaseIPRequest, opts ...grpc.CallOption) (*ReleaseIPResponse, error) {
+	out := new(ReleaseIPResponse)
+	err := c.cc.Invoke(ctx, DHCP_ReleaseIP_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// DHCPServer is the server API for DHCP service.
+// All implementations must embed UnimplementedDHCPServer
+// for forward compatibility
+type DHCPServer interface {
+	RentIP(context.Context, *RentIPRequest) (*RentIPResponse, error)
+	ReleaseIP(context.Context, *ReleaseIPRequest) (*ReleaseIPResponse, error)
+	mustEmbedUnimplementedDHCPServer()
+}
+
+// UnimplementedDHCPServer must be embedded to have forward compatible implementations.
+type UnimplementedDHCPServer struct {
+}
+
+func (UnimplementedDHCPServer) RentIP(context.Context, *RentIPRequest) (*RentIPResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RentIP not implemented")
+}
+func (UnimplementedDHCPServer) ReleaseIP(context.Context, *ReleaseIPRequest) (*ReleaseIPResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReleaseIP not implemented")
+}
+func (UnimplementedDHCPServer) mustEmbedUnimplementedDHCPServer() {}
+
+// UnsafeDHCPServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to DHCPServer will
+// result in compilation errors.
+type UnsafeDHCPServer interface {
+	mustEmbedUnimplementedDHCPServer()
+}
+
+func RegisterDHCPServer(s grpc.ServiceRegistrar, srv DHCPServer) {
+	s.RegisterService(&DHCP_ServiceDesc, srv)
+}
+
+func _DHCP_RentIP_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RentIPRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DHCPServer).RentIP(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DHCP_RentIP_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DHCPServer).RentIP(ctx, req.(*RentIPRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DHCP_ReleaseIP_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReleaseIPRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DHCPServer).ReleaseIP(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DHCP_ReleaseIP_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DHCPServer).ReleaseIP(ctx, req.(*ReleaseIPRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// DHCP_ServiceDesc is the grpc.ServiceDesc for DHCP service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var DHCP_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "rpc.DHCP",
+	HandlerType: (*DHCPServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "RentIP",
+			Handler:    _DHCP_RentIP_Handler,
+		},
+		{
+			MethodName: "ReleaseIP",
+			Handler:    _DHCP_ReleaseIP_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "dhcpserver.proto",
+}
--- a/pkg/webhook/rpc/gen.go
+++ b/pkg/webhook/rpc/gen.go
@@ -0,0 +1,3 @@
+package rpc
+
+//go:generate protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative dhcpserver.proto