[Multicast] Add precheck on the encryption mode configurations

Mutlicast feature can't work with WireGuard or IPSec configurations with encap
mode. It will return error when Multicast feature gate is enabled and either
Wireguard or IPSec is configured in the initial validations.

Signed-off-by: wenyingd <wenyingd@vmware.com>

cmd/antrea-agent/options.go

@@ -320,9 +320,12 @@ func (o *Options) validateFlowExporterConfig() error {
 	return nil
 }
 
-func (o *Options) validateMulticastConfig() error {
+func (o *Options) validateMulticastConfig(encryptionMode config.TrafficEncryptionModeType) error {
 	if features.DefaultFeatureGate.Enabled(features.Multicast) {
 		var err error
+		if encryptionMode != config.TrafficEncryptionModeNone {
+			return fmt.Errorf("multicast feature doesn't work with the current encryption mode %s", encryptionMode)
+		}
 		if o.config.Multicast.IGMPQueryInterval != "" {
 			o.igmpQueryInterval, err = time.ParseDuration(o.config.Multicast.IGMPQueryInterval)
 			if err != nil {
@@ -584,7 +587,7 @@ func (o *Options) validateK8sNodeOptions() error {
 	if err := o.validateFlowExporterConfig(); err != nil {
 		return fmt.Errorf("failed to validate flow exporter config: %v", err)
 	}
-	if err := o.validateMulticastConfig(); err != nil {
+	if err := o.validateMulticastConfig(encryptionMode); err != nil {
 		return fmt.Errorf("failed to validate multicast config: %v", err)
 	}
 	if err := o.validateEgressConfig(encapMode); err != nil {

cmd/antrea-agent/options_linux_test.go

@@ -102,7 +102,7 @@ func TestMulticlusterOptions(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			config := &agentconfig.AgentConfig{
-				FeatureGates:     map[string]bool{"Multicluster": tt.featureGate},
+				FeatureGates:     map[string]bool{"Multicluster": tt.featureGate, "Multicast": false},
 				TrafficEncapMode: tt.encapMode,
 				Multicluster:     tt.mcConfig,
 			}

cmd/antrea-agent/options_test.go

@@ -219,18 +219,42 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 	tests := []struct {
 		name              string
 		igmpQueryVersions []int
+		encryptionMode    config.TrafficEncryptionModeType
 		expectedErr       error
 		expectedVersions  []uint8
 	}{
 		{
 			name:              "wrong versions",
 			igmpQueryVersions: []int{1, 3, 4},
+			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       fmt.Errorf("igmpQueryVersions should be a subset of [1 2 3]"),
 			expectedVersions:  nil,
 		},
+		{
+			name:              "incorrect encryption mode with IPSec",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeIPSec,
+			expectedErr:       fmt.Errorf("multicast feature doesn't work with the current encryption mode IPsec"),
+			expectedVersions:  nil,
+		},
+		{
+			name:              "incorrect encryption mode with WireGuard",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeWireGuard,
+			expectedErr:       fmt.Errorf("multicast feature doesn't work with the current encryption mode WireGuard"),
+			expectedVersions:  nil,
+		},
+		{
+			name:              "incorrect encryption mode with invalid",
+			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeInvalid,
+			expectedErr:       fmt.Errorf("multicast feature doesn't work with the current encryption mode invalid"),
+			expectedVersions:  nil,
+		},
 		{
 			name:              "no error",
 			igmpQueryVersions: []int{1, 2},
+			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       nil,
 			expectedVersions:  []uint8{1, 2},
 		},
@@ -242,9 +266,11 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 				Multicast: agentconfig.MulticastConfig{
 					IGMPQueryVersions: tt.igmpQueryVersions},
 			}}
-			err := o.validateMulticastConfig()
+			err := o.validateMulticastConfig(tt.encryptionMode)
 			assert.Equal(t, tt.expectedErr, err)
-			assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)
+			if err != nil {
+				assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)
+			}
 		})
 	}
 }