[Multicast] Add validation to clarify networkPolicyOnly mode is not supported

cmd/antrea-agent/options.go

@@ -335,12 +335,15 @@ func (o *Options) validateFlowExporterConfig() error {
 	return nil
 }
 
-func (o *Options) validateMulticastConfig(encryptionMode config.TrafficEncryptionModeType) error {
+func (o *Options) validateMulticastConfig(encapMode config.TrafficEncapModeType, encryptionMode config.TrafficEncryptionModeType) error {
 	if features.DefaultFeatureGate.Enabled(features.Multicast) && o.config.Multicast.Enable {
 		var err error
 		if encryptionMode != config.TrafficEncryptionModeNone {
 			return fmt.Errorf("Multicast feature doesn't work with the current encryption mode '%s'", encryptionMode)
 		}
+		if encapMode.IsNetworkPolicyOnly() {
+			return fmt.Errorf("Multicast feature doesn't work with the networkPolicyOnly mode")
+		}
 		if o.config.Multicast.IGMPQueryInterval != "" {
 			o.igmpQueryInterval, err = time.ParseDuration(o.config.Multicast.IGMPQueryInterval)
 			if err != nil {
@@ -618,7 +621,7 @@ func (o *Options) validateK8sNodeOptions() error {
 	if err := o.validateFlowExporterConfig(); err != nil {
 		return fmt.Errorf("failed to validate flow exporter config: %v", err)
 	}
-	if err := o.validateMulticastConfig(encryptionMode); err != nil {
+	if err := o.validateMulticastConfig(encapMode, encryptionMode); err != nil {
 		return fmt.Errorf("failed to validate multicast config: %v", err)
 	}
 	if err := o.validateEgressConfig(encapMode); err != nil {

cmd/antrea-agent/options_test.go

@@ -219,41 +219,55 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 	tests := []struct {
 		name              string
 		igmpQueryVersions []int
+		encapMode         config.TrafficEncapModeType
 		encryptionMode    config.TrafficEncryptionModeType
 		expectedErr       error
 		expectedVersions  []uint8
 	}{
 		{
 			name:              "wrong versions",
 			igmpQueryVersions: []int{1, 3, 4},
+			encapMode:         config.TrafficEncapModeNoEncap,
 			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       fmt.Errorf("igmpQueryVersions should be a subset of [1 2 3]"),
 			expectedVersions:  nil,
 		},
 		{
 			name:              "incorrect encryption mode with IPSec",
 			igmpQueryVersions: []int{1, 2},
+			encapMode:         config.TrafficEncapModeEncap,
 			encryptionMode:    config.TrafficEncryptionModeIPSec,
 			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the current encryption mode 'IPsec'"),
 			expectedVersions:  nil,
 		},
 		{
 			name:              "incorrect encryption mode with WireGuard",
 			igmpQueryVersions: []int{1, 2},
+			encapMode:         config.TrafficEncapModeEncap,
 			encryptionMode:    config.TrafficEncryptionModeWireGuard,
 			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the current encryption mode 'WireGuard'"),
 			expectedVersions:  nil,
 		},
 		{
 			name:              "incorrect encryption mode with invalid",
 			igmpQueryVersions: []int{1, 2},
+			encapMode:         config.TrafficEncapModeEncap,
 			encryptionMode:    config.TrafficEncryptionModeInvalid,
 			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the current encryption mode 'invalid'"),
 			expectedVersions:  nil,
 		},
+		{
+			name:              "not supported with networkPolicyOnly mode",
+			igmpQueryVersions: []int{1, 2},
+			encapMode:         config.TrafficEncapModeNetworkPolicyOnly,
+			encryptionMode:    config.TrafficEncryptionModeNone,
+			expectedErr:       fmt.Errorf("Multicast feature doesn't work with the networkPolicyOnly mode"),
+			expectedVersions:  nil,
+		},
 		{
 			name:              "no error",
 			igmpQueryVersions: []int{1, 2},
+			encapMode:         config.TrafficEncapModeNoEncap,
 			encryptionMode:    config.TrafficEncryptionModeNone,
 			expectedErr:       nil,
 			expectedVersions:  []uint8{1, 2},
@@ -267,7 +281,7 @@ func TestOptionsValidateMulticastConfig(t *testing.T) {
 					Enable:            true,
 					IGMPQueryVersions: tt.igmpQueryVersions},
 			}}
-			err := o.validateMulticastConfig(tt.encryptionMode)
+			err := o.validateMulticastConfig(tt.encapMode, tt.encryptionMode)
 			require.Equal(t, tt.expectedErr, err)
 			if err != nil {
 				assert.Equal(t, tt.expectedVersions, o.igmpQueryVersions)

docs/multicast-guide.md

@@ -10,6 +10,9 @@ Antrea supports multicast traffic in the following scenarios:
 3. External to Pod - Pods can receive the multicast traffic from external
    hosts.
 
+Multicast is supported in `encap`, `noEncap` and `hybrid` mode, but not in
+`networkPolicyOnly` mode.
+
 ## Table of Contents
 
 <!-- toc -->