Support Internal Traffic Policy in AntreaProxy #2792

hongliangl · 2021-09-16T15:22:50Z

InternalTrafficPolicy is introduced in Kubernetes 1.21. Service Internal
Traffic Policy enables internal traffic restrictions to only route
internal traffic to Endpoints within the Node the traffic originated
from. The "internal" traffic here refers to traffic originated from Pods
in the current cluster. This can help to reduce costs and improve
performance.

Signed-off-by: Hongliang Liu lhongliang@vmware.com

codecov-commenter · 2021-09-16T15:30:36Z

Codecov Report

Merging #2792 (f6804fc) into main (b9e37a8) will decrease coverage by 1.15%.
The diff coverage is 53.03%.

@@            Coverage Diff             @@
##             main    #2792      +/-   ##
==========================================
- Coverage   64.17%   63.01%   -1.16%     
==========================================
  Files         278      278              
  Lines       27825    27861      +36     
==========================================
- Hits        17856    17558     -298     
- Misses       8048     8438     +390     
+ Partials     1921     1865      -56

Flag	Coverage Δ
kind-e2e-tests	`49.53% <40.90%> (-1.70%)`	⬇️
unit-tests	`43.38% <53.03%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/agent/proxy/proxier.go	`61.20% <53.03%> (-1.52%)`	⬇️
...g/agent/apiserver/handlers/featuregates/handler.go	`0.00% <0.00%> (-82.36%)`	⬇️
...kg/apiserver/registry/system/supportbundle/rest.go	`20.45% <0.00%> (-54.55%)`	⬇️
pkg/support/dump.go	`8.19% <0.00%> (-49.19%)`	⬇️
...egator/apiserver/handlers/recordmetrics/handler.go	`0.00% <0.00%> (-44.45%)`	⬇️
pkg/support/dump_others.go	`0.00% <0.00%> (-44.00%)`	⬇️
...g/agent/apiserver/handlers/addressgroup/handler.go	`0.00% <0.00%> (-40.00%)`	⬇️
...agent/apiserver/handlers/appliedtogroup/handler.go	`0.00% <0.00%> (-40.00%)`	⬇️
...gregator/apiserver/handlers/flowrecords/handler.go	`0.00% <0.00%> (-40.00%)`	⬇️
pkg/apiserver/handlers/loglevel/handler.go	`0.00% <0.00%> (-38.47%)`	⬇️
... and 27 more

antoninbas

what are we doing for e2e testing?
given that the feature gate is only enabled by default in K8s v1.22+, maybe we should have some temporary Antrea e2e tests for local internal traffic policy.

build/yamls/antrea-aks.yml

docs/feature-gates.md

pkg/agent/proxy/proxier.go

build/yamls/base/conf/antrea-agent.conf

pkg/agent/proxy/proxier.go

jianjuns · 2021-10-19T18:05:54Z

In the commit message:

The "internal" traffic here refers to traffic originated from Pod in the current cluster
The "internal" traffic here refers to traffic originates from Pods in the cluster

github-actions · 2022-01-19T00:30:49Z

This PR is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

hongliangl · 2022-02-25T14:45:46Z

@tnqn @jianjuns @antoninbas @wenyingd Could you review this PR when you are available? I have rebased this PR. I only added unit tests, and I will add e2e tests in another PR. Thanks a lot.

hongliangl · 2022-02-25T14:46:05Z

/test-all
/test-windows-all

pkg/agent/proxy/proxier.go

hongliangl · 2022-02-27T16:36:23Z

/test-all-features-conformance
/test-conformance
/test-e2e
/test-flexible-ipam-e2e
/test-ipv6-conformance
/test-ipv6-e2e
/test-ipv6-networkpolicy
/test-ipv6-only-conformance
/test-ipv6-only-e2e
/test-ipv6-only-networkpolicy
/test-multicluster-e2e
/test-networkpolicy
/test-windows-conformance
/test-windows-e2e
/test-windows-networkpolicy
/test-windows-proxyall-e2e
/test-integration

hongliangl · 2022-02-28T00:52:38Z

/test-windows-proxyall-e2e
/test-flexible-ipam-e2e

hongliangl · 2022-02-28T00:52:49Z

/test-ipv6-only-e2e

hongliangl · 2022-03-26T13:31:56Z

/test-all-features-conformance
/test-conformance
/test-e2e
/test-flexible-ipam-e2e
/test-ipv6-conformance
/test-ipv6-e2e
/test-ipv6-networkpolicy
/test-ipv6-only-conformance
/test-ipv6-only-e2e
/test-ipv6-only-networkpolicy
/test-multicluster-e2e
/test-networkpolicy
/test-windows-conformance
/test-windows-e2e
/test-windows-networkpolicy
/test-windows-proxyall-e2e
/test-integration

pkg/agent/proxy/proxier.go

hongliangl · 2022-03-30T13:45:03Z

/test-all-features-conformance
/test-conformance
/test-e2e
/test-flexible-ipam-e2e
/test-ipv6-conformance
/test-ipv6-e2e
/test-ipv6-networkpolicy
/test-ipv6-only-conformance
/test-ipv6-only-e2e
/test-ipv6-only-networkpolicy
/test-multicluster-e2e
/test-networkpolicy
/test-windows-conformance
/test-windows-e2e
/test-windows-networkpolicy
/test-windows-proxyall-e2e
/test-integration

hongliangl · 2022-03-30T13:49:18Z

@jianjuns @tnqn Could you help review this PR if you are available? Thanks.

jianjuns

Just a few nits.

pkg/agent/proxy/proxier.go

InternalTrafficPolicy is introduced in Kubernetes 1.21. Service Internal Traffic Policy enables internal traffic restrictions to only route internal traffic to Endpoints within the Node the traffic originated from. The "internal" traffic here refers to traffic originated from Pods in the current cluster. This can help to reduce costs and improve performance. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>

jianjuns

LGTM

hongliangl · 2022-03-31T05:12:57Z

@tnqn Do you have any comments about this PR?

hongliangl · 2022-03-31T05:13:12Z

/test-all-features-conformance
/test-conformance
/test-e2e
/test-flexible-ipam-e2e
/test-ipv6-conformance
/test-ipv6-e2e
/test-ipv6-networkpolicy
/test-ipv6-only-conformance
/test-ipv6-only-e2e
/test-ipv6-only-networkpolicy
/test-multicluster-e2e
/test-networkpolicy
/test-windows-conformance
/test-windows-e2e
/test-windows-networkpolicy
/test-windows-proxyall-e2e
/test-integration

hongliangl · 2022-04-01T03:27:58Z

/test-integration
/test-multicluster-e2e
/test-windows-networkpolicy

jianjuns · 2022-04-01T20:14:09Z

pkg/agent/proxy/proxier.go

+					// of the Service are different, install two groups. One group has all Endpoints, the other has only
+					// local Endpoints.
+					groupID := p.groupCounter.AllocateIfNotExist(svcPortName, true)
+					if err = p.ofClient.InstallServiceGroup(groupID, svcInfo.StickyMaxAgeSeconds() != 0, localEndpointUpdateList); err != nil {


Question - I know it is not introduced by you, but what is the strategy to handle errors? Is it right just to ignore them?

hongliangl requested review from antoninbas, wenyingd, tnqn and jianjuns September 16, 2021 15:22

hongliangl force-pushed the proxy-internal-traffic-policy branch from 5994fee to 93d3f31 Compare September 17, 2021 15:16

antoninbas reviewed Sep 21, 2021

View reviewed changes

build/yamls/antrea-aks.yml Outdated Show resolved Hide resolved

docs/feature-gates.md Outdated Show resolved Hide resolved

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

hongliangl force-pushed the proxy-internal-traffic-policy branch from 7bda9a3 to e52a40f Compare September 22, 2021 12:44

hongliangl requested a review from antoninbas September 22, 2021 12:45

hongliangl force-pushed the proxy-internal-traffic-policy branch 2 times, most recently from 4029309 to 19d01b6 Compare September 22, 2021 15:36

tnqn reviewed Sep 28, 2021

View reviewed changes

build/yamls/base/conf/antrea-agent.conf Outdated Show resolved Hide resolved

hongliangl force-pushed the proxy-internal-traffic-policy branch from 19d01b6 to f6b9cac Compare October 19, 2021 06:15

hongliangl requested a review from tnqn October 19, 2021 06:16

jianjuns reviewed Oct 19, 2021

View reviewed changes

hongliangl force-pushed the proxy-internal-traffic-policy branch from f6b9cac to b451b70 Compare October 20, 2021 00:44

hongliangl requested a review from jianjuns October 20, 2021 00:45

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 19, 2022

hongliangl force-pushed the proxy-internal-traffic-policy branch 3 times, most recently from c313c53 to a440e31 Compare February 25, 2022 14:40

jianjuns reviewed Feb 25, 2022

View reviewed changes

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

github-actions bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 26, 2022

hongliangl force-pushed the proxy-internal-traffic-policy branch from a440e31 to ca25c33 Compare February 27, 2022 16:35

hongliangl requested a review from jianjuns February 27, 2022 16:36

tnqn added this to the Antrea v1.6 release milestone Mar 9, 2022

tnqn added the action/release-note Indicates a PR that should be included in release notes. label Mar 9, 2022

hongliangl removed the action/release-note Indicates a PR that should be included in release notes. label Mar 16, 2022

hongliangl removed this from the Antrea v1.6 release milestone Mar 16, 2022

hongliangl force-pushed the proxy-internal-traffic-policy branch from ca25c33 to 9bb09d0 Compare March 28, 2022 04:24

wenyingd reviewed Mar 28, 2022

View reviewed changes

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

pkg/agent/proxy/proxier.go Outdated Show resolved Hide resolved

hongliangl force-pushed the proxy-internal-traffic-policy branch from 9bb09d0 to 3a27beb Compare March 28, 2022 06:37

hongliangl requested a review from wenyingd March 30, 2022 13:49

jianjuns reviewed Mar 30, 2022

View reviewed changes

hongliangl force-pushed the proxy-internal-traffic-policy branch from 3a27beb to 98697a7 Compare March 31, 2022 02:51

hongliangl force-pushed the proxy-internal-traffic-policy branch from 98697a7 to f6804fc Compare March 31, 2022 02:53

hongliangl requested a review from jianjuns March 31, 2022 02:53

jianjuns approved these changes Mar 31, 2022

View reviewed changes

hongliangl requested a review from jianjuns March 31, 2022 05:12

hongliangl added the area/proxy Issues or PRs related to proxy functions in Antrea label Mar 31, 2022

tnqn added the action/release-note Indicates a PR that should be included in release notes. label Mar 31, 2022

jianjuns reviewed Apr 1, 2022

View reviewed changes

jianjuns merged commit 709d920 into antrea-io:main Apr 1, 2022

hongliangl deleted the proxy-internal-traffic-policy branch April 21, 2022 01:02

hongliangl mentioned this pull request Jun 7, 2022

Automated cherry pick of #3340: Add method AllocateIfNotExist to interface GroupCounter in #2792: Support InternalTrafficPolicy in AntreaProxy #3865

Merged

tnqn mentioned this pull request Mar 2, 2023

Support ProxyTerminatingEndpoints in AntreaProxy #4607

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support Internal Traffic Policy in AntreaProxy #2792

Support Internal Traffic Policy in AntreaProxy #2792

hongliangl commented Sep 16, 2021 •

edited

codecov-commenter commented Sep 16, 2021 •

edited

antoninbas left a comment

jianjuns commented Oct 19, 2021

github-actions bot commented Jan 19, 2022

hongliangl commented Feb 25, 2022

hongliangl commented Feb 25, 2022

hongliangl commented Feb 27, 2022

hongliangl commented Feb 28, 2022

hongliangl commented Feb 28, 2022

hongliangl commented Mar 26, 2022

hongliangl commented Mar 30, 2022

hongliangl commented Mar 30, 2022

jianjuns left a comment

jianjuns left a comment

hongliangl commented Mar 31, 2022

hongliangl commented Mar 31, 2022

hongliangl commented Apr 1, 2022

jianjuns Apr 1, 2022

Support Internal Traffic Policy in AntreaProxy #2792

Support Internal Traffic Policy in AntreaProxy #2792

Conversation

hongliangl commented Sep 16, 2021 • edited

codecov-commenter commented Sep 16, 2021 • edited

Codecov Report

antoninbas left a comment

Choose a reason for hiding this comment

jianjuns commented Oct 19, 2021

github-actions bot commented Jan 19, 2022

hongliangl commented Feb 25, 2022

hongliangl commented Feb 25, 2022

hongliangl commented Feb 27, 2022

hongliangl commented Feb 28, 2022

hongliangl commented Feb 28, 2022

hongliangl commented Mar 26, 2022

hongliangl commented Mar 30, 2022

hongliangl commented Mar 30, 2022

jianjuns left a comment

Choose a reason for hiding this comment

jianjuns left a comment

Choose a reason for hiding this comment

hongliangl commented Mar 31, 2022

hongliangl commented Mar 31, 2022

hongliangl commented Apr 1, 2022

jianjuns Apr 1, 2022

Choose a reason for hiding this comment

hongliangl commented Sep 16, 2021 •

edited

codecov-commenter commented Sep 16, 2021 •

edited