Optimize NodePort performance by reducing request packets CT actions #3862
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hongliangl
added
the
action/release-note
hongliangl
force-pushed
the
reduce-svc-ct-action
branch
from
455a137
to
e3537d2
Compare
|
/test-e2e |
Codecov Report
@@ Coverage Diff @@
## main #3862 +/- ##
===========================================
+ Coverage 49.22% 60.36% +11.13%
===========================================
Files 258 290 +32
Lines 37969 42067 +4098
===========================================
+ Hits 18691 25392 +6701
+ Misses 17422 14569 -2853
- Partials 1856 2106 +250
Flags with carried forward coverage won't be shown. Click here to find out more.
|
tnqn
reviewed
Jun 7, 2022
hongliangl
force-pushed
the
reduce-svc-ct-action
branch
from
e3537d2
to
17a100a
Compare
|
/test-e2e |
jianjuns
previously approved these changes
Jun 9, 2022
pkg/agent/route/route_linux.go
Outdated
| @@ -1254,6 +1278,26 @@ func (c *Client) AddClusterIPRoute(svcIP net.IP) error { | |||
| return nil | |||
| } | |||
|
|
|||
| func (c *Client) addVirtualDNATIPRoute(isIPv6 bool) error { | |||
There was a problem hiding this comment.
Nit: should we name it addVirtualNodePortDNATIPRoute()
hongliangl
force-pushed
the
reduce-svc-ct-action
branch
from
17a100a
to
c4c1e13
Compare
jianjuns
previously approved these changes
Jun 10, 2022
|
@hongliangl : there is a conflict. |
hongliangl
force-pushed
the
reduce-svc-ct-action
branch
from
c4c1e13
to
4712bb2
Compare
|
@jianjuns Thanks, the PR is updated. |
jianjuns
previously approved these changes
Jun 10, 2022
|
/test-all Please take care of tests. |
wenyingd
reviewed
Jun 10, 2022
hongliangl
force-pushed
the
reduce-svc-ct-action
branch
from
4712bb2
to
0bd1448
Compare
For a NodePort connection sourced from external network or local Node, destination IP will be DNATed with a virtual IP, then the connection will be forwarded to OVS via Antrea gateway. However, in UnSNATTable, a flow is installed to unSNAT replied packets of SNATed connections by matching the virtual IP as destination IP. The flow is like the following: ``` table=UnSNAT, priority=200,ip,nw_dst=169.254.0.253 actions=ct(table=ConntrackZone,zone=65521,nat) ``` Note that, the request packets of a DNATed NodePort connection are also matched by the flow above, but it is unnecessary. To optimize the performance of NodePort, another virtual IP is used to DNAT NodePort connections. TCP_RR and TCP_CRR improvement is as fowllows: ``` Test old TPS new TPS delta TCP_CRR 3510.28 3847.76 +%9.61 TCP_RR 9574.29 10457.6 +%9.23 ``` Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
hongliangl
force-pushed
the
reduce-svc-ct-action
branch
from
0bd1448
to
f143fe7
Compare
|
/test-all |
|
/test-ipv6-e2e |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For a NodePort connection sourced from external network or local Node,
destination IP will be DNATed with a virtual IP, then the connection
will be forwarded to OVS via Antrea gateway. However, in UnSNATTable,
a flow is installed to unSNAT replied packets of SNATed connections by
matching the virtual IP as destination IP. The flow is like the following:
Note that, the request packets of a DNATed NodePort connection are also
matched by the flow above, but it is unnecessary. To optimize the
performance of NodePort, another virtual IP is used to DNAT NodePort
connections.
TCP_RR and TCP_CRR improvement is as fowllows:
Signed-off-by: Hongliang Liu lhongliang@vmware.com