ci-datapath: Enable IPV6 masquerading when KPR=off #25111
Conversation
As pointed by Maxim Mikityanskiy, the issue #23461 was resolved, so we can enable IPv6 with IPsec/vxlan. Signed-off-by: Martynas Pumputis <m@lambda.lt>
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
More test coverage. Signed-off-by: Martynas Pumputis <m@lambda.lt>
brb
force-pushed
the
pr/brb/ci-dp-v6-more
branch
from
b2df60d
to
494898a
Compare
|
/test |
brb
force-pushed
the
pr/brb/ci-dp-v6-more
branch
from
494898a
to
e8a39c0
Compare
brb
added
area/CI-improvement
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
| # BPF-masq requires KPR=strict. | ||
| # Disable IPv6 until https://github.com/cilium/cilium/issues/14350 has been resolved | ||
| MASQ="--helm-set=bpf.masquerade=true --helm-set=enableIPv6Masquerade=false" | ||
| fi |
There was a problem hiding this comment.
I don't seem to understand this second commit... It says:
Enable v6 masquerading with KPR=off in ci-dp
...but enableIPv6Masquerade is still false,
More test coverage.
...but bpf.masquerade is now set to true only when KPR=strict (used to be set unconditionally).
Could you explain what's the idea of this change?
There was a problem hiding this comment.
...but enableIPv6Masquerade is still false,
If not specified, it defaults to true - https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/values.yaml#L1527
...but bpf.masquerade is now set to true only when KPR=strict
This is because of https://github.com/cilium/cilium/blob/main/daemon/cmd/daemon.go#L940 (KPR=strict means that NodePort is enabled).
There was a problem hiding this comment.
This is because of https://github.com/cilium/cilium/blob/main/daemon/cmd/daemon.go#L940
How did it work before? When KPR could be none, and bpf.masquerade was always enabled.
There was a problem hiding this comment.
Very good question. I wanted to figure out myself. Anyway:
level=warning msg="Falling back to iptables-based masquerading." error="BPF masquerade requires NodePort (--enable-node-port="true")" subsys=daemon
The agent automatically switched to the iptables-based masquerading.
brb
added
the
ready-to-merge
ci-dp successful run https://github.com/cilium/cilium/actions/runs/4798712433/jobs/8537364470?pr=25111.
Before removing the WIP commit, all ginkgo tests have passed.