datapath: Only NOTRACK proxy return traffic going to Cilium datapath #11899
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Proxy return traffic accessed via a k8s NodePort will not be routed back via Cilium bpf datapath, so such traffic needs to have possible reverse NAT applied. Setting NOTRACK prevented this. Fix this by setting NOTRACK only on packets heading back to the Cilium datapath (-o lxc+ and -o cilium_host). Signed-off-by: Jarno Rajahalme <jarno@covalent.io>
jrajahalme
added
kind/bug
|
test-me-please |
|
test-gke |
|
This fixed nodeport with L7 on GKE on manual testing. |
|
1.17 flake #10231 |
|
K8s test suite run locally against a private cluster passed on GKE with this PR: |
|
retest-4.19 |
|
retest-gke |
joestringer
reviewed
Jun 5, 2020
maintainer-s-little-helper
bot
added
the
ready-to-merge
|
Change makes sense, probably just worth considering whether to further gate one of the new rules per my feedback above. I don't think it makes sense to backport to v1.6, we're not hearing reports of issues on that release with eg. EKS. This fixes a known issue with the GKE mode which is the same on v1.7 and v1.8 so those backports make sense to me. |
joestringer
requested changes
Jun 5, 2020
There was a problem hiding this comment.
We should agree on the previous comment before merging:
https://github.com/cilium/cilium/pull/11899/files#r436051065
tgraf
approved these changes
Jun 5, 2020
joestringer
approved these changes
Jun 5, 2020
|
Merging despite GKE failure since the GKE job seems entirely broken but Jarno had manually validated the fix in a GKE environment. |
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.8
in 1.8.0
maintainer-s-little-helper
bot
moved this from Backport pending to v1.8
to Backport done to v1.8
in 1.8.0
maintainer-s-little-helper
bot
moved this from Backport pending to v1.8
to Backport done to v1.8
in 1.8.0
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.7
in 1.7.5
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.7
in 1.7.5
maintainer-s-little-helper
bot
moved this from Backport pending to v1.7
to Backport done to v1.7
in 1.7.5
brb
added a commit
that referenced
this pull request
Jul 8, 2020
#11899 made it possible to run NodePort BPF with L7 policies. Signed-off-by: Martynas Pumputis <m@lambda.lt>
nebril
pushed a commit
that referenced
this pull request
Jul 8, 2020
#11899 made it possible to run NodePort BPF with L7 policies. Signed-off-by: Martynas Pumputis <m@lambda.lt>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proxy return traffic accessed via a k8s NodePort will not be routed
back via Cilium bpf datapath, so such traffic needs to have possible
reverse NAT applied. Setting NOTRACK prevented this. Fix this by
setting NOTRACK only on packets heading back to the Cilium datapath
(
-o lxc+and-o cilium_host).Fixes: #8971
Fixes: #8945
Signed-off-by: Jarno Rajahalme jarno@covalent.io