Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

policy: Suppress any policy map updates when updating redirects if keeping the current policy #14356

Conversation

jrajahalme
Copy link
Member

Incremental policy update path
(AccumulateMapChanges/ConsumeMapChanges) is taking care of the policy
map updates when a full policy recalcualtion is not necessary. We
already depended on this to get the redirect entries plumbed down to
the bpf maps. Make this more explicit by suppressing policy MapState
updates while updating proxy redirects if a new policy was not
calculated. This allows ConsumeMapsChanges() to notice that the
redirect entry was not already in the desired MapState and pass it
along as a map change to be applied to the bpf maps.

Signed-off-by: Jarno Rajahalme jarno@covalent.io

@jrajahalme jrajahalme added kind/enhancement This would improve or streamline existing functionality. sig/policy Impacts whether traffic is allowed or denied based on user-defined policies. release-note/misc This PR makes changes that have no direct user impact. labels Dec 10, 2020
@jrajahalme jrajahalme requested a review from a team as a code owner December 10, 2020 18:07
@jrajahalme jrajahalme requested review from a team, aditighag and fristonio December 10, 2020 18:07
@jrajahalme
Copy link
Member Author

test-me-please

@jrajahalme
Copy link
Member Author

Known flake (#12511) on netnext, no other failures.

…eping the current policy

Incremental policy update path
(AccumulateMapChanges/ConsumeMapChanges) is taking care of the policy
map updates when a full policy recalcualtion is not necessary. We
already depended on this to get the redirect entries plumbed down to
the bpf maps. Make this more explicit by suppressing policy MapState
updates while updating proxy redirects if a new policy was not
calculated. This allows ConsumeMapsChanges() to notice that the
redirect entry was not already in the desired MapState and pass it
along as a map change to be applied to the bpf maps.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>
@jrajahalme jrajahalme force-pushed the pr/jrajahalme/suppress-policy-map-update-when-updating-redirects branch from 5dbeb62 to 57701fa Compare December 14, 2020 05:45
@jrajahalme
Copy link
Member Author

test-me-please

@jrajahalme
Copy link
Member Author

Rebase to master & retest.

@jrajahalme jrajahalme added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Dec 30, 2020
@kkourt kkourt merged commit 0560795 into master Dec 31, 2020
@kkourt kkourt deleted the pr/jrajahalme/suppress-policy-map-update-when-updating-redirects branch December 31, 2020 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement This would improve or streamline existing functionality. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact. sig/policy Impacts whether traffic is allowed or denied based on user-defined policies.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants