-
Notifications
You must be signed in to change notification settings - Fork 2.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
kpr: Make it possible to run bpf_sock on Kind #14951
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A few nits on the comments, but looks good to me otherwise.
0099cbc
to
c245867
Compare
@brb On newer kernels (at least with 5.10), Kind is broken on v1.9 with the recommended options (ie: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, thank you!
@rolinh Good point, I will create a separate PR to update the docs. Meanwhile, could you create an issue for it so that I could link it in the docs? |
test-me-please |
c245867
to
ecb6ea1
Compare
ecb6ea1
to
c3ebafc
Compare
c3ebafc
to
9399a49
Compare
When running on Kind, multiple cilium-agent instances running on the same host will try to attach to the same cgroup v2 root bpf_sock programs. As the LB BPF maps cannot be shared among them, in-cluster LB won't work. To fix this, we try to derive a cgroup v2 sub-hierarchy from a cilium-agent process cgroup v2. This guarantees, that each bpf_sock will be attached to a different cgroup. The net_cls and net_prio discrepancy when running with cgroup v2 was spotted by Daniel Borkmann. Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
test-me-please |
test-net-next |
Please see commit msgs.
Marked to be backported to v1.9, because this will resolve the BPF complexity issues when the host-reachable svc is disabled.
On lack of unit tests - unfortunately, we cannot control whether the unit tests will run on a host with or without cgroup v1 which can influence the results. Anyway, I'm planning to enable kpr test suite on Kind.