Kata: Mention incompatibility with host-reachable services or strict KPR in documentation #15589
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
qmonnet
added
area/documentation
borkmann
approved these changes
Apr 7, 2021
joestringer
approved these changes
Apr 7, 2021
joestringer
requested changes
Apr 7, 2021
|
Switching back to draft while @qmonnet is out. |
Host-reachable services are not supported with Kata containers at this time. This is because they use socket-based load-balancing which requires hooking in the kernel at the socket level in the pods, but Kata containers are VMs with their own kernels, making it impossible. Kube-proxy replacement in strict mode implies host-reachable services, and is therefore not supported either. Update the documentation accordingly, to avoid users stumbling on it. Signed-off-by: Quentin Monnet <quentin@isovalent.com>
|
Thanks Joe for your feedback, I addressed the two points. New preview: Incremental diffdiff --git a/Documentation/gettingstarted/kata.rst b/Documentation/gettingstarted/kata.rst
index 46120ad5ea5a..ac760892c8ae 100644
--- a/Documentation/gettingstarted/kata.rst
+++ b/Documentation/gettingstarted/kata.rst
@@ -77,13 +77,15 @@ Deploy Cilium release via Helm:
.. warning::
- Kata containers do not work with :ref:`host-services`, or with
- :ref:`kube-proxy replacement <kubeproxy-free>` in strict mode. They should
- be disabled with ``--set hostServices.enabled=false`` (default) and
- ``--set kubeProxyReplacement=disabled`` (or ``partial``)
+ Kata containers do not work with :ref:`host-services`, or with
+ :ref:`kube-proxy replacement <kubeproxy-free>` in strict mode. These
+ features should be disabled with ``--set hostServices.enabled=false``
+ (default) and ``--set kubeProxyReplacement=disabled`` (or ``partial``).
- Both rely on socket-based load-balancing, which is not possible given that
- Kata containers are virtual machines running with their own kernel.
+ Both features rely on socket-based load-balancing, which is not possible
+ given that Kata containers are virtual machines running with their own
+ kernel. For kube-proxy replacement, this limitation is tracked with
+ `GitHub issue 15437 <https://github.com/cilium/cilium/issues/15437>`_.
.. include:: k8s-install-validate.rst
|
joestringer
approved these changes
Apr 12, 2021
pchaigno
added
the
ready-to-merge
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.9
in 1.9.6
maintainer-s-little-helper
bot
moved this from Backport pending to v1.9
to Backport done to v1.9
in 1.9.6
This was referenced Apr 28, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Host-reachable services are not supported with Kata containers at this time. This is because they use socket-based load-balancing which requires hooking in the kernel at the socket level in the pods, but Kata containers are VMs with their own kernels, making it impossible.
Kube-proxy replacement in strict mode implies host-reachable services, and is therefore not supported either.
Update the documentation accordingly, to avoid users stumbling on it.
Preview:
