datapath: Do not SNAT replies to outside #17168
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
brb
added
the
release-note/bug
brb
force-pushed
the
pr/brb/ct-snat-bpf
branch
2 times, most recently
from
49b6f6b
to
6107b87
Compare
|
test-net-next |
brb
force-pushed
the
pr/brb/ct-snat-bpf
branch
3 times, most recently
from
76ad256
to
b9a4d2d
Compare
brb
added
the
sig/datapath
brb
changed the title
|
test-me-please |
|
test-1.19-5.4 |
|
test-1.20-4.19 |
1 similar comment
|
test-1.20-4.19 |
|
4.19 is hitting the complexity issue 👀 |
|
test-1.20-4.19 |
|
test-me-please |
brb
force-pushed
the
pr/brb/ct-snat-bpf
branch
from
12656d7
to
c6764f1
Compare
|
test-me-please |
pchaigno
added
the
dont-merge/needs-rebase
maintainer-s-little-helper
bot
added
the
ready-to-merge
pchaigno
added
dont-merge/bad-bot
brb
force-pushed
the
pr/brb/ct-snat-bpf
branch
from
c6764f1
to
b24f05b
Compare
|
test-me-please |
brb
force-pushed
the
pr/brb/ct-snat-bpf
branch
from
b24f05b
to
d567075
Compare
Previously, the BPF-based masquerading (--enable-bpf-masquerade=true)
was wrongly masquerading replies from a pod to an outside when the
outside had initiated a connection. This was possible when e.g., the
outside had a route to the pod cidr.
To fix this, we introduce a lightweight CT lookup function
ct_is_reply4() which checks whether a given flow is a reply. The lookup
function is called in snat_v4_needed().
As a side note, I've tried to move the port extraction to a separate
function, but unfortunately it hits complexity issues on the 4.19
kernel in the "K8sDatapathConfig AutoDirectNodeRoutes Check direct
connectivity with per endpoint routes" suite:
BPF program is too large. Processed 131073 insn
libbpf: failed to load program 'handle_to_container'
libbpf: failed to load object '624_next/bpf_lxc.o'
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Previously, they were failing due to our datapath masquerading replies from pod to outside. As it got fixed in the previous commit, we can enable BPF-based masquerading. This will also gives us some coverage for the fix. Signed-off-by: Martynas Pumputis <m@lambda.lt>
|
test-me-please Job 'Cilium-PR-K8s-1.16-net-next' failed and has not been observed before, so may be related to your PR: Click to show.Test NameFailure OutputIf it is a flake, comment |
|
test-net-next |
christarazi
removed
dont-merge/needs-rebase
|
CI has passed and we have reviewer approval, marking ready to merge. |
christarazi
added
the
ready-to-merge
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.10
in 1.10.5
maintainer-s-little-helper
bot
moved this from Backport pending to v1.10
to Backport done to v1.10
in 1.10.5
maintainer-s-little-helper
bot
moved this from Backport pending to v1.10
to Backport done to v1.10
in 1.10.5
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See commit msgs.
Fix: #12544