egress gateway: fix non-tunnel mode

[kkourt]

Fixes: #17386

When a client uses an egress gateway node, it forwards traffic via a vxlan tunnel to the egress gateway node. If datapath is configured in non-tunnel mode (direct routing), replies from the gateway to the client do not go via the tunnel. This causes these replies to be dropped by iptables because no Cilium's FORWARD rule matches them

This patch identifies above packets (i.e., from egress gw to client), and steers them via the vlxan tunnel after rev-SNAT is performed even when datapath is configured in non-tunnel mode.

PR also adds a test for egress gateway functionality.

Signed-off-by: Kornilios Kourtis kornilios@isovalent.com

egress gateway: fix non-tunnel (direct routing) mode

[kkourt]

test-1.16-netnext

[kkourt]

test-me-please

[kkourt]

/test

[kkourt]

/test

[kkourt]

/test

[kkourt]

/test-gke

[brb]

Travis CI hit:

docker: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit.

Restarted.

[kkourt]

/test

[kkourt]

/test-gke

[pchaigno]

Looks good overall, only minor stuff below 🙂

[kkourt]

While trying to implement @pchaigno changes and running the Egress test locally, the test fail. It is not clear yet if this is a flake or due to the changes. Because, however, there are users waiting for the fix in this PR, and after discussing it offline, we will leave the changes to the test for a follow up PR.

Hence, I'm pushing a new branch with only white-space/comment changes so that we will not have to rerun tests. Previous tests were successful, except the Travis test which is a known flake.

The diff between the version that the tests run and the new one is:

diff --git a/bpf/lib/nodeport.h b/bpf/lib/nodeport.h
index f7b5507f68..ff8787e724 100644
--- a/bpf/lib/nodeport.h
+++ b/bpf/lib/nodeport.h
@@ -1968,7 +1968,7 @@ static __always_inline int rev_nodeport_lb4(struct __ctx_buff *ctx, int *ifindex
        csum_l4_offset_and_flags(tuple.nexthdr, &csum_off);
 
 #if defined(ENABLE_EGRESS_GATEWAY) && !defined(TUNNEL_MODE)
-       /* traffic from clients to egress gateway nodes, reaches said gateways
+       /* Traffic from clients to egress gateway nodes reaches said gateways
         * by a vxlan tunnel. If we are not using TUNNEL_MODE, we need to
         * identify reverse traffic from the gateway to clients and also steer
         * it via the vxlan tunnel to avoid issues with iptables dropping these
@@ -2011,6 +2011,7 @@ static __always_inline int rev_nodeport_lb4(struct __ctx_buff *ctx, int *ifindex
 #ifdef TUNNEL_MODE
                {
                        struct remote_endpoint_info *info;
+
                        info = ipcache_lookup4(&IPCACHE_MAP, ip4->daddr, V4_CACHE_KEY_LEN);
                        if (info != NULL && info->tunnel_endpoint != 0) {
                                tunnel_endpoint = info->tunnel_endpoint;
diff --git a/test/k8sT/Egress.go b/test/k8sT/Egress.go
index c28df5537a..17caeefef1 100644
--- a/test/k8sT/Egress.go
+++ b/test/k8sT/Egress.go
@@ -1,4 +1,4 @@
-// Copyright 2017-2021 Authors of Cilium
+// Copyright 2021 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -44,7 +44,6 @@ var _ = SkipDescribeIf(func() bool {
                namespaceSelector string = "ns=cilium-test"
        )
 
-       // TODO(anfernee): Check a better way to deduplicate it with similar snippet in DatapathConfiguration.go
        runEchoServer := func() {
                // Run echo server on outside node
                originalEchoPodPath := helpers.ManifestGet(kubectl.BasePath(), "echoserver-hostnetns.yaml")

[pchaigno]

LGTM.

FYI, the diff is also available here 👇 , by clicking on force-pushed:

[kkourt]

After Paul's ✅ and reasoning on #17517 (comment), marking ready-to-merge.