garp: Announce Pods with Gratuitous ARP

Documentation/spelling_wordlist.txt

@@ -840,6 +840,7 @@ pmdabcc
 pmtuDiscovery
 png
 podAnnotations
+podAnnouncements
 podCIDR
 podDisruptionBudget
 podLabels

install/kubernetes/cilium/templates/cilium-configmap.yaml

@@ -973,6 +973,11 @@ data:
   {{- end}}
 {{- end}}
 
+{{- if .Values.l2podAnnouncements.enabled }}
+  enable-l2-pod-announcements: {{ .Values.l2podAnnouncements.enabled | quote }}
+  l2-pod-announcements-interface: {{ .Values.l2podAnnouncements.interface | quote }}
+{{- end }}
+
 {{- if and .Values.bgp.enabled (and (not .Values.bgp.announce.loadbalancerIP) (not .Values.bgp.announce.podCIDR)) }}
   {{ fail "BGP was enabled, but no announcements were enabled. Please enable one or more announcements." }}
 {{- end }}

install/kubernetes/cilium/values.yaml.tmpl

@@ -367,6 +367,13 @@ l2announcements:
   # -- The timeout between retries if renewal fails
   # leaseRetryPeriod: 2s
 
+# -- Configure L2 pod announcements
+l2podAnnouncements:
+  # -- Enable L2 pod announcements
+  enabled: false
+  # -- Interface used for sending Gratuitous ARP pod announcements
+  interface: "eth0"
+
 # -- Configure BGP
 bgp:
   # -- Enable BGP support inside Cilium; embeds a new ConfigMap for BGP inside

pkg/datapath/cells.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/cilium/cilium/pkg/bpf"
 	"github.com/cilium/cilium/pkg/datapath/agentliveness"
+	"github.com/cilium/cilium/pkg/datapath/garp"
 	"github.com/cilium/cilium/pkg/datapath/iptables"
 	"github.com/cilium/cilium/pkg/datapath/l2responder"
 	"github.com/cilium/cilium/pkg/datapath/link"
@@ -65,6 +66,9 @@ var Cell = cell.Module(
 	// between datapath components and more high-level components.
 	tables.Cell,
 
+	// Gratuitous ARP event processor emits GARP packets on k8s pod creation events.
+	garp.Cell,
+
 	cell.Provide(func(dp types.Datapath) ipcache.NodeIDHandler {
 		return dp.NodeIDs()
 	}),

pkg/datapath/garp/cells.go

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Cilium
+
+package garp
+
+import (
+	"github.com/spf13/pflag"
+
+	"github.com/cilium/cilium/pkg/hive/cell"
+)
+
+const (
+	// L2PodAnnouncementsInterface is the interface used to send Gratuitous ARP messages.
+	L2PodAnnouncementsInterface = "l2-pod-announcements-interface"
+
+	EnableL2PodAnnouncements = "enable-l2-pod-announcements"
+)
+
+// Config contains the configuration for the GARP cell.
+type Config struct {
+	L2PodAnnouncementsInterface string
+	EnableL2PodAnnouncements    bool
+}
+
+func (def Config) Flags(flags *pflag.FlagSet) {
+	flags.String(L2PodAnnouncementsInterface, def.L2PodAnnouncementsInterface, "Interface used for sending gratuitous arp messages")
+	flags.Bool(EnableL2PodAnnouncements, def.EnableL2PodAnnouncements, "Enable announcing Pod IPs with Gratuitous ARP")
+}
+
+// Cell processes k8s pod events for the local node and determines if a
+// Gratuitous ARP packet needs to be sent.
+var Cell = cell.Module(
+	"l2-pod-announcements-garp",
+	"GARP processor sends gratuitous ARP packets for local pods",
+
+	cell.Provide(newGARPSender),
+
+	// This cell can't have a default config, it's entirely env dependent.
+	cell.Config(Config{}),
+
+	cell.Invoke(newGARPProcessor),
+)

pkg/datapath/garp/garp.go

@@ -4,57 +4,30 @@
 package garp
 
 import (
-	"errors"
 	"fmt"
 	"net"
 	"net/netip"
 
 	"github.com/mdlayher/arp"
 	"github.com/mdlayher/ethernet"
 	"github.com/sirupsen/logrus"
-	"github.com/spf13/pflag"
 	"github.com/vishvananda/netlink"
 
-	"github.com/cilium/cilium/pkg/hive/cell"
 	"github.com/cilium/cilium/pkg/logging/logfields"
 )
 
-const (
-	// GARPInterface is the interface used to send Gratuitous ARP messages.
-	GARPInterface = "garp-interface"
-)
-
-var Cell = cell.Module(
-	"garp",
-	"GARP",
-
-	cell.Provide(newGARPSender),
-
-	// This cell can't have a default config, it's entirely env dependent.
-	cell.Config(Config{}),
-)
-
-// Config contains the configuration for the GARP cell.
-type Config struct {
-	GARPInterface string
-}
-
-func (def Config) Flags(flags *pflag.FlagSet) {
-	flags.String(GARPInterface, def.GARPInterface, "Interface used for sending gratuitous arp messages")
-}
-
 type Sender interface {
 	Send(netip.Addr) error
 }
 
 func newGARPSender(log logrus.FieldLogger, cfg Config) (Sender, error) {
-	if cfg.GARPInterface == "" {
-		return nil, errors.New("gratuitous arp sender interface undefined")
+	if cfg.L2PodAnnouncementsInterface == "" {
+		return nil, nil
 	}
 
-	iface, err := interfaceByName(cfg.GARPInterface)
+	iface, err := interfaceByName(cfg.L2PodAnnouncementsInterface)
 	if err != nil {
-		return nil, fmt.Errorf("gratuitous arp sender interface %q not found: %w", cfg.GARPInterface, err)
+		return nil, fmt.Errorf("gratuitous arp sender interface %q not found: %w", cfg.L2PodAnnouncementsInterface, err)
 	}
 
 	l := log.WithField(logfields.Interface, iface.Name)

pkg/datapath/garp/garp_test.go

@@ -56,10 +56,12 @@ func (s *garpSuite) TestGARPCell(c *C) {
 	h := hive.New(cell.Module(
 		"test-garp-cell",
 		"TestGARPCell",
-		Cell,
+
+		cell.Config(Config{}),
+		cell.Provide(newGARPSender),
 		cell.Invoke(testGARPCell),
 	))
-	hive.AddConfigOverride(h, func(cfg *Config) { cfg.GARPInterface = testIfaceName })
+	hive.AddConfigOverride(h, func(cfg *Config) { cfg.L2PodAnnouncementsInterface = testIfaceName })
 
 	if err := h.Populate(); err != nil {
 		c.Fatalf("Failed to populate: %s", err)

pkg/datapath/garp/processor.go

@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Cilium
+
+package garp
+
+import (
+	"net/netip"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/cilium/cilium/pkg/endpoint"
+	"github.com/cilium/cilium/pkg/endpointmanager"
+	"github.com/cilium/cilium/pkg/hive/cell"
+	"github.com/cilium/cilium/pkg/lock"
+	"github.com/cilium/cilium/pkg/logging/logfields"
+)
+
+type processorParams struct {
+	cell.In
+
+	Logger          logrus.FieldLogger
+	EndpointManager endpointmanager.EndpointManager
+	GARPSender      Sender
+	Config          Config
+}
+
+func newGARPProcessor(p processorParams) *processor {
+	if !p.Config.EnableL2PodAnnouncements {
+		return nil
+	}
+
+	gp := &processor{
+		log:         p.Logger,
+		garpSender:  p.GARPSender,
+		endpointIPs: make(map[uint16]netip.Addr),
+	}
+
+	if p.EndpointManager != nil {
+		p.EndpointManager.Subscribe(gp)
+	}
+
+	p.Logger.Info("initialised gratuitous arp processor")
+
+	return gp
+}
+
+type processor struct {
+	mu lock.Mutex
+
+	log        logrus.FieldLogger
+	garpSender Sender
+
+	endpointIPs map[uint16]netip.Addr
+}
+
+var _ endpointmanager.Subscriber = &processor{}
+
+// EndpointCreated implements endpointmanager.Subscriber
+func (gp *processor) EndpointCreated(ep *endpoint.Endpoint) {
+	gp.mu.Lock()
+	defer gp.mu.Unlock()
+
+	newIP := ep.IPv4
+	if newIP.IsUnspecified() {
+		return
+	}
+
+	oldIP, ok := gp.endpointIPs[ep.ID]
+	if ok && oldIP == newIP {
+		return
+	}
+
+	gp.endpointIPs[ep.ID] = newIP
+
+	log := gp.log.WithFields(logrus.Fields{
+		logfields.K8sPodName: ep.K8sPodName,
+		logfields.IPAddr:     newIP,
+	})
+
+	if err := gp.garpSender.Send(newIP); err != nil {
+		log.WithError(err).Warn("Failed to send gratuitous arp")
+	} else {
+		log.Debug("pod upsert gratuitous arp sent")
+	}
+}
+
+// EndpointDeleted implements endpointmanager.Subscriber
+func (gp *processor) EndpointDeleted(ep *endpoint.Endpoint, conf endpoint.DeleteConfig) {
+	gp.mu.Lock()
+	defer gp.mu.Unlock()
+
+	delete(gp.endpointIPs, ep.ID)
+}