-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
daemon: Fail init if requirements for BPF masquerade are not met #29778
daemon: Fail init if requirements for BPF masquerade are not met #29778
Conversation
/test |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
There's another occurrence which also sets EnableBPFMasquerade
to false a few lines below. It may not be affected (as in that case MasqueradingEnabled()
is false), but it is likely worth to also address that one, so that the value is effectively never mutated.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Upgrade notes look good!
574441f
to
0d321b4
Compare
Fixed, PTAL 🙏 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
I think that this is probably the right approach to make this behaviour more explicit and clear to the user. At the same time, I'm not sure whether we could backport this to any released version given that users could be currently relying on the fallback behaviour and they don't expect to see their cluster break upon upgrade to a .5 or .6 patch release based on an opinionated flag parsing behaviour like this. I'd be open to backport this into v1.15 if y'all strongly advocate for it, or otherwise we could defer to v1.16 if there's no specific rush. |
Totally agree with this.
IMHO we need to backport to v1.15 to fix #29663. |
I think it is sufficient to backport this to v1.15 only, as the primary intent of the PR was to fix #29663 after iptables modularization (as Marco already pointed out). |
/test |
|
In case the requirements for BPF masquerade are not met, fail the daemon initialization instead of silently fall back to iptables based masquerading. This is needed because the iptables cell does not support runtime configuration changes. Fixes: a6a2b73 ("iptables: Add a cell for iptables config manager") Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
The previous commit removed the silent fallback to iptables based masquerading if the requirements for BPF masquerading are not met. Since having both enable-ipv4-masquerade and enable-ipv6-masquerade set to false is incompatible with BPF masquerading, the ginkgo tests that need this configuration now have to explicitly set iptables based masquerading. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
74ffb7a
to
57d879d
Compare
/test |
In case the requirements for BPF masquerade are not met, fail the daemon initialization instead of silently fall back to iptables based masquerading.
This is needed because the iptables cell does not support runtime configuration changes.
Fixes: #29663