Test IPsec + KPR #31760
Test IPsec + KPR #31760
Conversation
pchaigno
added
release-note/major
pchaigno
force-pushed
the
pr/pchaigno/ipsec-kpr
branch
4 times, most recently
from
f7cf28a
to
5069a4a
Compare
This comment was marked as resolved.
This comment was marked as resolved.
maintainer-s-little-helper
bot
added
the
dont-merge/needs-sign-off
pchaigno
force-pushed
the
pr/pchaigno/ipsec-kpr
branch
from
14b88c4
to
5069a4a
Compare
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-sign-off
pchaigno
force-pushed
the
pr/pchaigno/ipsec-kpr
branch
from
5069a4a
to
7800822
Compare
pchaigno
force-pushed
the
pr/pchaigno/ipsec-kpr
branch
from
7800822
to
0c7b583
Compare
pchaigno
added
area/CI
With previous fixes, we can now have IPsec enabled together with KPR. IPsec will encrypt traffic between pods as usual. Note that requests to a NodePort that are being forwarded from the receiving node to a node with a backend won't be encrypted. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
We can reuse the two configs that had --devices set because KPR will cause devices to be autodetected anyway. We then need to add one other config to cover VXLAN. Upgrade tests are not extended to cover KPR because it isn't supported in the previous stable. We will need to wait for the next minor release to be able to extend those tests. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
To be able to cover this configuration without removing coverage for others, we need to add one more test case. Fortunately, it will run in parallel to other test case. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
pchaigno
force-pushed
the
pr/pchaigno/ipsec-kpr
branch
from
0c7b583
to
2ad6401
Compare
| if option.Config.EnableIPSec { | ||
| return fmt.Errorf("IPSec cannot be used with BPF NodePort") | ||
| } | ||
|
|
There was a problem hiding this comment.
From a look at what additional feature combinations this allows (with features that depend on EnableNodePort, and thus were previously incompatible), the two that stand out are:
- XDP NodePort acceleration
- BPF Masquerade (and all of its dependencies, like Egress Gateway)
Should we explicitly reject these two, until we have fully understood the implications and added sufficient test coverage?
There was a problem hiding this comment.
Yeah, it's probably best. Should I already disable for WireGuard or do we have coverage in that case?
There was a problem hiding this comment.
I'm note quite parsing
Should I already disable for WireGuard or do we have coverage in that case?
You mean whether WireGuard should also conflict against XDP and/or BPF Masquerade? I think that ship has sailed already, breaking potentially existing configs is a much tougher decision. Coverage-wise, I see that we have WireGuard + EGW in the e2e test.
I would also expect that those features have much more user exposure to WireGuard already (because IPsec was not an option until now).
This pull request adds end-to-end CI coverage for IPsec + KPR, including coverage of key rotations and up/downgrades.