Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clustermesh: document global services limitations with KPR=false #31798

Merged

Conversation

giorio94
Copy link
Member

@giorio94 giorio94 commented Apr 5, 2024

Global services do not work when KPR is disabled if accessed through a NodePort, or from a host-netns pod, as kube-proxy doesn't know about the remote backends. Let's explicit these limitations.

Document Cluster Mesh global services limitations when KPR=false

@giorio94 giorio94 added area/documentation Impacts the documentation, including textual changes, sphinx, or other doc generation code. area/clustermesh Relates to multi-cluster routing functionality in Cilium. release-note/misc This PR makes changes that have no direct user impact. labels Apr 5, 2024
@giorio94 giorio94 requested review from a team as code owners April 5, 2024 14:35
@giorio94 giorio94 requested review from thorn3r and qmonnet April 5, 2024 14:35
@giorio94
Copy link
Member Author

giorio94 commented Apr 5, 2024

/test

@MrFreezeex
Copy link
Member

MrFreezeex commented Apr 5, 2024

BTW I would expect that the new endpointslice sync feature most likely lift this limitation as well (IIUC?) as the remote clusters endpoints would be available to kube proxy, although that's maybe too niche/new to mention it here?

Copy link
Member

@qmonnet qmonnet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@giorio94
Copy link
Member Author

giorio94 commented Apr 8, 2024

BTW I would expect that the new endpointslice sync feature most likely lift this limitation as well (IIUC?) as the remote clusters endpoints would be available to kube proxy, although that's maybe too niche/new to mention it here?

Yep, that's my expectation as well. I'd personally merge this version first so that it can be backported to stable branches, and then mention that as part of a follow-up. WDYT?

@giorio94 giorio94 added needs-backport/1.13 This PR / issue needs backporting to the v1.13 branch needs-backport/1.14 This PR / issue needs backporting to the v1.14 branch needs-backport/1.15 This PR / issue needs backporting to the v1.15 branch labels Apr 8, 2024
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.15.4 Apr 8, 2024
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.14.10 Apr 8, 2024
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.13.15 Apr 8, 2024
@giorio94 giorio94 removed the needs-backport/1.13 This PR / issue needs backporting to the v1.13 branch label Apr 8, 2024
@maintainer-s-little-helper maintainer-s-little-helper bot removed this from Needs backport from main in 1.13.15 Apr 8, 2024
Global services do not work when KPR is disabled if accessed through
a NodePort, or from a host-netns pod, as kube-proxy doesn't know about
the remote backends. Let's explicit these limitations.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
@giorio94 giorio94 force-pushed the mio/global-services-limitations branch from f75ca63 to 3a31bc4 Compare April 10, 2024 07:30
@giorio94
Copy link
Member Author

Rebased onto main as one of the workflows appears to have been renamed.

@giorio94
Copy link
Member Author

/test

@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Apr 11, 2024
@asauber asauber added this to Needs backport from main in 1.15.5 Apr 11, 2024
@asauber asauber removed this from Needs backport from main in 1.15.4 Apr 11, 2024
@asauber asauber added this to Needs backport from main in 1.14.11 Apr 11, 2024
@asauber asauber removed this from Needs backport from main in 1.14.10 Apr 11, 2024
@julianwiedmann julianwiedmann added this pull request to the merge queue Apr 12, 2024
Merged via the queue into cilium:main with commit b8050e5 Apr 12, 2024
59 checks passed
@giorio94 giorio94 mentioned this pull request Apr 15, 2024
3 tasks
@giorio94 giorio94 added backport-pending/1.15 The backport for Cilium 1.15.x for this PR is in progress. and removed needs-backport/1.15 This PR / issue needs backporting to the v1.15 branch labels Apr 15, 2024
@giorio94 giorio94 mentioned this pull request Apr 16, 2024
4 tasks
@giorio94 giorio94 added backport-pending/1.14 The backport for Cilium 1.14.x for this PR is in progress. and removed needs-backport/1.14 This PR / issue needs backporting to the v1.14 branch labels Apr 16, 2024
@github-actions github-actions bot added backport-done/1.14 The backport for Cilium 1.14.x for this PR is done. backport-done/1.15 The backport for Cilium 1.15.x for this PR is done. and removed backport-pending/1.14 The backport for Cilium 1.14.x for this PR is in progress. backport-pending/1.15 The backport for Cilium 1.15.x for this PR is in progress. labels Apr 18, 2024
@nebril nebril moved this from Needs backport from main to Backport done to v1.14 in 1.14.11 May 10, 2024
@nebril nebril moved this from Needs backport from main to Backport done to v1.15 in 1.15.5 May 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/clustermesh Relates to multi-cluster routing functionality in Cilium. area/documentation Impacts the documentation, including textual changes, sphinx, or other doc generation code. backport-done/1.14 The backport for Cilium 1.14.x for this PR is done. backport-done/1.15 The backport for Cilium 1.15.x for this PR is done. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact.
Projects
No open projects
1.14.11
Backport done to v1.14
1.15.5
Backport done to v1.15
Status: Released
Status: Released
Development

Successfully merging this pull request may close these issues.

hostNetwork client can't reach backends in remote cluster via Global Service
5 participants