-
Notifications
You must be signed in to change notification settings - Fork 2.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[v1.15] egressgw: Let the EGW manager relax rp_filter on egress device #32778
[v1.15] egressgw: Let the EGW manager relax rp_filter on egress device #32778
Conversation
/test-backport-1.15 |
[ upstream commit 43d65ed ] [ backporter's note: The sysctl Reconciler has not been introduced in v1.15, so the legacy sysctl is used instead. ] Pods running on the Egress GW node fail to communicate with an external endpoint through the Egress GW due to the rp_filter in an environment where egress IP is assigned to a different interface than the one with the default route. The reply packets from the external endpoints are dropped by the rp_filter - A request from a local pod hits eth0 with the default route. It matches an IEGP, gets masqueraded & bpf-redirected to eth1 with Egress IP. - Replies hit eth1, are revSNATed, and passed on to the stack. rp-filter complains that they are received on eth1, when the route doesn't point towards eth1. This PR fixes this issue by relaxing rp_filter on interfaces with Egress IP. Signed-off-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
63ff99f
to
2e65f6e
Compare
/test-backport-1.15 |
(added @dylandreimerink for the diff from missing #30439) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. We kept the same methods, just changed the implementation, for this reason.
@julianwiedmann no need to set |
This is a manual backport of #32679
Once this PR is merged, a GitHub action will update the labels of these PRs: