Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable cross-subnet mode with Calico by default #11810

Merged

Conversation

hakman
Copy link
Member

@hakman hakman commented Jun 19, 2021

Most kOps setup have at least 2 subnets so, the optimal setup is to:

  1. disable AWS src/dest checks
  2. set encapsulation mode to CrossSubnet (other possible options are Always and None)

/cc @johngmyers @olemarkus

@k8s-ci-robot k8s-ci-robot added area/addons size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jun 19, 2021
@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch from 9e587c7 to 3764ab7 Compare June 19, 2021 08:37
@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch from 3764ab7 to 8f65c09 Compare June 19, 2021 10:07
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 19, 2021
@hakman hakman changed the title Disable src/dst checks for Calico in IPv6 mode Enable cross-subnet mode with Calico by default Jun 19, 2021
@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch 4 times, most recently from 8e53181 to 2709e6a Compare June 19, 2021 11:54
@johngmyers
Copy link
Member

I'm not terribly knowledgeable about Calico. @olemarkus do you have expertise in this area?

@olemarkus
Copy link
Member

No, I'm afraid not. Our e2e are not multi-az either. That would have been handy to verify this doesn't cause something unexpected to happen.

@hakman
Copy link
Member Author

hakman commented Jun 20, 2021

We have this HA test for masters.
/test pull-kops-e2e-k8s-containerd-ha

@hakman
Copy link
Member Author

hakman commented Jun 20, 2021

Seems all good. I can add more periodic tests later for vxlan and maybe bpf.

pkg/apis/kops/networking.go Show resolved Hide resolved
pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
pkg/apis/kops/networking.go Show resolved Hide resolved
pkg/apis/kops/networking.go Show resolved Hide resolved
pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
pkg/apis/kops/validation/validation.go Outdated Show resolved Hide resolved
@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch 3 times, most recently from 8211ab8 to 8e23f21 Compare June 21, 2021 05:51
@hakman
Copy link
Member Author

hakman commented Jun 21, 2021

/retest

@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch from 8e23f21 to 8a1cdd7 Compare June 22, 2021 03:16
@hakman
Copy link
Member Author

hakman commented Jun 22, 2021

/retest

1 similar comment
@hakman
Copy link
Member Author

hakman commented Jun 22, 2021

/retest

@hakman
Copy link
Member Author

hakman commented Jun 22, 2021

/retest

pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch from 8a1cdd7 to e57fd05 Compare June 22, 2021 06:14
@hakman
Copy link
Member Author

hakman commented Jun 22, 2021

/retest

1 similar comment
@hakman
Copy link
Member Author

hakman commented Jun 22, 2021

/retest

pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
pkg/apis/kops/networking.go Outdated Show resolved Hide resolved
@hakman hakman force-pushed the ipv6_disable_calico_awssrcdstcheck branch from e57fd05 to a12b314 Compare June 25, 2021 04:13
@johngmyers
Copy link
Member

/lgtm
/approve
/retest

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 25, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johngmyers

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 25, 2021
@johngmyers
Copy link
Member

/retest

1 similar comment
@hakman
Copy link
Member Author

hakman commented Jun 25, 2021

/retest

@k8s-ci-robot k8s-ci-robot merged commit 89ad2bc into kubernetes:master Jun 25, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.22 milestone Jun 25, 2021
@hakman hakman deleted the ipv6_disable_calico_awssrcdstcheck branch October 22, 2021 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/addons area/api area/documentation cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants