Bug 1937238: Refactor chain setup for NodePort and ExternalIP #457
Conversation
Our iptables rules for NodePort and ExternalIP services were setting up rules in filter FORWARD, which is a table used for routing packets which don't have the node IP as neither source nore destination IP. This is not needed for NodePort and ExternalIP. For NodePort services we currently DNAT directly to the gatewayIP/clusterIP when a packet hits a node, and this happens on every node, which thus, does not warrant setting up filter FORWARD rules. In no case will node port packets just be forwarded to another node. For ExternalIP there is one case where routing external IP packets to another node does occur, but we use routing table rules to do this. Which means the filter FORWARD rules are not needed in that case either. The problem with having NodePort and ExternalIP iptables rules in filter FORWARD is that: every packet on the cluster going from one node to another will be looked up in those chains. They will never match, but the lookup can be exteremely costly on cluster with a lot of NodePort services defined, see: https://bugzilla.redhat.com/show_bug.cgi?id=1923157 Also, remove NAT PREROUTING in shared gateway mode, since we configure OVS flows on the shared gateway bridge to steer traffic into OVN thus rendering the iptables rules superflous. Signed-off-by: Alexander Constantinescu <aconstan@redhat.com> Delete stale iptables jump rules for updates On updates we need to remove the legacy jump rules for each mode. This will handle that. Unfortunately there's no generic way to do so depending on the services that we find, so we still need them hard-coded. For posteriority's sake we should really always have them, since we don't release ovn-kubernetes and we never know when someone deploying ovn-kubernetes reaches N+2 and can remove these. Signed-off-by: Alexander Constantinescu <aconstan@redhat.com>
openshift-ci-robot
added
the
bugzilla/severity-high
|
@alexanderConstantinescu: This pull request references Bugzilla bug 1937238, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 6 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Bugzilla (anusaxen@redhat.com), skipping review request. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/valid-bug
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alexanderConstantinescu, trozet The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
|
/retest Please review the full test history for this PR and help us cut down flakes. |
1 similar comment
|
/retest Please review the full test history for this PR and help us cut down flakes. |
crawford
added
the
cherry-pick-approved
|
@alexanderConstantinescu: All pull requests linked via external trackers have merged: Bugzilla bug 1937238 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Our iptables rules for NodePort and ExternalIP services were setting
up rules in filter FORWARD, which is a table used for routing packets
which don't have the node IP as neither source nore destination IP.
This is not needed for NodePort and ExternalIP. For NodePort services we
currently DNAT directly to the gatewayIP/clusterIP when a packet hits
a node, and this happens on every node, which thus, does not warrant
setting up filter FORWARD rules. In no case will node port packets
just be forwarded to another node.
For ExternalIP there is one case where routing external IP packets to
another node does occur, but we use routing table rules to do this. Which
means the filter FORWARD rules are not needed in that case either.
The problem with having NodePort and ExternalIP iptables rules in filter
FORWARD is that: every packet on the cluster going from one node to another
will be looked up in those chains. They will never match, but the lookup
can be exteremely costly on cluster with a lot of NodePort services defined,
see: https://bugzilla.redhat.com/show_bug.cgi?id=1923157
Also, remove NAT PREROUTING in shared gateway mode, since we configure OVS
flows on the shared gateway bridge to steer traffic into OVN thus rendering
the iptables rules superflous.
Signed-off-by: Alexander Constantinescu aconstan@redhat.com
Delete stale iptables jump rules for updates
On updates we need to remove the legacy jump rules for each
mode. This will handle that. Unfortunately there's no generic
way to do so depending on the services that we find, so we
still need them hard-coded. For posteriority's sake we should
really always have them, since we don't release ovn-kubernetes
and we never know when someone deploying ovn-kubernetes reaches
N+2 and can remove these.
/assign @trozet
- What this PR does and why is it needed
- Special notes for reviewers
- How to verify it
- Description for the changelog