Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Edge gateway automatically obtains public IP #170

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

a516664625
Copy link

边缘节点在无法连接公网环境下,是没办法通过 https://api.ipify.org 这些地址获取公网ip的 而每个边缘的gw写上public太过麻烦,wiregurd与libreswan都支持自动获取建立vpn隧道的endpoint 也就是public ip ,所以去掉对public ip 的强依赖

Copy link

codecov bot commented Apr 2, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 35.63%. Comparing base (fa158b9) to head (823982a).
Report is 3 commits behind head on main.

❗ Current head 823982a differs from pull request most recent head 7e8a0b8. Consider uploading reports for the commit 7e8a0b8 to get more accurate results

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #170   +/-   ##
=======================================
  Coverage   35.63%   35.63%           
=======================================
  Files          12       12           
  Lines        1476     1476           
=======================================
  Hits          526      526           
  Misses        842      842           
  Partials      108      108           
Flag Coverage Δ
unittests 35.63% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

边缘节点在无法连接公网环境下,是没办法通过 https://api.ipify.org 这些地址获取公网ip的
而每个边缘的gw写上public太过麻烦,wiregurd与libreswan都支持自动获取建立vpn隧道的endpoint
@rambohe-ch
Copy link
Member

@njucjc @River-sh PTAL

@njucjc
Copy link
Member

njucjc commented Apr 10, 2024

边缘节点在无法连接公网环境下,是没办法通过 https://api.ipify.org 这些地址获取公网ip的 而每个边缘的gw写上public太过麻烦,wiregurd与libreswan都支持自动获取建立vpn隧道的endpoint 也就是public ip ,所以去掉对public ip 的强依赖

@a516664625 这块有e2e测试的结果么,另外只看到对wireguard的改动,libreswan似乎没改

@a516664625
Copy link
Author

@njucjc 如下在填写边缘gw的时候 不写public ip vpn 隧道仍然建立成功,libreswan 的代码我看是支持 不写public ip的,因为在创建 隧道时 host 使用 了 any
image

[root@deepflow ~]# kubectl get gw -o yaml edge-a
apiVersion: raven.openyurt.io/v1beta1
kind: Gateway
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"raven.openyurt.io/v1alpha1","kind":"Gateway","metadata":{"annotations":{},"name":"edge-a"},"spec":{"endpoints":[{"nodeName":"ghi","underNAT":true}]}}
creationTimestamp: "2024-04-01T08:52:49Z"
generation: 2
name: edge-a
resourceVersion: "2574874"
uid: 46fff4e8-a2ea-4b7d-8514-81ed18b54c5f
spec:
endpoints:

  • config:
    publicKey: p19RK4tfDp+/ED5RrbUK/HBczxfCIIkanKO6dpV6SDY=
    nodeName: ghi
    port: 4500
    type: tunnel
    underNAT: true
    nodeSelector:
    matchLabels:
    raven.openyurt.io/gateway: edge-a
    proxyConfig:
    Replicas: 1
    tunnelConfig:
    Replicas: 1
    status:
    activeEndpoints:
  • config:
    enable-l3-tunnel: "true"
    publicKey: p19RK4tfDp+/ED5RrbUK/HBczxfCIIkanKO6dpV6SDY=
    nodeName: ghi
    port: 4500
    type: tunnel
    underNAT: true
    nodes:
  • nodeName: ghi
    privateIP: 192.168.10.254
    subnets:
    • 10.233.66.0/24
image

@River-sh
Copy link
Contributor

@YTGhost Nat穿越在没有publicIP的时候是否可行?

@@ -212,10 +210,6 @@ func (c *TunnelHandler) shouldHandleGateway(gateway *v1beta1.Gateway) bool {
klog.InfoS("no active endpoint , waiting for sync", "gateway", klog.KObj(gateway))
return false
}
if ep.PublicIP == "" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里是不是加下判断,只边缘gateway不强制要求public ip

@YTGhost
Copy link
Member

YTGhost commented Apr 10, 2024

@a516664625 目前测试的场景是云端deepflow节点与边缘ghi节点之间建立云边隧道,云端设置了publicIP,边缘节点没有设置publicIP吗?

@YTGhost
Copy link
Member

YTGhost commented Apr 10, 2024

@YTGhost Nat穿越在没有publicIP的时候是否可行?

我理解边与边两节点之间至少得有一边知道对面的publicIP

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants