add route to gateway, so that we dont blackhole it #1171
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nonsense
force-pushed
the
sidecar-add-route-to-gateway
branch
2 times, most recently
from
89085eb
to
c85f806
Compare
nonsense
force-pushed
the
sidecar-add-route-to-gateway
branch
from
c85f806
to
4c36f7d
Compare
raulk
reviewed
Nov 7, 2020
pkg/sidecar/k8s_reactor.go
Outdated
| @@ -313,6 +315,25 @@ func (d *K8sReactor) manageContainer(ctx context.Context, container *docker.Cont | |||
| routeDst = r.Dst.String() | |||
| } | |||
|
|
|||
| // detect the gateway => we know that we are going to delete the services CIDR, which are routed via the gateway, | |||
| // so we use they to figure out the gateway IP as well as the link index | |||
| if !addedGwRoute && routeDst == "100.64.0.0/10" { | |||
There was a problem hiding this comment.
Let's move this out to a configuration variable and make it settable through a CLI flag?
There was a problem hiding this comment.
Totally agree about extracting it - done.
I don't think we need a CLI flag for this - this configuration is highly coupled with the exact configuration of the Kubernetes cluster, so chances are it won't work if you have a different configuration (this PR is a good example of how fragile networking updates are).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR is explicitly adding a route to the gateway, because otherwise packets to DNS (and other services) are dropped:
This problem got triggered when upgrading Kubernetes, weave and flannel, as well as host OS from
debian 9 stretchtoubuntuUbuntu 20.04.1 LTS(kernel from4.9.0-11-amd64to5.4.0-1028-aws) at testground/infra#64I am not sure why packets going through 100.96.4.1 (i.e. the gateway) were not being dropped until now.