Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug: Controller does not filter IP address family #25

Closed
sstrk opened this issue Apr 22, 2021 · 2 comments · Fixed by #26
Closed

Bug: Controller does not filter IP address family #25

sstrk opened this issue Apr 22, 2021 · 2 comments · Fixed by #26
Labels
bug Something isn't working

Comments

@sstrk
Copy link
Contributor

sstrk commented Apr 22, 2021

The controller does not distinguish between IPv4 and IPv6 addresses. This breaks the appliance of nftables rules if the host nodes have an IPv4 and an IPv6 address (DualStack).

The controller tries to use IPv6 addresses in an IPv4 nftables rule. This leads to the failure of nftables when trying to apply the generated config:

Error: Could not resolve hostname: Address family for hostname not supported
@horazont
Copy link
Collaborator

@ComradeOgilvy Could you please add the diff which is logged by the operator so that it’s clear where the error comes from?

@horazont horazont added the bug Something isn't working label Apr 22, 2021
@sstrk
Copy link
Contributor Author

sstrk commented Apr 22, 2021 

Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: I0422 06:37:55.990373    1757 agent.go:201] configuration diff for /var/lib/ch-k8s-lbaas-agent/nftables/lbaas.conf:
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: --- /var/lib/ch-k8s-lbaas-agent/nftables/.bak-765999954        2021-04-22 06:37:55.984736510 +0000
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: +++ /var/lib/ch-k8s-lbaas-agent/nftables/.tmp-675798527        2021-04-22 06:37:55.984736510 +0000
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: @@ -9,6 +9,10 @@
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]:  table ip nat {
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]:          chain prerouting {
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]:  
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: +
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: +        ip daddr 172.30.154.11 tcp dport 80 mark set 0x1 and 0x1 ct mark set meta mark dnat to numgen inc mod 10 map {0 : 172.30.154.10, 1 : 172.30.154.15, 2 : 172.30.154.22, 3 : 172.30.154.28, 4 : 172.30.154.5, 5 : 172.30.154.7, 6 : fd00::11, 7 : fd00::14, 8 : fd00::15, 9 : fd00::6, } : 30681;
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: +
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]:          }
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]:  
Apr 22 06:37:55 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]:          chain postrouting {
Apr 22 06:37:55 managed-k8s-gw-az1 sudo[22853]: ch-k8s-lbaas-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl reload nftables
Apr 22 06:37:56 managed-k8s-gw-az1 sudo[22853]: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 22 06:37:56 managed-k8s-gw-az1 ch-k8s-lbaas-agent[1757]: Job for nftables.service failed.

sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 22, 2021
@sstrk
Filter dest addresses based on preferred IPFamily
6392b45 
On a DualStack-cluster, the nodes can have IPv4 and IPv6 addresses.
The controller does not distinguish the addresses, which leads to the
fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service.

This commit adjusts getDestinationAddress to return a map in which the
IP addresses are distinguished based on their Address Family.

Furthermore, if a Service has a preferred Address Family, only these
addresses will be used as destination addresses.

Issue: cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 22, 2021
@sstrk
Filter dest addresses based on preferred IPFamily
4e3c70d 
On a DualStack-cluster, the nodes can have IPv4 and IPv6 addresses.
The controller does not distinguish the addresses, which leads to the
fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service.

This commit adjusts getDestinationAddress to return a map in which the
IP addresses are distinguished based on their Address Family.

Furthermore, if a Service has a preferred Address Family, only these
addresses will be used as destination addresses.

Issue: cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 22, 2021
@sstrk
Filter dest addresses based on preferred IPFamily
d4ab14b 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
Furthermore, if a Service has a preferred Address Family, only these
addresses will be used as destination addresses.

Issue: cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on preferred IPFamily
96a2cf8 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Issue: cloudandheat#25
@sstrk sstrk mentioned this issue Apr 23, 2021
Merged
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on IngressIP
419a49b 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Issue: cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on IngressIP
f55dba3 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Fixes: cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on IngressIP
f927006 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Fixes cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on IngressIP
49f66ef 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Fixes cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on IngressIP
170f073 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Fixes cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 23, 2021
@sstrk
Filter dest addresses based on IngressIP
36dfa10 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Fixes cloudandheat#25
sstrk added a commit to sstrk/ch-k8s-lbaas that referenced this issue Apr 27, 2021
@sstrk
Filter dest addresses based on IngressIP
692ebfe 
The host nodes of a cluster can have IPv4 and/or IPv6 addresses.
The controller does not distinguish the address families, which leads to
the fact that all addresses will be used as Destination Addresses
independent of the preferred IPFamily of the Service or the Ingress IP.

This commit adjusts getDestinationAddress to return two lists, one for
each supported address family.
To do so, functions to check the correctness of a textual representation
of an IP and to check the address family got implemented.
golang does not natively support the determination of the address family,
which is why the presence of ":" and "." is checked.

The GenerateModel function has been adjusted to use only IP addresses
of the same address family as the IngressIP as destination addresses.

Fixes cloudandheat#25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Filter dest addresses based on IngressIP sstrk/ch-k8s-lbaas
2 participants
@horazont @sstrk