[BPF] When lo has IP override it when CTLB is disabled #8618
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
marvin-tigera
added
release-note-required
tomastigera
added
docs-not-required
tomastigera
force-pushed
the
tomas-bpf-ctlb-host-fix-src
branch
from
578282e to
6777ac7
Compare
tomastigera
force-pushed
the
tomas-bpf-ctlb-host-fix-src
branch
from
6777ac7 to
ef265df
Compare
tomastigera
force-pushed
the
tomas-bpf-ctlb-host-fix-src
branch
2 times, most recently
from
e24efd0 to
2f97002
Compare
tomastigera
force-pushed
the
tomas-bpf-ctlb-host-fix-src
branch
2 times, most recently
from
6bd1392 to
ad015b3
Compare
When CTLB is disabled, we route traffic for services via bpfnatin/out device. Since the final destination isn't resolved yet, Linux picks up an address set on loopback device (if there is any) as source. This may not be (likely is not) an address that can be used by the destination to return traffic. Therefore we need to replace it by the host's IP that is routable within the cluster. So we set the host IP as a source on the service routes. We can only set the routes when there is a host IP, but that is also a prerequisite for loading any bpf programs. When/if the host IP changes, we mark all services as dirty so we reapply them with updated source.
tomastigera
force-pushed
the
tomas-bpf-ctlb-host-fix-src
branch
from
ad015b3 to
f72b303
Compare
|
/merge-when-ready |
|
OK, I will merge the pull request when it's ready, leave the commits as is when I merge it, and leave the branch after I've merged it. |
3 tasks
tomastigera
added a commit
that referenced
this pull request
Apr 15, 2024
…-release-v3.28 [release-v3.28] Auto pick #8618: When lo has IP override it when CTLB is disabled
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When CTLB is disabled, we route traffic for services via bpfnatin/out device. Since the final destination isn't resolved yet, Linux picks up an address set on loopback device (if there is any) as source. This may not be (likely is not) an address that can be used by the destination to return traffic. Therefore we need to replace it by the host's IP that is routable within the cluster.
We use the same mechanism as for replacing main host device IP with a tunnel IP when we need to reach a remote workload via an overlay.
If the IP set on loopback is the host IP (say du to dual ToR connectivity), that would work, because the override of the lo IP kicks in only if that IP differs.
Description
Related issues/PRs
Todos
Release Note
Reminder for the reviewer
Make sure that this PR has the correct labels and milestone set.
Every PR needs one
docs-*label.docs-pr-required: This change requires a change to the documentation that has not been completed yet.docs-completed: This change has all necessary documentation completed.docs-not-required: This change has no user-facing impact and requires no docs.Every PR needs one
release-note-*label.release-note-required: This PR has user-facing changes. Most PRs should have this label.release-note-not-required: This PR has no user-facing changes.Other optional labels:
cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.