-
Notifications
You must be signed in to change notification settings - Fork 3.8k
Don't require host reachable service (socket-LB) for ebpf masquerading #15437
Copy link
Copy link
Closed
Labels
area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.Impacts bpf/ or low-level forwarding details, including map management and monitor messages.area/loadbalancingImpacts load-balancing and Kubernetes service implementationsImpacts load-balancing and Kubernetes service implementationsfeature/snatRelates to SNAT or Masquerading of trafficRelates to SNAT or Masquerading of trafficfeature/socket-lbImpacts the Socket-LB part of Cilium's kube-proxy replacement.Impacts the Socket-LB part of Cilium's kube-proxy replacement.kind/community-reportThis was reported by a user in the Cilium community, eg via Slack.This was reported by a user in the Cilium community, eg via Slack.kind/featureThis introduces new functionality.This introduces new functionality.pinnedThese issues are not marked stale by our issue bot.These issues are not marked stale by our issue bot.
Description
Metadata
Metadata
Assignees
Labels
area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.Impacts bpf/ or low-level forwarding details, including map management and monitor messages.area/loadbalancingImpacts load-balancing and Kubernetes service implementationsImpacts load-balancing and Kubernetes service implementationsfeature/snatRelates to SNAT or Masquerading of trafficRelates to SNAT or Masquerading of trafficfeature/socket-lbImpacts the Socket-LB part of Cilium's kube-proxy replacement.Impacts the Socket-LB part of Cilium's kube-proxy replacement.kind/community-reportThis was reported by a user in the Cilium community, eg via Slack.This was reported by a user in the Cilium community, eg via Slack.kind/featureThis introduces new functionality.This introduces new functionality.pinnedThese issues are not marked stale by our issue bot.These issues are not marked stale by our issue bot.
Proposal / RFE
Is your feature request related to a problem?
Yes
Describe the solution you'd like
Today cilium requires host reachable svc to enable bpf masquerading, the restriction is added in this commit.
The reason is that when hostns pods talking to clusterIP, kernel picks node IP as source IP but not cilium_host IP. The packets are still tunneled to remote backend. Due to #12544, the return packet is masqueraded on the remote node. The real fix should be letting kernel pick cilium_host IP for such traffic so that we have symmetric data path.
The feature is useful for kernel < 4.19 where people can enable bpf nodeport and masquerading while keep host-reachable-svc off in kubeproxy partial mode.
Proposal:
Passing a --cilium-host-route-cidr flag to cilium-agent and install a route based on that flag:
To make the implementation simpler, maybe we could always install this route when --cilium-host-route-cidr is passed regardless of other flags. So for whoever want to enable bpf masquerading without host-reachable-svc, he needs to pass --cilium-host-route-cidr