bpf: Don't resolve remote cluster NodePort services at the source#41337
Merged
bpf: Don't resolve remote cluster NodePort services at the source#41337
Conversation
e91ed1a to
288cfb2
Compare
35a5274 to
4d616e8
Compare
In the subsequent commit, we will need to know if a remote node is in the local or not. This commit therefore adds a new flag to the ipcache value, to indicate whether a node IP address belongs to a remote cluster node. This flag is only defined for nodes at the moment and remains unset for remote cluster pods. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
We currently have a bug when using socket-level load balancing (part of KPR) with Clustermesh. When we have the same non-global service existing on two clusters A and B, if we try to reach the B version from cluster A, we end up with an answer from the A version. We don't have a way to distinguish between remote node IPs belonging to the local or to a remote cluster. Hence, when the VIP is a remote node IP, we perform a wildcard lookup (0.0.0.0) and find the local service as a result. The previous commit introduces a way to distinguish between local and remote cluster node IP address, via the ipcache. This commit therefore uses it to only perform a wildcard lookup if the VIP is remote node IP belonging to the local cluster. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
4d616e8 to
84d8782
Compare
2 tasks
Merged
YutaroHayakawa
approved these changes
Sep 3, 2025
squeed
approved these changes
Sep 8, 2025
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request fixes a bug in clustermesh mode that causes us to redirect requests to the wrong NodePort service when the same NodePort service exists on a remote and the local clusters. The first commit adds a new ipcache flag to indicate that a node is in a remote cluster. The second commit uses the new flag to skip load balancing at the source for this case. See commits for details.
Fixes: #24692.