-
Notifications
You must be signed in to change notification settings - Fork 3.4k
Closed
Labels
area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.Impacts bpf/ or low-level forwarding details, including map management and monitor messages.area/encryptionImpacts encryption support such as IPSec, WireGuard, or kTLS.Impacts encryption support such as IPSec, WireGuard, or kTLS.area/proxyImpacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.Impacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.feature/ipsecRelates to Cilium's IPsec featureRelates to Cilium's IPsec featurefeature/ipv6Relates to IPv6 protocol supportRelates to IPv6 protocol supportneeds/triageThis issue requires triaging to establish severity and next steps.This issue requires triaging to establish severity and next steps.
Description
After fixing the MTU issue when having IPSec with both in+egress proxy in #35173, we enabled the pod-to-pod-with-l7-policy-encryption
test for IPv4. When trying to enable also the test for IPv6, we see a flaky behavior:
- native routing: after the MTU patch, no problems are encountered and the tests execute smoothly.
- overlay mode: either with or without the MTU patch, enabling the tests would cause a plain-test TCP RST packet to be leaked when using VxLan as overlay. This behavior is probably unrelated to the MTU patch and should be related only to CI and not to the whole IPv6 functioning. A guessing would be that bpftrace is still monitoring looking for plain-text packets while tearing down Cilium and something's probably happening in between.
As discussed in the previous MTU issue, the failing tests seems randomly happen with kernels rhel8-20240404.144247
, 5.15-20240710.064909
, and bpf-next-20240711.013133
. Testing with Geneve is ok, while with VXLan there's this problem.
Metadata
Metadata
Assignees
Labels
area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.Impacts bpf/ or low-level forwarding details, including map management and monitor messages.area/encryptionImpacts encryption support such as IPSec, WireGuard, or kTLS.Impacts encryption support such as IPSec, WireGuard, or kTLS.area/proxyImpacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.Impacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.feature/ipsecRelates to Cilium's IPsec featureRelates to Cilium's IPsec featurefeature/ipv6Relates to IPv6 protocol supportRelates to IPv6 protocol supportneeds/triageThis issue requires triaging to establish severity and next steps.This issue requires triaging to establish severity and next steps.