TPROXY support with eBPF #9921

New issue

Copy link

New issue

Copy link

Open

Enhancement

Open

TPROXY support with eBPF#9921

Enhancement

Copy link

Labels

area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.Impacts bpf/ or low-level forwarding details, including map management and monitor messages.area/kernelRequires upstream work in the Linux kernel.Requires upstream work in the Linux kernel.area/proxyImpacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.Impacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.kind/featureThis introduces new functionality.This introduces new functionality.pinnedThese issues are not marked stale by our issue bot.These issues are not marked stale by our issue bot.

Description

tgraf

opened on Jan 21, 2020

Issue body actions

• Linux kernel support to work around skb_orphan()
  • Add tests
  • Validate against Cilium
  • Submit upstream
    • v1: lore, git tree
    • v2: lore, git tree
    • v3: lore, git tree
    • v4: lore, git tree
    • v5: lore, git tree
  • Work through upstream feedback
    • Will be part of Linux 5.7 release
• Linux support for UDP listen socket lookup
  • Add tests
  • Validate against Cilium
  • Submit upstream (part of complete set above)
• Debug pod->proxy->proxy->pod connectivity issue
  • RCA'd: Socket assign fails for traffic from the host (including egress proxy) towards ingress proxy due to restriction on sk_assign that it must execute on TC ingress.
• Cilium feature detection
• Cilium datapath support
• Extend connectivity test to validate proxy paths
• Integrate connectivity tests into regular CI runs
• Fix endpoint routes mode
• Replace xt_socket rule with eBPF implementation
• Validate with host firewall enabled (+policy)
• Support SO_REUSEPORT sockets
  • Additional kernel work required
  • v1: lore
  • v2: lore
  • Merged: lore, bpf-next git
  • Add userspace feature detection for SO_REUSEPORT bpf socket lookup to enable the feature

Metadata

Metadata

Assignees

No one assigned

Labels

area/datapathImpacts bpf/ or low-level forwarding details, including map management and monitor messages.Impacts bpf/ or low-level forwarding details, including map management and monitor messages.area/kernelRequires upstream work in the Linux kernel.Requires upstream work in the Linux kernel.area/proxyImpacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.Impacts proxy components, including DNS, Kafka, Envoy and/or XDS servers.kind/featureThis introduces new functionality.This introduces new functionality.pinnedThese issues are not marked stale by our issue bot.These issues are not marked stale by our issue bot.

Type

Enhancement

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions