Attach to-wireguard to the tc egress of cilium_wg0 #33426
Merged
+1,090
−9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9840c37 to
a86eee6
Compare
a86eee6 to
b55bba8
Compare
|
Can't believe adding these trivial code leads to Edit: I think compiling to-wireguard independently can solve the problem by getting rid of |
f19e66f to
78e7a2a
Compare
78e7a2a to
15e53b5
Compare
bf2d8d5 to
46213e7
Compare
46213e7 to
a189b49
Compare
julianwiedmann
approved these changes
Jul 5, 2024
This is to handle rev-DNAT when L7 ingress proxy is enabled with wireguard, nodeport, native routing, and KPR. Consider a pod-to-remote-nodeport connection, the reply packet will pass: from_lxc@veth -> redirected to L7 proxy -> from_host@cilium_host -> to_host@cilium_net -> to_netdev@eth0 -> redirected to cilium_wg0. This patch ensures the new attached to-wireguard@cilium_wg0 can do the necessary rev-DNAT. Fixes: cilium#32899 Signed-off-by: gray <gray.liang@isovalent.com>
Signed-off-by: gray <gray.liang@isovalent.com>
|
BTW, with this PR merged, we can easily tackle:
From #23032. It will give us a few CPU cycles back 😎 |
MAX_WIREGUARD_OPTIONS and WIREGUARD_OPTIONS are set in a similar way to MAX_HOST_OPTIONS and HOST_OPTIONS, with ENABLE_IPSEC replaced by ENABLE_WIREGUARD. Signed-off-by: gray <gray.liang@isovalent.com>
The files are copied from bpf/complexity-tests/*/bpf_host/*.txt, followed by s/-DENABLE_IPSEC/-DENABLE_WIREGUARD/. Signed-off-by: gray <gray.liang@isovalent.com>
a189b49 to
2b3e1c6
Compare
|
/test |
1 task
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Nov 26, 2024
This was added with cilium#33426. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Nov 28, 2024
This was added with #33426. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
nbusseneau
pushed a commit
to nbusseneau/cilium
that referenced
this pull request
Dec 1, 2024
[ upstream commit 256684c ] This was added with cilium#33426. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
nbusseneau
pushed a commit
to nbusseneau/cilium
that referenced
this pull request
Dec 1, 2024
[ upstream commit 256684c ] This was added with cilium#33426. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is to handle rev-DNAT when L7 ingress proxy is enabled with wireguard, nodeport, native routing, and KPR.
Consider a pod-to-remote-nodeport connection via L7 ingress proxy, the reply packet will pass: from_lxc@veth -> redirected to L7 proxy -> from_host@cilium_host -> to_host@cilium_net -> to_netdev@eth0 -> redirected to cilium_wg0. This patch ensures the new attached to-wireguard@cilium_wg0 can do the necessary rev-DNAT in this case.
Fixes: #32899