Reinitialize datapath in case IP{v4,v6}NativeRoutingCIDR is updated #35624
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment was marked as outdated.
This comment was marked as outdated.
f8a57e8 to
f2e11e7
Compare
|
/test |
6983ed2 to
29bac1c
Compare
BPF Masquerading relies on IP{V4,V6}_SNAT_EXCLUSION_DST_CIDR datapath
config value to know which destination CIDRs should not be SNATed for
pod to pod traffic.
In case of IPAM modes "eni", "azure" or "alibabacloud", if
"ipv4-native-routing-cidr" is not explicitly set, the exclusion
destination CIDR is autodetected at runtime, specifically from the
relevant cloud provider Status section in the CiliumNode CRD.
In commit 50e42f1 the way that autodetection logic propagates that
value was changed and it now relies on the LocalNodeStore to emit an
update for the new IPv4 native routing CIDR value. But the datapath
still reads the value stored in the global config option variable, thus
it ignores the update from the autodetection logic.
To let the datapath configure the correct SNAT exclusion CIDR, let the
loader rely on the local node store read by the orchestrator, instead of
reading the global configuration options directly. This guarantees that
the datapath will be reinitialized in case of a runtime update to the
IPv4NativeRoutingCIDR following the autodetection.
Finally, to correctly reflect the current masquerading status in
`cilium-dbg status`, the exclusion CIDRs should be read from the local
node store instead of the possibly stale global configuration options.
Related: 50e42f1 ("node: Add ip{v4,v6} native routing CIDR")
Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
29bac1c to
022c4c8
Compare
|
/test |
gandro
approved these changes
Oct 30, 2024
dylandreimerink
approved these changes
Oct 30, 2024
|
Is there a test that exercises this logic? |
thorn3r
approved these changes
Nov 1, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
BPF Masquerading relies on IP{V4,V6}_SNAT_EXCLUSION_DST_CIDR datapath config value to know which destination CIDRs should not be SNATed for pod to pod traffic.
In case of IPAM modes "eni", "azure" or "alibabacloud", if "ipv4-native-routing-cidr" is not explicitly set, the exclusion destination CIDR is autodetected at runtime, specifically from the relevant cloud provider Status section in the CiliumNode CRD.
In commit 50e42f1 the way that autodetection logic propagates that value was changed and it now relies on the LocalNodeStore to emit an update for the new IPv4 native routing CIDR value. But the datapath still reads the value stored in the global config option variable, thus it ignores the update from the autodetection logic.
To let the datapath configure the correct SNAT exclusion CIDR, let the loader rely on the local node store read by the orchestrator, instead of reading the global configuration options directly.
This guarantees that the datapath will be reinitialized in case of a runtime update to the IPv4NativeRoutingCIDR following the autodetection.
Furthermore, update the
cilium statusoutput to reflect the actual masquerading status reading the native routing CIDRs from the local node store.