Skip to content

Conversation

julianwiedmann
Copy link
Member

Test for #37192.

saiaunghlyanhtet and others added 2 commits March 25, 2025 15:55
Signed-off-by: saiaunghlyanhtet <saiaunghlyanhtet2003@gmail.com>
Remove the unrelated configs, and skip the upgrade step.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
@maintainer-s-little-helper maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Mar 25, 2025
@github-actions github-actions bot added the cilium-cli This PR contains changes related with cilium-cli label Mar 25, 2025
@julianwiedmann
Copy link
Member Author

/ci-e2e-upgrade

@julianwiedmann julianwiedmann added the release-note/misc This PR makes changes that have no direct user impact. label Mar 25, 2025
@maintainer-s-little-helper maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Mar 25, 2025
@julianwiedmann
Copy link
Member Author

/ci-e2e-upgrade

@julianwiedmann
Copy link
Member Author

@saiaunghlyanhtet @ysksuzuki looks like progress 😁. The two LRP configs that use the SocketLB are good now. The two configs that are still failing have SocketLB disabled for pods. Maybe that rings a bell for you, what might still go wrong?

@ysksuzuki
Copy link
Member

ysksuzuki commented Mar 25, 2025

@julianwiedmann @saiaunghlyanhtet
It looks like the SkipRedirectFromBackend=false case is failing. It's expecting to loopback, but we don't currently support IPv6 loopback. This seems to be an issue with the per-packet LB. #26733

Maybe we should skip ipv6 with per packet LB until we support the ipv6 loopback.

.  [.] Action [local-redirect-policy/lrp/curl-0-ipv6: cilium-test-1/lrp-backend-5dc456df96-fgf5n (fd00:10:244:3::bf3e) -> fd00::169:254:169:254:80/TCP (fd00::169:254:169:254:80)]
.  ❌ command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -6 -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null http://[fd00::169:254:169:254]:80" failed: command failed (pod=cilium-test-1/lrp-backend-5dc456df96-fgf5n, container=lrp-backend): command terminated with exit code 28
  ℹ️  curl stdout:
  :0 -> :0 = 000
  ℹ️  curl stderr:
  curl: (28) Failed to connect to fd00::169:254:169:254 port 80 after 2001 ms: Timeout was reached

@saiaunghlyanhtet
Copy link
Member

saiaunghlyanhtet commented Mar 25, 2025

@ysksuzuki @julianwiedmann
To skip IPv6 with per-packet LB, can I fix like the following this time? As I am currently working on IPv6 loopback, I will change this after the implementation of IPv6 loopback.

if ipFamily != features.IPFamilyV6 || s.skipRedirectFromBackEnd {
    // Tests LRP back-end pods to LRP front-end connectivity: traffic gets redirected
    // based on the configured skipRedirectFromBackEnd flag.
    for _, pod := range t.Context().LrpBackEndPods() {
        for _, policy := range policies {
            if policy.Spec.SkipRedirectFromBackEnd != s.skipRedirectFromBackEnd {
                continue
            }
            i := 0
            lf := check.NewLRPFrontend(policy.Spec.RedirectFrontend)
            t.NewAction(s, fmt.Sprintf("curl-%d-%s", i, ipFamily), &pod, lf, ipFamily).Run(func(a *check.Action) {
                a.ExecInPod(ctx, a.CurlCommand(lf))
                if policy.Spec.SkipRedirectFromBackEnd {
                    a.ValidateFlows(ctx, pod, a.GetEgressRequirements(check.FlowParameters{
                        RSTAllowed: true,
                    }))
                }
                i++
            })
        }
    }
}

@julianwiedmann
Copy link
Member Author

To skip IPv6 with per-packet LB, can I fix like the following this time? As I am currently working on IPv6 loopback, I will change this after the implementation of IPv6 loopback.

Would be nice if you could make use of isSocketLBFull(), and filter the IPv6 test out in exactly the problematic scenario.

@saiaunghlyanhtet
Copy link
Member

To skip IPv6 with per-packet LB, can I fix like the following this time? As I am currently working on IPv6 loopback, I will change this after the implementation of IPv6 loopback.

Would be nice if you could make use of isSocketLBFull(), and filter the IPv6 test out in exactly the problematic scenario.

Thank you for pointing that out. Fixed it.

@julianwiedmann julianwiedmann deleted the pr/jwi/main/cilium-cli/ipv6-conn-test-lrp branch April 8, 2025 06:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cilium-cli This PR contains changes related with cilium-cli release-note/misc This PR makes changes that have no direct user impact.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants