Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

let pod talk to node directly in ipvlan mode #207

Merged
merged 1 commit into from
May 20, 2021
Merged

let pod talk to node directly in ipvlan mode #207

merged 1 commit into from
May 20, 2021

Conversation

xh4n3
Copy link
Collaborator

@xh4n3 xh4n3 commented May 20, 2021

Currently when client at node connects to pod, SYN will be directly sent to pod network via ipvlan interface, without going out to VPC. But pod's SYN ACK packets are routed to VPC, instead of go to node directly. This is due to the current setting in the pod, and ipvlan module checks if host ip's MAC address is same as SYN ACK packets' target MAC address.

Now in the pod, we have

# route
default via 192.168.7.253 dev eth0 onlink
# ip neighbor
192.168.7.253 dev eth0 lladdr ee:ff:ff:ff:ff:ff REACHABLE

A SYN ACK packet to the node will be tagged ee:ff:ff:ff:ff:ff as dest MAC address, not match ipvlan's mac address, so this traffic will not be regards as in-vlan traffic.
https://elixir.bootlin.com/linux/v4.4/source/drivers/net/ipvlan/ipvlan_core.c#L506

In this PR, we create a route for node ip, so mac address will not be ee:ff:ff:ff:ff:ff, at the same time, we will bind host ip's mac address as same as ipvlan's mac address. this is due to NOARP is set on the ipvlan interface.

After this PR, we can see below

[root@host bin]# nsenter -n/var/run/docker/netns/ab084f984d4d ip route
default via 192.168.7.253 dev eth0 onlink
192.168.0.140 dev eth0 scope link <--- new
192.168.4.0/22 dev eth0 proto kernel scope link src 192.168.7.176
[root@host bin]# nsenter -n/var/run/docker/netns/ab084f984d4d ip neighbor
192.168.7.253 dev eth0 lladdr ee:ff:ff:ff:ff:ff REACHABLE
192.168.0.140 dev eth0 lladdr 00:16:3e:0b:f6:8c PERMANENT <--- new

@codecov-commenter
Copy link

codecov-commenter commented May 20, 2021

Codecov Report

Merging #207 (fbccc42) into main (1159252) will decrease coverage by 0.04%.
The diff coverage is 0.00%.

Impacted file tree graph

@@           Coverage Diff            @@
##            main    #207      +/-   ##
========================================
- Coverage   6.05%   6.00%   -0.05%     
========================================
  Files         52      52              
  Lines       7073    7124      +51     
========================================
  Hits         428     428              
- Misses      6616    6667      +51     
  Partials      29      29              
Impacted Files Coverage Δ
plugin/driver/ipvlan.go 0.00% <0.00%> (ø)
plugin/driver/utils.go 1.97% <0.00%> (-0.27%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1159252...fbccc42. Read the comment docs.

@xh4n3 xh4n3 mentioned this pull request May 20, 2021
@xh4n3
Copy link
Collaborator Author

xh4n3 commented May 20, 2021

@l1b0k I modified the EnsureDefaultRoute a little bit, please have a look.

@xh4n3 xh4n3 requested review from l1b0k and BSWANG May 20, 2021 12:51
@BSWANG
Copy link
Member

BSWANG commented May 20, 2021

LGTM
ping @l1b0k

@l1b0k l1b0k merged commit 7ffa6e5 into AliyunContainerService:main May 20, 2021
Copy link
Collaborator

@l1b0k l1b0k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@l1b0k I modified the EnsureDefaultRoute a little bit, please have a look.

LGTM, thanks

plugin/driver/ipvlan.go Outdated Show resolved Hide resolved
@xh4n3 xh4n3 deleted the features/fix-ipvlan-pod-to-node-data-path branch May 21, 2021 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants