let pod talk to node directly in ipvlan mode #207
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently when client at node connects to pod, SYN will be directly sent to pod network via ipvlan interface, without going out to VPC. But pod's SYN ACK packets are routed to VPC, instead of go to node directly. This is due to the current setting in the pod, and ipvlan module checks if host ip's MAC address is same as SYN ACK packets' target MAC address.
Now in the pod, we have
A SYN ACK packet to the node will be tagged ee:ff:ff:ff:ff:ff as dest MAC address, not match ipvlan's mac address, so this traffic will not be regards as in-vlan traffic.
https://elixir.bootlin.com/linux/v4.4/source/drivers/net/ipvlan/ipvlan_core.c#L506
In this PR, we create a route for node ip, so mac address will not be ee:ff:ff:ff:ff:ff, at the same time, we will bind host ip's mac address as same as ipvlan's mac address. this is due to NOARP is set on the ipvlan interface.
After this PR, we can see below