Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Detect local traffic using interface #95400

Merged
merged 3 commits into from Mar 28, 2022
Merged

Detect local traffic using interface #95400

merged 3 commits into from Mar 28, 2022

Conversation

tssurya
Copy link
Contributor

@tssurya tssurya commented Oct 8, 2020 •
edited

What type of PR is this?

/kind feature

What this PR does / why we need it:

Implements the detection of local traffic using an interface parameter as outlined in the KEP: https://github.com/kubernetes/enhancements/blob/0e4d5df19d396511fe41ed0860b0ab9b96f46a2d/keps/sig-network/2450-Remove-knowledge-of-pod-cluster-CIDR-from-iptables-rules/README.md#iptables---masquerade-off-cluster-traffic-to-services-by-node-ip

Special notes for your reviewer:

Though the KEP outlines an interface parameter to accept multiple prefixes, for now we are sticking to accepting a single string argument. In future when we change --cluster-cidr and --node-cidr to accept multiple values, we can also change --pod-interface-name-prefix and --pod-bridge-interfaceto accept multiple values.

Does this PR introduce a user-facing change?:
yes

Adds support for "InterfaceNamePrefix" and "BridgeInterface" as arguments to --detect-local-mode option and also introduces a new optional `--pod-interface-name-prefix` and `--pod-bridge-interface` flags to kube-proxy.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:
[KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/20191104-iptables-no-cluster-cidr.md#proposal

Adds support for "BridgeInterface" and "InterfaceNamePrefix" as arguments to `--detect-local-mode` option and also introduces two new optional `--pod-interface-name-prefix` and `--pod-bridge-interface` flags to kube-proxy-config to avail the new local detector modes.

/sig network

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. sig/network Categorizes an issue or PR as relevant to SIG Network. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 8, 2020
@k8s-ci-robot
Copy link
Contributor

Hi @tssurya. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label Oct 8, 2020
@fejta-bot
Copy link

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

@aojea
Copy link
Member

aojea commented Oct 9, 2020

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 9, 2020
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 7, 2021
@tssurya
Copy link
Contributor Author

tssurya commented Feb 4, 2021

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 4, 2021
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 5, 2021
@aojea
Copy link
Member

aojea commented May 10, 2021

/remove-lifecycle stale
@tssurya if you need some help or want to hand it over let me know, I have some people asking for some areas to help and this seems a good candidate

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 10, 2021
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 8, 2021
@tssurya
Copy link
Contributor Author

tssurya commented Aug 9, 2021

/remove-lifecycle stale
@tssurya if you need some help or want to hand it over let me know, I have some people asking for some areas to help and this seems a good candidate

oh no, sorry yea at this point I know what needs to be done here, wasn't on the priority radar. I'll pick this up and rebase.

@tssurya
Copy link
Contributor Author

tssurya commented Aug 9, 2021

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 9, 2021
@tssurya tssurya force-pushed the detect-local-traffic-using-interface branch from 3cf4010 to 5e97d75 Compare March 25, 2022 18:24
@tssurya
Copy link
Contributor Author

tssurya commented Mar 25, 2022

waiting for CI to be green...

@tssurya
Copy link
Contributor Author

tssurya commented Mar 25, 2022

/remove-area cloudprovider

@tssurya
Copy link
Contributor Author

tssurya commented Mar 25, 2022

/remove-sig cloud-provider

@k8s-ci-robot k8s-ci-robot removed the sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. label Mar 25, 2022
tssurya and others added 3 commits March 25, 2022 20:06
@tssurya
Local Traffic Detector: Add two new modes
5632991 
This PR introduces two new modes for detecting
local traffic in a cluster.
1) detectLocalByBridgeInterface: This takes a bridge name
as argument and decides all traffic that match on their
originating interface being that of this bridge, shall be
considered as local pod traffic.
2) detectLocalByInterfaceNamePrefix: This takes an interface prefix
name as argument and decides all traffic that match on their
originating interface names having a prefix that matches this
argument shall be considered as local pod traffic.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
@tssurya
Enable local traffic detection using the interface options
7d480d8 
This commit adds the framework for the new local detection
modes BridgeInterface and InterfaceNamePrefix to work.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
@tssurya @wedaly
Add validation for bridge-interface and interface-name-prefix
1ea5f94 
Co-authored-by: Will Daly <widaly@microsoft.com>
Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
@tssurya tssurya force-pushed the detect-local-traffic-using-interface branch from 5e97d75 to 1ea5f94 Compare March 25, 2022 19:07
thockin
thockin reviewed Mar 25, 2022
View reviewed changes
Copy link
Member

@thockin thockin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 25, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aojea, danwinship, thockin, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 25, 2022
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Mar 25, 2022 •
edited

@tssurya: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-kubernetes-bazel-test 49a42daa77fc1a0b893c3731a345c054c4068a15 link /test pull-kubernetes-bazel-test
pull-kubernetes-e2e-capz-conformance 75a465ab3f1c1b9d784ed624e98b6bcc76d4b8b6 link false /test pull-kubernetes-e2e-capz-conformance
pull-kubernetes-e2e-capz-azure-disk-vmss 75a465ab3f1c1b9d784ed624e98b6bcc76d4b8b6 link false /test pull-kubernetes-e2e-capz-azure-disk-vmss
pull-kubernetes-e2e-capz-azure-file-vmss 75a465ab3f1c1b9d784ed624e98b6bcc76d4b8b6 link false /test pull-kubernetes-e2e-capz-azure-file-vmss
pull-kubernetes-e2e-capz-azure-disk 75a465ab3f1c1b9d784ed624e98b6bcc76d4b8b6 link false /test pull-kubernetes-e2e-capz-azure-disk
pull-kubernetes-e2e-capz-azure-file 75a465ab3f1c1b9d784ed624e98b6bcc76d4b8b6 link false /test pull-kubernetes-e2e-capz-azure-file

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@tssurya
Copy link
Contributor Author

tssurya commented Mar 25, 2022

@khenidak : are you ok with removing the hold?

@tssurya
Copy link
Contributor Author

tssurya commented Mar 28, 2022

/hold cancel
based on the lgtms

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 28, 2022
@tssurya
Copy link
Contributor Author

tssurya commented Mar 28, 2022

/test pull-kubernetes-e2e-kind-ipv6

@tssurya
Copy link
Contributor Author

tssurya commented Mar 28, 2022

/test pull-kubernetes-integration

@k8s-ci-robot k8s-ci-robot merged commit 922ccde into kubernetes:master Mar 28, 2022
@k8s-ci-robot k8s-ci-robot added this to the v1.24 milestone Mar 28, 2022
wedaly pushed a commit to wedaly/kubernetes that referenced this pull request Mar 28, 2022
@k8s-ci-robot @wedaly
Merge pull request kubernetes#95400 from tssurya/detect-local-traffic…
b1ee49c 
…-using-interface

Detect local traffic using interface
@github-actions github-actions bot mentioned this pull request Mar 29, 2022
Open
@cici37
Copy link
Contributor

cici37 commented Mar 29, 2022

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 29, 2022
@wedaly wedaly mentioned this pull request Mar 31, 2022
Closed
@tssurya tssurya mentioned this pull request Sep 6, 2022
Closed
9 tasks
@ganeshkumarashok ganeshkumarashok mentioned this pull request Jan 13, 2023
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wedaly wedaly wedaly left review comments

@thockin thockin thockin left review comments

@aojea aojea aojea left review comments

@freehan freehan Awaiting requested review from freehan

@smarterclayton smarterclayton Awaiting requested review from smarterclayton

@danwinship danwinship Awaiting requested review from danwinship

Assignees

@danwinship danwinship

@thockin thockin

@aojea aojea

@khenidak khenidak

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/code-generation cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/network Categorizes an issue or PR as relevant to SIG Network. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.24
Development

Successfully merging this pull request may close these issues.

None yet