Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CLI option to toggle disabling of source-dest-check in EC2 #541

Merged
merged 1 commit into from
Sep 22, 2018

Conversation

rjosephwright
Copy link
Contributor

When the number of nodes in a cluster is high enough, the
disableSourceDestinationCheck() logic creates a high number
of requests to EC2, resulting in throttling and subsequent
problems, such as the inability to attach EBS volumes. This is
not necessarily mitigated by the ec2IamAuthorized attribute
which was added to overcome this issue, as the number of
requests can still be high enough to reach Amazon's request
limits. In addition, it is not necessary to run this multiple
times in a loop for all the nodes in a cluster, as it is
sufficient to set it once when an instance boots.

This CLI option allows an administrator to turn off this
feature for kube-router so they can use some other means of
setting the attribute.

When the number of nodes in a cluster is high enough, the
`disableSourceDestinationCheck()` logic creates a high number
of requests to EC2, resulting in throttling and subsequent
problems, such as the inability to attach EBS volumes. This is
not necessarily mitigated by the `ec2IamAuthorized` attribute
which was added to overcome this issue, as the number of
requests can still be high enough to reach Amazon's request
limits. In addition, it is not necessary to run this multiple
times in a loop for all the nodes in a cluster, as it is
sufficient to set it once when an instance boots.

This CLI option allows an administrator to turn off this
feature for kube-router so they can use some other means of
setting the attribute.
@murali-reddy
Copy link
Member

murali-reddy commented Sep 22, 2018

thanks for the pr @rjosephwright

LGTM

Make sense for kube-router not do disable src-dst check forcefully

@murali-reddy murali-reddy merged commit 77459dd into cloudnativelabs:master Sep 22, 2018
@rjosephwright
Copy link
Contributor Author

Thanks @murali-reddy

rjosephwright added a commit to cloudboss/keights that referenced this pull request Sep 29, 2018
This will be used after kube-router releases a new version with
cloudnativelabs/kube-router#541, or when
using another CNI plugin.
rjosephwright added a commit to cloudboss/keights that referenced this pull request Sep 29, 2018
This will be used after kube-router releases a new version with
cloudnativelabs/kube-router#541, or when
using another CNI plugin.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants