Add CLI option to toggle disabling of source-dest-check in EC2

docs/user-guide.md

@@ -36,6 +36,7 @@ Usage of kube-router:
       --cleanup-config                   Cleanup iptables rules, ipvs, ipset configuration and exit.
       --cluster-asn uint                 ASN number under which cluster nodes will run iBGP.
       --cluster-cidr string              CIDR range of pods in the cluster. It is used to identify traffic originating from and destinated to pods.
+      --disable-source-dest-check        Disable the source-dest-check attribute for AWS EC2 instances. When this option is false, it must be set some other way. (default true)
       --enable-cni                       Enable CNI plugin. Disable if you want to use kube-router features alongside another CNI plugin. (default true)
       --enable-ibgp                      Enables peering with nodes with the same ASN, if disabled will only peer with external BGP peers (default true)
       --enable-overlay                   When enable-overlay set to true, IP-in-IP tunneling is used for pod-to-pod networking across nodes in different subnets. When set to false no tunneling is used and routing infrastrcture is expected to route traffic for pod-to-pod networking across nodes in different subnets (default true)

pkg/controllers/routing/bgp_peers.go

@@ -333,7 +333,7 @@ func (nrc *NetworkRoutingController) OnNodeUpdate(obj interface{}) {
 
 	// skip if first round of disableSourceDestinationCheck() is not done yet, this is to prevent
 	// all the nodes for all the node add update trying to perfrom disableSourceDestinationCheck
-	if nrc.initSrcDstCheckDone && nrc.ec2IamAuthorized {
+	if nrc.disableSrcDstCheck && nrc.initSrcDstCheckDone && nrc.ec2IamAuthorized {
 		nrc.disableSourceDestinationCheck()
 	}
 }

pkg/controllers/routing/network_routes_controller.go

@@ -90,6 +90,7 @@ type NetworkRoutingController struct {
 	bgpRRServer             bool
 	bgpClusterID            uint32
 	cniConfFile             string
+	disableSrcDstCheck      bool
 	initSrcDstCheckDone     bool
 	ec2IamAuthorized        bool
 	pathPrependAS           string
@@ -121,8 +122,10 @@ func (nrc *NetworkRoutingController) Run(healthChan chan<- *healthcheck.Controll
 	}
 
 	// In case of cluster provisioned on AWS disable source-destination check
-	nrc.disableSourceDestinationCheck()
-	nrc.initSrcDstCheckDone = true
+	if nrc.disableSrcDstCheck {
+		nrc.disableSourceDestinationCheck()
+		nrc.initSrcDstCheckDone = true
+	}
 
 	// enable IP forwarding for the packets coming in/out from the pods
 	err = nrc.enableForwarding()
@@ -789,6 +792,7 @@ func NewNetworkRoutingController(clientset kubernetes.Interface,
 	nrc.bgpRRClient = false
 	nrc.bgpRRServer = false
 	nrc.bgpServerStarted = false
+	nrc.disableSrcDstCheck = kubeRouterConfig.DisableSrcDstCheck
 	nrc.initSrcDstCheckDone = false
 
 	// lets start with assumption we hace necessary IAM creds to access EC2 api

pkg/options/options.go

@@ -21,6 +21,7 @@ type KubeRouterConfig struct {
 	CleanupConfig           bool
 	ClusterAsn              uint
 	ClusterCIDR             string
+	DisableSrcDstCheck      bool
 	EnableCNI               bool
 	EnableiBGP              bool
 	EnableOverlay           bool
@@ -144,4 +145,6 @@ func (s *KubeRouterConfig) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVarP(&s.VLevel, "v", "v", "0", "log level for V logs")
 	fs.Uint16Var(&s.HealthPort, "health-port", 20244, "Health check port, 0 = Disabled")
 	fs.BoolVar(&s.OverrideNextHop, "override-nexthop", false, "Override the next-hop in bgp routes sent to peers with the local ip.")
+	fs.BoolVar(&s.DisableSrcDstCheck, "disable-source-dest-check", true,
+		"Disable the source-dest-check attribute for AWS EC2 instances. When this option is false, it must be set some other way.")
 }