Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release-v3.28] Auto pick #8921: set RPF to strict as test provision for that. #8925

Conversation

tomastigera
Copy link
Contributor

Cherry pick of #8921 on release-v3.28.

#8921: set RPF to strict as test provision for that.

Original PR Body below

Description

[BPF] skip FIB when dest is unknown at HEP

* fix when CALI_ST_SKIP_FIB is set on the way to the host, set
  CALI_CT_FLAG_SKIP_FIB on conntrack - not just when from WEP

* add test for ^^^ and issue https://github.com/projectcalico/calico/issues/6450

* In addition to skipping FIB when there is no route to post-dnat
  destination, also skip FIB when there is a route, but it is not local
  while there was no service involved. In that case, we are not
  forwarding a service (NodePort) to another node and we should only
  forward locally. Let the host decide what to do with such a packet.

[BPF/UT] set RPF to strict as test provision for that.

Make tests execute the path again after we introduced the option to
disable RPF.

Fixes #8918

Related issues/PRs

Todos

  • Tests
  • Documentation
  • Release note

Release Note

ebpf: fix - let the node handle packet when we are not sure about the destination

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

  • docs-pr-required: This change requires a change to the documentation that has not been completed yet.
  • docs-completed: This change has all necessary documentation completed.
  • docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

  • release-note-required: This PR has user-facing changes. Most PRs should have this label.
  • release-note-not-required: This PR has no user-facing changes.

Other optional labels:

  • cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
  • needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

Make tests execute the path again after we introduced the option to
disable RPF.
* fix when CALI_ST_SKIP_FIB is set on the way to the host, set
  CALI_CT_FLAG_SKIP_FIB on conntrack - not just when from WEP

* add test for ^^^ and issue projectcalico#6450

* In addition to skipping FIB when there is no route to post-dnat
  destination, also skip FIB when there is a route, but it is not local
  while there was no service involved. In that case, we are not
  forwarding a service (NodePort) to another node and we should only
  forward locally. Let the host decide what to do with such a packet.

Fixes projectcalico#8918
@tomastigera tomastigera requested a review from a team as a code owner June 18, 2024 15:38
@tomastigera tomastigera added release-note-required Change has user-facing impact (no matter how small) docs-not-required Docs not required for this change merge-when-ready labels Jun 18, 2024
@marvin-tigera marvin-tigera added this to the Calico v3.28.1 milestone Jun 18, 2024
@tomastigera tomastigera merged commit ab25bc8 into projectcalico:release-v3.28 Jun 18, 2024
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs-not-required Docs not required for this change merge-when-ready release-note-required Change has user-facing impact (no matter how small)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants