cilium / cilium / 10953
39%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 440
Run time 49s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 44.698% (-0.02%) from 44.718%
10953

push

travis-ci-com

ianvernon 
iptables: fix cilium_forward chain rules to support openshift

Currently, Cilium installs the following FORWARD rules in order to not having
the default DROP hit:

  Chain CILIUM_FORWARD (1 references)
   pkts bytes target     prot opt in     out     source               destination
  86416   41M ACCEPT     all  --  any    cilium_host  anywhere        anywhere             /* cilium: any->cluster on cilium_host forward accept */
  84939 4820K ACCEPT     all  --  lxc+   any     anywhere             anywhere             /* cilium: cluster->any on lxc+ forward accept */

While that seems to suffice, we've had a user running into upgrade problems
from Cilium v1.5 to v1.6. In v1.6 we've changed the second rule above from
the address allocation range to use lxc+ instead due to address allocation
changes in combination with ENI support where we cannot rely on a CIDR
anymore.

When I'm using standard kube-proxy where a nodeport request needs to go to
a remote backend, I'm seeing the following flow going through FORWARD:

Frontend node:

  [ 2986.808242] FWD:IN=eno1 OUT=cilium_host [...] SRC=178.197.248.15 DST=10.217.1.229 [...]
  [ 2986.808516] FWD:IN=cilium_host OUT=eno1 [...] SRC=10.217.1.229 DST=178.197.248.15 [...]
  [ 2986.810935] FWD:IN=eno1 OUT=cilium_host [...] SRC=178.197.248.15 DST=10.217.1.229 [...]
  [...]

Backend node:

  [43984.506569] FWD:IN=eno1 OUT=cilium_host [...] SRC=192.168.1.125 DST=10.217.1.225 [...]
  [43984.506612] FWD:IN=lxc2b0bd02ac4b2 OUT=eno1 [...] SRC=10.217.1.225 DST=192.168.1.125 [...]
  [43984.506654] FWD:IN=eno1 OUT=cilium_host [...] SRC=192.168.1.125 DST=10.217.1.34 [...]
  [...]

Above rules cover fully the backend traffic flow, but only partially the
frontend, meaning, the 'in:any out:cilium_host' only covers the original
request but not the replies. What happens here is that replies are going
through the KUBE-FORWARD chain where they match the 'kubernetes forwarding
conntrack pod source rule':

  Chain FORWARD (policy DRO... (continued)

25549 of 57159 relevant lines covered (44.7%)

1179.15 hits per line

Jobs
ID Job ID Ran Files Coverage
1 10953.1 0
44.7
 Travis Job 10953.1
Source Files on build 10953
Detailed source file information is not available for this build.