kubeovn / kube-ovn / 29721904854

28%

Build Type

push

github

Committed by web-flow

Commit Message

feat: support share type iptables DNAT with nft map-based LB (#6858)

Add 'type' field to IptablesDnatRule CRD to support two modes:
- exclusive (default): EIP:Port is exclusively used by one DNAT rule,
  using iptables DNAT for 1:1 mapping (existing behavior)
- share: Multiple DNAT rules can share the same EIP:Port, using
  nftables map-based DNAT with jhash for load balancing
- refact as kube-proxy nft

fix: use @ as backend separator in nft-dnat-map to avoid shell ; interpretation

When execNatGwRules passes the backend list to the nat-gateway pod via the
Kubernetes exec API, semicolons in the argument string are interpreted as
shell command separators by the container runtime's exec path, causing the
second backend (e.g. 10.0.0.4:80) to be treated as a standalone command
and fail with 'command not found'.

Replace the backend separator from ';' to '@' in both the Go controller
(strings.Join) and the shell script (IFS parsing). The '@' character is
never a shell command separator and does not appear in ip:port strings,
making it safe across all exec paths.

fix: reject port 0 in dnat webhook and clarify share dnat comments

- webhook ValidateIptablesDnat: use util.ValidatePort (1-65535) so port 0
  is rejected, aligning admission with controller-side validation
- add webhook unit test covering dnat port validation boundaries
- clarify backend separator is '@' (not ';') in nft_dnat.go and nat-gateway.sh
- document informer-cache lag self-heal in getShareBackends
- document conntrack rehash behavior in cleanupShareDnatInPod

docs: describe share dnat as numgen random, not jhash

The gateway script generates 'numgen random mod N map { backends }', which is
per-connection random distribution pinned by conntrack, not jhash/source-affinity.
Align the API annotations and controller comments with the actual implementation
to avoid misleading maintainers. Regenerate CRDs accordingly.

docs: add TODO for source-IP session affinity in share dnat

Backends are... (continued)

Coverage Stats

93 of 282 new or added lines in 3 files covered. (32.98%)

2 existing lines in 1 file now uncovered.

16943 of 60916 relevant lines covered (27.81%)

0.32 hits per line