Mellanox / ovn-kubernetes / 39125553868

59%

Build Type

push

github

Committed by aserdean

Commit Message

feat: add option to disable SNAT on default gateway routers

Add a new --disable-snat-gateway-routers CLI flag
(env: OVN_DISABLE_SNAT_GATEWAY_ROUTERS) that disables default
cluster-subnet SNAT rules on gateway routers for the default network.

When enabled, OVN will not install SNAT rules that masquerade pod
traffic behind the node's external IP on gateway routers. This is
useful in deployments where pod CIDRs are externally routable (e.g.,
BGP-advertised) and SNAT would break return path routing.

Changes:
- config: add DisableSNATGatewayRouters bool to GatewayConfig and
  register the --disable-snat-gateway-routers CLI flag
- gateway: skip NAT rule installation in updateGWRouterNAT when the
  flag is set on the default network; stale NAT entries are still
  cleaned up on upgrade
- ovnkube.sh: wire OVN_DISABLE_SNAT_GATEWAY_ROUTERS into ovn-master,
  ovnkube-controller, ovnkube-controller-with-node, ovn-cluster-manager
  and ovn-node modes
- tests: add gateway_test case verifying no SNAT rules are created when
  the flag is set; update master_test skipSnat logic to cover the new flag

Signed-off-by: Hareesh Puthalath <hareeshp@nvidia.com>
(cherry picked from commit d8e8aa510)

Coverage Stats

5 of 5 new or added lines in 1 file covered. (100.0%)

14 existing lines in 5 files now uncovered.

57038 of 96125 relevant lines covered (59.34%)

315.17 hits per line