search

kubeovn / kube-ovn

A Bridge between SDN and Cloud Native (Project under CNCF)
https://kubeovn.github.io/docs/stable/en/
Apache License 2.0
1.87k stars 433 forks source link

[BUG] when vm1 stop , vm2 in cluster send arp request to the stop vm1，ovn will send arp response to vm2 with vm1's arp #4145

Open changluyi opened 3 weeks ago

changluyi commented 3 weeks ago

Kube-OVN Version

1.13.0

Kubernetes Version

v1.26.1

Operation-system/Kernel Version

Linux bogon 3.10.0-1160.83.1.el7.x86_64

Description

This behavior doesn’t feel very common sense. when vm1 is stopped, vm2 ping the stopped VM's IP, He can still get the arp of vm2

Steps To Reproduce

it can also reproduce in a kind cluster

  1. make kind-init && make kind-install-underlay
  2. delete one kube-ovn-pinger's pod's netns's host nic 'xxxxxxxxxxx_h' forcefully, and delete the pod related netns with command 'ip netns del {ns}'
  3. ping the kube-ovn-pinger pod that was deleted forcefully

Current Behavior

can get the arp response from the ovn.

Expected Behavior

can't get the arp response from ovn.

changluyi commented 3 weeks ago

the reason is that , when vm is stopped , the lsp is not deleted yet. then the flow related is also existed 企业微信截图_17180962966366

when other pod send arp request， ovn will do arp proxy response image

zhangzujian commented 2 weeks ago

OVN Post v24.03.0

zhangzujian commented 2 weeks ago

In NB_Global table:

options : ignore_lsp_down: optional string
    If set to false, ARP/ND reply flows for logical switch
    ports will be installed only if the port is up, i.e.
    claimed by a Chassis. If set to true, these flows are
    installed regardless of the status of the port, which can
    result in a situation that ARP request to an IP is
    resolved even before the relevant VM/container is running.
    For environments where this is not an issue, setting it to
    true can reduce the load and latency of the control plane.
    The default value is true.

In Logical_Switch_Port table:

enabled: optional boolean
    This column is used to administratively set port state. If
    this column is empty or is set to true, the port is
    enabled. If this column is set to false, the port is
    disabled. A disabled port has all ingress and egress
    traffic dropped.