[unnumbered-ptp] Allow nodeports to work when routed to local pods

lyft / cni-ipvlan-vpc-k8s

AWS VPC Kubernetes CNI driver using IPvlan

Apache License 2.0

360 stars 58 forks source link

[unnumbered-ptp] Allow nodeports to work when routed to local pods #44

Closed lbernail closed 5 years ago

lbernail commented 6 years ago

Addresses #38

This implements the solution described in the issue for services using ExternalTrafficPolicy: Cluster This is not enough for ExternalTrafficPolicy: Local because in that case traffic is not SNATed on the host so the answer is not coming back on the veth interface.

We haven't tested it extensively yet but initial tests are OK. I'm opening the PR to discuss the design and see what you think about it

dbyron0 commented 5 years ago

We've been using this for months and would love to see it merged.

lbernail commented 5 years ago

Thanks for merging this, we've also been using this on large clusters for the last 6 months without any issue.

I also have a solution for ExternalTrafficPolicy: Local but it's a bit complicated because it relies on marking packets inside all pod network namespaces. You can see it here: https://github.com/DataDog/cni-ipvlan-vpc-k8s/compare/master...DataDog:feature/nodeports-local?expand=1

I can definitely create a PR (and maybe clean up the code a little) if you are interested @dbyron0