Commits on Jul 11, 2024

1. Ensure full functionality of AntreaProxy with proxyAll enabled when k… …

   …ube-proxy presents
   
   To ensure full functionality of AntreaProxy, except for handling ClusterIP from Nodes,
   even when kube-proxy in iptables mode is present, certain key changes are implemented
   when proxyAll is enabled:
   
   The jump rules for the chains managed by Antrea, `ANTREA-PREROUTING` and `ANTREA-OUTPUT`
   in nat table, are installed by inserting instead of appending to bypass the chain
   `KUBE-SERVICES` performing Service DNAT managed by kube-proxy. Antrea ensures that
   the jump rules take precedence over those managed by kube-proxy.
   
   The iptables rules of nat table chain `ANTREA-PREROUTING` are like below, and they are
   similar in chain `ANTREA-OUTPUT`.
   
   ```
   -A ANTREA-PREROUTING -m comment --comment "Antrea: DNAT external to NodePort packets" -m set --match-set ANTREA-NODEPORT-IP dst,dst -j DNAT --to-destination 169.254.0.252
   ```
   
   The rule is to DNAT NodePort traffic, bypassing chain `KUBE-SERVICES`.
   
   The iptables rules of raw table chains ANTREA-PREROUTING / ANTREA-OUTPUT are like
   below:
   
   ```
   1. -A ANTREA-PREROUTING -m comment --comment "Antrea: do not track incoming encapsulation packets" -m udp -p udp --dport 6081 -m addrtype --dst-type LOCAL -j NOTRACK
   2. -A ANTREA-PREROUTING -m comment --comment "Antrea: drop Pod multicast traffic forwarded via underlay network" -m set --match-set CLUSTER-NODE-IP src -d 224.0.0.0/4 -j DROP
   3. -A ANTREA-PREROUTING -m comment --comment "Antrea: do not track request packets destined to external IPs" -m set --match-set ANTREA-EXTERNAL-IP dst -j NOTRACK
   4. -A ANTREA-PREROUTING -m comment --comment "Antrea: do not track reply packets sourced from external IPs" -m set --match-set ANTREA-EXTERNAL-IP src -j NOTRACK
   5. -A ANTREA-OUTPUT -m comment --comment "Antrea: do not track request packets destined to external IPs" -m set --match-set ANTREA-EXTERNAL-IP dst -j NOTRACK
   ```
   
   - Rules 1-2 are not new rules.
   - Rule 3 is to bypass conntrack for packets sourced from external and destined to
     externalIPs, which also results in bypassing the chains managed by Antrea Proxy
     and kube-proxy in nat table.
   - Rule 4 is to bypass conntrack for packets sourced from externalIPs, which also
     results in bypassing the chains managed by Antrea Proxy and kube-proxy in nat
     table.
   - Rule 5 is to bypass conntrack for packets sourced from local and destined to
     externalIPs, which also results in bypassing the chains managed by Antrea Proxy
     and kube-proxy in nat table.
   
   The following are the benchmark results of a LoadBalancer Service configured with DSR mode.
   The results of TCP_STREAM and TCP_RR (single TCP connection) are almost the same as that
   before. The result of TCP_CRR (multiple TCP connections) performs better than before. One
   reason should be that conntrack is skipped for LoadBalancer Services.
   
   ```
   Test           v2.0 proxyAll     Dev proxyAll    Delta
   TCP_STREAM     4933.97           4918.35         -0.32%
   TCP_RR         8095.49           8032.4         -0.78%
   TCP_CRR        1645.66           1888.93         +14.79%
   ```
   
   Signed-off-by: Hongliang Liu <[email protected]>

   

   hongliangl committed Jul 11, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 48b8f7d
   • Browse repository at this point

   Copy the full SHA

   48b8f7d View commit details

   Browse the repository at this point in the history