Automated cherry pick of #3371: Fix inability to access NodePort in particular case#3397
Merged
tnqn merged 1 commit intoMar 7, 2022
Conversation
hongliangl
added
the
kind/cherry-pick
Codecov Report
@@ Coverage Diff @@
## release-1.5 #3397 +/- ##
===============================================
- Coverage 59.87% 52.21% -7.66%
===============================================
Files 332 464 +132
Lines 28495 54702 +26207
===============================================
+ Hits 17062 28565 +11503
- Misses 9547 23676 +14129
- Partials 1886 2461 +575
Flags with carried forward coverage won't be shown. Click here to find out more.
|
Contributor
Author
|
/test-all-features-conformance |
When a Service NodePort and an Egress CRD has the same backend Pod, accessing to the NodePort Service may fail in particular cases. Assume that the backend Pod is on Node A and the Egress's external IP is on Node B. If an external client (not any K8s Node) accesses the NodePort through IP of Node A where the backend Pod is running, the access will fail. The root cause is that the reply packets of NodePort is incorrectly matched by the flow installed by Egress which is used to match the packets sourced from local Pods and destined for tunneling to Node B. This PR fixes the issue by loading NXM_NX_REG0[0..3] (PktSourceField, field to mark packet source) to NXM_NX_CT_MARK[0..3] when Service connection is committed, then the reply packets of Service connection sourced from Antrea gateway can be matched by NXM_NX_CT_MARK[0..3] and forced back to Antrea gateway. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
hongliangl
force-pushed
the
automated-cherry-pick-of-#3371-upstream-release-1.5
branch
from
334dab3 to
eb362e0
Compare
Contributor
Author
|
/test-all-features-conformance |
tnqn
approved these changes
Mar 7, 2022
hongliangl
deleted the
automated-cherry-pick-of-#3371-upstream-release-1.5
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry pick of #3371 on release-1.5.
#3371: Fix inability to access NodePort in particular case
For details on the cherry pick process, see the cherry pick requests page.