Add an iptable rule to allow icmp for antrea-gw0 for NodeLatencyMonitor feature

[luolanzone]

Describe the problem/challenge you have

When I tried the NodeLatencyMonitor feature in a local testbed where the ICMP query is blocked by default, the feature will not work as expected because it relys on ICMP request to get the latency between Nodes.

Describe the solution you'd like

When I added an iptable rule 'iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT' on the Node, the feature is back to normal.
We can add a new rule to limit it to antrea-gw0 only with iptables -A INPUT -i antrea-gw0 -p icmp --icmp-type echo-request -j ACCEPT from Antrea side to make the feature work when the Node ICMP is blocked by default.

[Dhruv-J]

I was thinking there would be two workflows that we need to account for: one where the ICMP rule exists before the NodeLatencyMonitor is deployed, and the other for when the ICMP rule is applied after the NLM is already created. For the first case, I believe it would make the most sense to add the changes in the onNodeLatencyMonitorAdd() in pkg/agent/monitortool/monitor.go, where I would check if any ICMP rules exist, and add the iptable rule if they do. However, I had a question about the second workflow, as I see two possible ways of addressing the issue: Should I add a check in the NetworkPolicy controller that checks if an NLM exists whenever an ICMP rule is set? (that seems a bit messy for one edge case) My alternate solution was to add that iptable rule upon any invocation of onNodeLatencyMonitorAdd(). This seems a bit redundant if no ICMP rules are applied, but would allow for easier case handling in my opinion? I might be mistaken though, so what do you think @luolanzone ?

[luolanzone]

Hi @Dhruv-J Since we will only allow the ICMP for antrea specific interface antrea-gw0, I feel it should be OK to add it as long as the NodeLatencyMonitor feature is enabled.

@antoninbas @tnqn what's your suggestion?

[antoninbas]

In policyOnlyMode, we use the Node's transport IP for the ICMP probes:

antrea/pkg/agent/monitortool/latency_store.go

Line 149 in 1ee108b

func (s *LatencyStore) getNodeIPs(node *corev1.Node) ([]net.IP, error) {

So based on the mode, we could either use antrea-gw0 or the transport interface - assuming we want to filter based on the interface which sounds reasonable to me?

BTW, should we add an output filter rule as well for the sake of completeness?

I synced up with @Dhruv-J today - I think most of the changes should be in pkg/agent/route/.