Flexible pipeline #3058
Flexible pipeline #3058
Conversation
|
/test-all-features-conformance |
hongliangl
changed the title
Codecov Report
@@ Coverage Diff @@
## main #3058 +/- ##
==========================================
- Coverage 65.55% 64.55% -1.01%
==========================================
Files 268 276 +8
Lines 26909 27117 +208
==========================================
- Hits 17641 17505 -136
- Misses 7346 7753 +407
+ Partials 1922 1859 -63
Flags with carried forward coverage won't be shown. Click here to find out more.
|
hongliangl
force-pushed
the
flexible_pipeline_all
branch
3 times, most recently
from
59c7335 to
91e1c02
Compare
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
51bb52b to
4faf6a1
Compare
hongliangl
changed the title
hongliangl
requested review from
wenyingd,
jianjuns,
gran-vmv,
antoninbas,
tnqn,
lzhecheng,
Dyanngg and
luolanzone
and removed request for
wenyingd
There was a problem hiding this comment.
looks like you need to update all commits' title, #1 linked to the issue in Antrea which is misleading information.
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
4faf6a1 to
d79caca
Compare
updated |
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
104ac96 to
6554840
Compare
There was a problem hiding this comment.
@hongliangl : I assume you will address comments on individual PRs too? For example, comments on #3035.
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
168f17b to
a748070
Compare
|
/test-flexible-ipam-e2e |
|
A general question on debuggability: It used to be the case that we can use table number in OVS dumps to find the specific flows (e.g. for a ACNP ingress rule, |
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
a748070 to
7dab284
Compare
|
/test-windows-networkpolicy |
|
/test-windows-networkpolicy |
3 similar comments
|
/test-windows-networkpolicy |
|
/test-windows-networkpolicy |
|
/test-windows-networkpolicy |
|
Do we know if "jenkins-windows-networkpolicy" failure is related? |
I'm finding the reason. |
|
/test-windows-networkpolicy |
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
16f813d to
020c35b
Compare
|
/test-windows-networkpolicy |
1 similar comment
|
/test-windows-networkpolicy |
Flexible Pipeline is framework to generate OVS pipelines with dynamic
table IDs. There are some abstractions introduced in this framework:
- **feature** is the interface to program a major function in Antrea
data path
- **stage** in FlexiblePipeline is used to group tables which implement
similar functions in a pipeline
- **pipeline** is used to implement a major function in Antrea data
path
- **Table** is the basic unit to build OVS pipelines. A Table can be
referenced by one or more features, but its member struct ofTable
will be initialized and realized on OVS only when it is referenced
by any activated features
At this moment, we have the following features:
- featurePodConnectivity, implementation of connectivity for Pods,
activated by default
- featureNetworkPolicy, implementation of K8s NetworkPolicy and Antrea
NetworkPolicy, activated by default
- featureService, implementation of K8s Service, activated by default
- featureEgress, implementation of Egress, activation is determined by
feature gate Egress
- featureMulticast, implementation of multicast, activation is
determined by feature gate Multicast
At this moment, we have the following stages:
- stageStart is only used to initialize PipelineClassifierTable
- stageClassifier is used to classify packets "category" (tunnel, local
gateway or local Pod, etc)
- stageValidation is used to validate packets
- stageConntrackState is used to transform committed packets in CT zones
- stagePreRouting is similar to PREROUTING chain of nat table in iptables
DNAT for Service connections is performed in this stage
- stageEgressSecurity is used to install egress rules for K8s
NetworkPolicy and Antrea NetworkPolicy
- stageRouting is used to implement L3 Forwarding of packets.
- stagePostRouting is similar to POSTROUTING chain of nat table in
iptables. SNAT for Service connections is performed in this stage
- stageSwitching is used to implement L2 Forwarding of packets
- stageIngressSecurity is used to install ingress rules for K8s
NetworkPolicy and Antrea NetworkPolicy
- stageConntrack is used to commit non-Service connections
- stageOutput is used to output packets to target port
At this moment, we have the following pipelines:
- pipelineRoot is only used to initialize PipelineClassifierTable
- pipelineARP is used to process ARP packets
- pipelineIP is used to process IPv4/IPv6 packets
- pipelineMulticast is used to process multicast packets
After refactoring, PipelineClassifierTable is table 0. It's the only
fixed table ID. Packets are forwarded to different pipelines in this
table.
OVS pipelineARP is used to process ARP packets. Stages and tables
in this pipeline:
- stageValidation
- ARPSpoofGuardTable, ARP-spoofing part of original SpoofGuardTable
- stageOutput
- ARPResponderTable, renamed from arpResponderTable
OVS pipelineIP is used to process IPv4/IPv6 packets. Stages and
tables in this pipelines
- stageClassifier
- ClassifierTable, original ClassifierTable (0)
- stageValidation
- SpoofGuardTable, part of original SpoofGuardTable (10)
- IPv6Table, original IPv6Table (21)
- IPClassifierTable, new added for multicast
- stageConntrackState
- SNATConntrackTable, original ServiceConntrackTable (35)
- ConntrackTable, original ConntrackTable (30)
- ConntrackStateTable, original ConntrackStateTable (31)
- stagePreRouting
- PreRoutingClassifierTable, new added
- NodePortMarkTable, original ServiceClassifierTable (35)
- SessionAffinityTable, original SessionAffinityTable (41)
- ServiceLBTable, original ServiceLBTable (41)
- EndpointDNATTable, original EndpointDNATTable (42)
- DNATTable, original DNATTable (40)
- stageEgressSecurity
- AntreaPolicyEgressRuleTable, original AntreaPolicyEgressRuleTable
(45)
- EgressRuleTable, original EgressRuleTable (50)
- EgressDefaultTable, original EgressDefaultTable (60)
- EgressMetricTable, original EgressMetricTable (61)
- stageRouting
- L3ForwardingTable, original L3ForwardingTable (70)
- EgressMarkTable, original SNATTable (71)
- L3DecTTLTable, original L3DecTTLTable (72)
- stagePostRouting
- ServiceMarkTable, new added
- SNATConntrackCommitTable, origin ServiceConntrackCommitTable
(105)
- stageSwitching
- L2ForwardingCalcTable, original L2ForwardingCalcTable (80)
- stageIngressSecurity
- IngressSecurityClassifierTable, new added
- AntreaPolicyIngressRuleTable, original AntreaPolicyIngressRuleTable
(85)
- IngressRuleTable, original IngressRuleTable (90)
- IngressDefaultTable, original IngressDefaultTable (100)
- IngressMetricTable, original IngressDefaultTable (101)
- stageConntrack
- ConntrackCommitTable, original ConntrackCommitTable (105)
- stageOutput
- L2ForwardingOutTable, original L2ForwardingOutTable (110)
OVS pipelineMulticast is used to process multicast packets.
Stages and tables in this pipeline:
- stageRouting
- MulticastTable, original MulticastTable (22)
Removed tables:
- original ServiceHairpinTable (22)
- original DefaultTierEgressRuleTable (49)
- original HairpinSNATTable (108)
For hairpin connection, SNAT is performed by CT operation instead of
modifying source IP stateless. Another change is to use different IPs
to perform SNAT:
- Hairpin Service connection initiated through a local Pod, and SNAT
is performed with the Antrea gateway IP.
- Hairpin Service connection initiated through the Antrea gateway,
and SNAT is performed with a virtual IP.
Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
hongliangl
force-pushed
the
flexible_pipeline_all
branch
from
020c35b to
7b8495f
Compare
|
/test-all-features-conformance |
|
/test-windows-e2e |
|
/test-ipv6-conformance |
|
/test-flexible-ipam-e2e |
|
/test-integration |
1 similar comment
|
/test-integration |
|
/test-ipv6-e2e |
|
Thanks everyone for review this big PR! |
|
Congrats! @hongliangl |
Flexible Pipeline is framework to generate OVS pipelines with dynamic
table IDs. There are some abstractions introduced in this framework:
data path
similar functions in a pipeline
path
referenced by one or more features, but its member struct ofTable
will be initialized and realized on OVS only when it is referenced
by any activated features
At this moment, we have the following features:
activated by default
NetworkPolicy, activated by default
feature gate Egress
determined by feature gate Multicast
At this moment, we have the following stages:
gateway or local Pod, etc)
DNAT for Service connections is performed in this stage
NetworkPolicy and Antrea NetworkPolicy
iptables. SNAT for Service connections is performed in this stage
NetworkPolicy and Antrea NetworkPolicy
At this moment, we have the following pipelines:
After refactoring, PipelineClassifierTable is table 0. It's the only
fixed table ID. Packets are forwarded to different pipelines in this
table.
OVS pipelineARP is used to process ARP packets. Stages and tables
in this pipeline:
OVS pipelineIP is used to process IPv4/IPv6 packets. Stages and
tables in this pipelines
(45)
(105)
(85)
OVS pipelineMulticast is used to process multicast packets.
Stages and tables in this pipeline:
Removed tables:
For hairpin connection, SNAT is performed by CT operation instead of
modifying source IP stateless. Another change is to use different IPs
to perform SNAT:
is performed with the Antrea gateway IP.
and SNAT is performed with a virtual IP.
Signed-off-by: Hongliang Liu lhongliang@vmware.com