Fail in Agent initialization if GRE tunnel type is used with IPv6 #3156
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
antoninbas
added
area/transit/encapsulation
Codecov Report
@@ Coverage Diff @@
## main #3156 +/- ##
===========================================
- Coverage 65.34% 45.81% -19.53%
===========================================
Files 268 345 +77
Lines 26901 38720 +11819
===========================================
+ Hits 17578 17740 +162
- Misses 7415 18873 +11458
- Partials 1908 2107 +199
Flags with carried forward coverage won't be shown. Click here to find out more.
|
jianjuns
previously approved these changes
Dec 21, 2021
antoninbas
force-pushed
the
fail-in-agent-initialization-if-using-gre-with-ipv6
branch
from
ce50ae7 to
23d8be1
Compare
|
/test-all |
tnqn
added
the
action/release-note
tnqn
reviewed
Mar 17, 2022
pkg/agent/agent.go
Outdated
| } | ||
| continue | ||
| } | ||
| if i.nodeConfig.PodIPv6CIDR != nil { | ||
| klog.Warningf("One IPv6 PodCIDR is already configured on this Node, ignore the IPv6 subnet CIDR %s", localSubnet.String()) | ||
| klog.InfoS("One IPv6 PodCIDR is already configured on this Node, ignore the IPv4 Subnet CIDR", "subnet", localSubnet) |
There was a problem hiding this comment.
Suggested change
| klog.InfoS("One IPv6 PodCIDR is already configured on this Node, ignore the IPv4 Subnet CIDR", "subnet", localSubnet) | |
| klog.InfoS("One IPv6 PodCIDR is already configured on this Node, ignore the IPv6 Subnet CIDR", "subnet", localSubnet) |
otherwise it would mean dual-stack is not supported.
There was a problem hiding this comment.
thanks, copy-paste error
The 'gre' tunnel type does not work for IPv6 overlays. The correct tunnel type for OVS would be 'ip6gre'. For dual-stack clusters with both an IPv4 and an IPv6 overlay, we would need 2 default tunnel ports: one for IPv4 (with type 'gre') and one for IPv6 (with type 'ip6gre'). This would add complexity (and require testing) as the code currently assumes a single default tunnel port. Rather than trying to support IPv6 with the added complexity that it entails, we choose to fail during Agent initialization for now if the user-provided tunnel type is 'gre' and the cluster supports IPv6. Note that this means that the default manifest for IPsec (antrea-ipsec.yml) cannot be used in an IPv6 cluster as the tunnel type defaults to GRE in that case. However, this is not new, and it is better to fail explicitly rather than have a cluster where the Agent appears to be running fine but there is no connectivity. See antrea-io#3150 Signed-off-by: Antonin Bas <abas@vmware.com>
antoninbas
force-pushed
the
fail-in-agent-initialization-if-using-gre-with-ipv6
branch
from
23d8be1 to
584782b
Compare
|
/test-all |
antoninbas
deleted the
fail-in-agent-initialization-if-using-gre-with-ipv6
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The 'gre' tunnel type does not work for IPv6 overlays. The correct
tunnel type for OVS would be 'ip6gre'. For dual-stack clusters with both
an IPv4 and an IPv6 overlay, we would need 2 default tunnel ports: one
for IPv4 (with type 'gre') and one for IPv6 (with type 'ip6gre'). This
would add complexity (and require testing) as the code currently assumes
a single default tunnel port. Rather than trying to support IPv6 with
the added complexity that it entails, we choose to fail during Agent
initialization for now if the user-provided tunnel type is 'gre' and the
cluster supports IPv6.
Note that this means that the default manifest for IPsec
(antrea-ipsec.yml) cannot be used in an IPv6 cluster as the tunnel type
defaults to GRE in that case. However, this is not new, and it is better
to fail explicitly rather than have a cluster where the Agent appears to
be running fine but there is no connectivity.
See #3150
Signed-off-by: Antonin Bas abas@vmware.com