Disable TCP early demux when pod-eni is enabled

aws · Sep 16, 2020 · f5b056f · f5b056f
1 parent 0d3daa5
commit f5b056f
Show file tree

Hide file tree

Showing 6 changed files with 29 additions and 5 deletions.
diff --git a/config/master/aws-k8s-cni-cn.yaml b/config/master/aws-k8s-cni-cn.yaml
@@ -193,7 +193,10 @@
  "name": "xtables-lock"
  "hostNetwork": true
  "initContainers":
- - "image": "961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/amazon-k8s-cni-init:latest"
+ - "env":
+ - "name": "DISABLE_TCP_EARLY_DEMUX"
+ "value": "false"
+ "image": "961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/amazon-k8s-cni-init:latest"
  "imagePullPolicy": "Always"
  "name": "aws-vpc-cni-init"
  "securityContext":

diff --git a/config/master/aws-k8s-cni-us-gov-east-1.yaml b/config/master/aws-k8s-cni-us-gov-east-1.yaml
@@ -193,7 +193,10 @@
  "name": "xtables-lock"
  "hostNetwork": true
  "initContainers":
- - "image": "151742754352.dkr.ecr.us-gov-east-1.amazonaws.com/amazon-k8s-cni-init:latest"
+ - "env":
+ - "name": "DISABLE_TCP_EARLY_DEMUX"
+ "value": "false"
+ "image": "151742754352.dkr.ecr.us-gov-east-1.amazonaws.com/amazon-k8s-cni-init:latest"
  "imagePullPolicy": "Always"
  "name": "aws-vpc-cni-init"
  "securityContext":

diff --git a/config/master/aws-k8s-cni-us-gov-west-1.yaml b/config/master/aws-k8s-cni-us-gov-west-1.yaml
@@ -193,7 +193,10 @@
  "name": "xtables-lock"
  "hostNetwork": true
  "initContainers":
- - "image": "013241004608.dkr.ecr.us-gov-west-1.amazonaws.com/amazon-k8s-cni-init:latest"
+ - "env":
+ - "name": "DISABLE_TCP_EARLY_DEMUX"
+ "value": "false"
+ "image": "013241004608.dkr.ecr.us-gov-west-1.amazonaws.com/amazon-k8s-cni-init:latest"
  "imagePullPolicy": "Always"
  "name": "aws-vpc-cni-init"
  "securityContext":

diff --git a/config/master/aws-k8s-cni.yaml b/config/master/aws-k8s-cni.yaml
@@ -193,7 +193,10 @@
  "name": "xtables-lock"
  "hostNetwork": true
  "initContainers":
- - "image": "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni-init:latest"
+ - "env":
+ - "name": "DISABLE_TCP_EARLY_DEMUX"
+ "value": "false"
+ "image": "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni-init:latest"
  "imagePullPolicy": "Always"
  "name": "aws-vpc-cni-init"
  "securityContext":

diff --git a/config/master/manifests.jsonnet b/config/master/manifests.jsonnet
@@ -227,6 +227,11 @@ local awsnode = {
  image: "%s/amazon-k8s-cni-init:%s" % [$.ecrRepo, $.version],
  imagePullPolicy: "Always",
  securityContext: {privileged: true},
+ env: [
+ {
+ name: "DISABLE_TCP_EARLY_DEMUX", value: "false",
+ },
+ ],
  volumeMounts: [
  {mountPath: "/host/opt/cni/bin", name: "cni-bin-dir"},
  ],

diff --git a/scripts/init.sh b/scripts/init.sh
@@ -27,7 +27,14 @@ TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-meta
 HOST_IP=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-ipv4)
 PRIMARY_IF=$(ip -4 -o a | grep "$HOST_IP" | awk '{print $2}')
 sysctl -w "net.ipv4.conf.$PRIMARY_IF.rp_filter=2"
-
 cat "/proc/sys/net/ipv4/conf/$PRIMARY_IF/rp_filter"
 
+# Set DISABLE_TCP_EARLY_DEMUX to true to enable kubelet to pod-eni TCP communication
+# https://lwn.net/Articles/503420/ and https://github.com/aws/amazon-vpc-cni-k8s/pull/1212 for background
+if [ "${DISABLE_TCP_EARLY_DEMUX:-false}" == "true" ]; then
+ sysctl -w "net.ipv4.tcp_early_demux=0"
+else
+ sysctl -w "net.ipv4.tcp_early_demux=1"
+fi
+
 echo "CNI init container done"