Skip to content

Commit

Permalink
fixes overzealous deletion of SNAT in egressIP
Browse files Browse the repository at this point in the history
currently when creating egressIP in a dualstack cluster regardless of if
the egressip is ipv4 or ipv6 when disable-snat-multiple-gws is set the
code removes both ipv4 and ipv6 snats from the database. This means that
the pod will not be able to communicate with the cluster correctly
becuase the Gateway Router is missing an SNAT and the traffic will be
dropped.

Additionally the testing looks a little different from the others
because we do not correctly setup dualstack clusters when running unit
tests

Signed-off-by: Jacob Tanenbaum <jtanenba@redhat.com>
  • Loading branch information
JacobTanenbaum authored and jcaamano committed Dec 9, 2024
1 parent de402c9 commit dfa9d87
Show file tree
Hide file tree
Showing 3 changed files with 403 additions and 1 deletion.
7 changes: 6 additions & 1 deletion go-controller/pkg/ovn/egressip.go
Original file line number Diff line number Diff line change
Expand Up @@ -1674,13 +1674,17 @@ func (e *egressIPZoneController) addExternalGWPodSNATOps(ops []ovsdb.Operation,
// deleteExternalGWPodSNATOps creates ops for the required external GW teardown for the given pod
func (e *egressIPZoneController) deleteExternalGWPodSNATOps(ops []ovsdb.Operation, pod *kapi.Pod, podIPs []*net.IPNet, status egressipv1.EgressIPStatusItem, isOVNNetwork bool) ([]ovsdb.Operation, error) {
if config.Gateway.DisableSNATMultipleGWs && status.Node == pod.Spec.NodeName && isOVNNetwork {
affectedIPs := util.MatchAllIPNetFamily(utilnet.IsIPv6String(status.EgressIP), podIPs)
if len(affectedIPs) == 0 {
return nil, nil // noting to do.
}
// remove snats to->nodeIP (from the node where pod exists if that node is also serving
// as an egress node for this pod) for these podIPs before adding the snat to->egressIP
extIPs, err := getExternalIPsGR(e.watchFactory, pod.Spec.NodeName)
if err != nil {
return nil, err
}
ops, err = deletePodSNATOps(e.nbClient, ops, e.GetNetworkScopedGWRouterName(pod.Spec.NodeName), extIPs, podIPs, "")
ops, err = deletePodSNATOps(e.nbClient, ops, e.GetNetworkScopedGWRouterName(pod.Spec.NodeName), extIPs, affectedIPs, "")
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -1806,6 +1810,7 @@ func (e *egressIPZoneController) createReroutePolicyOps(ops []ovsdb.Operation, p
var err error
// Handle all pod IPs that match the egress IP address family
for _, podIPNet := range util.MatchAllIPNetFamily(isEgressIPv6, podIPNets) {

lrp := nbdb.LogicalRouterPolicy{
Match: fmt.Sprintf("%s.src == %s", ipFamilyName(isEgressIPv6), podIPNet.IP.String()),
Priority: types.EgressIPReroutePriority,
Expand Down
Loading

0 comments on commit dfa9d87

Please sign in to comment.