Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove mutual exclusivity in calico: NAT and router mode #9255

Merged
merged 5 commits into from
Sep 13, 2022
Merged

Remove mutual exclusivity in calico: NAT and router mode #9255

merged 5 commits into from
Sep 13, 2022

Conversation

HoKim98
Copy link
Contributor

@HoKim98 HoKim98 commented Sep 5, 2022 •
edited by floryut
Loading

What type of PR is this?
/kind bug

What this PR does / why we need it:

In special cases it's needed to enable peer_with_router with NAT in calico, such as in labs.
But these have been implemented as mutually exclusive, so there is no way to enable both of them.

So, I offer a optional feature that forcefully enables NAT mode even when `peer_with_router` is enabled: * `peer_with_router_nat_outgoing` to forcefully enable NAT when `peer_with_router` is enabled (default value: false).

So, I think it's better to release the mutual exclusivity between nat_outgoing and peer_with_router.
If someone wants to use peer_with_router without the NAT, he/she should disable the nat_outgoing manually.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

[Calico] The NAT (`nat_outgoing`) would not be disabled automatically when enabling `peer_with_router`.

@k8s-ci-robot k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Sep 5, 2022
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Sep 5, 2022
@k8s-ci-robot k8s-ci-robot requested a review from EppO September 5, 2022 13:16
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 5, 2022
@k8s-ci-robot
Copy link
Contributor

Hi @kerryeon. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Sep 5, 2022
@HoKim98 HoKim98 force-pushed the add-peer_with_router_nat_outgoing branch from 97bcec2 to a1ea040 Compare September 5, 2022 13:32
oomichi
oomichi reviewed Sep 12, 2022
View reviewed changes
Copy link
Contributor

@oomichi oomichi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/cc @oomichi

docs/calico.md Outdated
Then the following variables need to be set:

* `nat_outgoing` to enable NAT (default value: true).
* `peer_with_router_nat_outgoing` to forcefully enable NAT (default value: false).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

to forcefully enable NAT (default value: false).

seems to make confusions because nat_outgoing is to enable NAT and the default value is true.
That means the NAT is already enabled by default.

roles/network_plugin/calico/tasks/install.yml Outdated
@@ -227,7 +227,7 @@
"cidr": "{{ calico_pool_cidr | default(kube_pods_subnet) }}",
"ipipMode": "{{ calico_ipip_mode }}",
"vxlanMode": "{{ calico_vxlan_mode }}",
"natOutgoing": {{ nat_outgoing|default(false) and not peer_with_router|default(false) }}
"natOutgoing": {{ nat_outgoing|default(false) and ((not peer_with_router|default(false)) or (peer_with_router_nat_outgoing|default(false))) }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we control this use case with the existing nat_outgoing only?

Copy link
Contributor Author

@HoKim98 HoKim98 Sep 12, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, we can remove the mutual exclusivity between nat_outgoing and not peer_with_router by ignoring the peer_with_router flag.

But it may causes for users that enable peer_with_router to get side-effect.

Regardless, the direction of concise and complete improvement seems to fit the content of the review, so I made a new commit.

@k8s-ci-robot k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Sep 12, 2022
@HoKim98 HoKim98 changed the title Add optional NAT support in calico router mode Remove mutual exclusivity in calico: NAT and router mode Sep 12, 2022
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 12, 2022
oomichi
oomichi reviewed Sep 12, 2022
View reviewed changes
Copy link
Contributor

@oomichi oomichi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for updating.

/ok-to-test
/approve

roles/network_plugin/calico/tasks/install.yml
@@ -227,7 +227,7 @@
"cidr": "{{ calico_pool_cidr | default(kube_pods_subnet) }}",
"ipipMode": "{{ calico_ipip_mode }}",
"vxlanMode": "{{ calico_vxlan_mode }}",
"natOutgoing": {{ nat_outgoing|default(false) and not peer_with_router|default(false) }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This original line has been added since #3086
And I could not find the reason of this condition.
The new line

"natOutgoing": {{ nat_outgoing|default(false) }}

seems pretty straightforward for me.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow PR 3xxx 😄

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 12, 2022
floryut
floryut approved these changes Sep 13, 2022
View reviewed changes
Copy link
Member

@floryut floryut left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kerryeon All good for me
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 13, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: floryut, kerryeon, oomichi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@floryut floryut added kind/network Network section in the release note and removed kind/feature Categorizes issue or PR as related to a new feature. labels Sep 13, 2022
@k8s-ci-robot k8s-ci-robot merged commit 952cad8 into kubernetes-sigs:master Sep 13, 2022
@floryut floryut mentioned this pull request Sep 19, 2022
Closed
enneitex pushed a commit to enneitex/kubespray that referenced this pull request Jan 25, 2023
@HoKim98 @enneitex
Remove mutual exclusivity in calico: NAT and router mode (kubernetes-…
0452fb4 
…sigs#9255)

* Add optional NAT support in calico router mode

* Add a blank line in front of lists

* Remove mutual exclusivity: NAT and router mode

* Ignore router mode from NAT

* Update calico doc
nolimitkun pushed a commit to nolimitkun/kubespray that referenced this pull request Mar 19, 2023
@HoKim98 @nolimitkun
Remove mutual exclusivity in calico: NAT and router mode (kubernetes-…
72a64eb 
…sigs#9255)

* Add optional NAT support in calico router mode

* Add a blank line in front of lists

* Remove mutual exclusivity: NAT and router mode

* Ignore router mode from NAT

* Update calico doc
LuckySB pushed a commit to southbridgeio/kubespray that referenced this pull request Jul 7, 2023
@HoKim98 @LuckySB
Remove mutual exclusivity in calico: NAT and router mode (kubernetes-…
53f5081 
…sigs#9255)

* Add optional NAT support in calico router mode

* Add a blank line in front of lists

* Remove mutual exclusivity: NAT and router mode

* Ignore router mode from NAT

* Update calico doc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@oomichi oomichi oomichi left review comments

@floryut floryut floryut approved these changes

@cristicalin cristicalin Awaiting requested review from cristicalin

@EppO EppO Awaiting requested review from EppO

Assignees

@floryut floryut

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/network Network section in the release note lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@HoKim98 @k8s-ci-robot @oomichi @floryut