-
Notifications
You must be signed in to change notification settings - Fork 38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Using VTI devices and Routes to manage VPN connections #80
Comments
@hhyasdf How to sync the ip of "nodepool"?
|
Maybe "Watch Pods ip on each node" is fine. The logic can be, "only Pod ips of local nodepool donnot need to get through the VPN", so only the Pod ips of the nodepool this node belongs to need to be handled. |
@hhyasdf This means every raven agent on nodes should list/watch all pods in the cluster? but i am worried that cloud-edge public network traffic will increase greatly. |
@rambohe-ch Sync the Pods ip of "nodepool" to gateway CR might be a good way to reduce the cloud-edge public network traffic, I mean, both of them are fine. |
Raven now use the Subnet-based configuration of Libreswan to create VPN connections, which is strongly rely on the "One-Subnet-One-Node" supposition. This brings troubles when the CNI implimentation don't obay the supposition, many of CNI even makes subnets be able to cross multiple nodes.
Both Libreswan and WireGuard can support a Route-based management method. Using this, maybe raven can only watch ips of Pod object and use them to configure routes (policy route + ipset + iptables mark) instead of rely on the "subnets" of nodes.
The text was updated successfully, but these errors were encountered: