Remote subnet feature #1061
Remote subnet feature #1061
Conversation
|
@ksubrmnn do you plan to add the tests and documentation in this PR? |
|
@rajatchopra Testing and documentation will probably take about 2 weeks. I think it's fine to merge this PR and follow up with testing/docs in a separate PR, if that's okay with you. This has been manually validated. |
|
|
||
| networkPolicySettings := hcn.RemoteSubnetRoutePolicySetting{ | ||
| IsolationId: 4096, | ||
| DistributedRouterMacAddress: net.HardwareAddr(vxlanAttrs.VtepMAC).String(), |
There was a problem hiding this comment.
Just a question. How was it even working with ConjureMAC before? Not ARP right? Or was the MAC manufactured and dropped on the interface?
There was a problem hiding this comment.
Previously there was a remote endpoint for each IP in the subnet on the host. For example if Host A has subnet 192168.1.0/24 and Host B has 192.168.2.0/24, then Host A had 250+ remote endpoints from 192.168.2.1-254. Vice versa for Host B
This was before HNS had the remote subnet feature. And before Remote Subnet, many things were not working properly like service vip, node port access, etc. With remote subnet feature, this RemoteSubnetPolicy replaces the tens/hundreds of endpoints you previously had to create per other node in the cluster.
With the previous remote endpoint strategy, it worked because flannel sets the mac by using a similar approach with mac prefix and then setting the mac based on IP. So we just used conjureMac in flanneld to replicate that logic. So it was a real mac, that we sort of figured out from the IP.
There was a problem hiding this comment.
One would have hoped that the MAC can be learned through ARP. But I assume this is for added security.
There was a problem hiding this comment.
Updated my previous response after consulting with Dinesh when I realized I misunderstood your original question
There was a problem hiding this comment.
/lgtm
@ksubrmnn Minor nit and a question. Otherwise ready to go, let me know if there are any more changes planned.
|
@rajatchopra let me do one final run in the morning for peace of mind, then we can merge. Only upcoming changes I can foresee are removing hardcoding of VNI (necessary for now until I can add a small Linux change) and testing. Both of those will be separate PRs from this though. |
|
@rajatchopra this looks good to merge. |
|
@ksubrmnn Thanks. |
Description
This PR implements the HNS Remote Subnet feature. With this feature, Flannel in overlay will create one network policy per subnet instead of creating several endpoints per subnet.
Todos
Release Note