[v1.15] fix: correctly set scope_switch for service lookup #32608
Conversation
c0ad72a
to
83d0095
Compare
There was a problem hiding this comment.
Thank you! One change request inline, to make this work for both in-cluster and cluster-external usage.
Some context, as the patch description & release note aren't very clear on the affected scenario / wider impact. For eTP=local services, we add two entries to the service map - one with only the local backends, and a second entry with all backends. In-cluster access is meant to use the wider-scope entry.
But due to this bug, the in-cluster access to eTP=local services doesn't fall through to the "all backends" entry. As result, a client on a node with no local backend would be unable to fall back, in case its initial backend terminates.
83d0095
to
8b15d62
Compare
For eTP=local services, we add two entries to the service map - one with only the local backends, and a second entry with all backends. In-cluster access is meant to use the wider-scope entry. Due to incorrect scope switch, in-cluster access to eTP=local services doesn't fall through to the "all backends" entry. As result, a client on a node with no local backend would be unable to fall back, in case its initial backend terminates. Note: this change only applies to v1.15 and below, as v1.16 has been refactored to prevent the lb4_lookup_service call. Fixes: cilium#32472 Signed-off-by: Mark St John <markstjohn@google.com>
8b15d62
to
ee44bc6
Compare
|
/test-backport-1.15 |
|
@julianwiedmann I'm not sure this is considered a major bug for the backport criteria -- thoughts? |
I'm seeing it as more of a corner-case, that wouldn't justify backports to older branches. And I'd expect |
When looking up a loadbalancer service in lxc
from-container,scope_switchvalue for flows matching an existing conntrack entry may skip the correct return path. Set scope switch value to be consistent with earlier service lookup.Note: this change only applies to v1.15 and below, as v1.16 has been refactored to prevent the lb4_lookup_service call.
This can lead to packet drops due to failed service lookup when a stale CT entry maps to a backend ID that is no longer present in the service map.
Fixes: #32472