Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add flowType field for Flow Exporter #2000

Merged
merged 1 commit into from
Apr 8, 2021

Conversation

dreamtalen
Copy link
Contributor

@dreamtalen dreamtalen commented Mar 26, 2021

Fixes #1925
In this PR, we implemented the logic of flowType value assignment.
We distinguished Pod-To-Pod flows and Pod-To-External flows using the podCIDRs of all nodes in the k8s cluster.

Copy link
Member

@srikartati srikartati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @dreamtalen for working on this.

Retreiving podCIDRs from nodes to maintain Pod Subnets is only possible solution. However, not sure if this is completely foolproof. Please see the comment.

Discussion with @antoninbas offline: One more option is to use nodeRouteController, which is part of AntreaController that takes the responsibility of install routes for antrea-gw on every node(route client). It has podCIDR info for all nodes.
Ok with nodeSpec solution, if it serves the purpose. Otherwise, nodeRouteController should be explored.

Comment on lines 587 to 590
if i == subnet {
return true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why not use i.Contains(subnet) to skip the subnet? i is not a great variable name in this context IMO.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, net.IPNet.Contain function can only reports whether the network includes ip. I added some logic to judge whether the network includes the new network.


func fetchPodSubnets(k8sClient kubernetes.Interface) ([]*net.IPNet, error) {
podSubnets := []*net.IPNet{}
nodeList, err := k8sClient.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As this is done as part of the initialization of Flow Exporter, can we be sure that all the nodes with Antrea agents are up?

Copy link
Contributor Author

@dreamtalen dreamtalen Mar 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed offline and current solution is if source/destination ip is not known we will do the query and update the podCIDRs first, then update the flow type.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please integrate with the NodeRouteController, it already has this information

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the PR integrating with the NodeRouteController.

@dreamtalen dreamtalen force-pushed the local-add-flowtype branch 2 times, most recently from f94943c to 45c400e Compare March 29, 2021 23:42
@codecov-io
Copy link

codecov-io commented Mar 30, 2021

Codecov Report

Merging #2000 (c52b20d) into main (e027c7b) will increase coverage by 1.16%.
The diff coverage is 64.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #2000      +/-   ##
==========================================
+ Coverage   60.87%   62.03%   +1.16%     
==========================================
  Files         268      269       +1     
  Lines       20236    20486     +250     
==========================================
+ Hits        12319    12709     +390     
+ Misses       6633     6460     -173     
- Partials     1284     1317      +33     
Flag Coverage Δ
e2e-tests 24.45% <6.00%> (?)
kind-e2e-tests 51.74% <56.00%> (+0.23%) ⬆️
unit-tests 41.42% <40.00%> (-0.12%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
pkg/util/ip/ip.go 80.30% <50.00%> (ø)
...gent/controller/noderoute/node_route_controller.go 46.39% <53.57%> (+0.55%) ⬆️
pkg/agent/flowexporter/exporter/exporter.go 71.70% <80.00%> (+2.44%) ⬆️
pkg/agent/nodeportlocal/k8s/npl_controller.go 52.43% <0.00%> (-7.73%) ⬇️
pkg/apiserver/certificate/certificate.go 69.86% <0.00%> (-6.85%) ⬇️
pkg/agent/route/route_linux.go 40.18% <0.00%> (-2.51%) ⬇️
pkg/antctl/raw/traceflow/command.go 25.73% <0.00%> (-0.61%) ⬇️
pkg/ovs/openflow/ofctrl_packetin.go 35.08% <0.00%> (ø)
pkg/agent/cniserver/server.go 68.91% <0.00%> (+0.32%) ⬆️
pkg/agent/openflow/client.go 60.37% <0.00%> (+0.53%) ⬆️
... and 22 more

@antoninbas antoninbas added this to the Antrea v1.0 release milestone Mar 30, 2021
Comment on lines 565 to 568
if exp.nodeRouteController != nil {
exp.podSubnets = exp.nodeRouteController.GetPodSubnetsFromAllNodes()
klog.V(4).Infof("Updated Pod subnets: %v", exp.podSubnets)
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have to do this every time we create the flow record?

@@ -551,3 +553,34 @@ func (exp *flowExporter) sendDataSet() (int, error) {
klog.V(4).Infof("Data set sent successfully. Bytes sent: %d", sentBytes)
return sentBytes, nil
}

func (exp *flowExporter) findFlowType(record flowexporter.FlowRecord) uint8 {
if record.Conn.Mark == openflow.ServiceCTMark || exp.ipInPodSubnets(record.Conn.TupleOrig.SourceAddress) && exp.ipInPodSubnets(record.Conn.TupleOrig.DestinationAddress) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this has to be modified.
Do you mean the following to represent Pod-To-Pod flows and Pod-To-Service flows?
exp.ipInPodSubnets(record.Conn.TupleOrig.SourceAddress) && (record.Conn.Mark == openflow.ServiceCTMark || exp.ipInPodSubnets(record.Conn.TupleOrig.DestinationAddress))

klog.V(4).Infof("Updated Pod subnets: %v", exp.podSubnets)
}
if !exp.ipInPodSubnets(record.Conn.TupleOrig.SourceAddress) {
return ipfixregistry.FromExternal
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do not support External-To-Pod flows (nodePort service) for now. They will be ignored in the connection flow dump. Prefer removing this to avoid confusion.

Comment on lines 580 to 577
for _, subnet := range exp.podSubnets {
if subnet.Contains(ip) {
return true
}
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently, we have fixed mask(same size) for all podCIDRs. Based on that we could optimize further.
Ok to keep this for now and consider the optimization later.

@@ -27,3 +31,16 @@ func NewConnectionKey(conn *Connection) ConnectionKey {
strconv.FormatUint(uint64(conn.TupleOrig.Protocol), 10),
}
}

func IsConnectionDying(conn *Connection) bool {
// "TIME_WAIT" state indicates local endpoint has closed the connection
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better to add '.' at the end of the sentence.

Copy link
Contributor Author

@dreamtalen dreamtalen Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Jianjun, I fing some of your comments are focusing on @zyiou 's change in PR #1904. Yiou, could you please take a look?

@@ -125,7 +125,7 @@ func (ct *connTrackOvsCtl) ovsAppctlDumpConnections(zoneFilter uint16) ([]*flowe

// flowStringToAntreaConnection parses the flow string and converts to Antrea connection.
// Example of flow string:
// "tcp,orig=(src=10.10.1.2,dst=10.10.1.3,sport=45170,dport=2379,packets=80743,bytes=5416239),reply=(src=10.10.1.3,dst=10.10.1.2,sport=2379,dport=45170,packets=63361,bytes=4811261),start=2020-07-24T05:07:01.591,id=462801621,mark=32,zone=65520,status=SEEN_REPLY|ASSURED|CONFIRMED|SRC_NAT_DONE|DST_NAT_DONE,timeout=86397"
// "tcp,orig=(src=127.0.0.1,dst=127.0.0.1,sport=45218,dport=2379,packets=320108,bytes=24615344),reply=(src=127.0.0.1,dst=127.0.0.1,sport=2379,dport=45218,packets=239595,bytes=24347883),start=2020-07-24T05:07:03.998,id=3750535678,status=SEEN_REPLY|ASSURED|CONFIRMED|SRC_NAT_DONE|DST_NAT_DONE,timeout=86399,protoinfo=(state_orig=ESTABLISHED,state_reply=ESTABLISHED,wscale_orig=7,wscale_reply=7,flags_orig=WINDOW_SCALE|SACK_PERM|MAXACK_SET,flags_reply=WINDOW_SCALE|SACK_PERM|MAXACK_SET)"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not mean we must do it in this PR, but in general I feel such OVS level parsing should be put into pkg/ovs/

Copy link
Contributor

@zyiou zyiou Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Noted. We are planning to decouple conntrack polling and exporting process where we can move ovs specific parsing or handling to pkg/ovs and decouple conntrack part. #1278

@@ -155,6 +155,10 @@ func NetlinkFlowToAntreaConnection(conn *conntrack.Flow) *flowexporter.Connectio
SourcePodName: "",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file probably worth a separate pkg under pkg/agent/util/conntrack. Again not saying we must do in this PR.

} else {
// Update Pod subnets to distinguish Pod-To-External flows.
if exp.nodeRouteController != nil {
exp.podSubnets = exp.nodeRouteController.GetPodSubnetsFromAllNodes()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we call it for every flow? Then we should optimize here; probably by maintaining a single map in NodeRouteController and look up there, or even require a podCIDR parameter to add flow type.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We call it if a flow record is not a Pod-To-Pod or Pod-To-Service record. Since new nodes may be added into the cluster anytime, current solution is that if we failed to judge current record is a Pod-To-Pod or Pod-To-Service record, we will fetch the latest PodCIDRs from NodeRouteController, then distinguish if it is a Pod-To-External flow.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But when this happens - failed to judge current record is a Pod-To-Pod or Pod-To-Service record?

Copy link
Contributor Author

@dreamtalen dreamtalen Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be brief, if the destination IP of a record is not in all PodSubnets we currently known && it's not a Pod-To-Service record.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it mean every flow to external will end up here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then we should optimize in my mind.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. @dreamtalen Please optimize this as discussed offline.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, updated PR with following optimization:
Maintained a PodCIDRIPsMap in NodeRouteController to avoid looking up PodSubsets in flow exporter when send record.
Took advantage of the fixed mask size among PodCIDRs, using Map to accelerate the judgement of IP in PodSubnets.

@dreamtalen dreamtalen force-pushed the local-add-flowtype branch 2 times, most recently from 069b8ed to ea9bdca Compare April 2, 2021 00:36
@@ -97,7 +103,9 @@ func NewNodeRouteController(
nodeLister: nodeInformer.Lister(),
nodeListerSynced: nodeInformer.Informer().HasSynced,
queue: workqueue.NewNamedRateLimitingQueue(workqueue.NewItemExponentialFailureRateLimiter(minRetryDelay, maxRetryDelay), "noderoute"),
installedNodes: cache.NewIndexer(nodeRouteInfoKeyFunc, cache.Indexers{nodeRouteInfoPodCIDRIndexName: nodeRouteInfoPodCIDRIndexFunc})}
installedNodes: cache.NewIndexer(nodeRouteInfoKeyFunc, cache.Indexers{nodeRouteInfoPodCIDRIndexName: nodeRouteInfoPodCIDRIndexFunc}),
PodCIDRIPsMap: make(map[string]int),
Copy link
Member

@srikartati srikartati Apr 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

installedNodes (cache.indexer) already have this mapping functionality of searching using podCIDR through nodeRouteInfoPodCIDRIndexFunc. We do not need a separate map. Please take a look.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I updated code using nodeRouteInfoPodCIDRIndexFunc.

@dreamtalen dreamtalen force-pushed the local-add-flowtype branch from ea9bdca to 645423b Compare April 2, 2021 19:00
Copy link
Member

@srikartati srikartati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall logic is LGTM. I just had a couple of comments.

Wondering if you got a chance to test this out manually to make sure Flow Aggregator exports Pod-To-External flows.
Not sure if adding an e2e test case for Pod-To-External flow is trivial. If its not trivial we probably can take it up in a different PR. At least we should test manually.

}
}
ipCIDRStr := ipCIDR.String()
nodesHaveSamePodCIDR, _ := c.installedNodes.ByIndex(nodeRouteInfoPodCIDRIndexName, ipCIDRStr)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodeInCluster is better name. I feel the context for nodesHaveSamePodCIDR is different.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, addressed.

Comment on lines 56 to 59
PodIPv4CIDRMaskSize = 24
IPv4BitLen = 32
PodIPv6CIDRMaskSize = 64
IPv6BitLen = 128
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These could be gathered runtime from local podCIDRs. Hardcoded values may work fine for now.. just want to confirm with @antoninbas

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's fine to assume fixed size CIDRs across the cluster for now (because this is how Node IPAM works), but it is not fine to assume that the size is 24 (for IPv4) or 64 (for IPv6). The cluster admin can easily change this by providing a different value with --node-cidr-mask-size for kube-controller-manager.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, Antonin.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I add the logic of gathering PodIPv4/v6CIDRMaskSize from local podCIDRs, if it doesn't exist, using 24 (for IPv4) or 64 (for IPv6) as default value instead.

@@ -615,3 +621,30 @@ func GetNodeAddr(node *corev1.Node) (net.IP, error) {
}
return ipAddr, nil
}

func (c *Controller) IPInPodSubnets(ip net.IP) bool {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we add a simple unit test for this method?

Copy link
Contributor Author

@dreamtalen dreamtalen Apr 6, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, added a unit test for IPInPodSubnets function.
For Pod-To-External flows, I have tested manually by watching the records on the ipfix-collector side.

@dreamtalen dreamtalen force-pushed the local-add-flowtype branch from 645423b to e9d9b39 Compare April 6, 2021 18:45
Copy link
Member

@srikartati srikartati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding the unit test and sharing the result of the manual test. Please add a TODO in e2e tests to add a test that checks the functionality of Pod-To-External flow.

LGTM except for the corner case situation of network policy only mode.

klog.Warningf("Can't find flowType without nodeRouteController")
return 0
}
if exp.nodeRouteController.IPInPodSubnets(record.Conn.TupleOrig.SourceAddress) {
Copy link
Member

@srikartati srikartati Apr 6, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will not work for network-policy only mode traffic as the installed node cache indexer is not maintained at all.
https://github.com/vmware-tanzu/antrea/blob/main/pkg/agent/controller/noderoute/node_route_controller.go#L278

I think we need to check the network subnet of local nodeAddr in nodeConfig to determine if the IP address is inside cluster or not. @jianjuns Could you please confirm if this check is correct or not for network policy only mode?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Srikar for pointing out it, added a TODO right now and wait for Jianjun's opinion.

Copy link
Member

@srikartati srikartati Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding these lines to address this.

My initial assessment on node network based identification is not correct and was mixed up with something else. There is no straightforward way to detect PodIPs at Antrea agent when operating in network policy only mode.
Therefore, we are supporting Pod-To-External flows for all traffic modes except for the special mode of network policy only mode. Pod-To-Pod flows and Pod-To-Service flows are supported in network policy only mode. There is no regression here.

Comment on lines 633 to 631
} else {
podIPv4CIDRMaskSize = defaultPodIPv4CIDRMaskSize
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you provide some clarity (and maybe add a comment) as to why this is needed? shouldn't we just return false at this point?

same for the v6 case below

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree. I thought it might be ok since it is the default setting in Kube-control-manager.
However, thinking more about it it is better to not resolve the flow type and print a warning. This situation also arises for network policy only mode.
https://github.com/vmware-tanzu/antrea/blob/main/pkg/agent/config/node_config.go#L113

Any thoughts @dreamtalen ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree too, addressed.

Comment on lines 343 to 345
if !strings.Contains(record, fmt.Sprintf("%s: %d", "flowType", flowType)) {
t.Errorf("Record does not have correct flowType")
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: there is an assert.Contains assertion

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, addressed.

@dreamtalen dreamtalen force-pushed the local-add-flowtype branch 2 times, most recently from 3ecd2b0 to 6d359c2 Compare April 7, 2021 22:38
Copy link
Member

@srikartati srikartati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM except for one nit.

@@ -52,6 +52,9 @@ const (
ovsExternalIDNodeName = "node-name"

nodeRouteInfoPodCIDRIndexName = "podCIDR"

IPv4BitLen = 32
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there are constants for these lengths in net package: https://golang.org/pkg/net/

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I only found bytes length constants, so I changed the code to:

IPv4BitLen = net.IPv4len * 8
IPv6BitLen = net.IPv6len * 8

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for checking.
Realized that this is available here: https://github.com/vmware-tanzu/antrea/blob/main/pkg/util/ip/ip.go#L26

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I capitalized these constant and updated the code.

klog.Warningf("Can't find flowType without nodeRouteController")
return 0
}
if exp.nodeRouteController.IPInPodSubnets(record.Conn.TupleOrig.SourceAddress) {
Copy link
Member

@srikartati srikartati Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding these lines to address this.

My initial assessment on node network based identification is not correct and was mixed up with something else. There is no straightforward way to detect PodIPs at Antrea agent when operating in network policy only mode.
Therefore, we are supporting Pod-To-External flows for all traffic modes except for the special mode of network policy only mode. Pod-To-Pod flows and Pod-To-Service flows are supported in network policy only mode. There is no regression here.

@srikartati srikartati requested a review from antoninbas April 8, 2021 05:29
@dreamtalen dreamtalen force-pushed the local-add-flowtype branch from 6d359c2 to 55b6c7e Compare April 8, 2021 17:21
In this PR, we implemented the logic of flowType value assignment.
We distinguished Pod-To-Pod flows and Pod-To-External flows using the
podCIDRs of all nodes in the k8s cluster.
@dreamtalen dreamtalen force-pushed the local-add-flowtype branch from 55b6c7e to c52b20d Compare April 8, 2021 17:49
Copy link
Member

@srikartati srikartati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
Please edit the description by adding Fixes #XXX to link the issue properly.

@dreamtalen
Copy link
Contributor Author

LGTM
Please edit the description by adding Fixes #XXX to link the issue properly.

Thanks, done.

var curNodeCIDRStr string
if ip.To4() != nil {
var podIPv4CIDRMaskSize int
if c.nodeConfig.PodIPv4CIDR != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we tend to use early returns when possible to reduce indentation levels:

if c.nodeConfig.PodIPv4CIDR == nil {
    return false
}
curNodeCIDRStr = c.nodeConfig.PodIPv4CIDR.String()
podIPv4CIDRMaskSize, _ := c.nodeConfig.PodIPv4CIDR.Mask.Size()

same below

this can be addressed in a future PR

Comment on lines +551 to +558
func (exp *flowExporter) findFlowType(record flowexporter.FlowRecord) uint8 {
// TODO: support Pod-To-External flows in network policy only mode.
if exp.isNetworkPolicyOnly {
if record.Conn.SourcePodName == "" || record.Conn.DestinationPodName == "" {
return ipfixregistry.InterNode
}
return ipfixregistry.IntraNode
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as discussed with @srikartati offline, I feel like flow type resolution should belong in the Flow Aggregator
The Flow Aggregator could watch all Pods if needed

Copy link
Member

@srikartati srikartati Apr 8, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @antoninbas. Yes, we have to explore this to support Pod-To-External flows in Nwtqork Policy only mode in the future.

// TODO: support Pod-To-External flows in network policy only mode.
if exp.isNetworkPolicyOnly {
if record.Conn.SourcePodName == "" || record.Conn.DestinationPodName == "" {
return ipfixregistry.InterNode
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you probably should rename these to FlowTypeInterNode, etc. in go-ipfix so there is more context in the name

Copy link
Member

@srikartati srikartati Apr 8, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As these were used in the context of adding flow types (the function is GetFlowType here), I thought a simple name might be sufficient. If it's confusing, we could change it.
@dreamtalen Could you please create an issue in go-ipfix?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, thanks.

@@ -336,6 +341,11 @@ func checkBandwidthFromRecord(t *testing.T, record, bandwidth string) {
}
}

// TODO: Add a test that checks the functionality of Pod-To-External flow.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this TODO seems out-of-place on this function, maybe it should have been part of the commit message

@srikartati
Copy link
Member

/test-all
/test-ipv6-only-e2e
/test-ipv6-e2e

@srikartati
Copy link
Member

/test-ipv6-only-e2e
/test-ipv6-e2e

@srikartati
Copy link
Member

srikartati commented Apr 8, 2021

I see flow aggregator tests passing both on single stack v6 and dual stack clusters.. there was traceflow test failure in the previous run.
http://10.176.27.169:8080/view/ipv6-only/job/antrea-ipv6-only-e2e-for-pull-request/272/console
http://10.176.27.169:8080/view/dual-stack/job/antrea-ipv6-ds-e2e-for-pull-request/298/console

Merging this

@srikartati srikartati merged commit 7eeeb49 into antrea-io:main Apr 8, 2021
@zyiou zyiou added area/flow-visibility Issues or PRs related to flow visibility support in Antrea area/flow-visibility/exporter Issues or PRs related to the Flow Exporter functions in the Agent labels Jun 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/flow-visibility/exporter Issues or PRs related to the Flow Exporter functions in the Agent area/flow-visibility Issues or PRs related to flow visibility support in Antrea
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Aggregator discards Pod-to-External Flows
7 participants