Skip to content

[FlowExporter] Pod-to-Service traffic using non-ClusterIP VIP is not identified correctly #7601

@antoninbas

Description

@antoninbas

Describe the bug
When trying to access a Service from a Pod using a Service VIP different from the ClusterIP (e.g., using a LB IP), the FlowExporter does not "identify" the connection as Service traffic, and does not include Service information in the exporter flow records.

To Reproduce
Create a Service with a LoadBalancer IP or an External IP, access the Service from a Pod using that VIP, check the exported records.
Note that if you are using a LoadBalancer IP, you need to make sure that antreaProxy.proxyLoadBalancerIPs remains True, otherwise the traffic will not be handled by AntreaProxy and the incomplete flow records are expected.

Expected
Flow records including Service information (name or UID, etc).

Actual behavior
Flow records without Service information, unlike when accessing the Service using the ClusterIP.

Versions:
Antrea v2.4.3 + latest

Additional context

  • This is different from [FlowExporter] Need uniform handling for "External-to-Pod" traffic #5706, as in this case we are looking at flows which are internal to the cluster (Pod-to-Service). However, if we want to handle the case where antreaProxy.proxyLoadBalancerIPs is False, the issue becomes more complex (either the VIP is handled by kube-proxy or the VIP is handled by an external LB), and we need to think about a good solution. As a first step, we should assume antreaProxy.proxyLoadBalancerIPs is True.
  • Root cause of the issue is that we only add the ClusterIP as key in:
    // serviceStringMap provides map from serviceString(ClusterIP:Port/Proto) to ServicePortName.
    serviceStringMap map[string]k8sproxy.ServicePortName

Metadata

Metadata

Labels

area/flow-visibility/exporterIssues or PRs related to the Flow Exporter functions in the Agentkind/bugCategorizes issue or PR as related to a bug.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions