-
Notifications
You must be signed in to change notification settings - Fork 433
Description
Describe the bug
When trying to access a Service from a Pod using a Service VIP different from the ClusterIP (e.g., using a LB IP), the FlowExporter does not "identify" the connection as Service traffic, and does not include Service information in the exporter flow records.
To Reproduce
Create a Service with a LoadBalancer IP or an External IP, access the Service from a Pod using that VIP, check the exported records.
Note that if you are using a LoadBalancer IP, you need to make sure that antreaProxy.proxyLoadBalancerIPs remains True, otherwise the traffic will not be handled by AntreaProxy and the incomplete flow records are expected.
Expected
Flow records including Service information (name or UID, etc).
Actual behavior
Flow records without Service information, unlike when accessing the Service using the ClusterIP.
Versions:
Antrea v2.4.3 + latest
Additional context
- This is different from [FlowExporter] Need uniform handling for "External-to-Pod" traffic #5706, as in this case we are looking at flows which are internal to the cluster (Pod-to-Service). However, if we want to handle the case where
antreaProxy.proxyLoadBalancerIPsis False, the issue becomes more complex (either the VIP is handled by kube-proxy or the VIP is handled by an external LB), and we need to think about a good solution. As a first step, we should assumeantreaProxy.proxyLoadBalancerIPsis True. - Root cause of the issue is that we only add the ClusterIP as key in:
antrea/pkg/agent/proxy/proxier.go
Lines 129 to 130 in bf039b9
// serviceStringMap provides map from serviceString(ClusterIP:Port/Proto) to ServicePortName. serviceStringMap map[string]k8sproxy.ServicePortName