Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BPF] decap VXLAN at host ingress - skip vxlan.calico #9288

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

[BPF] decap VXLAN at host ingress - skip vxlan.calico #9288

wants to merge 1 commit into from

Commits on Oct 28, 2024

  1. [BPF] decap VXLAN at host ingress - skip vxlan.calico 

    When we see a vxlan packet entering a node and if the packet belongs to
calico, that is, it came from a calico node to a calico node with the
right VNI, we decap the packet and deliver it where it belongs. This
allows us to bypass the vxlan.calico device on ingress to the system,
avoid UDP processing on the host, processing on the vxlan device and
redirection from there. If packet is from a cluster node or a pod
without any nat, it can go straight to the peer side of the pod iface.

Note that this would break RPF checks if BPFEnforceRPF=Strict, therefore
it is not performed when that option is set to Strict and packets take
the regular path.
    @tomastigera
    tomastigera committed Oct 28, 2024
    Configuration menu
    Copy the full SHA
    f567b4e View commit details
    Browse the repository at this point in the history