Uploaded image for project: 'OpenShift Core Networking'
  1. OpenShift Core Networking
  2. CORENET-5562

[OVN-Kubernetes, IPv6] ensure RAs from GW routers of other nodes do not reach the workload LSPs

XMLWordPrintable

    • Product / Portfolio Work
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • Bug Fix
    • Hide
      This fix filter out the router advertisements from remote nodes to prevent VMs to end up with multipath ipv6 default gw.

      In case the live migration is not automatically issued by the upgrade when rebooting nodes, a live upgrade need to be done to install the nftables that filter out the unwanted router advertisements at the new network namespace.
      Show
      This fix filter out the router advertisements from remote nodes to prevent VMs to end up with multipath ipv6 default gw. In case the live migration is not automatically issued by the upgrade when rebooting nodes, a live upgrade need to be done to install the nftables that filter out the unwanted router advertisements at the new network namespace.

      Per the design , the logical switch that implements the layer2 network will have LSPs representing both the local GW router as well as the remote GW routers (in order to implement features like services / egress IPs).

      For IPv6 to work properly, we need to ensure these "remote" GW routers do not advertise their RAs outside the node they run on - thus we need to install ACLs applying to the logical switch that would drop RAs belonging to these "remote" GW routers.

      matching expression

      • "allow locally generated RAs": acl1: from-lport, prio 2000, match: "inport == <local-GR-port> && nd_ra" then allow
      • "drop all other RAs": acl2: from-lport, prio 1000, match: "nd_ra" then drop

      Also take into account that the proper solution is the future "transit router" topology feature from OVN that is in progress:

       

      Upstream PR:

              oshoval@redhat.com Or Shoval
              mduarted@redhat.com Miguel Duarte de Mora Barroso
              None
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: