643effc340
In case of hairpin LB traffic (member of the LB calls the LB and the
request is directed back to the same member) OVN replaces the source-ip
of the request with the LB IP. This means that pods with network
policies applied may have that traffic blocked when it should be
allowed.
To fix that this commit makes sure that SGs used for NPs include ingress
rules for each of the Service in it's namespace. It's not ideal but
seems to be a fair compromise between opening as little traffic as
possible and increasing number of security groups and rules.
As this commit makes sure all the NPs in the namespaces are reanalyzed
every time a Service is created or deleted, a little fixes in order to
support that are also made.
Change-Id: I7e0458c4071e4a43ab4d158429e05c67cd897a3c
Closes-Bug: 1923452
(cherry picked from commit
|
||
|---|---|---|
| .zuul.d | ||
| contrib | ||
| devstack | ||
| doc | ||
| etc | ||
| kubernetes_crds | ||
| kuryr_cni | ||
| kuryr_kubernetes | ||
| playbooks | ||
| releasenotes | ||
| tools | ||
| .coveragerc | ||
| .dockerignore | ||
| .gitignore | ||
| .gitreview | ||
| .pre-commit-config.yaml | ||
| .stestr.conf | ||
| CONTRIBUTING.rst | ||
| HACKING.rst | ||
| LICENSE | ||
| README.rst | ||
| babel.cfg | ||
| cni.Dockerfile | ||
| cni_ds_init | ||
| controller.Dockerfile | ||
| lower-constraints.txt | ||
| requirements.txt | ||
| setup.cfg | ||
| setup.py | ||
| test-requirements.txt | ||
| tox.ini | ||
README.rst
Team and repository tags
Project description
Kubernetes integration with OpenStack networking
The OpenStack Kuryr project enables native Neutron-based networking in Kubernetes. With Kuryr-Kubernetes it's now possible to choose to run both OpenStack VMs and Kubernetes Pods on the same Neutron network if your workloads require it or to use different segments and, for example, route between them.
- Free software: Apache license
- Documentation: https://docs.openstack.org/kuryr-kubernetes/latest
- Source: https://opendev.org/openstack/kuryr-kubernetes
- Bugs: https://bugs.launchpad.net/kuryr-kubernetes
- Overview and demo: https://superuser.openstack.org/articles/networking-kubernetes-kuryr
- Release notes: https://docs.openstack.org/releasenotes/kuryr-kubernetes/
Contribution guidelines
For the process of new feature addition, refer to the Kuryr Policy.