KEP-4963: Kube-proxy Services Acceleration #4964
Open
+505
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: aojea The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
kind/kep
k8s-ci-robot
added
the
sig/network
aojea
changed the title
k8s-ci-robot
added
do-not-merge/work-in-progress
aojea
changed the title
Use the kernel flowtables infrastructure to allow kube-proxy users to accelerate service traffic. Change-Id: Iee638c8e86a4d17ddbdb30901b4fb4fd20e7dbda
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
|
/assign @thockin @danwinship I leave up to you if is worth to go through the feature gate process if this is an opt-in option |
|
|
||
| Once the network traffic moves to the datapath it completely bypass the kernel stack, so | ||
| any other network applications that depend on the packets going through the network stack (monitoring per example) we'll not be able to see the connection data. The feature will only | ||
| apply the fast path on established connections, since most of the network applications are statefuls, usually is safe to think that once a connection is established no additional operations are required on it. |
There was a problem hiding this comment.
Small typo:
Suggested change
| apply the fast path on established connections, since most of the network applications are statefuls, usually is safe to think that once a connection is established no additional operations are required on it. | |
| apply the fast path on established connections, since most of the network applications are stateful, usually is safe to think that once a connection is established no additional operations are required on it. |
|
|
||
| This feature will only work with kube-proxy nftables mode. | ||
|
|
||
| Users will be able to opt-in to Service traffic acceleration by passing a CEL expression using the flag `--accelerated-interface-expression` or the configuration option `AcceleratedInterfaceExpression` to match the network interfaces in the node that are subjet to Service traffic acceleration. The absence of a CEL expression disables the feature. |
There was a problem hiding this comment.
Suggested change
| Users will be able to opt-in to Service traffic acceleration by passing a CEL expression using the flag `--accelerated-interface-expression` or the configuration option `AcceleratedInterfaceExpression` to match the network interfaces in the node that are subjet to Service traffic acceleration. The absence of a CEL expression disables the feature. | |
| Users will be able to opt-in to Service traffic acceleration by passing a CEL expression using the flag `--accelerated-interface-expression` or the configuration option `AcceleratedInterfaceExpression` to match the network interfaces in the node that are subject to Service traffic acceleration. The absence of a CEL expression disables the feature. |
|
I like this proposal. Giving users the choice to opt in makes a lot of sense and reduces risk. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
One-line PR description: Service acceleration for Kube-proxy using netfilter’s flowtable infrastructure
Issue link: Kube-proxy Services Acceleration #4963
Other comments: See prototype implementation in Flowtables kubernetes#128392