feat: CNS writes CNI conflist on Windows. #2281
Conversation
nddq
force-pushed
the
feat/cns-writes-cni-conflist-on-windows
branch
2 times, most recently
from
eb34786 to
d1fa944
Compare
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
nddq
force-pushed
the
feat/cns-writes-cni-conflist-on-windows
branch
4 times, most recently
from
71293ae to
ad104ca
Compare
| "ExceptionList": [ | ||
| "10.240.0.0/16", | ||
| "10.0.0.0/8" | ||
| ] | ||
| }`), | ||
| }, | ||
| { | ||
| Name: "EndpointPolicy", | ||
| Value: []byte(`{ | ||
| "Type": "ROUTE", | ||
| "DestinationPrefix": "10.0.0.0/8", | ||
| "NeedEncap": true |
There was a problem hiding this comment.
could you fix the indentation spaces here?
There was a problem hiding this comment.
@nddq it's a mix of spaces and tabs, you should replace it with all tabs
| "ExceptionList": [ | ||
| "10.240.0.0/16", | ||
| "10.0.0.0/8" | ||
| ] | ||
| }`), | ||
| }, | ||
| { | ||
| Name: "EndpointPolicy", | ||
| Value: []byte(`{ | ||
| "Type": "ROUTE", | ||
| "DestinationPrefix": "10.0.0.0/8", | ||
| "NeedEncap": true |
There was a problem hiding this comment.
this could come in a later PR, but we should test this feature on our pipeline clusters
nddq
force-pushed
the
feat/cns-writes-cni-conflist-on-windows
branch
from
ad104ca to
ec788d4
Compare
rbtr
force-pushed
the
feat/cns-writes-cni-conflist-on-windows
branch
from
ec788d4 to
327b97b
Compare
nddq
force-pushed
the
feat/cns-writes-cni-conflist-on-windows
branch
from
327b97b to
10324cc
Compare
| @@ -0,0 +1,52 @@ | |||
| { | |||
There was a problem hiding this comment.
I know that in Windows AKS, the CNI conflist is generated dynamically based on a few things:
- If the customer specified
DisableOutboundNAT, then a certainExceptionListfor anEndpointPolicywill not be present- In the conflist I commented down below, this block is what I'm talking about:
{
"Name": "EndpointPolicy",
"Value": {
"Type": "OutBoundNAT",
"ExceptionList": [
"fddc:be24:d690:87d::/64"
]
}
},
There are other settings that are dynamic, based on a few customer inputs, so we'll need to take all that into account when generating these Windows conflists
Here is where the Conflists are configured (altered) in Windows AKS: AgentBaker - azurecnifunc.ps1
I would also talk to @AbelHu about what all settings in a customer cluster, can change the Conflist (or read the script I linked, he gave it to me originally)
| @@ -0,0 +1,52 @@ | |||
| { | |||
| "cniVersion": "0.3.0", | |||
There was a problem hiding this comment.
Here is an example overlay conflist today in AKS, from a cluster that I just made once:
{
"cniVersion": "0.3.0",
"name": "azure",
"adapterName": "",
"plugins": [
{
"type": "azure-vnet",
"mode": "bridge",
"bridge": "azure0",
"capabilities": {
"portMappings": true,
"dns": true
},
"ipam": {
"type": "azure-cns",
"mode": "overlay"
},
"dns": {
"Nameservers": [
"10.0.0.10",
"168.63.129.16"
],
"Search": [
"svc.cluster.local"
]
},
"AdditionalArgs": [
{
"Name": "EndpointPolicy",
"Value": {
"Type": "OutBoundNAT",
"ExceptionList": [
"10.244.0.0/16"
]
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "OutBoundNAT",
"ExceptionList": [
"fddc:be24:d690:87d::/64"
]
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Protocols": "6",
"Action": "Block",
"Direction": "Out",
"RemoteAddresses": "168.63.129.16/32",
"RemotePorts": "80",
"Priority": 200,
"RuleType": "Switch"
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Action": "Allow",
"Direction": "In",
"Priority": 65500
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Action": "Allow",
"Direction": "Out",
"Priority": 65500
}
}
],
"windowsSettings": {
"enableLoopbackDSR": true
}
}
]
}
nddq
force-pushed
the
feat/cns-writes-cni-conflist-on-windows
branch
from
10324cc to
26c1d07
Compare
Merge queue setting changed
|
This pull request is stale because it has been open for 2 weeks with no activity. Remove stale label or comment or this will be closed in 7 days |
|
Pull request closed due to inactivity. |
Reason for Change:
Allow CNS to write CNI conflist for SWIFT and SWIFT Overlay scenario on Windows.
Issue Fixed:
Requirements:
Notes: