Enable srcAndDstChecksEnabled field from k8s >= v1.22

[AxiomSamarth]

How to categorize this PR?

/area networking
/kind enhancement
/platform aws

What this PR does / why we need it:
This PR introduces a new field in the providerSpec of MachineClass for AWS called srcAndDstChecksEnabled which is true by default and when set to false will disable the source destination check on the AWS Instance (NAT instance in this case). This field shall be used by default from K8s >= v1.22

Which issue(s) this PR fixes:
Fixes #36

Special notes for your reviewer:

Release note:

Introducing a new field in the `providerSpec` of `MachineClass` for AWS called `srcAndDstChecksEnabled ` which is `true` by default and when set to `false` will disable the source destination check on the AWS Instance 

[gardener-robot]

@AxiomSamarth Label area/todo does not exist.

[AxiomSamarth]

/invite @prashanth26

@prashanth26 Could you please help with the area label for this draft PR?

[prashanth26]

@AxiomSamarth - We would also have to release the new MCM provider AWS version.

@DockToFuture - There would also be calico changes required right? I am guessing some flags in the configuration of the calico?

[gardener-robot]

@prashanth26 You have pull request review open invite, please check

[AxiomSamarth]

/invite @DockToFuture @ScheererJ

Is it okay to set the value of srcAndDstChecksEnabled to true by default if shoot k8s version is >= 1.22 or should it be set based on the boolean value from the network object here?

[DockToFuture]

srcAndDstChecksEnabled

/invite @DockToFuture @ScheererJ

Is it okay to set the value of srcAndDstChecksEnabled to true by default if shoot k8s version is >= 1.22 or should it be set based on the boolean value from the network object here?

It should either be disabled starting from k8s version >= 1.22 which would makes things easier or it should be set based on the boolean value from the network object. For the latter case I will introduce the boolean field spec.providerConfig.srcAndDstChecks.enabled in the network resource.

  providerConfig:
    apiVersion: calico.networking.extensions.gardener.cloud/v1alpha1
    kind: NetworkConfig
    srcAndDstChecks:
      enabled: false

[prashanth26]

Depends on #387.

[gardener-robot]

@ScheererJ, @prashanth26, @DockToFuture You have pull request review open invite, please check

[prashanth26]

Should we enable this setting by default on the CNIs? Or will the CNI support both ways? I am guessing it would be the latter. In that case, it should be fine.

cc: @DockToFuture for opinion.

[DockToFuture]

@prashanth26 What do you mean with Should we enable this setting by default on the CNIs?
It depends on the networking mode which is used, with an overlay we can use both with native infrastructure routing, we need to disable the checks otherwise it won't work.

[gardener-robot]

@prashanth26, @ScheererJ You have pull request review open invite, please check

[prashanth26]

Apologies for the delayed response.

@prashanth26 What do you mean with Should we enable this setting by default on the CNIs?
It depends on the networking mode which is used, with an overlay we can use both with native infrastructure routing, we need to disable the checks otherwise it won't work.

My question was that with current changes the check would be disabled by default with 1.22. And with this change, I hope both modes will be supported by the CNI. I guess it shouldn't affect the working of CNI in either configuration i.e. with/without IP-in-IP encapsulation right? It should work both ways?

[rfranzke]

cc @AxiomSamarth @DockToFuture

[AxiomSamarth]

@rfranzke I believe implementation is in place.

@DockToFuture Any more comments?

[DockToFuture]

was that with current changes the check would be disabled by default with 1.22. And with this change, I hope both modes will be supported by the CNI. I guess it shouldn't affect the working of CNI in either configuration i.e. with/without IP-in-IP encapsulation right? It should work both ways?

yes it will work in both modes with disabled checks

[DockToFuture]

/lgtm

[rfranzke]

Thanks! @prashanth26 any further comments?

[prashanth26]

/lgtm
Thanks. no further comments.

[ialidzhikov]

/hold
as there is already ongoing release validation

[ialidzhikov]

/unhold
as v1.28.0 was released

[rfranzke]

cc @timuthy