forked from gardener/gardener
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add network disjointness check between shoot node network and seed po…
…d network. (gardener#8353) * Add network disjointness check between shoot node network and seed pod network. In case there is an overlap between the shoot node network and the seed pod network there can be strange network issues due to incorrect layer 3 routing. For the default VPN, the affected connections are from kube-apiserver to vpn-seed-server and from istio-ingressgateway to vpn-seed-server. In both cases the reply (SYN-ACK) may be incorrectly sent into the VPN tunnel when the source pod IP overlaps with the shoot node network as the shoot node network is added as a special route along with the shoot service and shoot pod networks. In the highly-available VPN, the affected connections are from any pod in the seed to kube-apiserver of the shoot cluster. SYN-ACK packets may be sent incorrectly into the VPN tunnel as kube-apiserver has similar special route for shoot nodes, pods and services. This issue is not new, but was present also with the previous VPN solution. * Address review feedback
- Loading branch information
Showing
2 changed files
with
72 additions
and
45 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters