Azure / Azure/unbounded

unbounded-net : issue timeout AKS control plane routing

Open
#503 4 comments 0 reactions 1 assignee Claimed by @phealy View on GitHub
Dominant language
Go
Stars
28
Forks
11
Avg merge
1d 8h
Merged PRs (30d)
55

Description

During the installation of a Flex Node on a private AKS cluster, we encountered timeout issues toward the control plane, which hosts the private link on the same subnet as the AKS nodes.

Jul 16 16:55:00 kubelet[175]: E0716 16:55:00.235062 175 status_manager.go:1045] "Failed to get status for pod" err="Get \"https://xxx.privatelink.westeurope.azmk8s.io:443/api/v1/namespaces/unbounded-net/pods/unbounded-net-kube-proxy-onprem-pero-site-hf57m\": dial tcp 10.6411.13:443: i/o timeout" podUID="d1fdb0d3-728e-475d-a108-16ea4da3be89" pod="unbounded-net/unbounded-net-kube-proxy-onprem-a-site-hf57m"

The network is 10.64.11.0/25. After the unbounded-net-cni container starts up, we see that a route is created that redirects traffic to the unbounded0 interface. As a result, the traffic bypasses the physical interface.

```
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.96.127.1 0.0.0.0 UG 0 0 0 enp5s0
10.64.11.0 0.0.0.0 255.255.255.128 U 0 0 0 unbounded0
10.96.127.0 0.0.0.0 255.255.255.0 U 0 0 0 enp5s0
10.160.127.0 0.0.0.0 255.255.255.0 U 0 0 0 unbounded0
172.16.100.0 0.0.0.0 255.255.252.0 U 0 0 0 unbounded0
172.16.200.0 0.0.0.0 255.255.252.0 U 0 0 0 unbounded0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 unbounded0
192.168.0.0 0.0.0.0 255.255.192.0 U 0 0 0 unbounded0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 unbounded0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 unbounded0
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 unbounded0
```

We have created both the Site and SitePeering resources, but the issue persists even after rebooting the node.

```
apiVersion: net.unbounded-cloud.io/v1alpha1
kind: Site
metadata:
name: azure-cloud-site
namespace: unbounded-net
spec:
tunnelProtocol: VXLAN
nodeCidrs:
- 10.64.11.0/25
podCidrAssignments:
- cidrBlocks:
- 192.168.0.0/18
---
apiVersion: net.unbounded-cloud.io/v1alpha1
kind: GatewayPool
metadata:
name: azure-gateway-pool
namespace: unbounded-net
spec:
type: Internal
tunnelProtocol: VXLAN
nodeSelector:
kubernetes.io/os: linux
---
apiVersion: net.unbounded-cloud.io/v1alpha1
kind: Site
metadata:
name: onprem-a-site
namespace: unbounded-net
spec:
tunnelProtocol: VXLAN
nodeCidrs:
- 10.96.127.0/24
podCidrAssignments:
- cidrBlocks:
- 172.16.100.0/22
---
apiVersion: net.unbounded-cloud.io/v1alpha1
kind: GatewayPool
metadata:
name: onprem-a-gateway-pool
namespace: unbounded-net
spec:
type: Internal
tunnelProtocol: VXLAN
nodeSelector:
location: a
---
apiVersion: net.unbounded-cloud.io/v1alpha1
kind: Site
metadata:
name: onprem-b-site
namespace: unbounded-net
spec:
tunnelProtocol: VXLAN
nodeCidrs:
- 10.160.127.0/24
podCidrAssignments:
- cidrBlocks:
- 172.16.200.0/22
---
apiVersion: net.unbounded-cloud.io/v1alpha1
kind: GatewayPool
metadata:
name: onprem-b-gateway-pool
namespace: unbounded-net
spec:
type: Internal
tunnelProtocol: VXLAN
nodeSelector:
location: b
```
In this scenario the unbounded-net-node created wrong routes because it used the nodeCidrs value present into the site CRD config and created the routes for the VXLAN traffic but it's not correct.

```
10.64.11.0 0.0.0.0 255.255.255.128 U 0 0 0 unbounded0
10.96.127.0 0.0.0.0 255.255.255.0 U 0 0 0 enp5s0
10.160.127.0 0.0.0.0 255.255.255.0 U 0 0 0 unbounded0
```

Marcello

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.