Skip to content

[sample #12451] Per Pod/LB IP proxy ARP #201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stevegaossou wants to merge 1 commit into
base: coc-sample-12451-base
Choose a base branch
from
Open

[sample #12451] Per Pod/LB IP proxy ARP #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions api/config/crd/projectcalico.org_felixconfigurations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -771,6 +771,17 @@ spec:
type: object
type: array
x-kubernetes-list-type: atomic
hostSubnetNeighResponses:
description: |-
HostSubnetNeighResponses controls whether Felix automatically responds to
ARP (IPv4) and NDP (IPv6) requests on host interfaces for local pod IPs and
selected LoadBalancer VIPs that fall within the same subnet as the host
interface. When set to PodsAndLoadBalancers, pods and LB VIPs on the host
subnet are reachable from the local L2 segment without BGP. [Default: PodsAndLoadBalancers]
enum:
- Disabled
- PodsAndLoadBalancers
type: string
interfaceExclude:
description: |-
InterfaceExclude A comma-separated list of interface names that should be excluded when Felix is resolving
Expand Down
16 changes: 16 additions & 0 deletions api/pkg/apis/projectcalico/v3/felixconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,14 @@ const (
FloatingIPsDisabled FloatingIPType = "Disabled"
)

// +kubebuilder:validation:Enum=Disabled;PodsAndLoadBalancers
type HostSubnetNeighResponsesMode string

const (
HostSubnetNeighResponsesDisabled HostSubnetNeighResponsesMode = "Disabled"
HostSubnetNeighResponsesPodsAndLoadBalancers HostSubnetNeighResponsesMode = "PodsAndLoadBalancers"
)

// +kubebuilder:validation:Enum=Enabled;Disabled
type BPFHostNetworkedNATType string

Expand Down Expand Up @@ -1104,6 +1112,14 @@ type FelixConfigurationSpec struct {
// +optional
FloatingIPs *FloatingIPType `json:"floatingIPs,omitempty" validate:"omitempty"`

// HostSubnetNeighResponses controls whether Felix automatically responds to
// ARP (IPv4) and NDP (IPv6) requests on host interfaces for local pod IPs and
// selected LoadBalancer VIPs that fall within the same subnet as the host
// interface. When set to PodsAndLoadBalancers, pods and LB VIPs on the host
// subnet are reachable from the local L2 segment without BGP. [Default: PodsAndLoadBalancers]
// +optional
HostSubnetNeighResponses *HostSubnetNeighResponsesMode `json:"hostSubnetNeighResponses,omitempty" validate:"omitempty,oneof=Disabled PodsAndLoadBalancers"`

// WindowsManageFirewallRules configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports). [Default: Disabled]
// +optional
WindowsManageFirewallRules *WindowsManageFirewallRulesMode `json:"windowsManageFirewallRules,omitempty" validate:"omitempty,oneof=Enabled Disabled"`
Expand Down
5 changes: 5 additions & 0 deletions api/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions api/pkg/client/applyconfiguration_generated/internal/internal.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 14 additions & 0 deletions api/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 7 additions & 0 deletions api/pkg/openapi/generated.openapi.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

44 changes: 27 additions & 17 deletions e2e/pkg/describe/describe.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,23 +58,24 @@ func WithCategory(cat Category) any {
//
// If you are unsure which feature to use, please ask!
var features = map[string]bool{
"NetworkPolicy": true,
"Tiered-Policy": true,
"IPPool": true,
"IPAM": true,
"AutoHEPs": true,
"Host-Protection": true,
"HostPorts": true,
"OwnerReferences": true,
"MTU": true,
"Maglev": true,
"BGPPeer": true,
"IPIP": true,
"Tiered-RBAC": true,
"Pods": true,
"QoS": true,
"Datapath": true,
"Istio": true,
"NetworkPolicy": true,
"Tiered-Policy": true,
"IPPool": true,
"IPAM": true,
"AutoHEPs": true,
"Host-Protection": true,
"HostPorts": true,
"OwnerReferences": true,
"MTU": true,
"Maglev": true,
"BGPPeer": true,
"IPIP": true,
"Tiered-RBAC": true,
"Pods": true,
"QoS": true,
"Datapath": true,
"Istio": true,
"HostSubnetNeighResponses": true,
}

// RequiresCalicoAPIServer marks tests that depend on the aggregated Calico API
Expand Down Expand Up @@ -147,6 +148,15 @@ func WithExternalNode() any {
return framework.WithLabel("ExternalNode")
}

// RequiresKindNetwork marks tests that need to attach a docker container to the

@github-actions github-actions Bot Jun 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Casey Casey — I think relying on a manual --ginkgo.skip=KindNetwork is fragile — we’ve been trying to avoid self-skip and to fail explicitly with a clear reason. Could we make this behave like our other “Requires” patterns and fail-fast when the requirement isn’t met, e.g.,

Fail("This test requires local access to the docker daemon and a KIND network; run on a kind cluster or skip via labels")

Or, wire it up as a proper “RequiresKindNetwork” capability in the framework so CI selection/skips are explicit and enforced? The key thing IMO is: if the test runs in the wrong place, it should fail loudly with a helpful message.

// host's "kind" network as an L2-adjacent peer of the cluster nodes. These
// tests can only run where the test runner has direct access to the local
// docker daemon (i.e., kind clusters), and must be skipped elsewhere via
// --ginkgo.skip=KindNetwork.
func RequiresKindNetwork() any {
return framework.WithLabel("KindNetwork")
}

// RequiresAzureIPAM marks tests that require a cluster with Azure IPAM.
func RequiresAzureIPAM() any {
return framework.WithLabel("AzureIPAM")
Expand Down
Loading
Loading