Skip to content

[sample #12451] [v2] Per Pod/LB IP proxy ARP #241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stevegaossou wants to merge 1 commit into
base: coc-sample-12451-v2-base
Choose a base branch
from
+2,810 −32
Open

[sample #12451] [v2] Per Pod/LB IP proxy ARP #241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions api/config/crd/projectcalico.org_felixconfigurations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -771,6 +771,17 @@ spec:
type: object
type: array
x-kubernetes-list-type: atomic
hostSubnetNeighResponses:
description: |-
HostSubnetNeighResponses controls whether Felix automatically responds to
ARP (IPv4) and NDP (IPv6) requests on host interfaces for local pod IPs and
selected LoadBalancer VIPs that fall within the same subnet as the host
interface. When set to PodsAndLoadBalancers, pods and LB VIPs on the host
subnet are reachable from the local L2 segment without BGP. [Default: PodsAndLoadBalancers]
enum:
- Disabled
- PodsAndLoadBalancers
type: string
interfaceExclude:
description: |-
InterfaceExclude A comma-separated list of interface names that should be excluded when Felix is resolving
Expand Down
16 changes: 16 additions & 0 deletions api/pkg/apis/projectcalico/v3/felixconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,14 @@ const (
FloatingIPsDisabled FloatingIPType = "Disabled"
)

// +kubebuilder:validation:Enum=Disabled;PodsAndLoadBalancers

@github-actions github-actions Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Casey Casey — I think “Neigh” here is a bit opaque — any reason not to spell this out?

Suggested change
// +kubebuilder:validation:Enum=Disabled;PodsAndLoadBalancers
// +kubebuilder:validation:Enum=Disabled;PodsAndLoadBalancers
type HostSubnetNeighborResponsesMode string
const (
HostSubnetNeighborResponsesDisabled HostSubnetNeighborResponsesMode = "Disabled"
HostSubnetNeighborResponsesPodsAndLoadBalancers HostSubnetNeighborResponsesMode = "PodsAndLoadBalancers"
)

We tend to prefer descriptive names over abbreviations.

type HostSubnetNeighResponsesMode string

const (
HostSubnetNeighResponsesDisabled HostSubnetNeighResponsesMode = "Disabled"
HostSubnetNeighResponsesPodsAndLoadBalancers HostSubnetNeighResponsesMode = "PodsAndLoadBalancers"
)

// +kubebuilder:validation:Enum=Enabled;Disabled
type BPFHostNetworkedNATType string

Expand Down Expand Up @@ -1104,6 +1112,14 @@ type FelixConfigurationSpec struct {
// +optional
FloatingIPs *FloatingIPType `json:"floatingIPs,omitempty" validate:"omitempty"`

// HostSubnetNeighResponses controls whether Felix automatically responds to
// ARP (IPv4) and NDP (IPv6) requests on host interfaces for local pod IPs and
// selected LoadBalancer VIPs that fall within the same subnet as the host
// interface. When set to PodsAndLoadBalancers, pods and LB VIPs on the host
// subnet are reachable from the local L2 segment without BGP. [Default: PodsAndLoadBalancers]
// +optional
HostSubnetNeighResponses *HostSubnetNeighResponsesMode `json:"hostSubnetNeighResponses,omitempty" validate:"omitempty,oneof=Disabled PodsAndLoadBalancers"`

// WindowsManageFirewallRules configures whether or not Felix will program Windows Firewall rules (to allow inbound access to its own metrics ports). [Default: Disabled]
// +optional
WindowsManageFirewallRules *WindowsManageFirewallRulesMode `json:"windowsManageFirewallRules,omitempty" validate:"omitempty,oneof=Enabled Disabled"`
Expand Down
5 changes: 5 additions & 0 deletions api/pkg/apis/projectcalico/v3/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions api/pkg/client/applyconfiguration_generated/internal/internal.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 14 additions & 0 deletions api/pkg/client/applyconfiguration_generated/projectcalico/v3/felixconfigurationspec.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 7 additions & 0 deletions api/pkg/openapi/generated.openapi.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

44 changes: 27 additions & 17 deletions e2e/pkg/describe/describe.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,23 +58,24 @@ func WithCategory(cat Category) any {
//
// If you are unsure which feature to use, please ask!
var features = map[string]bool{
"NetworkPolicy": true,
"Tiered-Policy": true,
"IPPool": true,
"IPAM": true,
"AutoHEPs": true,
"Host-Protection": true,
"HostPorts": true,
"OwnerReferences": true,
"MTU": true,
"Maglev": true,
"BGPPeer": true,
"IPIP": true,
"Tiered-RBAC": true,
"Pods": true,
"QoS": true,
"Datapath": true,
"Istio": true,
"NetworkPolicy": true,
"Tiered-Policy": true,
"IPPool": true,
"IPAM": true,
"AutoHEPs": true,
"Host-Protection": true,
"HostPorts": true,
"OwnerReferences": true,
"MTU": true,
"Maglev": true,
"BGPPeer": true,
"IPIP": true,
"Tiered-RBAC": true,
"Pods": true,
"QoS": true,
"Datapath": true,
"Istio": true,
"HostSubnetNeighResponses": true,
}

// RequiresCalicoAPIServer marks tests that depend on the aggregated Calico API
Expand Down Expand Up @@ -147,6 +148,15 @@ func WithExternalNode() any {
return framework.WithLabel("ExternalNode")
}

// RequiresKindNetwork marks tests that need to attach a docker container to the
// host's "kind" network as an L2-adjacent peer of the cluster nodes. These
// tests can only run where the test runner has direct access to the local
// docker daemon (i.e., kind clusters), and must be skipped elsewhere via
// --ginkgo.skip=KindNetwork.
func RequiresKindNetwork() any {
return framework.WithLabel("KindNetwork")
}

// RequiresAzureIPAM marks tests that require a cluster with Azure IPAM.
func RequiresAzureIPAM() any {
return framework.WithLabel("AzureIPAM")
Expand Down
Loading
Loading