-
Notifications
You must be signed in to change notification settings - Fork 1.6k
UDP Support over IPv6 via Dualstack NLBs using SourceNAT configurations #3926
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
UDP Support over IPv6 via Dualstack NLBs using SourceNAT configurations #3926
Conversation
Hi @shethyogita83. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/ok-to-test |
/lgtm |
pkg/service/model_builder_test.go
Outdated
jsonString, err := d.Marshal(stack) | ||
assert.Equal(t, nil, err) | ||
assert.JSONEq(t, tt.wantValue, jsonString) | ||
assert.JSONEq(t, tt.wantValue, jsonString) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added assert twice by mistake.
/lgtm |
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: shethyogita83, shraddhabang, zac-nixon The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Issue
Until now, UDP on NLB was supported only over IPv4 address type NLBs because the NLB preserves the client-IP for IPv4 address type NLBs.
Dualstack NLBs and PrivateLink NLBs are required to do sourceNAT and thus cannot support UDP because in cases where NLB doesn’t preserve client-IP but translates (sourceNAT) it to its own IP, there is a risk of packets being mis-routed between clients.
But now we want to support UPD over IPv6 address type NLBs too since this feature allow customers (service owners) to provide UDP-based services such as media streaming, gaming, remote desktop applications, VoIP, etc., over IPv6 too.
Description
To support UDP for NLB over IPv6 on K8 controller Service, We introduced two new optional annotations on K8 Service annotations, for the corresponding API input Parameters on CreateLoadBalancer API and SetSubnets API
Optional Annotation 1 - service.beta.kubernetes.io/aws-load-balancer-enable-prefix-for-ipv6-source-nat: Values can be either “on” or “off”. Default value is off. Corresponding API Input property is EnablePrefixForIpv6SourceNat in CreateLoadBalancer API and SetSubnets API
Optional Annotation 2 - service.beta.kubernetes.io/aws-load-balancer-source-nat-ipv6-prefixes : Value is a list of ipv6Prefixes or if user doesn’t want to provide particular ipv6Prefixe value, user can use “auto-assigned”.
ipv6Prefixes list should have same length as the number of subnets. Each Ipv6 prefix in the list will be applied to each corresponding subnet in the subnets annotation list in the same order. A valid ipv6 prefix ends with /80 and it should be within the CIDR range of the corresponding subnet (e.g. 2600:1f16:ed6:312:98c3::/80). Corresponding API Input property is SourceNatIpv6Prefixes in CreateLoadBalancer API and SetSubnets API
This PR is very similar to the old PR https://github.com/shethyogita83/private-aws-load-balancer-controller/pull/1, but with required modifications to suit the aws-sdk-go version update.
Checklist
README.md
, or thedocs
directory)BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯