[provider-local] Harmonize local VPN setup with real-world scenario #9752
+182
−288
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Skipping CI for Draft Pull Request. |
gardener-prow
bot
added
do-not-merge/work-in-progress
|
/test pull-gardener-e2e-kind pull-gardener-e2e-kind-ipv6 |
rfranzke
force-pushed
the
hackathon-provider-local-vpn
branch
2 times, most recently
from
928e29f
to
a483ac7
Compare
|
/test pull-gardener-e2e-kind pull-gardener-e2e-kind-ipv6 |
rfranzke
force-pushed
the
hackathon-provider-local-vpn
branch
from
a483ac7
to
d8873a1
Compare
|
/test pull-gardener-e2e-kind pull-gardener-e2e-kind-ipv6 |
timebertt
force-pushed
the
hackathon-provider-local-vpn
branch
2 times, most recently
from
305949a
to
6259b95
Compare
gardener-prow
bot
removed
the
do-not-merge/work-in-progress
|
EDIT: we added workarounds to make the upgrade tests past even we perform the |
timebertt
force-pushed
the
hackathon-provider-local-vpn
branch
6 times, most recently
from
90822ed
to
1caa265
Compare
gardener-prow
bot
added
the
needs-rebase
|
/assign |
ScheererJ
reviewed
May 22, 2024
timebertt
force-pushed
the
hackathon-provider-local-vpn
branch
from
1caa265
to
993a8bd
Compare
rfranzke
force-pushed
the
hackathon-provider-local-vpn
branch
from
63bca2e
to
dca9c39
Compare
gardener-prow
bot
removed
the
needs-rebase
rfranzke
force-pushed
the
hackathon-provider-local-vpn
branch
from
dca9c39
to
220cc9e
Compare
|
/lgtm |
|
LGTM label has been added. Git tree hash: bfc26186529edb2e4164aba58322fc8b01aaf476
|
rfranzke
force-pushed
the
hackathon-provider-local-vpn
branch
from
220cc9e
to
7218483
Compare
…ovider-local#42" This reverts commit 7ec12fe.
no longer needed now that MCM-provider-local no longer deploys a `Service`
This network policy is not needed since packets to the shoot networks are always encapsulated in the VPN tunnel and never handled by the seed network policies. Co-authored-by: Tim Ebert <[email protected]>
The shoot networks are always "contacted" via the VPN tunnel (which is established FROM the machine pods TO the `vpn-seed-server`). Co-authored-by: Tim Ebert <[email protected]>
Co-authored-by: Tim Ebert <[email protected]>
Co-Authored-By: Rafael Franzke <[email protected]> Co-Authored-By: Marcel Boehm <[email protected]>
Co-Authored-By: Johannes Scheerer <[email protected]>
rfranzke
force-pushed
the
hackathon-provider-local-vpn
branch
from
7218483
to
e4f54b4
Compare
|
/lgtm |
|
LGTM label has been added. Git tree hash: 3126d936a08bf1c4238dcf512c1b1fd428a9d7e4
|
|
Kaum macht man's richtig, schon geht's 😉 |
rfranzke
added a commit
to rfranzke/gardener
that referenced
this pull request
May 31, 2024
…N fix (from gardener#9752, released with `v1.96.0`)
vpnachev
added a commit
to gardener/gardener-extension-shoot-oidc-service
that referenced
this pull request
May 31, 2024
rfranzke
added a commit
to rfranzke/gardener
that referenced
this pull request
May 31, 2024
…N fix (from gardener#9752, released with `v1.96.0`)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
How to categorize this PR?
/area dev-productivity
/kind enhancement
What this PR does / why we need it:
Currently, in the local scenario, some pods talk to the machine pods directly (instead of using the VPN tunnel). See the referenced issue for a more detailed description.
This PR harmonizes the local VPN setup by specifying the node network for
Shoots and creating a dedicated IP pool.With this, the VPN components correctly configure IP routes for talking to the shoot node network.
As a consequence, all traffic correctly traverses the VPN tunnel and gardenlet's tunnel health check reliably detects a broken tunnel.
Which issue(s) this PR fixes:
Part of #9604
Fixes #9020
See also: https://github.com/gardener-community/hackathon/blob/main/2024-05_Schelklingen/README.md#-harmonize-local-vpn-setup-with-real-world-scenario
Special notes for your reviewer:
/cc @timebertt
We need to do some workarounds for making the e2e upgrade tests pass for this specific version. The workarounds are only active until the next minor release.
Release note: