Skip to content

Commit

Permalink
Website update for main
Browse files Browse the repository at this point in the history
  • Loading branch information
antrea-bot committed Oct 29, 2024
1 parent 4e870b3 commit 7d70e18
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 13 deletions.
2 changes: 1 addition & 1 deletion content/docs/main/docs/api-reference.html
Original file line number Diff line number Diff line change
Expand Up @@ -11784,5 +11784,5 @@ <h3 id="system.antrea.io/v1beta1.BundleStatus">BundleStatus
<hr/>
<p><em>
Generated with <code>gen-crd-api-reference-docs</code>
on git commit <code>71d57f1</code>.
on git commit <code>a6300d1</code>.
</em></p>
26 changes: 14 additions & 12 deletions content/docs/main/docs/egress.md
Original file line number Diff line number Diff line change
Expand Up @@ -466,13 +466,15 @@ in a cluster using `kube-proxy` IPVS. The issue was fixed in Antrea v1.7.0.

## Known issues

To support `EgressSeparateSubnet` feature, VLAN sub-interfaces will be created by
Antrea Agents, the `rp_filter` of VLAN sub-interfaces should be 2, which enables loose
mode filtering. In a vanilla Kubernetes cluster, Antrea Agents will set the `rp_filter`
to 2 automatically without user intervention. However, it has been observed that
`rp_filter` update by Antrea has no effect on OpenShift clusters due to [a known issue](https://github.com/antrea-io/antrea/issues/6546).
A workaround is to leverage OpenShift Node Tuning Operator to update the `rp_filter`
for `all` interface on all Egress Nodes:
To support the `EgressSeparateSubnet` feature, VLAN sub-interfaces will be
created by Antrea Agent on a Node, and the `rp_filter` setting of the VLAN
sub-interfaces should be set to `2`, which configures loose reverse path
filtering. In a vanilla Kubernetes cluster, Antrea Agent will set `rp_filter` to
`2` automatically without user intervention. However, it has been observed that
the `rp_filter` update by Antrea takes no effect on an OpenShift cluster due to
[a known issue](https://github.com/antrea-io/antrea/issues/6546). A workaround
for this issue is to leverage OpenShift Node Tuning Operator to update
`rp_filter` for all interfaces on all Egress Nodes:

```yaml
apiVersion: tuned.openshift.io/v1
Expand All @@ -496,8 +498,8 @@ spec:
profile: openshift-antrea
```

After you apply above `Tuned` CR named `antrea` in a given OpenShift cluster, the Node
Tuning Operator will watch the CR and update `net.ipv4.conf.all.rp_filter` to 2 for all
matched Nodes (e.g. all Nodes with a label `network-role=egress-gateway`). Please refer
to the OpenShift official document about [Using the Node Tuning Operator](https://docs.openshift.com/container-platform/4.16/scalability_and_performance/using-node-tuning-operator.html)
for more details of `Tuned` CR.
After you apply the above `Tuned` CR named `antrea` in an OpenShift cluster, the
Node Tuning Operator will reconcile the CR and update
`net.ipv4.conf.all.rp_filter` to `2` for all the matched Nodes (e.g. all Nodes
with label `network-role=egress-gateway`). Please refer to the OpenShift
document about [Using the Node Tuning Operator](https://docs.openshift.com/container-platform/4.16/scalability_and_performance/using-node-tuning-operator.html).

0 comments on commit 7d70e18

Please sign in to comment.