Auto-detect nft from kube-proxy #11629
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds auto-detection of nftables mode for Felix by detecting whether kube-proxy is running in nftables mode. The key changes include:
- Adds "Auto" as a new NFTablesMode option alongside "Enabled" and "Disabled"
- Changes the default from "Disabled" to "Auto"
- Implements kube-proxy nftables mode detection by checking for the kube-proxy nftables table
- Refactors rule rendering to separate the boolean nft flag from the string configuration value
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| api/pkg/apis/projectcalico/v3/felixconfig.go | Adds NFTablesModeAuto constant and updates kubebuilder validation enum |
| api/pkg/openapi/generated.openapi.go | Updates OpenAPI schema description to reflect new "Auto" default |
| manifests/*.yaml | Updates all CRD manifests to include "Auto" enum value and change default to "Auto" |
| libcalico-go/config/crd/crd.projectcalico.org_felixconfigurations.yaml | Updates FelixConfiguration CRD with new enum and default |
| felix/rules/rule_defs.go | Changes NFTables config field from bool to string, adds nft bool field to renderer, updates NewRenderer signature |
| felix/rules/policy.go | Replaces r.NFTables with r.nft for chain name generation |
| felix/rules/endpoints.go | Replaces r.NFTables with r.nft throughout endpoint rendering |
| felix/rules/dispatch.go | Replaces r.NFTables with r.nft in dispatch chain logic |
| felix/dataplane/driver.go | Passes NFTablesMode string value instead of boolean |
| felix/dataplane/linux/int_dataplane.go | Implements kubeProxyNftablesFn for detection, useNftables decision function, and checkKubeProxyNftablesMode for runtime detection |
| felix/docs/config-params.md | Updates documentation to show "Auto" option and new default (incomplete) |
| felix/docs/config-params.json | Updates JSON schema to include "Auto" enum value |
| .semaphore/semaphore.yml | Generated CI file updated with new file path patterns |
caseydavenport
force-pushed
the
casey-nft-auto-detect
branch
4 times, most recently
from
ed37371 to
93d50f6
Compare
caseydavenport
force-pushed
the
casey-nft-auto-detect
branch
from
93d50f6 to
1c472db
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR makes it easier to switch to nftables mode on a live system, by having each node capable of auto-detecting whether to use iptables or nftables based on the local kube-proxy.
Related issues/PRs
Todos
Release Note
Reminder for the reviewer
Make sure that this PR has the correct labels and milestone set.
Every PR needs one
docs-*label.docs-pr-required: This change requires a change to the documentation that has not been completed yet.docs-completed: This change has all necessary documentation completed.docs-not-required: This change has no user-facing impact and requires no docs.Every PR needs one
release-note-*label.release-note-required: This PR has user-facing changes. Most PRs should have this label.release-note-not-required: This PR has no user-facing changes.Other optional labels:
cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.