Dan Winship c12534d8b4 kubelet, kube-proxy: unmark packets before masquerading them ...

It seems that if you set the packet mark on a packet and then route
that packet through a kernel VXLAN interface, the VXLAN-encapsulated
packet will still have the mark from the original packet. Since our
NAT rules are based on the packet mark, this was causing us to
double-NAT some packets, which then triggered a kernel checksumming
bug. But even without the checksum bug, there are reasons to avoid
double-NATting, so fix the rules to unmark the packets before
masquerading them.

2020-06-15 18:45:38 -04:00

951 B

Raw Blame History

View Raw