Packet drops with `externalTrafficPolicy: Cluster` in generic-veth chaining mode about cilium HOT 4 CLOSED

This patch makes it working in my setup with hostLegacyRouting=true execpt connectivity from pods to external net:

diff --git a/bpf/bpf_lxc.c b/bpf/bpf_lxc.c
index 5034120554..5b26d84b01 100644
--- a/bpf/bpf_lxc.c
+++ b/bpf/bpf_lxc.c
@@ -1250,7 +1250,7 @@ skip_vtep:
                        return ret;
        }
 #endif /* TUNNEL_MODE || ENABLE_HIGH_SCALE_IPCACHE */
-       if (is_defined(ENABLE_HOST_ROUTING)) {
+       if (!is_defined(ENABLE_HOST_ROUTING)) {
                int oif = 0;

                ret = fib_redirect_v4(ctx, ETH_HLEN, ip4, false, false, ext_err, &oif);

from cilium.

@borkmann maybe you could help to investigate this?

from cilium.

Oh, after three days of debugging I found that ovn0 device has missing bpf program:

now I added it to cilium-config:

devices: "en+ ovn0"

and everything statred working 🎉

# tc filter show dev ovn0 egress
filter protocol all pref 1 bpf chain 0
filter protocol all pref 1 bpf chain 0 handle 0x1 cil_to_netdev-ovn0 direct-action not_in_hw id 114214 tag 63638179020264a5 jited

Is there any way to say "use autodetected device plus another one" in cilium?

Also there is a potencial race condition, because kube-ovn requires cilium to working and starts , and cilium requires ovn0 interface to add bpf program on it.

from cilium.

Closed in favor #32721

from cilium.