From 78e6409bd0abac23451951dc93748513d238bcec Mon Sep 17 00:00:00 2001 From: Dalton Hubble Date: Sat, 1 Aug 2020 21:00:39 -0700 Subject: [PATCH] Fix flannel support on Fedora CoreOS * Fedora CoreOS now ships systemd-udev's `default.link` while Flannel relies on being able to pick its own MAC address for the `flannel.1` link for tunneled traffic to reach cni0 on the destination side, without being dropped * This change first appeared in FCOS testing-devel 32.20200624.20.1 and is the behavior going forward in FCOS since it was added to align FCOS network naming / configs with the rest of Fedora and address issues related to the default being missing * Flatcar Linux (and Container Linux) has a specific flannel.link configuration builtin, so it was not affected * https://github.com/coreos/fedora-coreos-tracker/issues/574#issuecomment-665487296 Note: Typhoon's recommended and default CNI provider is Calico, unless `networking` is set to flannel directly. --- CHANGES.md | 7 +++++++ aws/fedora-coreos/kubernetes/fcc/controller.yaml | 7 +++++++ aws/fedora-coreos/kubernetes/workers/fcc/worker.yaml | 7 +++++++ azure/fedora-coreos/kubernetes/fcc/controller.yaml | 7 +++++++ azure/fedora-coreos/kubernetes/workers/fcc/worker.yaml | 7 +++++++ bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml | 7 +++++++ bare-metal/fedora-coreos/kubernetes/fcc/worker.yaml | 7 +++++++ digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml | 7 +++++++ digital-ocean/fedora-coreos/kubernetes/fcc/worker.yaml | 7 +++++++ google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml | 7 +++++++ .../fedora-coreos/kubernetes/workers/fcc/worker.yaml | 7 +++++++ 11 files changed, 77 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index 3de6d207..2e5a2985 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -8,6 +8,13 @@ Notable changes between versions. * Update CoreDNS from v1.6.7 to [v1.7.0](https://coredns.io/2020/06/15/coredns-1.7.0-release/) * Update Cilium from v1.8.1 to [v1.8.2](https://github.com/cilium/cilium/releases/tag/v1.8.2) +### Fedora CoreOS + +* Fix support for Flannel with Fedora CoreOS ([#795](https://github.com/poseidon/typhoon/pull/795)) + * Fedora CoreOS fixes to align network interface defaults altered MAC address assignment for + the `flannel.1` interface in a way that caused flannel to drop pod-to-pod traffic + * Configure flannel interfaces explicitly + #### Addons * Update Prometheus from v2.19.2 to [v2.20.0](https://github.com/prometheus/prometheus/releases/tag/v2.20.0) diff --git a/aws/fedora-coreos/kubernetes/fcc/controller.yaml b/aws/fedora-coreos/kubernetes/fcc/controller.yaml index 0d8b4c35..0bec7c81 100644 --- a/aws/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/aws/fedora-coreos/kubernetes/fcc/controller.yaml @@ -183,6 +183,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/aws/fedora-coreos/kubernetes/workers/fcc/worker.yaml b/aws/fedora-coreos/kubernetes/workers/fcc/worker.yaml index c178f896..5fdeca2a 100644 --- a/aws/fedora-coreos/kubernetes/workers/fcc/worker.yaml +++ b/aws/fedora-coreos/kubernetes/workers/fcc/worker.yaml @@ -110,6 +110,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/azure/fedora-coreos/kubernetes/fcc/controller.yaml b/azure/fedora-coreos/kubernetes/fcc/controller.yaml index a337e9a8..cdfa5f2a 100644 --- a/azure/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/azure/fedora-coreos/kubernetes/fcc/controller.yaml @@ -182,6 +182,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/azure/fedora-coreos/kubernetes/workers/fcc/worker.yaml b/azure/fedora-coreos/kubernetes/workers/fcc/worker.yaml index 06904d40..e392486a 100644 --- a/azure/fedora-coreos/kubernetes/workers/fcc/worker.yaml +++ b/azure/fedora-coreos/kubernetes/workers/fcc/worker.yaml @@ -109,6 +109,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml b/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml index 2f6c9ee7..4700a9c4 100644 --- a/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml @@ -193,6 +193,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/bare-metal/fedora-coreos/kubernetes/fcc/worker.yaml b/bare-metal/fedora-coreos/kubernetes/fcc/worker.yaml index 79a9275b..2b0645a1 100644 --- a/bare-metal/fedora-coreos/kubernetes/fcc/worker.yaml +++ b/bare-metal/fedora-coreos/kubernetes/fcc/worker.yaml @@ -111,6 +111,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml b/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml index a819e6a6..6ce76a4d 100644 --- a/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml @@ -189,6 +189,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/digital-ocean/fedora-coreos/kubernetes/fcc/worker.yaml b/digital-ocean/fedora-coreos/kubernetes/fcc/worker.yaml index f4b605e5..fbff7b33 100644 --- a/digital-ocean/fedora-coreos/kubernetes/fcc/worker.yaml +++ b/digital-ocean/fedora-coreos/kubernetes/fcc/worker.yaml @@ -114,6 +114,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml b/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml index 8edb5261..b9fdcef2 100644 --- a/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml @@ -182,6 +182,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: | diff --git a/google-cloud/fedora-coreos/kubernetes/workers/fcc/worker.yaml b/google-cloud/fedora-coreos/kubernetes/workers/fcc/worker.yaml index dff706ce..5db86926 100644 --- a/google-cloud/fedora-coreos/kubernetes/workers/fcc/worker.yaml +++ b/google-cloud/fedora-coreos/kubernetes/workers/fcc/worker.yaml @@ -109,6 +109,13 @@ storage: inline: | net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.*.rp_filter=0 + - path: /etc/systemd/network/50-flannel.link + contents: + inline: | + [Match] + OriginalName=flannel* + [Link] + MACAddressPolicy=none - path: /etc/systemd/system.conf.d/accounting.conf contents: inline: |