Skip to content

Commit e78b14d

Browse files
cheina97adamjensenbot
cheina97
authored and
adamjensenbot
committed
Network: aggressive dns resolution
1 parent efa23ba commit e78b14d

File tree

2 files changed

+152
-11
lines changed

2 files changed

+152
-11
lines changed

‎deployments/liqo/templates/liqo-wireguard-gateway-server-template-eks.yaml‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
{{- $templateConfig := (merge (dict "name" "wireguard-server-eks" "module" "networking") .) -}}
2+
{{- $gatewayConfig := (merge (dict "name" "gateway" "module" "networking" "version" .Values.networking.gatewayTemplates.container.gateway.image.version) .) -}}
3+
{{- $wireguardConfig := (merge (dict "name" "gateway-wireguard" "module" "networking" "version" .Values.networking.gatewayTemplates.container.wireguard.image.version) .) -}}
4+
{{- $geneveConfig := (merge (dict "name" "gateway-geneve" "module" "networking" "version" .Values.networking.gatewayTemplates.container.geneve.image.version) .) -}}
5+
6+
{{- if .Values.networking.enabled }}
7+
8+
apiVersion: networking.liqo.io/v1alpha1
9+
kind: WgGatewayServerTemplate
10+
metadata:
11+
name: {{ $templateConfig.name }}
12+
labels:
13+
{{- include "liqo.labels" $templateConfig | nindent 4 }}
14+
spec:
15+
objectKind:
16+
apiVersion: networking.liqo.io/v1alpha1
17+
kind: WgGatewayServer
18+
template:
19+
metadata:
20+
{{- include "liqo.metadataTemplate" $templateConfig | nindent 6 }}
21+
spec:
22+
service:
23+
metadata:
24+
{{- include "liqo.metadataTemplate" $templateConfig | nindent 10 }}
25+
{{- if .Values.networking.gatewayTemplates.server.service.annotations }}
26+
annotations:
27+
{{- toYaml .Values.networking.gatewayTemplates.server.service.annotations | nindent 12 }}
28+
service.beta.kubernetes.io/aws-load-balancer-type: external
29+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
30+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "80"
31+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: TCP
32+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "3"
33+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "3"
34+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-timeout: "10"
35+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "10"
36+
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
37+
{{- end }}
38+
spec:
39+
selector:
40+
{{- include "liqo.labelsTemplate" $templateConfig | nindent 12 }}
41+
type: "{{"{{ .Spec.Endpoint.ServiceType }}"}}"
42+
ports:
43+
- port: "{{"{{ .Spec.Endpoint.Port }}"}}"
44+
protocol: UDP
45+
targetPort: "{{"{{ .Spec.Endpoint.Port }}"}}"
46+
{{- if .Values.networking.gatewayTemplates.server.service.allocateLoadBalancerNodePorts }}
47+
allocateLoadBalancerNodePorts: {{ .Values.networking.gatewayTemplates.server.service.allocateLoadBalancerNodePorts }}
48+
{{- end }}
49+
deployment:
50+
metadata:
51+
{{- include "liqo.metadataTemplate" $templateConfig | nindent 10 }}
52+
spec:
53+
replicas: {{ .Values.networking.gatewayTemplates.replicas }}
54+
strategy:
55+
type: Recreate
56+
selector:
57+
matchLabels:
58+
{{- include "liqo.labelsTemplate" $templateConfig | nindent 14 }}
59+
template:
60+
metadata:
61+
{{- include "liqo.metadataTemplate" $templateConfig | nindent 14 }}
62+
spec:
63+
serviceAccount: "{{"{{ .Name }}"}}"
64+
serviceAccountName: "{{"{{ .Name }}"}}"
65+
containers:
66+
- name: gateway
67+
image: {{ .Values.networking.gatewayTemplates.container.gateway.image.name }}{{ include "liqo.suffix" $gatewayConfig }}:{{ include "liqo.version" $gatewayConfig }}
68+
imagePullPolicy: {{ .Values.pullPolicy }}
69+
args:
70+
- --name={{"{{ .Name }}"}}
71+
- --namespace={{"{{ .Namespace }}"}}
72+
- --remote-cluster-id={{"{{ .ClusterID }}"}}
73+
- --node-name={{"$(NODE_NAME)"}}
74+
- --gateway-uid={{"{{ .GatewayUID }}"}}
75+
- --mode=server
76+
- --metrics-address=:8080
77+
- --health-probe-bind-address=:8081
78+
- --ping-enabled=true
79+
- --ping-loss-threshold={{ .Values.networking.gatewayTemplates.ping.lossThreshold }}
80+
- --ping-interval={{ .Values.networking.gatewayTemplates.ping.interval }}
81+
- --ping-update-status-interval={{ .Values.networking.gatewayTemplates.ping.updateStatusInterval }}
82+
{{- if gt .Values.networking.gatewayTemplates.replicas 1.0 }}
83+
- --leader-election=true
84+
{{- end }}
85+
env:
86+
- name: NODE_NAME
87+
valueFrom:
88+
fieldRef:
89+
fieldPath: spec.nodeName
90+
securityContext:
91+
privileged: true
92+
capabilities:
93+
add:
94+
- NET_ADMIN
95+
- NET_RAW
96+
- name: wireguard
97+
image: {{ .Values.networking.gatewayTemplates.container.wireguard.image.name }}{{ include "liqo.suffix" $wireguardConfig }}:{{ include "liqo.version" $wireguardConfig }}
98+
imagePullPolicy: {{ .Values.pullPolicy }}
99+
args:
100+
- --name={{"{{ .Name }}"}}
101+
- --namespace={{"{{ .Namespace }}"}}
102+
- --remote-cluster-id={{"{{ .ClusterID }}"}}
103+
- --gateway-uid={{"{{ .GatewayUID }}"}}
104+
- --mode=server
105+
- --mtu={{"{{ .Spec.MTU }}"}}
106+
- --listen-port={{"{{ .Spec.Endpoint.Port }}"}}
107+
- --metrics-address=:8082
108+
- --health-probe-bind-address=:8083
109+
- --implementation={{ .Values.networking.gatewayTemplates.wireguard.implementation }}
110+
securityContext:
111+
capabilities:
112+
add:
113+
- NET_ADMIN
114+
- NET_RAW
115+
{{ if .Values.networking.gatewayTemplates.wireguard.implementation | eq "userspace" }}
116+
privileged: true
117+
{{ end }}
118+
- name: geneve
119+
image: {{ .Values.networking.gatewayTemplates.container.geneve.image.name }}{{ include "liqo.suffix" $geneveConfig }}:{{ include "liqo.version" $geneveConfig }}
120+
imagePullPolicy: {{ .Values.pullPolicy }}
121+
args:
122+
- --name={{"{{ .Name }}"}}
123+
- --namespace={{"{{ .Namespace }}"}}
124+
- --remote-cluster-id={{"{{ .ClusterID }}"}}
125+
- --node-name={{"$(NODE_NAME)"}}
126+
- --gateway-uid={{"{{ .GatewayUID }}"}}
127+
- --mode=server
128+
- --metrics-address=:8084
129+
- --health-probe-bind-address=:8085
130+
- --enable-arp=true
131+
env:
132+
- name: NODE_NAME
133+
valueFrom:
134+
fieldRef:
135+
fieldPath: spec.nodeName
136+
securityContext:
137+
capabilities:
138+
add:
139+
- NET_ADMIN
140+
- NET_RAW
141+
- name: tcp-healthcheck
142+
image: nginx
143+
# Uncomment to set a priorityClassName
144+
# priorityClassName: ""
145+
{{- end }}

‎pkg/gateway/tunnel/wireguard/dns.go‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -40,23 +40,22 @@ import (
4040
// The DNS is resolved every 5 minutes.
4141
// If the DNS changed a new publickkeys-controller reconcile is triggered through a generic event.
4242
func StartDNSRoutine(ctx context.Context, ch chan event.GenericEvent, opts *Options) {
43-
// Try to solve the DNS every 5 seconds until the DNS is resolved.
44-
// This is useful to avoid to wait 5 minutes before the first DNS resolution.
45-
// In some cases (like AWS LoadBalancer) the DNS is not immediatlly populated.
46-
err := wait.PollUntilContextCancel(ctx, time.Second*5, true, forgeResolveCallback(opts, ch, true))
47-
if err != nil {
43+
// Try to solve the DNS every 5 seconds until the DNS is resolved for 10 minutes.
44+
// In some cases (like AWS LoadBalancer) the DNS is not immediatlly populated or can contain not working IPs.
45+
timeout, _ := context.WithTimeoutCause(ctx, time.Minute*10, context.DeadlineExceeded)
46+
err := wait.PollUntilContextCancel(timeout, time.Second*5, true, forgeResolveCallback(opts, ch))
47+
if err != nil && !errors.Is(err, context.DeadlineExceeded) {
4848
klog.Error(err)
4949
os.Exit(1)
5050
}
51-
err = wait.PollUntilContextCancel(ctx, opts.DNSCheckInterval, true, forgeResolveCallback(opts, ch, false))
51+
err = wait.PollUntilContextCancel(ctx, opts.DNSCheckInterval, true, forgeResolveCallback(opts, ch))
5252
if err != nil {
5353
klog.Error(err)
5454
os.Exit(1)
5555
}
5656
}
5757

58-
func forgeResolveCallback(opts *Options, ch chan event.GenericEvent,
59-
solveJustOnce bool) func(_ context.Context) (done bool, err error) {
58+
func forgeResolveCallback(opts *Options, ch chan event.GenericEvent) func(_ context.Context) (done bool, err error) {
6059
return func(_ context.Context) (done bool, err error) {
6160
ips, err := net.LookupIP(opts.EndpointAddress)
6261
if err != nil {
@@ -96,9 +95,6 @@ func forgeResolveCallback(opts *Options, ch chan event.GenericEvent,
9695
// Triggers a new reconcile
9796
ch <- event.GenericEvent{}
9897

99-
if solveJustOnce {
100-
return true, nil
101-
}
10298
return false, nil
10399
}
104100
}

0 commit comments

Comments
 (0)