CONFIG_NF_TABLES_ARP

[gerwsx]

Is there any reason why CONFIG_NF_TABLES_ARP has been left out? I have some PODS that fail because ARP rules cannot be installed and ARP is not filtered.

talosctl -n mynode read /proc/config.gz | gunzip | egrep 'CONFIG_NF_TABLES|CONFIG_NF_TABLES_ARP'
CONFIG_NF_TABLES=y
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NF_TABLES_IPV4=y
# CONFIG_NF_TABLES_ARP is not set
CONFIG_NF_TABLES_IPV6=y
CONFIG_NF_TABLES_BRIDGE=y

thanks

[smira]

no real reason, just curious what kind of pods rely on that?

[gerwsx]

Multiple PODS sharing a virtual IP, only the active one should listen to arp requests. This is implemented by using nft arp tables. Currently looking into netdev tables which can also filter arp, but is being hit by other packets too. With arp tables only arp packets are hitting the filter and the current implementation of the POD is using it.

[smira]

it's easy to enable, we can get it done in the nearest future

[gerwsx]

That would be great! Could I monitor it somewhere when it's expected to be available?

[smira]

v1.13.6+ will have this

[gerwsx]

Many thanks!