Antrea Community, 24 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meting 05/24/2021

Description

Antrea Community Meeting, May 24th 2021

A

So welcome everyone uh good morning good afternoon good evening and uh welcome to this uh instance of the andrea community meeting uh today is monday may 24th. If you are on the west side of the atlantic, otherwise it will be tuesday, uh may the 25th.

A

So for today's meeting uh we have a planned topic in the agenda, and that is a discussion of the wireguard support for andrea, and this will be. This discussion will be led by shu.

A

I do apologize if I misspelled your name, and uh I see that uh your real line, so we can get started so um sure. That's uh that will be the floor. Is yours. Please go ahead with your uh with your presentation. Okay, thank you. So.

B

This is, I will share my screen.

B

I opened an issue here 2204 and that is to support wirecard for traffic encryption, so I will jump through the jump into the design dock directly as more details here.

B

So I will start here and please stop me if you have any comments and okay. So the motivation is that virgo has been shaped with the latest linux kernel and it's an alternative to ibiza and it claims to be faster, simpler and more useful. So for our recent tests it performs two times faster than ipsec, but for the latency wagon is not as good at episode, so we can only get 23 percent for the tcp uh our test compared with episode.

B

So here are the test results and.

B

If you want to check some details, I have uh some data information here. So there are the the recent benchmark from syrium also showed that it performs uh 1.7 times compares to ibsec, but the throughput is lower than bisect, so um seems to have got. Could utilize multi-core more efficiently, though the tpr result is not as good as a clive stack. So I think it is still valuable to integrate well guard with andrea, as the maxim throughput is significantly better.

B

So, okay, so uh the kernel version above uh 5.6 there's building support for our guard for other kernels.

B

We may need the user to install kernel manually, so this should be a document work and if we want to enable wirecart, we must define a port number for all nodes. We assume that on all nodes should use the same pattern to communicate with each other, so this part might also be configurable by users.

B

And this also should be documented workout use. So here is how we can configure the workout interface. Our workout use networking based configuration api, so we don't need any demon process in user space and there is an official golan library to control work out. The linux kernel module directly. So I press the link here.

B

uh The most important part for for our guard is it's using the keypair to second pianos and also for encrypt traffic.

B

So we must impose a public key for every node and let other nodes configure it as well appears.

B

So a proper way is to set annotation on the kubernetes load resource, and maybe it looks like this- and we add this annotation to enforce the public key for every node and we do not need to save or store the private key by all means so for adding restarts or node reports. We just need to check whether the welcome interface has been assigned or keynote.

B

If not, we need to generate a new private key and set it to the web interface. Otherwise, we just need to check and ensure the public key of the one guard interface and the annotation of the node are identical.

B

So so we don't need to store any configurations in a file or something like the file. We just need to generate the workout configuration in memory and set it to the interface and, if the, if the notation of a node changes, other agents will be informed, so they will change the probability of the player node. Accordingly,.

B

So here are more details for the implementation rotation here and workout only works on layer three, so it cannot handle there to traffic and we cannot attach the wire guard uh part to the uh resource, and that means the traffic can need to go out, form and clear gateway and be handled by the host network stack so robot.

B

Controls the traffic based on the pr configurations around the appeals field, so for the first phase we think we can assume that all nodes in the cluster will get compatible, so we can set up workout based on entire knowing cap mode.

B

That means uh we just need to change the routine routing table based on the knowing cut mode to load all traffic through the for the target setter for of the pyramids through the wildcat tunnel.

B

So that's the detailed steps here and the uh the first steps that we, even though we do not need to install the kernel module and we still can try to load the kernel module in the unit container and maybe we can save the results to the file to for for the future check of the android agent.

B

uh The step two is that an intelligent container should check whether the workout is enabled in the configure map and.

B

Then check the where the workout panel module is loaded successfully, so this could be by checking a file generated by step y. So if, uh if wirecard is enabled in the computer map, but the workout model is not loaded, so we should uh try and shoot the exit with error code in indicating that workout is not supported. So that means the node. Will the android engine cannot derive that from that node, but because we have uh assumption that all the nodes must be well guard compatible.

B

Oh um okay step three and we need to add an interface, maybe the name, design, chair, wg and host mode and then bring it up.

B

So this step also includes setting up the current time to you and generating a new private key if necessary, and then therefore.

B

For for each peer node, so this means that we list all nodes resource in the cluster and we configure every node as well guard here using the four steps.

B

A is: we create the node public key from london data and set it as a public key field, and then we set the load iq to the load ips field, and then we also set the current the nodes uh pulsator to the route ips field and the last step is uh we set the node ip and uh the workouts: uh listen port to the end point field. So that's the four steps need to be done for every node and then, as I said earlier, so we designed it to based on the entry and card mode.

B

So we just need to change the original loading table.

B

Which utility originally wrote for the itself to that link when you to set it to the worker tunnel, so.

B

So after this step, so the changes for the node based and all traffic will go. Oh imagine the traffic will go through the walker tunnel and be encrypted.

B

So the last step is that we watch on the reconcile for optimal changes and we may also need to add or delete node peer node if necessary.

B

So do you have any comments for for this steps.

B

For now I will continue.

B

Well, we'll look at more details in that index later.

B

So here are more considerations with workouts on the hybrid mode. So, ideally, although they should support our guard and we can set up our tunnel on all the nodes- and we do not do not need to create an overlay network uh extension or other input in calculation method.

B

So, but if there are any pianos that do not have welcome installed or we or user, some users might want to disable webguard for some node explicitly so they're, not the network might be broken, as uh the presumption is that we are setting up the network based on annoying card mode.

B

So we may leverage enter a hybrid mode and which means that for for those who do not stop do not support workers or disabled.

B

Well, god, if they are in the same subnet, the low income mode should just work fast and if they are not in the same subnet, the packet should be encapsulated by g or other another, as andrea in capital does.

B

So maybe this this could be dying in phase 2 or later.

B

And also we may want to support uh topology awareness encryption, so that means uh for some cases the user might want to encrypt traffic for cross-load nodes, not only and for the losing in the same control zone uh traffic that wants not. They may want not to increase traffic to reduce cost.

B

So we may leverage the topology annotation of kubernetes node and for the nodes they have. The same annotation package can send out to uplink directly. You start off sending to the web partner panel to reduce the cost. This could be an option in the cultural map.

C

So sure, in this case you are saying I will still do low impact for regular hybrid mode. I mean for the for loads in the same zone.

B

I think they are all based on knowing that mode.

C

But it's possible low income doesn't work right.

B

Yeah, maybe this should be combined with the hybrid mode together.

C

Okay, actually, I was thinking uh I mean uh purely a hybrid mode. I'll, probably probably don't really make much money in my mind. I have no humor people probably will just config the encryption for all the notes for the point. It makes sense for this topology or wow encryption um in our community. If we go knowing how mode, I think we will lose some features right. No, probably.

D

I should say.

C

Loose finally, some features will be implemented differently and actually you will lose some features, for example the us it was done supporting camera today.

C

I I'm not sure any other features will be uh impacted, but I will show there will be some important features.

B

Sorry, I did not check for that. Maybe I will do some research and find out whether the manika mode will affect country features, and it's not. It's not currently covered by this data.

C

Sure, probably you can do some comparison here. um Another thing that I I think in time, even within kai mode, you can do one called encryption, but of course that will be a little more overhead.

B

Yeah yeah yeah. uh Actually I uh I.

C

See you do have.

B

C

Okay, yeah that function.

B

C

Okay, probably largest, that you guys will talk about.

B

Okay, okay, so our finish, uh there is a talk first, so thank you. Settings uh we're gonna, need a 64, ipv4 and 84 ipv6, so we can adjust the mtu based on whether ipv6 is enabled, so this is empty and for ipv6 support. We also need to adjust the endpoint on the other here. Setting software guard and also for accurately enabled the rotating table should also be changed.

B

Here is some sorts on one guard on the impact mode.

B

So I think, ideally, we should not encap the package before sending it to wagon, as uh the workout can handle the routing automatically and if we encaps the packet, you need to name our other protocol, so it will bring additional overhead, but it's still possible to create an overlay network based on robot.

B

So this this means we need to change some um uh rotten tables.

B

So because we after the encapsulation the destination, ip will be the node ip and we want to roast the nodal p packet to the workout panel. So when we need to create a separate routing table and set a mask in the form entry, so steps are here, so we may need to change the following tree in table 17 and add a packet mark here and then add a special other row for the packet with this mark to jump into another table at the table.

B

Return for this case and in table ten, we set the default route for the tunnel, so this could also work for uh tested its name with well god together as an overlay network. But I assume this will bring more overhead, so I don't know whether this makes sense or not.

B

I put so. I put it.

B

Here, that's basically.

B

All the design for about our trailer- and here are some cool sneakers.

C

B

C

Performs data for for internment.

B

uh Yes, yes, I have, I think it's it's slightly worse than the knowing cardboard, not that yeah, not that much.

C

B

B

So that's actually for all for my design here and any questions for others.

E

Small question you started: the fullness is not used for mass, for every node for every node is established, welcome channel to other nodes and watch what beauty udp port. It will use.

B

Give me the setting here.

E

B

Well, I I haven't paid my idea to how to choose a product, so I think we may assume that all the loaders have are not open apart open for the one guard and they all know they should use the same part.

E

Okay, so ideally, I think they can use the same part, and then you can establish, welcome channel use the you just use the same part.

B

Yeah, I think so.

B

So that will also be helpful for users if they want to add some firewall rules use the same part.

F

Yes, changing when you ask the question about the in cap and the regard you see any value to enable both to include the traffic captive by gino.

C

Yeah, I think my major point is still but our features.

C

I I probably cannot have a complete list or all the features impacted by no income mode. You might hide yet maybe uh I mean if you can put a summary there, but it's easier for us to run it.

B

Okay, so I will check this over.

C

Yeah, I think at least trace flow will be impacted a little. um I think it's useful for transfer within uh sorry, I slow income mode. Actually, I'm not sure, truthful, still works on our timing, since you do workout tunnel again uh with living traffic for you to check and for the evening to us, it will be some difference from incoming.

C

Inside trees flow, the grass will be imparted, I'm not sure anything else can be.

B

Impacted will check is.

F

Better, thank you.

F

Why do you think egress will be affected if using a knowing cap mode.

C

Because today we don't support us.

F

Well, what if, what? If we support, we make uh eagles work in knowing that mode? I think in that motorway we will also create a tunnel.

C

I say busy you're saying we we add some changes for work.

C

You can program the tunnel, I think with workout. I don't know, I guess so.

F

C

F

C

Yeah, maybe change you can have something about foreign with my god.

F

Sure sure I've ever followed up with it.

E

C

B

Only concern so any more questions. If you know I will stop sharing, so this stock is a attachment here. So if you have any comments, please just comment on this talk.

C

I also hope to get some inputs from.

C

Product managers to see any requirements on workout or ipsec because I see there are some big super throughput improvements, but those the latency uh jobs right and um another thing that uh I don't know how enterprise customers will work out that much. We know for enterprise or not because for strong, strong one. That is, we know it's been there for many years and adopted by many enterprise customers, but where I got I just don't know, maybe you can get some inputs from my chinese one too.

C

D

uh Yes, yes, um actually, I have already involved puja and if to give us comment, okay,.

B

Okay, so thank you. Thank you. I will stop trying.

B

No more questions.

A

No, no more questions thanks uh sure. It's uh it's a very nice presentation. It's also a very divided point about changing weather. We should also consider uh in a wider way pro and cons between a wire guard and an ipsec.

A

I mean it's good that we have a better throughput, but the results from the latency are, let's say, not encouraging, and we know that there are many latency critical applications. You know.

D

A

Where latency is a very important factor, the other thing that might be, in my opinion, a resistance to the adoption of wire guard is the fact that it's supported only on kernel, 5.6 and above and, as we know in many in many real environments, the linux distributed linux operating system that is used for for host nodes. It's a kind of uh you can say, consider black box, so users cannot go and install modules, update, kernels and stuff like that.

A

But anyway, it's uh probably definitely a good addition to have you know to the technologies supported by andrea.

A

Said this um for today, I don't believe that there was any other. Maybe there is another topic? No, there is no other topic proposed for today in the agenda, which means that now we are with open up for open discussion. So if you have anything that you like to bring up, discuss, complain about, please go.

C

A

Foreign well, it appears, then that maybe we might have a significantly shorter meeting today and give back almost half an hour of your time to the attendees and I'll just wait, uh 10 seconds to 15 10 to 15 seconds to see. If there is any other topic you like to bring up and then I'll stop the.

A

A

Perfect, it seems that therefore, that's all for today, and I would like to thank you for this very informative presentation, which it was really enjoyable and the one. I would like to wish everyone a good evening, a good afternoon or a good day, uh thanks again for joining and uh talk to you again in the next century, community meeting in two weeks time.

F

Thank you, bye.

A

Bye bye have a good one, bye.