Antrea Community, 7 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meeting 11/07/2022

Description

Antrea Community Meeting, November 7th 2022

A

B

Started so good morning, good evening or good afternoon, thanks for joining the systems of the entry accommodating for today, we have two topics in our agenda. uh China will give us an update on follow-up items for the layer, 7 Network policy work that is leading and Lan will then give us an overview of uh policy. Only support for multi-cluster.

B

So I will uh that's our agenda for today that we will have some open discussion and then Chan over to you for layer, 7, letter policies.

C

Thank you, zamato.

C

um Thank you, everyone for joining this meeting and we presented the closure of an airport learn7 policy a few weeks ago, and there were some open items and uh in written the ways we did some investigation and some results and some still open questions for this discussion. uh The first API name currently in my PR for the seven year course API I just use the first name and I sync. This we could just discuss this in the pi itself.

C

So let's go to the second directory for a second question: uh uh I uh in my current uh patch for the API I didn't set the port field and mainly because we don't support uh traffic control to redirect or mirror ports specific traffic only it has to be the whole traffic or for a port or not. So even we have this field in this release. It will not help the performance much and it will limit the protocol. We are, will only work.

C

The policy will only work when you use a use, one port or the specific Port range, so I didn't have this I didn't have this portfolio in this release and the hostname will only match the the host field will only match the hostname in the URI or the host failed in the HTTP header and in the future.

C

When we start supporting uh when traffic control starts, starts to support traffic, redirecting traffic specific to One, Transport Port, only I think we could consider add it add this portfolio as an optional field and for the second one- and this includes several- is problems.

C

For example, I found that for a egress rule, if we, if we adjust the job, all other protocols or all traffic of other protocols, the egress networks, layer, 7, nail policy, we are not work because when we use the domain to X to specify the destination URL, the workload has to resolve the domain to IP. So it has to use DNS protocol so, but but if we don't support DNS protocol Universal release, basically the egress near policy will make, with with the the client, doesn't even have a chance to send out the HTTP request.

C

So uh previously I I, remember. My design was that if we uh we had, we had a two choice: that when user, specifying one protocol in the seminar policy uh what happens to traffic of other protocols, one option is that we ignore other protocols, meaning that term. All other protocol will be allowed by a last seminal policy, and another option is that we drop all traffic or for other protocols, it's more like the second choice.

C

The second option is more like the current uh kubernetes net policy that only the listed product code protocol will be allowed and all others will be dropped.

C

So if we go to, if we go the second option, it will have this problem and it has another problem that even we support DNS protocol in this release is still the second option is they are not friendly when workload use more than one protocol and one protocol is, one of them is supported by the seminal policy. Another one is not supported by the seven of nail policy, because with that behavior.

C

The unsupported unsupported protocol, the traffic of unsupported protocol, will always be dropped.

C

So that's the problem of the second choice, but if we go the first choice that you just ignore other protocols uh it, we don't have a good solution to support a scenario that user want just to allow HTTP protocol, but no others yeah so uh I'm. Thinking about two solutions uh to uh to to fix the um to support uh to better support the the use cases for one. uh If, if like, we, we go option two, but we add DNS protocol support in the first release, together with HTTP protocol.

C

In this way, uh so the user could specify two two protocols one is HTTP and which contains the paths and Method and the host the name and they want to use and another protocol is DNS and it should repeat the uh it should also has the domain name as the field of the DNS protocol to say that it only allows the client to query the domain, the the IP of specific domain- and this is one option and it doesn't resolve the second problem.

C

But if the second problem is really a problem and I have also Pro, I propose the first option, because I'm thinking that uh um either a port should focus on on a specific application. So so you shouldn't use many protocols at the same time, especially when it serves as the server so when it serves as a server when we Define the Ingress, there are seven policy, and just one protocol for HTTP to just one one GDP protocol should be enough uh and therefore applications that codes runs as client.

C

There might be some other protocols being used. For example, one may access other servers web API and it could access DB service at the same time, but the DB service are not supported as for the time being, so in this case they could.

C

May not work for them that that's one limitation of the first option and then the second option is that we introduce a field like a protocol mismatch policy and it has two value. One is job. uh It is just like the second option.

C

I just mentioned that we just drop all traffic of all other protocols um so that you can achieve allowing HTTP protocol only with one policy with one player, seven near policy and another value would be ignore and it means the layer 7 near policy would ignore traffic of all other protocols uh for you for the previous case, if the client, the portal runs either client, it wants to access uh uh specific HTTP service.

C

At the same time, it wants to access some DB service, but a deeper service is not supported with ignore it will um the the DB traffic will will pass the seven, of course automatically, and the user could use layer, 4, nail policy, together with layer, 7, nail policy to limit to to have some limit to how some restriction about the traffic, whether which port and which destination the client? Could you could access? So currently there are two options to uh to resolve the some of the problem.

C

I think the first one is more kubernetes net policy style and it's simpler, but it would introduce. It may introduce some use case. We cannot support until the protocol support. It's a very is rich and the second could address all cases, but uh is not this Theory? We don't have this third uh in previous nail policy apis. So it's something new and a new one has suggestion or questions about these two options.

D

You can have a question for you option. One.

A

D

I was thinking uh when you say uh the possible job. Traffic of the political political slots specified that.

A

D

The policies, the supported policies right I, mean, for example, if we only saw ICP uh that means actually will not drop any other particles only when we support those ATP and DS. At that time, you can see uh if there has no specific with Europeans.

D

That is my understanding.

C

I didn't mean that if, in that way, then the last seven airports is meaning were changed whenever we support a new protocol right, for example, we we don't support DNS protocol in this first release and it it was not dropped in the first release and after user upgraded to the second release, and then we add the support, then the Sam policy, where job DNS protocol so.

D

Even for level four, do you think that's the case, for example, today we support key Sav yeah for later. If you add a new policy like IGM Qi CMP, then do. Let me see.

C

It's more like the option, one when we don't support itsmp protocol, there's no way to allow SMP traffic when you isolate the port.

D

So you're saying uh today is like once you define life policy uh was unsupported. Ipod already talked.

C

Yes, yes, with.

D

C

Therefore, yeah no policy yeah, you know people kubernetes new process, they'll only support TCP and UDP anyways, the kubernetes. In their policy. There is no way to allow SMP traffic once any nail policy applies to a port.

C

Okay, if you want to test it, pin you can only remove all nail polishes from the port.

D

And the problem, how could you know the full set of Nelson policy you want to support now.

C

uh Yeah, so that's the problem so and and that's why I proposed another option to which is not similar to kubernetes nail policy style for Community Network say. Therefore, then there are only two major three major protocols is easy to enamorate all, but for level 4 level 7. There are too many- and in this case, if supported and unsupported protocol are used together for workload, user cannot use the supported protocol. If we go the first option, because all unsupported protocol will be dropped.

D

C

The option 2 is just to add a field to change the behavior, the behavior, the default Behavior could be same as the kubernetes in their policy, but we add another one to allow to to ignore traffic of all other protocols. So when.

D

C

D

I mean how you define what other protocols I mean. Do you mean the product was supported.

C

Any protocol that doesn't match the the listed protocol in the in the in the object in the seven year policy.

D

But how you know the part is other political, I, I didn't we.

C

Just use IP to match the traffic, uh because this is a blacklist mode right this. This is the white list mode. Once the the seven nail policy applies to a port. uh If we go the first option, there would be a lure to drop all IP packets to this port, for example. If this is ingress, we will we will have a deny or a job rule to job.

D

I, remember you said in the first version will not support right.

C

I mean product we use IP to.

A

Match: okay, okay, yeah.

C

So, with only the protocols that used in The Seven Year policy, we will add a allow lure, so you accepted the HTTP protocol. Old IP traffic will be dropped.

D

I'm a little confused uh if I have a little level four policy, for example, to allow SMP and the once you define their seven points. Smp cannot be allowed.

C

It will not be allowed, uh let's say, therefore, under 70 policy are enforced individually.

A

C

Are enforce the first and then level seven.

C

uh If we mix them, then the therefore you you already allow level for, for example, um with uh level say you, you allows TCP uh 80 Port traffic right. It's already. It already allows the the traffic itself. So if we we we are not enforced, then the the two kinds of laws. uh First and later it doesn't make sense that the second could drop the traffic right. So if they they don't affect each other. It's just a uh one is enforced fast, then the next one.

C

So if it's already dropped by the there are four policy it will not even get get into the.

D

um Case right, if you have a little Focus to allow SMP.

D

Always dropped.

C

D

I think that's a looks a little strange. uh Probably later we should match the seven portable to a level four protocol uh election or not.

D

C

That could be a way. If you add your example, is your your point is about uh number seven protocol I think they could be fixed that we we just need to. We just need to make the uh just the seventh policy to focus. There are seven protocols uh this based on TCP and UDP.

D

No I, I I think the the problem is that what I describe it I think the problem that for for some, but for example, if if just we just talk about TCP, it's possible, you have both level four traffic and they're selling traffic, uh uh both use TCP for the ones you define there, some policy. uh Actually, you cannot allow any other long layer, 7 traffic to the to the port, Al.

D

um I have also have a little for heartbeat. I have no way to define the positive levels.

C

Yeah, that's the then that's the pro second problem: yeah unsupported protocol when a workload use them together. Yeah, that's the problem of I. Don't understand that, so that's why we we could consider the second choice.

C

If we don't know the protocol. Well, we don't support the protocol. Yet there are seven near policy. Would just ignore that traffic I think this could adjust Just Your Problem.

E

Maybe I can think of another option. For example, if you, if we can mention the TCP and UDP port in the England and egress rules, and then you can define a policy, something like I want to allow a specific, tsp, Pro but I, don't know the layer, 7 proxy and then this is because usually one TCP and udb product is used for only one kind of their serum policy.

E

So so maybe you can enumate in eliminate all of the ports you will be using in this part and and then Define a layer, serum policy for the ports that we still don't support the layer 7. But we can support what is the key.

C

You mean like this yeah.

E

Yeah we can, for example, remove the HTTP path and Method and only mention the port 80 or, for example, 443 22, and then it will be allowed and then we even we don't support, for example, SSH as a application, but we can still allow the product ID. Yes,.

C

In this way, how we support allowing only HTTP protocol, but not other traffic.

E

I think we can still use the same way. The product number is not mandatory, so.

C

That means that the port, whether to set whether the port is set, would affect whether other protocols or other, uh for example, does this affect the UDP Pro UDP based the seven protocols and the other now HTTP protocols?

C

Would this affect them with this port specified specified or not? uh I I think that would mean also means the isolation would be per protocol right.

E

So, for example, if you set protein HTTP here it, um uh it allows HTTP only on this program block or the other ports, and then, if you have another rule to allow Port 81 and then all of the protocols on for TCP, Port 81 will be allowed um and the other ports are blocked.

E

If you have, for example another example, if you have HTT HTTP without product and and then you have a rule with only part, for example, H1 and then 81 will always be allowed and the other ports will be inspected to check if it's a HTTP and then it will be dropped. If it's not, can this be done so.

A

C

We maybe yeah, let me think about it: uh I'm trying to understand the meaning of yeah.

D

I think if we go this way, this poor number is not a match criteria for this Zoo. Actually, it's it's to define a skill, the traffic to to go to level seven enforcement. You can.

C

D

C

So it it would mean that uh uh with this, uh no maybe we need to have less intent for this port.

A

C

But anyway, uh with this uh Lua defined, it will only check TCP uh tsap to Port 80 traffic, and if it match this HTTP attributes, it will be allowed any other traffic that match TCP, uh 80 Port will be dropped right and all other TCP Port traffic and the UDP traffic will not be affected by this layer. 7 air quality is that what you means.

E

I mean that if, with this um all of the traffic on the other ports be to each CP or not, should be dropped because it's isolation, it's loved. It.

C

uh This doesn't match this cannot resolved use case, changing release right if they are dropped.

E

And then you want to allow some supported Proto, you just add another entry and with only product mentioned without any layer, serum photographer, for example, TSB, Port, 403 and then sorry, GSP, TCP, Port 22, and then even we don't support SSH and we can just allow every protocol 22 and block all the other ports. Yeah.

C

I understand, but that was I tried to avoid it would be a little duplicated with our current foreign policy, so you need to allow the same traffic the same plot. There are four protocol and Port twice in therefore under level. Seven, so that that was I wanted to avoid into I would send send me information in the 70 policy.

C

Well, you you, you see that if.

A

C

You have to so.

E

Maybe yeah so maybe the Second Use case, for example, if you don't, uh you only want to allow HTTP and block the other protocols. We can use the layer, four layer flow policy for that and then in layer 7 you can allow everything on the other parts.

A

E

So I'm surprised.

C

This this policy would mean that it will yeah, they would hand TCP Port 80 only and if it matches this plot this attributes it would allowed. If it doesn't match the HTTP HBO's, it will be dropped and all other Port will not be affected right.

E

C

And if we don't support, specify the port, and then uh it would mean oh, oh traffic, otcp, port or even o UDP Port will be denied if they doesn't match the HD protocol.

C

It's this, whether you, your energy engine, would agree.

C

D

This is a limitation.

D

I I didn't I, didn't spend time about this before.

C

D

Yeah father I, I I was thinking, uh there's something like this actually defines the traffic redirection and what five Mega meter uh scope. uh It's not part of a. We were matching criteria. It's more like a traffic direction right here.

C

Yeah I understand yeah, okay, we couldn't and discuss more offline and or in the pi itself, and let's see the the this program and for the check sound of loading issues and as I mentioned before uh the traffic once it is handled handled by the 7th engine it. The traffic would be sent to data data plane from user Space by the seven engine, and some is some of the beats in the package as KB is changed and the destination.

C

We are not accepted the package, because the check song it looks not correct and we investigate another option except the the Y already is already working but may affect all poles and has to be turned on once the cluster is deployed. This then, the other option is that we could use to say say some action to trigger to force recalculate the check sound of specific packets, and we only need to set the and the this configuration in the Network device used by the layer 7 engine to send send traffic.

C

So only uh for this for the existing solution, all traffic will be affected, but with this new solution, only uh there are seven error policy and applied traffic will be affected, uh is a little better than the other one, but not resolving the issue completely investigation about this mechanism later, and he also verified that this could work for a newer kernel, but not for the one.

C

And I remember: we have also this question. That was the effect if the nail policy used fqdn after some consideration, I feel that the it may not make sense to let the cellular policy to use fqdn as the destination at the near policy peer, because, if user want to.

C

Oh, uh let's check this, the client to only access a specific web service. They could use host hostname in the near 7 protocol attribute, but not has to specify the net policy peer and it could to be more uh to to be more safe. They could also specify DNS a protocol to only allow the client to ex to query the same domain, but but this is not really needed, because if user access, other domain names and the traffic would have already been dropped, even without the uh IP matching and hope this makes sense.

C

And next question is about what, if a signature has a lot of discontinuous IP we and then that would be two problems. One is management issue that if we, for example, we for our left the seven and policy we have address group and apply to group, there could be many IPS in those groups.

C

If we just repeat the uh the the the IP in the signature itself, the the single signature would be very long and there would be many duplicated information in the signature.

C

uh uh I I try to use the uh the variables in the signation and I want to find that it could work that, instead of listing all IPS, we could Define a address group it'll. It's also called address group in surikata.

C

The address group could refer to a list of ips, but before in surikata 7, which is we just released a few two weeks ago. I think before this release. There is a limitation that the address Gene must smaller shorter than and 8K bytes, and uh it would only include a five more than 500 ipv4 addresses, and uh this issue has been fixed by this PR and the current 7 release.

C

7.1.0.0 beta 1 already include the patch and I want to find that from this release there could be only limited address included by one address group, and also with this, with the use of the variable, it's possible that the law, the signature file, is static, and we only need to update the the configuration file which contains the address group member information and ask the circata instance to reload the whole rule after that, after updating the variable.

C

So in the case of no policy change but just put life cycle events, only the valuable file would be updated. The signature will not change and another is performing issue. What what if uh we have many IPS in a single signature and what, if we have many signatures, uh converted from The Seven Year policy, their performance impact and Hong Yang will have will share more information about them.

C

Could you take it over? Let.

F

F

Which I mean how to update in just a few seconds.

C

If anyone has anything want to discuss about the about issues, please go ahead.

B

I think we can load the channel three I'm, not sure. What's. The next topic is a holly I'm, going to present something.

C

Yeah, yes, okay,.

F

Yes, yeah, okay, I'm ready now, okay,.

F

uh Hello, this is the data about the street about the signatures of circata.

F

This is the signals of numbers, and this is the source IP for Signature and that's the IP prosecutor, and this is the time cost, and this is the cost of time to reload all all these signatures. We can see that when there are, there are 32 in judicial source and test type is import or signification.

F

We don't need a very long time to to reloading our signatures, and but but with the with the increase of Society, is per signatures, the reload the cost of reloading time or increases. We can see that um and we can see this line when there are two students and 70 75 IPS per second interest. It takes seven seconds to reload to reload and all signal inference.

F

Any question about the data.

C

So from this data, I think is the management performance is okay, because on each node there should be at the most 1000 I I feel because there are only a few ports running on report and that might be a few numbers or for their Seminary policy applied to each port. So a film, perhaps hundreds of signatures is the our all we need and from your data it could be less one less than one second to little all rules right, so I think this. It should be fine.

F

F

And question about this: if you know we can, we can do connect.

E

So I'm too sorry I.

F

E

uh For example, if we only have a few signatures, but in some of the signatures, the IP addresses numbers are really huge fix, number 1000 or 2000.. um Maybe we can also evaluate this.

F

uh For this, as mentioned, um we we have some limit before 70.

F

We have to split a very fuse IP range to into three into two or three one, because for current you can see that you know we. We can have most about the 1200 IPS and proper signatures.

E

F

Okay, then we can go go next, and this is The Benchmark data about uh about this ricotta with different signatures.

F

uh These are the types of environment. How does the two parts they? They are disabled, which checks on injects exam offloading and there is just recorded part with host Network and there are there. Are you know, node I just use the default argument for every payload and every test is calculated from 10 wrong test. Remove the lowest enhanced then get the average.

F

um Oh sorry, I need to remove this uh I have how.

F

Before the before January, before this produce a house, a house changed through Carter argument, so we can anyway we can. We can see that with the authors record- and this is the payload data uh then, and also- and then we can with this Ricardo. uh This is a very small scale and there's only 102 signature. This Thread is Auto, and this is very important because well it will set it manually at the one or two some some some tests is affected. Very it's affected. We can increase worry.

F

um This is like this and this this, like a tcpr on this PCR, is affected. The device right and that's right is um is related with CPU numbers.

F

Okay, we can see the with Auto and with the threat Auto and the TCP stream, and the Newt stream is almost about maybe about a 50 percent of the he starts the PFT percent of the original land, and you can see in that piece and of course we can see another another condition and there are two signatures, which is which is easy, which are used to match the master payload, and um without this.

F

Due to the limited of time, I didn't test the term out, but we can see it this. This, this part is, is complicated.

F

uh We can see, there are two, there are only two strands.

F

This is the we can see these two tests are affected, but I started it to Auto. They they look much better, but they they are also about 50 percent of the original data.

F

um Another difference is about the first recorder signals there are um for this one, and there is no significant can match the any payload of this. For this one. There are two rules. There are two signatures which are used to match the payload of tsp stream, iotp stream and the TCR um when they are masked when they are technicians. With my system.

F

The data is a little better for tsp stream and the other or like tcpr, and the tsp CR op other um like for this is the most the biggest game with the most IPS and the the most. What turns out in the season is: oh, we can see that that the data of TCP stream is also decreased.

F

Okay, um any question about this.

B

No no question from me: does anybody in the team has any question for hollyanganchan foreign.

B

Policy on your policy only for multi-cluster um so learn I'm. Sorry, this might not be enough time for you. So perhaps we can start the conversation on this and then, if needed, we can follow up in the next community meeting. So yep uh thanks for waiting London, please go ahead with your presentation.

B

G

G

Yeah, okay, thanks so and again see my screen: yes, hello, okay, cool, uh okay! Maybe I can just give a quick overview of the current design and uh okay, hello. Everyone and uh before we discuss about Network policy, only mode um I'd like to show you that's about some multi-class traffic when we using it with the income mode, which is the default model we are using for the enabling the multi-class feature. uh You know that in hour and three month cluster, when we have a multi-clusters always which exported in one cluster, for example member cluster.

G

Here we have two member, a three-member cluster and another core services, our multi-class service. We will Define as always seeing the imported the cluster and it will have this kind of prefix and the the special case special point for the multi-class service is that we will no longer have the part IP as the endpoint. We were using the remote exported Services cluster IPS standpoint. So if you see here these two eyepiece, actually, the those cluster IPS are signed in their own cluster, for example, in class B. This is a 1.20 toe and uh okay.

G

You will see that in class C and it will have this class IP so for the income mode. So we will use the class IP of exported services and point in import service.

G

And if you go to see the traffic, you will see that we actually we have two dnat and one as net all of the Cross traffic cross-class traffic will go through the Gateway and do the do the S Nets before it goes out of the cluster, so I I guess all of you should be familiar with this traffic model.

G

So maybe I just give you a view of current income modes, and you know that in income mode we're managing our class pod, IP and and also the traffic, we are all go through the tunnel interface right. But if we go through the policy only mode, the problem is that we would have some gaps here. One thing that so there's no tunnel interface because there is no longer needed and the other traffic or the IP is managed by the primary CI and also the roads is set up by the Privacy.

G

So our assumption is no longer or I. I would say that prerequis is no longer supported in network policy only mode, for example, here in one cluster, there's no longer have Channel interface and those in-class traffic is also control the primaries and by the cloud provider. So here the in-class tunnel and the universe is no longer existing here. This is a Gap we have in the narrow policy only mode, so how we can fix this Gap. The MIM works are actually in the entry agent.

G

One thing that we need the tunnel interface, so we need to set up the tunnel interface. Even we run it in the narrow policy only mode, and even it's uh it's uh by default, there's no tunnel interface. So for we will create a new tunnel interface, it's only for the cross-class traffic. This is one thing we need to do from the entry agent and then otherwise that you know there's a gap, there's no uh in-class roads for the part IP and this out of our control, because it's controlled by primary CI.

G

So we need to set up those power rows and from the gateway to General nodes, and then let it go through the tunnel interface.

G

Okay, here, as you can see that the Gap is here, if you see the first one and the green one, it's actually the income mode, so we will have something like the default level through forwarding group, and this this slider will be the part cider right. uh Oh sorry, okay, oh the uh okay. We think that it will be the power slider. Oh sorry, this is in cardboard. uh Just so excited won't, be it's actually the serviceider remote service. This slider belongs to the remote class. For example.

G

This cider is from class B and we know that this cider and as Florence Class B. So we will forward this from the gateway to forward the traffic to the uh Class B. Okay, when we go to the nail polish, the only modes and the same rule will be there and there's no training for this part, but to win the class when the traffic hits the class B or we see the cross-cast traffic has reached the class B in the class B.

G

When we write the income mode, we will have something for the power IP and we we know how to root those product. uh A lot of traffic to the right node right, because we have some level three forwarding rule here and we know the remote or other General nodes cider here, but in narrow policy elements we don't have this kind of a forwarding rule, because the part IP is not the control managed by us and The Roots is on their own delay Network. So this is one puzzle.

G

We need to fix, okay, so in how we can so when, when the request or cross-cluster traffic request is goes out to another class, for example, here we reach the class B how to get away know how uh this traffic goes to the right node. We will add something we'll add a new controller in the entry agent to set up a necessary part roads between Gateway and the general node, but we will only watch those exporting the service back and part and it's a corresponding endpoints.

G

Only so you will see a new rule in the level three forwarding and the destination will be the part IP, and we will set up the right tunnel destination IP for the for the cross-class traffic. Sorry so before you will see that we have a cider sorry here we have a simple designer to control which uh node this traffic should goes to. For now we will just set up a necessary pod IP here uh in the level 34 body and uh okay. This is a one puzzle.

G

Another puzzle is that when the traffic- let's say the traffic from class B, it's a reached across B and let's go back to the class A in the class B we will have in in cap mode. We will have lowercase forwarding and understand that the traffic you know that we have as net so we know that this IP is from remote cluster. We know the destination is matching the remote class IP. Then it goes to the right. It will go back to the Gateway and I go back to the uh product lines.

G

Then there in the network policy, only mode they're actually known difference here, but so, when the request, the reply, the package go back to the class A in in-cap mode as before you you, we can tell that the same through the same way. There's a level three forwarding power slider here right and we can just send it back to the based on the power cider, but for now you know policy only mode. It has the same problem here.

G

We don't have such a literacy forwarding row rows here, so how we can fix it in the request: cluster.

G

uh Okay, here's how we do that. You know that in reply Direction uh we will need a way to let the Gateway know, which general know that the traffic should send back right. So we knew we use the CT label a new label here to save the request packages Source tunnel IP when the request arrives Gateway at the beginning, and so I will see something like this. It will match the destination and also load the necessary registration and also thus, we saved for the source, IP tunnel, Source IP to new uh New Field.

G

Here and after that, we will also, you know, match, make sure the cross-class traffic we commit the source IP tunnel IP to the label so that we can use it later. Then, after we save this. When the request, when the replied package, you come back to the Gateway on the class A, it will fit and match based on the city label.

G

Then it will set the right tunnel here tunnel based on the IP and, of course in the city label and save or reload load the rights tunnel, so a destination IP here to the tunnel destination. Then it will go back to the right, General, node, yeah I think that's all for the uh core function for core part on the multi plaster. With the network policy. Only modes and I'll show you there any questions.

B

Hello, so is there any question for learn: I understand that we are already at time, but it would be nice to spend a few minutes discussing uh this feature. So if you have any question, please go ahead.

B

B

What you discussed makes sense to me, but I probably need to I would like to review your presentation and read it better is? Is this already shared somewhere.

G

um Not yet I think I can maybe I can create an issue on the GitHub and provide the details. There.

B

Cool thanks. That would be great. Yes,.

G

Okay, thank you.

B

Okay, is there any additional question comment? Any feedback for learn, I'll, probably wait 15 to 20 seconds and then, if no additional question, we can close this meeting here.

B

B

For such good presentations and a very good discussion and I'm looking forward to see more uh more more conversation, both about layer, 7, Network policies and policy, only mode for uh multi-cluster, so thanks a lot to everyone for attending and uh let's meet again in two weeks time. Thanks and I wish everyone a good day good afternoon or good night oil.