►
From YouTube: Antrea Community Meeting 11/09/2020
Description
Antrea Community Meeting, November 9th 2020
B
Okay,
okay,
I
would
like
to
show
the
entroproxy
no
power
service
design
today
and
first,
this
traffic
is
only
for
new
snows
and
we
still
need
to
design
the
solution
for
windows
snows
later
yeah.
The
motivation
is
that
we
have
already
implemented
class
iep
services
in
andrea
and
but
the
key
proxy
is
still
needed
to
support
newport
services,
since
the
current
proxy
can
not
run
only
for
no
power
sources
and
causality
sources,
calculation
of
faith
with
a
lot
of
cpu
cycles
and
memories
yeah
mostly
important.
B
Q,
proxy
and
here
come
the
detailed
design
yeah
from
our
prior
experiment.
The
performance
of
pipe12s
will
go
down
as
a
significant
like
if
there
are
too
many
rules
those.
Thus
we
should
keep
the
number
of
iptables
rules
as
small
as
possible
and
by
using
rpset
we
can
use
a
constant
number
of
architectural
rules
to
make
traffic
that
we
need
to
redirect
and
for
a
hashtag
type
set.
The
matching
complexity
should
be
a
one
and
for
each
with
no
power
service
we
can
there
should
be
several
entries
in
the
ipsec.
B
This
web
graph
is
directly
copied
from
the
kronetics
official
document
yeah.
There
are
two
options
for
the
type
of
no
port
service
cluster
and
the
local
and
the
cluster
obscures
a
current
source
ip
and
may
cause
a
second
hook
to
another
node,
but
it
should
have
good
overall
load
spreading
and
the
local
preserved
client
source
ip
and
avoids
a
second
hoop
for
load,
balancer
and
no
prototype
sources.
Various
risks
potential
imbalance,
traffic
spreading.
B
This
approach
preserves
the
original
source
id
addresses
need
to
attention
here
that,
if
there
are
there
are
no
local
endpoints
packets
sent
to
the
node
are
dropped
yeah,
so
you
can
rely
on
the
correct
source
ip
in
any
package
processing
rules.
You
might
apply
a
package
that
makes
it
through
the
endpoint.
B
B
B
Implementation,
according
to
the
external
traffic
policy,
would
look
like
below
yeah
this
one
and
the
f-zero
hex
yes,
f-zero
and
the
f-one
are
used
to
tell
the
external
traffic
policy
type
of
the
package,
as,
as
I
said,
in
output
chain
and
the
pre-loading
chain,
we
we
send
the
packet
to
the
internal
port
chain
to
match
if
it.
If,
if
the
package
is
a
no
power
target
yeah
and
for
for
local
external
traffic
policy
package
yeah,
we
we
reset
with
c
with
city
mark.
B
B
Make
the
package
be
forwarded
to
the
os
and
after
after
the
whole,
these
are
a
loud
decision,
and
then
the
package
goes
through
the
post
routing
chain
and
the
impulse
rotation.
The
the
package
with
source
with
localhost
source
ipr
is
for
it
goes
to
cluster
snowpower
service.
We
do
as
that
yeah
yeah
zoom
out
wheel.
There
are
two
type
called
traffic
passes
of
no
pro
services,
for
example
the
external
traffic
policy,
local
or
x-traffic
policy
cluster,
and
for
local
policy.
We
only
need
to
care
about
the
first
cases.
B
The
client
goes
through
the
node
and
there
is.
There
is
no
second
hoop
and
for
a
cluster
policy
we
need
to
care
about
both
of
these
two
cases
and
for
the
local
policy
or
single
hoop
council
policy.
The
detailed
traffic
path
of
our
implementation
issues
like
this
when
the
client
issues
a
request
and
that
come
to
the
pre-routing
and
and
in
pre-routing
we
do
the
d-net
if
it
is
no
port
service
traffic
and
if
it
and
do
the
do
the
data
and
do
the
masquerade.
B
B
Currently,
in
current
os
pipeline
and
package
from
paul
to
external
addresses,
will
be
tracked
with
60
mark
20.,
as
we
do
denied
for
endpoint
selection
with
21,
then
the
second
package
of
a
connection
from
external
will
not
be
correctly
tracked.
Thus
we
need
the
following
flow
to
handle.
The
issue
yeah
also,
we
need
a
water,
ip
virtual
ip.
B
The
time
complexity
of
os
flow
matching
is
also
0
1.
Then
the
performance
should
be
decent.
At
least
more
standard
activations
will
reduce
significantly
once
we
remove
the
cube
proxy.
The
connection
setup
delay
should
decrease
too
yeah
and,
as
you
mentioned,
that
in
current
design,
the
traffic
from
pod
to
no
power
service
will
go
through
a
complex
path.
Yeah.
It
should
when
upon
issues
well
paul
issues,
a
a
low
part
request.
B
B
It
is
it's
complex,
but
as
a
notepad
service
are
designed
for
out
of
classroom
access
and
the
pause
to
notepad
should
not
be
a
common
and
best
practice
use
case.
So
to
keep
the
implementation
clear
and
the
efficient
for
those
real
use.
Cases
I
think,
can
current
implementation
is
reasonable,
yeah
and
and
that's
all
about
the
design
dock
and
the
questions.
A
Thanks
foreign,
this
is
a
very
good
introduction.
I
have
a
simple
question
so,
basically,
okay,
confident
now
we
are
doing
a
d
not
twice
for
every
connection
that
gets
into
the
host
right,
because
there
is
a
first
d
naught
to
the
virtual
ip
address
in
this
indeed
link
local
network
and
then
a
second
dinette
to
the
actual
pod
ip,
which
is
done
in
obs.
A
A
B
A
D
B
Yeah
for
now
I
insert
those
those
ipod
rules
at
the
first
phase,
so
it's
actually
take
over
the
right
as
right
hand
to
proxy,
but
when
we
yeah
when
we
when
we
implement
this
one
and
and
we
consider
the
way
to
start
entry
without
to
proxy
since
coproxy-
provide
the
stories
of
the
chronicles
yeah,
then
maybe
we
can
remove
to
proxy
totally.
But
this
is
only
for
new
snows
and
windows.
We
may
still
need
a
cure
proxy
for
a
while.
D
D
D
D
B
D
C
B
B
B
B
A
A
So,
unfortunately,
for
today
we
don't
have
any
other
topic,
which
means
I
will.
We
will
open
now
the
meeting
for
open
discussion,
which
of
course
implies
that
we
can
talk
about
anything
you
want.
So
if
you
have
anything
that
it's
buzzing,
you
that
you
like
to
talk
about,
feel
free
to
propose
your
topic.
F
A
F
Great
question:
this
is
something
that
we
need
to
discuss.
Apparently,
the
the
people
at
vmware
running
this
public
registry
would
be
okay
with
the
kind
of
traffic
we're
seeing
for
our
docker
images,
which
I
think
is
way
less,
that
than
I
think
it's
a
it's
less
than
ten
thousand
a
week
for
sure
ten
thousand
polls
a
week.
So
we
probably
need
to
double
check,
but-
and
I
think
we
have
no
plan
to
update
the
manifest
for
the
upcoming
release
to
replace
a
default
docker
registry
with
arbor
registry.
F
F
F
G
So
another
item
I'd
like
to
bring
up
in
the
in
a
prior
release.
We
did
a
retrospective
and
I
think
cody
is
the
one
who
ran
it.
I'm
here
trying
to
help
the
andrea
project
get
a
good
open
source
community
health
report
card.
So
I
would
like
to
see
a
another
retrospective
in
the
upcoming
release
if
cody
isn't
available,
I'm
willing
to
volunteer,
but
if
somebody
else
wants
to
do
that,
that's
fine
too,
just
asking
if
people
liked
having
one
before
and
if
you
did.
A
F
Oh
yeah
that's
correct,
but
I
think
we
would
love
to
have
a
new
one
driven
by
stephen.
I
think
it
would
be
great.
Is
your
next
meeting
or
the
one
after
that?
I'm
gonna
be
off
next
meeting
for
thanksgiving
week.
I
don't
know
if
other
people
are
going
to
be
in
that
same
boat
but
yeah
in
one
of
the
next
couple
meetings.
It
would
be
great
to
do
that.
A
Yeah,
I
mean
that's
a
good
idea
and
I
will
really
welcome
stephen
leading
this.
As
mentioned,
the
next
meeting
will
follow
in
the
thanksgiving
week,
so
I
believe
many
community
members
from
joining
from
the
united
states
might
not
be
available.
So
we
might
do
this
in
four
weeks
time
if
that's
okay
for
everyone.
A
A
And
it
appears
that
there
are
no
more
topics
for
today,
so
I
would
like
to
thank
again
waychanga
for
his
demo
really
really
informative,
and
also
many
thanks
to
steven
for
volunteering
for
conducting
retrospective
or
for
assessing
the
health
of
the
open
source
project
and
say
that
I
would
like
to
also
thank
everyone
for
attending
and,
as
usual,
I
wish
everyone
a
good
morning,
good
afternoon,
good
evening
or
good
night,
of
course,
for
our
friends
in
palo
alto.
So
thanks
thanks
for
joining
and
talk
to
you
in
two
weeks
time.