Active connection tracking in ebpf

[AwesomePatrol]

As described in cilium/design-cfps#31, this is part of #31752

Example configuration (in cilium-config) for KIND cluster:

  fixed-zone-mapping: zone-a=123,zone-b=129
  enable-active-connection-tracking: "true"

where topology labels were set on the nodes:

kubectl label node kind-control-plane topology.kubernetes.io/zone=zone-a
kubectl label node kind-worker topology.kubernetes.io/zone=zone-b

Zone mapping can be verified with cilium map get cilium_lb4_backends_v3:

Key   Value                        State   Error
16    ANY://10.244.1.74[zone-b]    sync
17    ANY://10.244.1.74[zone-b]    sync
18    ANY://10.244.1.202[zone-b]   sync
19    ANY://10.244.1.202[zone-b]   sync
13    ANY://192.168.11.2[zone-b]   sync
14    ANY://10.244.0.178[zone-a]   sync
15    ANY://10.244.0.178[zone-a]   sync

LRS accounting can be verified with cilium map get cilium_lb_act:

Key                       Value     State   Error
10.96.138.80:80[zone-b]   +72 -72
10.96.138.80:80[zone-a]   +28 -28

Add cilium_lb_act BPF map with counters of opened and closed connections

[lmb]

Loader changes are fine. As a rando reviewer, it's not at all clear to me what lrs stands for however.

[tommyp1ckles]

@julianwiedmann would you be able to review this for @cilium/sig-datapath, I'm assigned sig-cli but my review would also count towards datapath - and I'm not familiar enough with this code to provide a thorough review.

[AwesomePatrol]

Loader changes are fine. As a rando reviewer, it's not at all clear to me what lrs stands for however.

LRS stands for Load Reporting Service from Envoy. Please see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/load_stats/v3/lrs.proto. I am bad at naming stuff, so I am open to suggestions

[tommyp1ckles]

@AwesomePatrol Does the TODO list in the second commits message represent work that's still to be done?

[julianwiedmann]

Based on the TODOs and the missing description in the second patch, this looks like it still needs some more work. Flipping to draft for now to get it off my queue, please flip back when you're ready! 🙏

[pchaigno]

/test

[julianwiedmann]

👋 thank you! I'd want to address the integration into the BPF codepath below.

Besides that, could you please squash the last two patches in the series into the initial series? I don't think we need to merge code that immediately gets refactored again.

[julianwiedmann]

Note that you'll probably need a rebase to pick up the changes from #32653.

[AwesomePatrol]

/test

[julianwiedmann]

lgtm, the conntrack integration feels much simpler now. Thank you!

[joestringer]

Relating to release-note/major, I'm trying to understand the impact on users. Currently the release note is the following:

Add cilium_lb_act BPF map with counters of opened and closed connections

This sounds to me like a low-level detail that operators might consult during debugging, rather than unlocking for instance better load balancing across the cluster.

What's the user-facing impact of this change? Could it be broader and we can describe it better in the release note, or is this pretty accurate, in which case do we think this has a major impact on users?

[pchaigno]

I'm the one who added this release note. I added it because my understanding is that this is a new feature being exposed to advanced users (who would poll the new map). In the past, I've used release-note/major for all new features, including things like internalTrafficPolicy=Local that may not be considered major in other contexts.

[AwesomePatrol]

This sounds to me like a low-level detail that operators might consult during debugging

I agree. I work on exposing these as prometheus metrics, so I believe this PR is an implementation detail and not really a new feature. Hopefully I will publish new PR this week. It could be marked major then (and this one minor).

What's the user-facing impact of this change?

There should be no impact. Even with flags set (both fixed-zone-mapping and enable-active-connection-tracking) the only change is that you can query a new map with some data in it.

this is a new feature being exposed to advanced users (who would poll the new map)

I don't think that map polling is very user friendly, but are there many examples of usage of cilium maps outside of cilium binary?