Explicitly specifiying ipset revision seems to fix some ipset creatio…

…n/insertion corner cases (istio#53862) * Explicitly specifiying ipset revision seems to fix some corner cases Signed-off-by: Benjamin Leggett <benjamin.leggett@solo.io> * Relnote Signed-off-by: Benjamin Leggett <benjamin.leggett@solo.io> * Use Revision=2, it works just as well and based on sketchy code comments in the userspace binary is maybe ~more correct Signed-off-by: Benjamin Leggett <benjamin.leggett@solo.io> --------- Signed-off-by: Benjamin Leggett <benjamin.leggett@solo.io>
MorrisLaw · Nov 18, 2024 · 5237ccc · 5237ccc
1 parent c3253de
commit 5237ccc
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/cni/pkg/ipset/nldeps_linux.go b/cni/pkg/ipset/nldeps_linux.go
@@ -39,7 +39,12 @@ func (m *realDeps) ipsetIPHashCreate(name string, v6 bool) error {
 	} else {
 		family = unix.AF_INET
 	}
-	err := netlink.IpsetCreate(name, "hash:ip", netlink.IpsetCreateOptions{Comments: true, Replace: true, Family: family})
+
+	// Note: `vishvananda/netlink` seems to have a bug where it defaults to revision=1 for `hash:ip,port` but defaults to revision=0 for `hash:ip`
+	// This causes breakages in some cases with Docker-based nodes: https://github.com/istio/istio/issues/53512
+	// Setting `Revision=2` here seems to work correctly in all cases found thus far.
+	// Source: https://github.com/Olipro/ipset/blob/9f145b49100104d6570fe5c31a5236816ebb4f8f/kernel/net/netfilter/ipset/ip_set_hash_ip.c#L28
+	err := netlink.IpsetCreate(name, "hash:ip", netlink.IpsetCreateOptions{Comments: true, Replace: true, Revision: 2, Family: family})
 	// Note there appears to be a bug in vishvananda/netlink here:
 	// https://github.com/vishvananda/netlink/issues/992
 	//

diff --git a/releasenotes/notes/53862.yaml b/releasenotes/notes/53862.yaml
@@ -0,0 +1,8 @@
+apiVersion: release-notes/v2
+kind: bug-fix
+area: installation
+issue:
+  - https://github.com/istio/istio/issues/53512
+releaseNotes:
+  - |
+    **Fixed** an issue where ipset entry creation would fail on certain kinds of Docker-based kubernetes nodes