Re: Numen with reference to vmap

["Serguei Bezverkhi (sbezverk)" <sbezverk@cisco.com>]

Hello,

I came across a situation when I need to match against L4 proto (tcp/udp), L3 daddr and L4 port(port value) with vmap.

Vmap looks like this:

	map no-endpoints-services {
		type inet_proto . ipv4_addr . inet_service : verdict
	}

I was wondering if somebody could come up with a single line rule with reference to that vmap.

Thank you
Serguei

On 2019-12-17, 11:41 AM, "n0-1@orbyte.nwl.cc on behalf of Phil Sutter" <n0-1@orbyte.nwl.cc on behalf of phil@nwl.cc> wrote:

    Hi Serguei,
    
    On Tue, Dec 17, 2019 at 02:05:58PM +0000, Serguei Bezverkhi (sbezverk) wrote:
    > Thank you very much for your reply. Can I paste your reply into the doc with reference to your name? If you do not wish. I will rephrase it and post it there.
    
    Noo, don't tell anyone what I write in mails to public lists! ;)
    Seriously, I don't care if you paste it there or just link to my reply
    in a public archive.
    
    > I have one question, 
    > 
    > chain KUBE-SVC-57XVOCFNTLTR3Q27 {
    > 	numgen random mod 2 vmap { 0 : jump KUBE-SEP-FS3FUULGZPVD4VYB, 
    >                                                                        1 : jump KUBE-SEP-MMFZROQSLQ3DKOQA }
    > }
    > 
    > In this rule, as far as I understood you last time, there is no way dynamically change elements of anonymous vmap. So if the service has large number of dynamic (short lived) endpoints, this rule will have to be reprogrammed for every change and it would be extremely inefficient. Is there any way to make it more dynamic or plans to change the static behavior?  That would extremely important.
    
    Consensus was that you should either copy the iptables solution for now
    (accepting the drawbacks I explained in my last mail) or go with
    replacing that rule for each added/removed node. You'll have to adjust
    both mapping contents and modulus value!
    
    While it would be nice to have a better way of managing this
    load-balancing, I have no idea how one would ideally implement it. Feel
    free to file a ticket in netfilter bugzilla, but don't hold your breath
    for a quick solution.
    
    Cheers, Phil