Disable Source/Dest Check on network interfaces

[mweibel]

trafficstars

/kind feature

Describe the solution you'd like Calico over VXLAN requires to disable the source/dest check of AWS network interfaces. Currently it is impossible to configure that via CAPA and one needs to run e.g. a src dest check controller which automatically disables it on the ec2 instances once new nodes come up.

I'd like to be able to disable src dest check via a configuration setting on the AWSMachineTemplate and AWSMachinePool CRDs. The respective controllers take those into account when creating the ec2 instance or the launch template. Due to a AWS API limitiation, I believe the src/dest check on AutoscalingGroups can only be disabled after starting the instance. This means an AWSMachinePool launchtemplate with src/dest check disabled would need to have an addition to the default userdata to disable the src/dest check.

Environment:

• Cluster-api-provider-aws version: 1.3.0
• Kubernetes version: (use kubectl version): 1.23.4
• OS (e.g. from /etc/os-release): linux/windows hybrid

[k8s-ci-robot]

@mweibel: This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sedefsavas]

The respective controllers take those into account when creating the ec2 instance or the launch template. Due to a AWS API limitiation, I believe the src/dest check on AutoscalingGroups can only be disabled after starting the instance.

Disabling src/dst check during ec2 creation does not look possible either. So from my understanding, this is something that needs to be done after the cluster is up. Installing an addon to do this might make more sense if this is the case. After the addon proposal is in, we can utilize it to add addons similar to kOps.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.