Kebe

@istio/technical-oversight-committee Would you mind taking a look at this PR?

It looks like it's because the map creation of sockhash type failed. We haven't run the test on centos8.2, thank you for the information, I will try to find the...

> I have the same error. Version 0.7.0 from Dockerhub, CNI enabled > > ``` > args: > - /app/mbctl > - -m > - istio > - --use-reconnect=true >...

> > > > @kebe7jun If I understood your comment correctly, you are suggesting that user should not have to set --dns-redir=true if they want to enable the dns redirection...

> Apart from that, I am wondering if we can use cni-mode to filter the packet in sendmsg/recvmsg coming from istio injected pod, rather than doing a lookup for OUT_REDIRECT_PORT...

I will try to reproduce the problem as soon as possible and give you feedback later.

ohh, I'm very sorry for forgetting to reply. I tested this specifically a few days ago, and your problem did not reproduce in my environment. Can this be reproduced directly...

Hi @tanjunchen , in the latest version, we have optimized the performance, can you test it again?

How did you test it? If you want to have a good performance, you need to turn on the cni mode. See: https://merbridge.io/blog/2022/05/18/cni-mode/

> BTW - how can I tell its working? The following validation ways are possible. 1. Observe the number of packets in the `ISTIO_REDIRECT` chain by running `iptables -t nat...