Repository navigation
Conversation
haproxy cannot balance UDP, so the virtual router refused UDP load balancer rules although it lists udp as a supported protocol. UDP rules are now left out of the haproxy configuration and sent to the router as a separate list. The router serves them with IPVS in NAT mode (it is the gateway of the backends), keeping the IPVS table in sync with the rules instead of flushing it, and opens the UDP port in its firewall for the rule's source CIDRs. - algorithms map to IPVS schedulers: roundrobin -> rr, leastconn -> lc, source -> sh; source based stickiness becomes IPVS persistence with its expire value as the timeout - other stickiness methods and health check policies are refused for UDP rules - a UDP rule gets a UDP firewall rule, and its protocol cannot be switched between udp and the tcp based protocols
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sketch: UDP load balancer rules on the virtual router, served by IPVS (NAT mode) instead of haproxy.
Changes
expirebecomes the IPVS persistence timeout), health check policies are refused. A UDP rule gets a UDP firewall rule, and an update cannot switch a rule between udp and the tcp based protocols.haproxy.cfgand haproxy's (tcp) firewall rules and sent as a newudp_ruleslist (VIP, port, scheduler, persistence, backends, source CIDRs). Algorithms: roundrobin -> rr, leastconn -> lc, source -> sh.CsLoadBalancer.py): opens the UDP port per source CIDR, syncs the IPVS table withipvsadm(adds/removes only the differences), setsnet.ipv4.vs.conntrack=1.Tested
Unit tests only (
HAProxyConfiguratorTest,NetworkHelperImplTest,LoadBalancingRulesManagerImplTest,VirtualRouterElementTest,ConfigHelperTest), build with-P developer. Not tried on a router yet.Open
ilb.sh) not covered