3 Commits

Include renames

Author	SHA1	Message	Date
levaliciousandClaude Opus 5.5	8018ea4bf9	lb: keep the client's address past weave's masquerade ... Weave's expose rule (nat WEAVE: ! -s <alloc> -d <alloc> -j MASQUERADE) masquerades everything entering the pod network from outside unless it is for a local pod (weaver-no-masq-local). Live on the SG cluster a pod on another node than the holder saw the holder's bridge address instead of the client's. A new chain, REWEAVE-LB-POST, hooked first in nat POSTROUTING, lets a connection we DNATed to a held address leave the nat table with its source untouched; one that comes from a pod (hairpin) is masqueraded to the holder instead, so its reply returns through the holder's conntrack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ	2026-10-13 13:30:08 -04:00
levaliciousandClaude Opus 5.5	ef50dc921f	lb: DNAT rules carry their protocol; end-to-end test against a cluster ... iptables refuses a DNAT to ip:port unless the same rule names the protocol, so every per-port chain's DNAT now has -p. Live on the SG cluster the first sync (no endpoints yet) applied; every later one failed with "Need TCP, UDP, SCTP or DCCP with port specification" and left the chains empty. The unit test now rejects any DNAT line without its protocol; the rendered nat and mangle payloads were also checked with the nodes' own iptables-restore --test (nf_tables). reweave/test/lb/run.sh is the end-to-end test: from outside, both a pod on the holder and one on another node see the client's own address; status is [{ip, ipMode: Proxy}] and kube-proxy has nothing for the address; a pod on a third node reaches it; an unheld address clears the status and stops the forward; deleting the Services removes the holder's chains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ	2026-10-13 13:10:49 -04:00
levaliciousandClaude Opus 5.5	9bc3415111	lb: LoadBalancer Services from addresses nodes hold, client address kept ... A Service of type LoadBalancer with loadBalancerClass reweave.levk.dev/node-address names its address in spec.loadBalancerIP. Each node's weave-npc publishes the IPv4 addresses on its host interfaces and its weave bridge (Node annotations reweave.levk.dev/addresses and reweave.levk.dev/weave). The one node that holds a Service's address is its holder: it alone writes status.loadBalancer (ipMode Proxy, so kube-proxy installs nothing for the address) and DNATs the address's ports to ready endpoints (EndpointSlices), without SNAT, from nat PREROUTING ahead of kube-proxy. Every other node marks the connections the holder forwards to its pods (new, from the holder's bridge MAC, from outside the pod network) and routes their replies back to the holder's bridge through a per-holder policy rule and table, so the holder's conntrack undoes the DNAT and the reply leaves from the address the client connected to. Fail closed: an address no node holds, or that several nodes hold, is served by no node, and its status is cleared (by its holder, or by the first node by name if none holds it). Compute is the policy as a pure function; Datapath replaces exactly the chains it owns with iptables-restore --noflush and keeps its rules and tables exact. weave-npc runs it unless --lb=false; the ClusterRole gains services (watch), services/status (patch), endpointslices (watch), nodes (patch). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ	2026-10-13 12:45:54 -04:00