levaliciousandClaude Opus 5.5 8018ea4bf9 lb: keep the client's address past weave's masquerade ...

Weave's expose rule (nat WEAVE: ! -s <alloc> -d <alloc> -j MASQUERADE)
masquerades everything entering the pod network from outside unless it is
for a local pod (weaver-no-masq-local). Live on the SG cluster a pod on
another node than the holder saw the holder's bridge address instead of
the client's. A new chain, REWEAVE-LB-POST, hooked first in nat
POSTROUTING, lets a connection we DNATed to a held address leave the nat
table with its source untouched; one that comes from a pod (hairpin) is
masqueraded to the holder instead, so its reply returns through the
holder's conntrack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ

2026-10-13 13:30:08 -04:00

..

addresses.go

lb: LoadBalancer Services from addresses nodes hold, client address kept

2026-10-13 12:45:54 -04:00

controller.go

lb: LoadBalancer Services from addresses nodes hold, client address kept

2026-10-13 12:45:54 -04:00

datapath.go

lb: keep the client's address past weave's masquerade

2026-10-13 13:30:08 -04:00

model_test.go

lb: keep the client's address past weave's masquerade

2026-10-13 13:30:08 -04:00

model.go

lb: LoadBalancer Services from addresses nodes hold, client address kept

2026-10-13 12:45:54 -04:00