Re: Operation not supported when adding jump command

[Phil Sutter <phil@nwl.cc>]

Hi,

On Wed, Nov 27, 2019 at 04:50:56PM +0000, Serguei Bezverkhi (sbezverk) wrote:
> According to api folks kube-proxy must sustain 5k or about test otherwise it will never see production environment. Implementing of numgen expression is relatively simple, thanks to "nft --debug all" once it's done, a user can use it as easily as  with json __
> 
> Regarding concurrent usage, since my primary goal is kube-proxy I do not really care at this moment, as k8s cluster is not an application you co-locate in production with some other applications potentially altering host's tables. I agree firewalld might be interesting and more generic alternative, but seeing how quickly things are done in k8s,  maybe it will be done by the end of 21st century __

I agree, in dedicated setup there's no need for compromises. I guess if
you manage to reduce ruleset changes to mere set element modifications,
you could outperform iptables in that regard. Run-time performance of
the resulting ruleset will obviously benefit from set/map use as there
are much fewer rules to traverse for each packet.

> Once I get filter chain portion in the code I will share a link to repo so you could review.

Thanks! I'm also interested in seeing whether there are any
inconveniences due to nftables limitations. Maybe some problems are
easier solved on kernel-side.

Cheers, Phil