Re: load balancing between two chains

[sbezverk <sbezverk@gmail.com>]

It started working?!?!?!?!

sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive pod1 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive from pod2 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive from pod3 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive pod1 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive from pod2 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive from pod3 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive pod1 :)
sbezverk@kube-4:~$ curl http://57.141.53.140:808
Still alive from pod2 :)

        chain k8s-nfproxy-svc-M53CN2XYVUHRQ7UB { # handle 60
                numgen inc mod 3 vmap { 0 : goto k8s-nfproxy-sep-TMVEFT7EX55F4T62, 1 : goto k8s-nfproxy-sep-GTJ7BFLUOQRCGMD5, 2 : goto k8s-nfproxy-sep-23NTSA2UXPPQIPK4, 16777216 : goto endianbug } # handle 174
                counter packets 4 bytes 240 comment "" # handle 76
        }


        chain endianbug { # handle 171
                counter packets 0 bytes 0 # handle 172
        }

Why is that?

Thank you
Serguei

On 2020-01-20, 5:12 PM, "Florian Westphal" <fw@strlen.de> wrote:

    Florian Westphal <fw@strlen.de> wrote:
    > sbezverk <sbezverk@gmail.com> wrote:
    > > Numgen has GOTO directive and not Jump (Phil asked to change it), I thought it means after hitting any chains in numgen the processing will go back to service chain, no?
    > > 
    > > It is Ubuntu 18.04
    > > 
    > > sbezverk@kube-4:~$ uname -a
    > > Linux kube-4 5.4.10-050410-generic #202001091038 SMP Thu Jan 9 10:41:11 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
    > > sbezverk@kube-4:~$ sudo nft --version
    > > nftables v0.9.1 (Headless Horseman)
    > > sbezverk@kube-4:~$
    > > 
    > > I also want to remind you that I do NOT use nft cli to program rules, I use nft cli just to see resulting rules.
    > 
    > In that case, please include "nft --debug=netlink list ruleset".
    > 
    > It would also be good to check if things work when you add it via nft
    > tool.
    
    Oh, and for the fun of it, you could also try this:
    
    chain k8s-nfproxy-svc-M53CN2XYVUHRQ7UB {
    	numgen inc mod 2 vmap { 0 : goto k8s-nfproxy-sep-I7XZOUOVPIQW4IXA, 1 : goto k8s-nfproxy-sep-ZNSGEJWUBCC5QYMQ, 16777216 : goto endianbug }
    	counter packets 0 bytes 0 } 
            chain endianbug {
    		 counter packets 0 bytes 0
    	}
     ...
    
    numgen generates a 32bit number in host byte order, so nft internally
    converts the keys accordingly (16777216 is htonl(1)).