Felix programs IPIP tunnels

api/pkg/apis/projectcalico/v3/felixconfig.go

@@ -63,6 +63,13 @@ const (
 	NFTablesModeDisabled = "Disabled"
 )
 
+type ProgramRouteMode string
+
+const (
+	ProgramRouteModeNone ProgramRouteMode = "None"
+	ProgramRouteModeIPIP ProgramRouteMode = "IPIP"
+)
+
 // +kubebuilder:validation:Enum=DoNothing;Enable;Disable
 type AWSSrcDstCheckOption string
 
@@ -324,6 +331,8 @@ type FelixConfigurationSpec struct {
 	// IPIPMTU controls the MTU to set on the IPIP tunnel device.  Optional as Felix auto-detects the MTU based on the
 	// MTU of the host's interfaces. [Default: 0 (auto-detect)]
 	IPIPMTU *int `json:"ipipMTU,omitempty" confignamev1:"IpInIpMtu"`
+	// ProgramRoutes specifies what type of routes Felix should program. [Default: None]. [Default: None]
+	ProgramRoutes *ProgramRouteMode `json:"programRoutes,omitempty" validate:"omitempty,oneof=None IPIP"`
 
 	// VXLANEnabled overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking.
 	// Optional as Felix determines this based on the existing IP pools. [Default: nil (unset)]

charts/calico/templates/calico-config.yaml

@@ -41,6 +41,8 @@ data:
   # Configure the backend to use.
 {{- if or (.Values.flannel_migration) (.Values.vxlan) }}
   calico_backend: "vxlan"
+{{- else if (.Values.ipip) }}
+  calico_backend: "ipip"
 {{- else }}
   calico_backend: "bird"
 {{- end }}

charts/calico/templates/calico-node.yaml

@@ -323,6 +323,9 @@ spec:
             # Enable or Disable VXLAN on the default IPv6 IP pool.
             - name: CALICO_IPV6POOL_VXLAN
               value: "{{- if .Values.vxlan -}} CrossSubnet {{- else -}} Never {{- end -}}"
+            # Set if Felix should program IPIP routes or not.
+            - name: FELIX_PROGRAMROUTES
+              value: "{{ if .Values.ipip -}} IPIP {{- else -}} None {{- end -}}"
             # Set MTU for tunnel device used if ipip is enabled
             - name: FELIX_IPINIPMTU
               valueFrom:
@@ -406,7 +409,7 @@ spec:
               command:
               - /bin/calico-node
               - -felix-live
-{{- if and (eq .Values.network "calico") (not .Values.flannel_migration) (not .Values.vxlan) }}
+{{- if and (eq .Values.network "calico") (not .Values.flannel_migration) (not .Values.vxlan) (not .Values.ipip) }}
               - -bird-live
 {{- end }}
             periodSeconds: 10
@@ -419,7 +422,7 @@ spec:
               command:
               - /bin/calico-node
               - -felix-ready
-{{- if and (not .Values.flannel_migration) (not .Values.vxlan) }}
+{{- if and (not .Values.flannel_migration) (not .Values.vxlan) (not .Values.ipip) }}
               - -bird-ready
 {{- end }}
 {{- else if eq .Values.network "flannel" }}

charts/values/calico-ipip.yaml

@@ -0,0 +1,3 @@
+datastore: kubernetes
+network: calico
+ipip: true

felix/calc/calc_graph.go

@@ -392,7 +392,8 @@ func NewCalculationGraph(
 	hostIPPassthru.RegisterWith(allUpdDispatcher)
 	cg.hostIPPassthru = hostIPPassthru
 
-	if conf.BPFEnabled || conf.Encapsulation.VXLANEnabled || conf.Encapsulation.VXLANEnabledV6 || conf.WireguardEnabled || conf.WireguardEnabledV6 {
+	if conf.BPFEnabled || conf.Encapsulation.VXLANEnabled || conf.Encapsulation.VXLANEnabledV6 ||
+		conf.WireguardEnabled || conf.WireguardEnabledV6 || conf.ProgramIPIPRoutes() {
 		// Calculate simple node-ownership routes.
 		//        ...
 		//     Dispatcher (all updates)

felix/config/config_params.go

@@ -353,6 +353,7 @@ type Config struct {
 	IpInIpEnabled    *bool  `config:"*bool;"`
 	IpInIpMtu        int    `config:"int;0"`
 	IpInIpTunnelAddr net.IP `config:"ipv4;"`
+	ProgramRoutes    string `config:"oneof(None,IPIP);None"`
 
 	// Feature enablement.  Can be either "Enabled" or "Disabled".  Note, this governs the
 	// programming of NAT mappings derived from Kubernetes pod annotations.  OpenStack floating
@@ -1241,6 +1242,10 @@ func (config *Config) RouteTableIndices() []idalloc.IndexRange {
 	return config.RouteTableRanges
 }
 
+func (config *Config) ProgramIPIPRoutes() bool {
+	return config.ProgramRoutes == string(v3.ProgramRouteModeIPIP)
+}
+
 func New() *Config {
 	if knownParams == nil {
 		loadParams()

felix/dataplane/driver.go

@@ -310,6 +310,7 @@ func StartDataplaneDriver(
 				RouteSyncDisabled:   configParams.RouteSyncDisabled,
 			},
 			IPIPMTU:                        configParams.IpInIpMtu,
+			ProgramIPIPRoutes:              configParams.ProgramIPIPRoutes(),
 			VXLANMTU:                       configParams.VXLANMTU,
 			VXLANMTUV6:                     configParams.VXLANMTUV6,
 			VXLANPort:                      configParams.VXLANPort,

felix/dataplane/linux/bpf_ep_mgr.go

@@ -549,7 +549,11 @@ func newBPFEndpointManager(
 
 	specialInterfaces := []string{"egress.calico"}
 	if config.RulesConfig.IPIPEnabled {
-		specialInterfaces = append(specialInterfaces, dataplanedefs.IPIPIfaceName)
+		if config.ProgramIPIPRoutes {
+			specialInterfaces = append(specialInterfaces, dataplanedefs.IPIPIfaceNameV4)
+		} else {
+			specialInterfaces = append(specialInterfaces, dataplanedefs.IPIPDefaultIfaceNameV4)
+		}
 	}
 	if config.RulesConfig.VXLANEnabled {
 		specialInterfaces = append(specialInterfaces, dataplanedefs.VXLANIfaceNameV4)

felix/dataplane/linux/dataplanedefs/dataplane_defs.go

@@ -17,10 +17,13 @@ package dataplanedefs
 import "github.com/vishvananda/netlink"
 
 const (
-	IPIPIfaceName                           = "tunl0"
-	VXLANIfaceNameV4                        = "vxlan.calico"
-	VXLANIfaceNameV6                        = "vxlan-v6.calico"
-	VXLANDefaultProto netlink.RouteProtocol = 80
+	VXLANIfaceNameV4 = "vxlan.calico"
+	VXLANIfaceNameV6 = "vxlan-v6.calico"
+
+	IPIPIfaceNameV4        = "ipip.calico"
+	IPIPDefaultIfaceNameV4 = "tunl0"
+
+	DefaultRoutingProto netlink.RouteProtocol = 80
 
 	BPFInDev  = "bpfin.cali"
 	BPFOutDev = "bpfout.cali"

felix/dataplane/linux/int_dataplane.go

@@ -149,10 +149,13 @@ type Config struct {
 	NodeZone             string
 	IPv6Enabled          bool
 	RuleRendererOverride rules.RuleRenderer
-	IPIPMTU              int
-	VXLANMTU             int
-	VXLANMTUV6           int
-	VXLANPort            int
+
+	IPIPMTU           int
+	ProgramIPIPRoutes bool
+
+	VXLANMTU   int
+	VXLANMTUV6 int
+	VXLANPort  int
 
 	MaxIPSetSize int
 
@@ -319,6 +322,7 @@ type InternalDataplane struct {
 	ipSets          []dpsets.IPSetsDataplane
 
 	ipipManager *ipipManager
+	ipipParentC chan string
 
 	vxlanManager   *vxlanManager
 	vxlanParentC   chan string
@@ -1035,10 +1039,33 @@ func NewIntDataplaneDriver(config Config) *InternalDataplane {
 	dp.RegisterManager(newFloatingIPManager(natTableV4, ruleRenderer, 4, config.FloatingIPsEnabled))
 	dp.RegisterManager(newMasqManager(ipSetsV4, natTableV4, ruleRenderer, config.MaxIPSetSize, 4))
 	if config.RulesConfig.IPIPEnabled {
-		log.Info("IPIP enabled, starting thread to keep tunnel configuration in sync.")
-		// Add a manager to keep the all-hosts IP set up to date.
-		dp.ipipManager = newIPIPManager(ipSetsV4, config.MaxIPSetSize, config.ExternalNodesCidrs)
-		go dp.ipipManager.KeepIPIPDeviceInSync(config.IPIPMTU, config.RulesConfig.IPIPTunnelAddress, dataplaneFeatures.ChecksumOffloadBroken)
+		if config.ProgramIPIPRoutes {
+			log.Info("IPIP enabled, starting thread to keep tunnel configuration in sync.")
+			// Add a manager to keep the all-hosts IP set up to date.
+			dp.ipipManager = newIPIPManager(
+				ipSetsV4,
+				routeTableV4,
+				dataplanedefs.IPIPIfaceNameV4,
+				config,
+				dp.loopSummarizer,
+				4,
+				featureDetector,
+			)
+			dp.ipipParentC = make(chan string, 1)
+			go dp.ipipManager.KeepCalicoIPIPDeviceInSync(context.Background(), dataplaneFeatures.ChecksumOffloadBroken, 10*time.Second, dp.ipipParentC)
+		} else {
+			log.Info("IPIP using BGP enabled, starting thread to keep tunnel configuration in sync.")
+			dp.ipipManager = newIPIPManager(
+				ipSetsV4,
+				nil,
+				dataplanedefs.IPIPDefaultIfaceNameV4,
+				config,
+				dp.loopSummarizer,
+				4,
+				featureDetector,
+			)
+			go dp.ipipManager.KeepIPIPDeviceInSync(dataplaneFeatures.ChecksumOffloadBroken)
+		}
 		dp.RegisterManager(dp.ipipManager) // IPv4-only
 	} else {
 		// Only clean up IPIP addresses if IPIP is implicitly disabled (no IPIP pools and not explicitly set in FelixConfig)
@@ -2078,6 +2105,8 @@ func (d *InternalDataplane) loopUpdatingDataplane() {
 			d.vxlanManager.OnParentNameUpdate(name)
 		case name := <-d.vxlanParentCV6:
 			d.vxlanManagerV6.OnParentNameUpdate(name)
+		case name := <-d.ipipParentC:
+			d.ipipManager.OnParentNameUpdate(name)
 		case <-ipSetsRefreshC:
 			log.Debug("Refreshing IP sets state")
 			d.forceIPSetsRefresh = true