Cory Snider
01573380f9
Add a native nftables implementation of service load balancing which achieves feature parity with the iptables firewall mode. This is accomplished using a static nftables ruleset with dynamic data. NAT and DSR modes are both supported. The backend server for each flow is chosen randomly rather than round-robin like the iptables+IPVS implementation. As the load balancer endpoint only sees one side of DSR flows we cannot use netfilter's conntrack subsystem. And IPVS does not play well with nftables -- nftables is missing an analogue for the `ipvs` xtables matcher. DSR flows are made sticky by implementing one-sided connection tracking directly in the nftables ruleset using maps that are updated in the packet path. A network's load-balancer tables have exactly one writer: each loadBalancer records the data plane it wants, and the complete element set is composed from every recorded contribution. nat-publish-port is an interval map keyed on `l4proto . dport . numgen`, so the bucket space for a published port has to be partitioned by a single owner -- and a service whose published-port set changes has a separate binding, hence a separate loadBalancer, per generation until the rolling update drains. Two of them partitioning a shared port independently would emit overlapping intervals, which nftables rejects. Composing them instead partitions the port once over every backend that serves it, so a shared published port is load-balanced across both generations. IPVS cannot do that: one fwMark cannot select a different backend set per port. Signed-off-by: Cory Snider <csnider@mirantis.com>
The contrib directory contains scripts, images, and other helpful things
which are not part of the core docker distribution. Please note that they
could be out of date, since they do not receive the same attention as the
rest of the repository.