Problem
We cannot use a routing based Kubernetes CNI as OpenStack port security does prevent IP and MAC spoofing. Disabling the port security in OpenStack does allow Kubernetes CNI such as Cilium to use native routing.
Kubermatic's machine-controller does not support setting disablePortSecurity. Please implement this setting, which is already present in newer cluster-api.
Reference
|
// Machine details |
|
Image string |
|
Flavor string |
|
SecurityGroups []string |
Problem
We cannot use a routing based Kubernetes CNI as OpenStack port security does prevent IP and MAC spoofing. Disabling the port security in OpenStack does allow Kubernetes CNI such as Cilium to use native routing.
Kubermatic's
machine-controllerdoes not support settingdisablePortSecurity. Please implement this setting, which is already present in newer cluster-api.Reference
machine-controller/pkg/cloudprovider/provider/openstack/provider.go
Lines 96 to 99 in 1302066