{"action":"created","issue":{"url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/issues/130","repository_url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s","labels_url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/issues/130/labels{/name}","comments_url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/issues/130/comments","events_url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/issues/130/events","html_url":"https://github.com/aws/amazon-vpc-cni-k8s/pull/130","id":339872723,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAwNDE5NDU5","number":130,"title":"Fix return path of NodePort traffic.","user":{"login":"fasaxc","id":469264,"node_id":"MDQ6VXNlcjQ2OTI2NA==","avatar_url":"https://avatars0.githubusercontent.com/u/469264?v=4","gravatar_id":"","url":"https://api.github.com/users/fasaxc","html_url":"https://github.com/fasaxc","followers_url":"https://api.github.com/users/fasaxc/followers","following_url":"https://api.github.com/users/fasaxc/following{/other_user}","gists_url":"https://api.github.com/users/fasaxc/gists{/gist_id}","starred_url":"https://api.github.com/users/fasaxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasaxc/subscriptions","organizations_url":"https://api.github.com/users/fasaxc/orgs","repos_url":"https://api.github.com/users/fasaxc/repos","events_url":"https://api.github.com/users/fasaxc/events{/privacy}","received_events_url":"https://api.github.com/users/fasaxc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-07-10T14:38:45Z","updated_at":"2018-07-12T20:50:21Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/pulls/130","html_url":"https://github.com/aws/amazon-vpc-cni-k8s/pull/130","diff_url":"https://github.com/aws/amazon-vpc-cni-k8s/pull/130.diff","patch_url":"https://github.com/aws/amazon-vpc-cni-k8s/pull/130.patch"},"body":"*Issue #, if available:*\r\n\r\nFixes #75\r\n\r\n*Description of changes:*\r\n\r\nAdd iptables and routing rules that\r\n\r\n- connmark traffic that arrives at the host over eth0\r\n- restore the mark when the traffic leaves a pod veth\r\n- force marked traffic to use the main routing table so that it\r\n  exits via eth0.\r\n\r\n*Testing performed*\r\n\r\n- Spun up a 2 node cluster and installed the plugin (and Calico with the `IptablesMangleAllowAction=RETURN`).\r\n- Started a 2-pod nginx service, at least one ngingx pod was on a non-primary ENI (checked with `ip rule`)\r\n- Exposed the nginx pods as a NodePort service\r\n- Repeatedly checked connectivity from both nodes to the service, going via the other node's NodePort.  Worked as expected.  (Without fix, saw 50% connection failure rate.)\r\n- Checked connectivity to the service from a busybox pod to its cluster IP and domain name.\r\n- Killed/restarted the aws-node pod.\r\n- Checked log for errors/ warnings.\r\n\r\nBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.\r\n"},"comment":{"url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/issues/comments/404646299","html_url":"https://github.com/aws/amazon-vpc-cni-k8s/pull/130#issuecomment-404646299","issue_url":"https://api.github.com/repos/aws/amazon-vpc-cni-k8s/issues/130","id":404646299,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNDY0NjI5OQ==","user":{"login":"liwenwu-amazon","id":24555154,"node_id":"MDQ6VXNlcjI0NTU1MTU0","avatar_url":"https://avatars1.githubusercontent.com/u/24555154?v=4","gravatar_id":"","url":"https://api.github.com/users/liwenwu-amazon","html_url":"https://github.com/liwenwu-amazon","followers_url":"https://api.github.com/users/liwenwu-amazon/followers","following_url":"https://api.github.com/users/liwenwu-amazon/following{/other_user}","gists_url":"https://api.github.com/users/liwenwu-amazon/gists{/gist_id}","starred_url":"https://api.github.com/users/liwenwu-amazon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liwenwu-amazon/subscriptions","organizations_url":"https://api.github.com/users/liwenwu-amazon/orgs","repos_url":"https://api.github.com/users/liwenwu-amazon/repos","events_url":"https://api.github.com/users/liwenwu-amazon/events{/privacy}","received_events_url":"https://api.github.com/users/liwenwu-amazon/received_events","type":"User","site_admin":false},"created_at":"2018-07-12T20:50:21Z","updated_at":"2018-07-12T20:50:21Z","author_association":"CONTRIBUTOR","body":"@fasaxc , can you  explain why change eth0 to \"loose\" mode make it working?  In another word, if it is not set (as it today in eks), which particular packet get dropped and make the instance `unhealthy`?  thanks"}}
{"actor":{"display_login":"liwenwu-amazon"}}