@@ -686,23 +686,31 @@ func (oc *ovsController) ensureTunMAC() error {
686
686
return nil
687
687
}
688
688
689
- func (oc * ovsController ) UpdateNamespaceEgressRules (vnid uint32 , nodeIP , mark string ) error {
689
+ func (oc * ovsController ) SetNamespaceEgressNormal (vnid uint32 ) error {
690
690
otx := oc .ovs .NewTransaction ()
691
691
otx .DeleteFlows ("table=100, reg0=%d" , vnid )
692
+ return otx .EndTransaction ()
693
+ }
692
694
693
- if mark == "" {
694
- // Namespace no longer has an EgressIP; no VNID-specific rules needed
695
- } else if nodeIP == "" {
696
- // Namespace has Egress IP, but it is unavailable, so drop egress traffic
695
+ func (oc * ovsController ) SetNamespaceEgressDropped (vnid uint32 ) error {
696
+ otx := oc .ovs .NewTransaction ()
697
+ otx .DeleteFlows ("table=100, reg0=%d" , vnid )
698
+ otx .AddFlow ("table=100, priority=100, reg0=%d, actions=drop" , vnid )
699
+ return otx .EndTransaction ()
700
+ }
701
+
702
+ func (oc * ovsController ) SetNamespaceEgressViaEgressIP (vnid uint32 , nodeIP , mark string ) error {
703
+ otx := oc .ovs .NewTransaction ()
704
+ otx .DeleteFlows ("table=100, reg0=%d" , vnid )
705
+ if nodeIP == "" {
706
+ // Namespace wants egress IP, but no node hosts it, so drop
697
707
otx .AddFlow ("table=100, priority=100, reg0=%d, actions=drop" , vnid )
698
708
} else if nodeIP == oc .localIP {
699
- // Local Egress IP
700
709
if err := oc .ensureTunMAC (); err != nil {
701
710
return err
702
711
}
703
712
otx .AddFlow ("table=100, priority=100, reg0=%d, ip, actions=set_field:%s->eth_dst,set_field:%s->pkt_mark,goto_table:101" , vnid , oc .tunMAC , mark )
704
713
} else {
705
- // Remote Egress IP; send via VXLAN
706
714
otx .AddFlow ("table=100, priority=100, reg0=%d, ip, actions=move:NXM_NX_REG0[]->NXM_NX_TUN_ID[0..31],set_field:%s->tun_dst,output:1" , vnid , nodeIP )
707
715
}
708
716
return otx .EndTransaction ()
0 commit comments