K8S_POD-to-POD

-
 
root@ems203-m1:/home/labadmin# kubectl get pods -A -o wide | grep ems203-w2
ems               edgecloud-suse-adapter-df5d6d78b-m5zc2                            1/1     Running     0             13m     10.233.101.222   ems203-w2   <none>           <none>
ems               ems-a10nsp-accounting-89c69b796-rpb9k                             1/1     Running     0             4m28s   10.233.101.224   ems203-w2   <none>           <none>

root@ems203-w2:/home/labadmin# ip r
default via 172.27.71.254 dev ens3 proto static
blackhole 10.233.101.192/26 proto 80
10.233.101.222 dev cali11299111064 scope link
10.233.101.224 dev caliaa479e31ff6 scope link
** Both IPs are in: 10.233.101.192/26

Step-by-step: Pod → Pod on same node
1️.Pod A sends packet
Pod A (10.233.101.222) sends traffic to:
DST = 10.233.101.224
2️.Packet enters host namespace
Leaves Pod A via veth
Enters host on interface:
cali11299111064
3️.Linux routing lookup (THIS table)
Kernel evaluates routes top-down, longest prefix first.
It finds:
10.233.101.224 dev caliaa479e31ff6 scope link
** Exact /32 route wins ** VXLAN route is NOT used ** Blackhole is NOT used
4️.Why VXLAN is NOT used
You also have:
10.233.101.128/26 via 10.233.101.128 dev vxlan.calico onlink
But /32 routes (10.233.101.224) are more specific than /26.
** Linux routing rule: Most specific route always wins
So: /32 (pod) > /26 (subnet)
5️.Blackhole route (why it exists)
blackhole 10.233.101.192/26 proto 80
This is a Calico safety mechanism:
Prevents packets from leaking into VXLAN accidentally
If a pod IP has no local cali route*, traffic is dropped
Avoids routing loops & silent failures
But since /32 exists → blackhole is ignored.
6️.Packet delivered to Pod B
Packet exits via:
cali aa479e31ff6
Enters Pod B’s veth
App receives packet
** No NAT,No VXLAN,No physical NIC,No kube-proxy
Visual datapath (your exact node)
Pod A (10.233.101.222)
   |
   | veth
   |
cali11299111064
   |
   |  Linux routing (/32 match)
   |
cali aa479e31ff6
   |
   | veth
   |
Pod B (10.233.101.224)
What VXLAN routes are used for
Example:
10.233.100.128/26 via 10.233.100.128 dev vxlan.calico onlink

Pods on other nodes
Flow:
Pod → cali → vxlan.calico → ens3 → remote node → vxlan → cali → pod

Comments

Post a Comment

Popular posts from this blog

gNMI_with_grafana on containerlabs

-
Image
  root@digi-oss:/home/labadmin/mohan/2jan26_grafana# cat sr_lab.clab.yml name: sr_lab topology:   nodes:     sr1 : {kind: nokia_srlinux, image: ghcr.io/nokia/srlinux:latest, startup-config: sr1.cfg}     sr2 : {kind: nokia_srlinux, image: ghcr.io/nokia/srlinux:latest, startup-config: sr2.cfg}     # gNMIc Collector     gnmic:       kind: linux       image: ghcr.io/openconfig/gnmic:latest       binds: [gnmic-config.yml:/app/gnmic-config.yml:ro]       cmd: "--config /app/gnmic-config.yml subscribe"     # Prometheus TSDB     prometheus:       kind: linux       image: prom/prometheus:latest       binds: [prometheus.yml:/etc/prometheus/prometheus.yml:ro]       ports: ["9090:9090"]     # Grafana Visualization     grafana:       kind: linux       image: grafa...
Read more

EVPN Route type-1 & type-4 in action

-
Image
 Route Type 1: Ethernet Auto-Discovery (A-D) A Type 1 route is advertised by a PE router on a per-Ethernet Segment Identifier (ESI) basis. It is triggered by the presence of a multihomed connection.  Purpose of Type 1 routes Aliasing:  In an all-active multihoming setup, a Type 1 route informs remote PE routers that an Ethernet segment is reachable via multiple PEs. This allows for load-balancing traffic to the same customer device over multiple paths. Fast convergence (Mass MAC Withdrawal):  If a local link to a multihomed customer device fails, the PE sends a withdrawal message for the Type 1 route. Remote PEs can then withdraw all MAC addresses associated with that Ethernet segment, instead of waiting for individual MAC withdrawals, which speeds up convergence. Split-horizon filtering:   The route carries an ESI label to prevent traffic loops in all-active mode. A PE router won't forward broadcast, unknown unicast, and multicast (BUM) traffic back to its sour...
Read more

Network Automation with ROBOT Framework

-
Image
  Folder-structure Scripts testcase_with_keywordsLibrary.robot *** Settings *** Documentation    Test Case With Keyword Resource         Resources/Keywords/common.robot Resource          Resources/Keywords/vxlanInstance.robot Test Setup        Open Connection Test Teardown    Close Connection *** Test Cases *** [Documentation] Step 1: Verify VXLAN Interface Status     VXLAN Interface Status [Documentation] Step 2: Verify VXLAN VNI to VLAN Mapping     VXLAN VNI to VLAN Mapping Resources/Keywords/common.robot *** Settings *** Documentation    Common Keyword Library Library          ../../Libraries/commonLib.py Variables        ../Variables/veosLeaf01.yaml *** Variables *** ${devType}         ${virtualBox}[vmType] ${ipAddr}          ${virtualBox}[vmManagement][hostIp] ${po...
Read more