SDN Switch Translation Module Bypass for Kubernetes Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SDN-based networking solutions for Kubernetes services face scalability issues due to high data plane latency caused by redirecting every packet to iptables for services lookup, which increases latency and consumes bandwidth.
Innovation Solution
Implementing a translation module bypass mechanism where the SDN controller configures the switch to apply network address translations directly, bypassing the translation module, and disabling timeout processing to prevent premature rule removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If every packet is redirected to iptables for service lookup, then service access control and manipulation are provided, but data plane latency increases and scalability is reduced
Solution Approach 1:
The system pre-establishes flow rules in the forwarding plane that contain network address translation information before packets arrive. When a packet matches an established flow, the forwarding plane can directly apply the pre-computed translation and forward the packet without redirecting it to iptables, thus eliminating the latency penalty while maintaining service access control.
Solution Approach 2:
The invention creates a copy of the service lookup functionality by implementing flow rules in the forwarding plane that mirror the translation behavior of iptables. Instead of sending every packet to the original translation module, the forwarding plane maintains local copies of translation rules that can be applied directly to matching packets, providing the same service access control without the latency overhead.
2Manufacturing precision
If every packet is sent to the translation module for network address translation, then accurate translation is applied, but bandwidth is consumed and processing overhead increases
Solution Approach 1:
The system applies different processing qualities to different packets based on their flow characteristics. Packets that match established flow rules in the forwarding plane receive direct local translation using pre-computed rules, while only packets that do not match any flow rule are redirected to the full iptables translation module. This local quality approach ensures translation accuracy for all packets while minimizing bandwidth consumption by avoiding unnecessary translations of packets that can be handled locally.
3Productivity
If the translation module processes all packets, then flow management is maintained, but system complexity and processing overhead increase
Solution Approach 1:
The system segments the packet processing function into two parts: the forwarding plane handles flow matching and direct translation for established flows, while the translation module (iptables) handles only new flow establishment and rule management. This segmentation reduces system complexity by distributing functionality across layers, allowing the forwarding plane to independently manage established flows without requiring constant intervention from the translation module.
Data Source
AI summary
A method by a software defined networking (SDN) controller to configure a switch to perform translation module bypass in a container orchestration system. The method includes receiving a translation rule for a flow from a load balancer, sending translation module bypass instructions to a switch in response to receiving the translation rule for the flow, where the translation module bypass instructions include instructions for the switch to stop sending packets belonging to the flow to the translation module and to apply a network address translation specified by the translation rule for the flow to the packets belonging to the flow, and send an indication to the load balancer that the packets belonging to the flow are to bypass the translation module to cause the load balancer to disable timeout processing for the flow in the translation module.