Skip to content

socketlb: replace cilium_lb*_reverse_sk map with socket storage

Background: For LB'ed connections the SocketLB code currently manages RevNAT entries in the cilium_lb*_reverse_sk map, which are used by getpeername hooks and the Socket termination feature.

Proposal: Use BPF_MAP_TYPE_SK_STORAGE instead to store this information, thus avoiding any kernel-side LRU issues and the need for Cilium-managed GC of old map entries. It's available since kernel v5.2.

Doing so requires that all intended users have access to a struct bpf_sock. If we end up needing to track socket cookies, it's questionable whether this brings any benefit.

Note that we'll need to consider upgrades / downgrades here (old connections where Cilium didn't create the sk-storage, and new connections which still need the map entry on downgrade).