Skip to content

docs: 添加 OVN Underlay 首包延迟优化文档(S2 跳过 Conntrack 方案)#134

Open
changluyi wants to merge 4 commits intoalauda:mainfrom
changluyi:docs/skip-conntrack-ovn-underlay
Open

docs: 添加 OVN Underlay 首包延迟优化文档(S2 跳过 Conntrack 方案)#134
changluyi wants to merge 4 commits intoalauda:mainfrom
changluyi:docs/skip-conntrack-ovn-underlay

Conversation

@changluyi
Copy link
Copy Markdown
Contributor

@changluyi changluyi commented Apr 7, 2026

Summary

  • 添加 OVN Underlay 网络首包延迟优化方案文档(中英文)
  • 介绍 skip-conntrack-dst-cidrs 参数的配置方法和使用注意事项
  • 关联 Jira: ACP-51629

Test plan

  • 文档格式符合项目规范(frontmatter、标题术语、代码块)
  • 中英文内容一致

Summary by CodeRabbit

  • Documentation
    • Added English and Chinese guides on reducing OVN Underlay first‑packet latency by enabling skip-conntrack for selected destination CIDRs. Covers prerequisites, step‑by‑step controller argument configuration, expected behavior (bypasses conntrack for specified CIDRs), CIDR formatting, and a warning that NetworkPolicy and Service access/LoadBalancer behavior will not apply to skipped CIDRs.

@changluyi changluyi requested a review from a team April 7, 2026 03:12
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 7, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: eb95ddb5-9fab-41a3-a203-e8877139e57f

📥 Commits

Reviewing files that changed from the base of the PR and between de77bb0 and df93e86.

📒 Files selected for processing (2)
  • docs/en/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md
  • docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md
✅ Files skipped from review due to trivial changes (2)
  • docs/en/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md
  • docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md

Walkthrough

A new English and Chinese solution doc were added explaining how to configure Kube-OVN's --skip-conntrack-dst-cidrs in OVN Underlay mode to bypass conntrack for specified destination CIDRs, detailing behavior, flow priority (105), prerequisites, configuration steps, and operational warnings.

Changes

Cohort / File(s) Summary
Documentation: Skip Conntrack Solution
docs/en/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md, docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md
Added English and Chinese docs describing --skip-conntrack-dst-cidrs usage in OVN Underlay. Documents mechanism (inserts priority 105 flows into ls_in_pre_lb to override priority 100 conntrack flows), prerequisites (ACP 4.3+, OVN Underlay, Kube-OVN v1.15+), step-by-step edits to the kube-ovn-controller Deployment args, and explicit warnings about disabled NetworkPolicy and Service access for matched CIDRs.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

  • fanzy618
  • oilbeater
  • tyzhou111

Poem

🐰 I hopped through docs to make things quick,
Skip conntrack whispers — a tiny trick.
First packets sprint across the mesh,
Tweak the args, then watch them fresh.
🥕

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding documentation for OVN Underlay first-packet latency optimization using the skip-conntrack feature. It is concise, clear, and directly reflects the changeset content.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md (1)

36-36: 中文文档标题建议保持全中文术语。

Line 36 的 ### Step 1 建议改为 ### 步骤 1,与中文文档整体风格一致。

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md`
at line 36, 将标题中的英文“Step”替换为中文“步骤”以保持文档术语一致:把当前标题文本 `### Step 1: 配置 Kube-OVN
Controller` 修改为 `### 步骤 1: 配置 Kube-OVN Controller`(定位文本可通过该标题字符串本身查找并替换)。
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md`:
- Line 12: The Chinese doc mentions reducing "conntrack 表压力" as a benefit but
the English version doesn't; update for consistency by either adding the same
benefit to the English paragraph describing skip-conntrack-dst-cidrs or remove
the "conntrack 表压力" phrase from the Chinese paragraph so both languages describe
the same benefits; locate the description of skip-conntrack-dst-cidrs in this
document and make the change accordingly.
- Around line 46-50: The YAML snippet only shows args and may be applied to the
wrong container in multi-container Pods; update the doc to include the
surrounding context matching the English version by adding the containers: block
and the specific container identifier name: kube-ovn-controller so the
--skip-conntrack-dst-cidrs argument is clearly under containers -> - name:
kube-ovn-controller -> args, and ensure you do not alter other container
parameters or indentation so only that container receives the flag.

---

Nitpick comments:
In
`@docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md`:
- Line 36: 将标题中的英文“Step”替换为中文“步骤”以保持文档术语一致:把当前标题文本 `### Step 1: 配置 Kube-OVN
Controller` 修改为 `### 步骤 1: 配置 Kube-OVN Controller`(定位文本可通过该标题字符串本身查找并替换)。
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2254a0eb-e6a7-40a1-ac20-58d67691b36b

📥 Commits

Reviewing files that changed from the base of the PR and between 15fe15e and 45189c6.

📒 Files selected for processing (2)
  • docs/en/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md
  • docs/zh/solutions/How_to_Optimize_OVN_Underlay_First_Packet_Latency_with_Skip_Conntrack.md

- 删除中文版残留的 conntrack 表压力描述
- 补全 YAML 片段中 containers/name 定位信息
@oilbeater oilbeater enabled auto-merge (squash) April 7, 2026 06:14
auto-merge was automatically disabled April 7, 2026 06:45

Head branch was pushed to by a user without write access

@changluyi changluyi deployed to translate April 7, 2026 06:49 — with GitHub Actions Active

> **警告**:一旦对某个目标 CIDR 跳过 conntrack,以下 OVN 功能对该 CIDR 的流量将**不再生效**:
> - **NetworkPolicy** — 依赖 conntrack 状态的 OVN ACL 规则将无法匹配
> - **Service 负载均衡** — ClusterIP/NodePort 服务的 OVN LB 规则将被绕过
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这个和 UI 上保持一致说法, 内部路由
后面改为说明现象,比如配置了 Network policy 也无法控制 pod 流量,以及无法通过 cluster Ip 或者 node port 访问 service

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants