calico bgp模式偶尔出现部分应用pod连接集群外网络不通

[heavy-Bamboo]

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce (for bugs)

1、pod与应用区所有网段互ping不通
2、同一集群pod互ping正常，节点与pod互ping正常，跨集群节点ping异常
3、calico相关组件正常，无异常日志等，无内部网络策略
4、主机路由检查正常
5、抓包进行分析（从外部ping pod地址不通，从主机端和pod端抓包可以看到正常接受icmp请求，并且正常返回）

Context

Your Environment

• Calico version：v3.20.2
• Calico dataplane (iptables, windows etc.)：iptables
• Orchestrator version (e.g. kubernetes, mesos, rkt):1.21.10
• Operating System and version:centos7.8
• Link to your project (optional):

[coutinhop]

@heavy-Bamboo this is with the help of google translate, so please let me know if I'm misunderstanding your issue:
Calico is mostly responsible for the host-pod and pod-host stuff. If you have packet capture showing that's OK, then the problem is host-host networking, which most probably isn't Calico's fault.

Additionally, Calico v3.20.2 is extremely old (2021!), could you please try a more recent and currently supported Calico version to see if the issue persists?

[heavy-Bamboo]

Hi
Thank you very much for your reply and analysis！
Issue Description

When using Calico CNI in the Kubernetes cluster and performing rolling updates on Deployments, an occasional issue arises where certain Pods cannot connect to external networks.
1. From an external network, Ping to a specific Pod’s IP shows both requests and replies.
2. However, Ping from inside the Pod to the external network gets no response.

Environment Details
1. CNI Plugin: Calico (BGP mode)
2. Node-to-Node Mesh: Disabled
3. Related Configuration: Detailed configuration file screenshots are provided.

Packet Capture Analysis

Capture Points:
1. When Pinging the Pod’s IP from an external network: Captures on the Worker Node hosting the Pod and inside the Pod itself show both Request and Reply packets.
2. When Pinging the external network from inside the Pod: No response is observed.

Summary of the Phenomenon
• External network access to Pod: Works normally (Request and Reply packets are successful).
• Pod access to external network: Fails (No response).

[heavy-Bamboo]

[caseydavenport]

@heavy-Bamboo could you share your IPPools?

kubectl get ippool -o yaml

Are you expecting traffic from pods -> external IPs to be SNAT'd in your environment?