[ambient iptables mode] geneve dstport 6081 conflict with other cni plugin.

[fyuan1316]

We know that the Istio CNI plugin runs as a chained CNI plugin and is designed to be used with another CNI plugin. Should we consider setting geneve dstport to a port other than 6081(or making it configurable) to avoid potential conflicts with other CNI implementations?

For example, kube-ovn creates a geneve type link

7: genev_sys_6081: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65000 qdisc noqueue master ovs-system state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether 86:76:1a:94:80:8b brd ff:ff:ff:ff:ff:ff promiscuity 1
    geneve id 0 dstport 6081 external udp6zerocsumrx
    openvswitch_slave addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535

[fyuan1316]

It looks like the code in the master branch already has the appropriate detection mechanism. I'll give it a try to see if this scenario is supported.

[sridhargaddam]

In the new ambient in-Pod mode, we no longer use the geneve tunnels on the host for traffic redirection from the pods to the local ztunnel pods. For more details, please see - https://istio.io/latest/blog/2024/inpod-traffic-redirection-ambient/

Hope we can close this as its no longer relevant.

[fyuan1316]

Yes, the new ambient implementation no longer has this issue. Thanks for your response.