Merge pull request #9440 from jrcichra/wireguard-threading-docs

Add documentation for Wireguard Threaded NAPI
projectcalico · Jan 9, 2025 · 0112791 · 0112791
2 parents e069dc0 + 18e5507
commit 0112791
Show file tree

Hide file tree

Showing 15 changed files with 94 additions and 26 deletions.
diff --git a/api/pkg/apis/projectcalico/v3/felixconfig.go b/api/pkg/apis/projectcalico/v3/felixconfig.go
@@ -827,7 +827,12 @@ type FelixConfigurationSpec struct {
 
 	// WireguardEnabledV6 controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network). [Default: false]
 	WireguardEnabledV6 *bool `json:"wireguardEnabledV6,omitempty"`
-	// WireguardThreadingEnabled controls whether Wireguard has NAPI threading enabled. [Default: false]
+	// WireguardThreadingEnabled controls whether Wireguard has Threaded NAPI enabled. [Default: false]
+	// This increases the maximum number of packets a Wireguard interface can process.
+	// Consider threaded NAPI only if you have high packets per second workloads that are causing dropping packets due to a saturated `softirq` CPU core.
+	// There is a [known issue](https://lore.kernel.org/netdev/CALrw=nEoT2emQ0OAYCjM1d_6Xe_kNLSZ6dhjb5FxrLFYh4kozA@mail.gmail.com/T/) with this setting
+	// that may cause NAPI to get stuck holding the global `rtnl_mutex` when a peer is removed.
+	// Workaround: Make sure your Linux kernel [includes this patch](https://github.com/torvalds/linux/commit/56364c910691f6d10ba88c964c9041b9ab777bd6) to unwedge NAPI.
 	WireguardThreadingEnabled *bool `json:"wireguardThreadingEnabled,omitempty"`
 	// WireguardListeningPort controls the listening port used by IPv4 Wireguard. [Default: 51820]
 	WireguardListeningPort *int `json:"wireguardListeningPort,omitempty" validate:"omitempty,gt=0,lte=65535"`

diff --git a/api/pkg/openapi/generated.openapi.go b/api/pkg/openapi/generated.openapi.go
diff --git a/felix/docs/config-params.json b/felix/docs/config-params.json
diff --git a/felix/docs/config-params.md b/felix/docs/config-params.md
diff --git a/libcalico-go/config/crd/crd.projectcalico.org_felixconfigurations.yaml b/libcalico-go/config/crd/crd.projectcalico.org_felixconfigurations.yaml
diff --git a/manifests/calico-bpf.yaml b/manifests/calico-bpf.yaml
diff --git a/manifests/calico-policy-only.yaml b/manifests/calico-policy-only.yaml
diff --git a/manifests/calico-typha.yaml b/manifests/calico-typha.yaml
diff --git a/manifests/calico-vxlan.yaml b/manifests/calico-vxlan.yaml
diff --git a/manifests/calico.yaml b/manifests/calico.yaml
diff --git a/manifests/canal.yaml b/manifests/canal.yaml
diff --git a/manifests/crds.yaml b/manifests/crds.yaml
diff --git a/manifests/flannel-migration/calico.yaml b/manifests/flannel-migration/calico.yaml
diff --git a/manifests/ocp/crd.projectcalico.org_felixconfigurations.yaml b/manifests/ocp/crd.projectcalico.org_felixconfigurations.yaml
diff --git a/manifests/operator-crds.yaml b/manifests/operator-crds.yaml