Cilium
Hard
Networking
What does Direct Server Return (DSR) mode change in Cilium's NodePort and LoadBalancer handling?
Select your answer:
Show answer and explanation
Answer: Backends reply to the client directly, not via the ingress node
Explanation
In the default SNAT mode, a node that forwards a request to a backend on another node rewrites the source address, so the reply has to come back through it. In DSR mode the forwarding node keeps the client address and passes the service address along with the packet, so the backend can reply to the client directly. That saves a hop and lets the backend see the client IP.
More hard Cilium questions
- How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?
- Which command lists only the flows that Cilium dropped, for example because of a network policy?
- How can you roll out a new Cilium network policy without risking dropped traffic?
- You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?
- Which of these is required to connect two clusters with Cilium ClusterMesh?
- How do you make a Service load-balance across all clusters in a Cilium ClusterMesh?