kernel: enable ipset hash:netport set type#793
Open
kvinwang wants to merge 1 commit into
Open
Conversation
kube-router NetworkPolicy enforcement in k3s requires the netfilter ipset set types it creates at startup. The kernel config already enables ipset core, xt_set and most hash/bitmap set types as modules installed into the rootfs, but hash:netport was missing, causing `ipset save` to fail and kube-router to silently skip policy enforcement. Enable CONFIG_IP_SET_HASH_NETPORT=m and install the module into the rootfs image. Closes #792
Contributor
There was a problem hiding this comment.
Pull request overview
Enables the missing Linux ipset set type needed by k3s/kube-router so Kubernetes NetworkPolicy enforcement doesn’t get silently disabled on dstack guest images.
Changes:
- Enable
CONFIG_IP_SET_HASH_NETPORTas a kernel module to supporthash:net,portipset sets. - Install the corresponding
kernel-module-ip-set-hash-netportpackage into the base rootfs image so it’s available at runtime.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg | Adds CONFIG_IP_SET_HASH_NETPORT=m alongside existing ipset module config. |
| os/yocto/layers/meta-dstack/recipes-core/images/dstack-rootfs-base.inc | Ships kernel-module-ip-set-hash-netport in the rootfs, matching other ipset module packaging. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #792 — k3s/kube-router NetworkPolicy enforcement silently disabled due to missing ipset support.
Most of the netfilter ipset support requested in the issue is already enabled:
CONFIG_IP_SET,CONFIG_NETFILTER_XT_SETand thehash:ip/hash:net/hash:ip,port/bitmap set types are all built as modules indstack-docker.cfg, and the correspondingkernel-module-*packages (includingxt-set) are installed into the rootfs image.The only missing piece was the
hash:net,portset type, which kube-router also creates at startup — a single missing set type is enough to makeipset savefail withKernel error received: Invalid argument, after which kube-router skips NetworkPolicy enforcement entirely.Changes
dstack-docker.cfg: addCONFIG_IP_SET_HASH_NETPORT=mdstack-rootfs-base.inc: installkernel-module-ip-set-hash-netportinto the rootfsNote: built as a module (
=m) rather than built-in (=y) as suggested in the issue, matching the existing ipset config style — modules listed inIMAGE_INSTALLship in the image and are auto-loaded by the kernel on demand, so no module-loading tooling is needed in the guest.