Display host firewall status in cilium status

[pchaigno]

Before we move the host firewall out of beta, it would be good to have its status reported in cilium status. Ideally, we would also inherit its enforcement status (enabled/disabled/audit, ingress/egress) from the host endpoint. If the host firewall is disabled, we could print its status only in cilium status --verbose to reduce noise.

[AnishShah]

I would like to work on this.

[pchaigno]

@AnishShah I've assigned you. Don't hesitate to reach out on Slack/#development or here if you have any question.

[AnishShah]

any idea where do we implement GetHealthz call?

cilium/cilium/cmd/status.go

Line 82 in 90c1aca

if resp, err := client.Daemon.GetHealthz(params); err != nil {

[pchaigno]

I would say here:

cilium/api/v1/client/daemon/daemon_client.go

Line 163 in 90c1aca

func (a *Client) GetHealthz(params *GetHealthzParams) (*GetHealthzOK, error) {

It might be easier to tackle this issue by looking for a commit that implemented a similar feature though. Commit c285ca0, for example, added the host routing status.

[AnishShah]

Thanks @pchaigno. That was helpful.

Ideally, we would also inherit its enforcement status (enabled/disabled/audit, ingress/egress) from the host endpoint

Any idea how do I fetch this information? options.Config.EnableHostFirewall will tell me whether enforcement status is enabled or disabled. What about audit, ingress, egress?

[pchaigno]

Ideally, we would also inherit its enforcement status (enabled/disabled/audit, ingress/egress) from the host endpoint

Any idea how do I fetch this information? options.Config.EnableHostFirewall will tell me whether enforcement status is enabled or disabled. What about audit, ingress, egress?

I'm not sure exactly, but it should be possible given cilium endpoint list and cilium endpoint get -l reverse:host have this information. Maybe see:

cilium/cilium/cmd/endpoint_get.go

Lines 46 to 51 in 265d677

	params := endpointApi.NewGetEndpointParams().WithLabels(lbls).WithTimeout(api.ClientTimeout)
	result, err := client.Endpoint.GetEndpoint(params)
	if err != nil {
	Fatalf("Cannot get endpoints for given list of labels %s: %s\n", lbls, err)
	}
	endpointInst = result.Payload

[pchaigno]

@AnishShah Are you still working on this? I'd like to get it in 1.10, but can take care of it if you're on other things.

[AnishShah]

Sorry @pchaigno. I was not able to make progress on this. Please unassign me

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.