Policy with k8sService on port 443 allows traffic on port 443 to world

[arjantop-cai]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

Policy defined:

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: my-policy
spec:
  endpointSelector: {}
  ingress:
    - {}
  egress:
    - toServices:
        - k8sService:
            namespace: ns
            serviceName: svc
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP

Expected: Only traffic to service svc.ns on port 443 is allowed
Result: All traffic to "world" on port 443 is allowed

Observed in local k3d install and EKS

Cilium Version

1.10.x and 1.11.x

Kernel Version

Linux hostname 5.4.188-104.359.amzn2.x86_64 #1 SMP Thu Apr 14 20:53:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Kubernetes Version

v1.21.5-eks-9017834

Sysdump

No response

Relevant log output

No response

Anything else?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[arjantop-cai]

Reproduction steps using sw-app example:

kubectl create -ntest -f https://github.com/cilium/cilium/blob/master/examples/minikube/http-sw-app.yaml

Requests to world:80 and world:443 work:

kubectl -ntest exec -it tiefighter -- curl "http://google.com"
kubectl -ntest exec -it tiefighter -- curl "https://google.com"

Apply the policy:

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "rule1"
spec:
  endpointSelector:
    matchLabels:
      org: empire
      class: tiefighter
  ingress:
    - {}
  egress:
    - toServices:
        - k8sService:
            namespace: test
            serviceName: deathstar
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
          rules:
            dns:
              - matchPattern: "*"

Request to world:80 works (the one specified in the policy toPorts) and traffic to world:443 is dropped (not specified in the policy)

kubectl -ntest exec -it tiefighter -- curl "http://google.com"
kubectl -ntest exec -it tiefighter -- curl "https://google.com"

[atykhyy]

I have observed the same behavior with a toServices pointing to kube-dns service. A toServices rule allowing egress to kube-dns service in fact allows requests on port 53 to any remote server. Specifying toEndpoints with a selector of k8s-app=kube-dns instead of toServices works as expected: only requests to kube-dns are allowed.

[github-actions]

This issue has been automatically marked as stale because it has not
had recent activity. It will be closed if no further activity occurs.

[aanm]

Maybe it's something that we should document as a limitation of k8sService

[github-actions]

This issue has been automatically marked as stale because it has not
had recent activity. It will be closed if no further activity occurs.

[github-actions]

This issue has not seen any activity since it was marked stale.
Closing.

[gandro]

Apologies for the noise, I discovered this issue as it is referenced in the code and the limitation still applies. To reflect that, I've relabeled it as a "question" since this is a known and (now) documented limitation.