Enable configuration of the source IP verification per endpoint #23985
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Most of our feature macros follow the pattern ENABLE_XXX. Let's ensure that one does as well. It simplifies a bit the following patch. Fixes: 9c72798 ("datapath: optionaly disable SIP verification") Signed-off-by: Paul Chaignon <paul@cilium.io>
Commit 9c72798 ("datapath: optionaly disable SIP verification") introduced a new setting to allow disabling the SIP verification. That setting was however not exposed through the usual API and could only be changed if calling directly into the endpoint creation logic (initial use case was for Cilium integration on OpenStack IIRC). We now have another use case where users of Cilium's L4LB want to terminate the tunnel between L4LB and backend into the backend pod itself. As a result, when DSR is enabled, the replies leave the backend pod with a VIP as the source. To enable that, we thus need to disable the SIP verification for those backend pods. This commit enables that by exposing the setting as a usual per-endpoint setting (same as e.g. the policy verdict and audit settings). Signed-off-by: Paul Chaignon <paul@cilium.io>
pchaigno
added
sig/datapath
|
this looks great, I don't see a problem with it as long as we can override this with endpointDatapathConfig 馃憤 |
nathanjsweet
approved these changes
Feb 27, 2023
pchaigno
added
the
ready-to-merge
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request exposes as a per-endpoint config the existing setting to disable the source IP verification pods' egress. That setting was introduced in #16134. See commits for details.
@oblazek I'd love a review from you 馃檪