k8s: Invalidate Policies that Support "EndPort" #28704
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nathanjsweet
added
the
release-note/minor
nathanjsweet
added
the
needs-backport/1.14
|
I think the subtle question here is exactly what behaviour we want on upgrade. Currently the policy with endport will put endpoints into default deny and therefore lock down the endpoints. If we reject the policy completely, that could mean the policy is ineffective and opens up the endpoints completely if that's the only policy. It may be safer to accept but log, given this is long-standing behaviour (?) |
joestringer
added
the
upgrade-impact
joamaki
previously requested changes
Oct 23, 2023
Cilium does not currently support port ranges in network policies. Signed-off-by: Nate Sweet <nathanjsweet@pm.me>
nathanjsweet
force-pushed
the
pr/nathanjsweet/add-endport-unsupported-error-when-endport-is-present
branch
from
7c5f4d6
to
a69aee3
Compare
|
/test |
joestringer
approved these changes
Nov 2, 2023
There was a problem hiding this comment.
I think this makes sense, it's hard for me to argue for something better for the short term and the existing stable releases. I know the support for this feature is making some progress soon so hopefully we won't need a better solution to communicating this problem in the end. 👍
joamaki
approved these changes
Nov 3, 2023
maintainer-s-little-helper
bot
added
the
ready-to-merge
joamaki
deleted the
pr/nathanjsweet/add-endport-unsupported-error-when-endport-is-present
branch
jibi
added
backport-pending/1.14
maintainer-s-little-helper
bot
moved this from Needs backport from main
to Backport pending to v1.14
in 1.14.4
github-actions
bot
added
backport-done/1.14
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cilium does not currently support port ranges in
network policies.