Follow ups for host firewall support of endpoint routes #15942
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pchaigno
added
release-note/misc
13 tasks
pchaigno
force-pushed
the
hostfw-ep-route-followups
branch
from
5a1a886
to
87f8c17
Compare
The host firewall is now supported when running with endpoint routes enabled. We can remove the note from the getting started guide. Signed-off-by: Paul Chaignon <paul@cilium.io>
Detail why we won't loop when jumping from bpf_lxc to bpf_host and back for ingress to the pods with host firewall enabled. Suggested-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Paul Chaignon <paul@cilium.io>
When endpoint routes are enabled, the host firewall requires the remote-node identity to be enabled as well to function properly. The host identity is used to detect traffic that should be sent through bpf_host on egress/ingress of bpf_lxc. If the remote-node identity is disabled, the host identity then also matches remote-node IPs. Reported-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Paul Chaignon <paul@cilium.io>
HOST_EP_ID was defined as a static data variable in a695f53 ("Endpoint for host") because the ID of the host endpoint wasn't known at the time we generated the datapath header files. Commit 81f0626 ("datapath: Include the host endpoint ID in all endpoint headers") changed this by making the host endpoint ID available globally to the agent via the node package and by setting the ID sooner on startup. We can therefore define the HOST_EP_ID as a normal constant now, without needing static data. That in turns allows us to revert commit 04cbfa1 ("bpf: Lift constraint for inline asm of static tail calls"). We however still use a template-specific value in bpf_host for the BPF program injected in the policy map (see TEMPLATE_HOST_EP_ID). We could instead directly use HOST_EP_ID for the program's name, but we would then have to ignore that symbol when replacing symbols in the ELF [1]. To ignore that symbol we would also have to ignore similar symbols corresponding to pod endpoints (i.e., all "1/xxxx" symbols), opening the door to silent errors. It's probably not worth it since there's no benefit to using HOST_EP_ID for the program's name directly. 1 - https://github.com/cilium/cilium/blob/v1.10.0-rc0/pkg/datapath/loader/cache.go#L39 Suggested-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Paul Chaignon <paul@cilium.io>
pchaigno
force-pushed
the
hostfw-ep-route-followups
branch
from
87f8c17
to
35f215e
Compare
|
test-me-please |
qmonnet
approved these changes
May 7, 2021
jibi
approved these changes
May 10, 2021
pchaigno
added
the
ready-to-merge
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.10
in 1.10.0-rc2
maintainer-s-little-helper
bot
moved this from Backport pending to v1.10
to Backport done to v1.10
in 1.10.0-rc2
maintainer-s-little-helper
bot
moved this from Backport pending to v1.10
to Backport done to v1.10
in 1.10.0-rc2
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See commits for details.
Updates: #13121.