Commits on Nov 10, 2021

1. Adds an ACCEPT rule for untracked pkts in filter:CILIUM_OUTPUT …

   Currently, when `no-track-port` is specified for a pod (the only use
   case for now is nodelocaldns), we insert several iptable rules to skip
   conntrack for packet to and from the pod to achieve pararity with OSS
   node-local-dns.
   
   However, we need to add a specific accept rule int the CILIUM_OUTPUT
   chain to accept such packets. Otherwise, a dns query pkt originated from
   the hostns will skip conntrack and gets dropped in the filter OUTPUT
   chain. This rule is however NOT needed for standard OSS node-local-dns
   because it relies on the loopback rule installed by the OS to allowlist
   this traffic pattern. With Cilium, we DNAT such packet in a way that its
   dst is the pod IP of the local node-cache pod, so it will NOT hit the
   loopback dev, hence we need to punch a specific hole to allowlist it.
   
   Fixes: 16694
   
   Signed-off-by: Weilong Cui <cuiwl@google.com>

   

   Weil0ng committed Nov 10, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for b908885
   • Browse repository at this point

   Copy the full SHA

   b908885 View commit details

   Browse the repository at this point in the history