-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Internal traffic policy #21871
Internal traffic policy #21871
Conversation
2bdd0be
to
d16335d
Compare
20f300d
to
057aacb
Compare
This comment was marked as resolved.
This comment was marked as resolved.
72d2bd3
to
2ae3382
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm very excited to see this land! 🎉
The renaming of trafficPolicy
fields in the api/
subfolder (both Hubble and OpenAPI), as well as the monitor API might break external JSON parsers trying to read the field. For example, Hubble can export those events into a JSON file which are then read by external systems.
I don't think we should rename it without warning/deprecation. If we want to rename it, I would suggest adding a new field called externalTrafficPolicy, populate both the new and old one, and deprecate the old one. Later, we can then check if it is safe to remove the old field.
5404159
to
ed51820
Compare
6839886
to
5c82f5f
Compare
…uide [ upstream commit fda3667 ] Pull request cilium#21871 introduced a few minor behavioral changes and fixes. Document them in the upgrade guide for Cilium 1.13. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com> Signed-off-by: Aditi Ghag <aditi@cilium.io>
…uide [ upstream commit fda3667 ] Pull request cilium#21871 introduced a few minor behavioral changes and fixes. Document them in the upgrade guide for Cilium 1.13. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com> Signed-off-by: Aditi Ghag <aditi@cilium.io>
As L7 LB service is having dummy endpoint (e.g. 192.192.192.192), the in-cluster traffic will be dropped due to no healthy backend. This commit is to make sure that the proper exclusion rule is done. Relates: cilium#21871 Fixes: 38959d4 Signed-off-by: Tam Mach <tam.mach@cilium.io>
[ upstream commit f5fdb67 ] As L7 LB service is having dummy endpoint (e.g. 192.192.192.192), the in-cluster traffic will be dropped due to no healthy backend. This commit is to make sure that the proper exclusion rule is done. Relates: cilium#21871 Fixes: 38959d4 Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
As L7 LB service is having dummy endpoint (e.g. 192.192.192.192), the in-cluster traffic will be dropped due to no healthy backend. This commit is to make sure that the proper exclusion rule is done. Relates: cilium#21871 Fixes: 38959d4 Signed-off-by: Tam Mach <tam.mach@cilium.io>
[ upstream commit f5fdb67 ] As L7 LB service is having dummy endpoint (e.g. 192.192.192.192), the in-cluster traffic will be dropped due to no healthy backend. This commit is to make sure that the proper exclusion rule is done. Relates: #21871 Fixes: 38959d4 Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
…uide [ upstream commit fda3667 ] Pull request cilium#21871 introduced a few minor behavioral changes and fixes. Document them in the upgrade guide for Cilium 1.13. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com> Signed-off-by: Aditi Ghag <aditi@cilium.io> Signed-off-by: Michi Mutsuzaki <michi@isovalent.com>
As L7 LB service is having dummy endpoint (e.g. 192.192.192.192), the in-cluster traffic will be dropped due to no healthy backend. This commit is to make sure that the proper exclusion rule is done. Relates: cilium#21871 Fixes: 38959d4 Signed-off-by: Tam Mach <tam.mach@cilium.io>
As L7 LB service is having dummy endpoint (e.g. 192.192.192.192), the in-cluster traffic will be dropped due to no healthy backend. This commit is to make sure that the proper exclusion rule is done. Relates: cilium#21871 Fixes: 38959d4 Signed-off-by: Tam Mach <tam.mach@cilium.io>
Internal traffic policy = Local means that internal (East-West)
connections to the service should be handled by node-local backends
only. When external and internal traffic policies are different, the
existing implementation is extended to support filtering out non-local
backends for the internal scope. When both policies are both Local, only
the external scope is used (the same already happens when both policies
are Cluster), and it contains local backends only.
Fixes: #16071