-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix behavior where packets leave node if there are no backends (v2) #22388
Conversation
Resolve an issue where an outgoing packet destined for a service will not be dropped if it does not have any backends. Currently we will not return the service if there are no backends for it, meaning we will never drop a packet in this case and instead simply route it through the kernels default routes. Fixes: cilium#21453 Signed-off-by: Michael Aspinwall <maspinwall@google.com> [jwi: wordsmith the patch description] Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Packets that are adressed to a VIP without any backend should be dropped. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Packets that are adressed to a VIP without any backend should be dropped. As the VIP doesn't get translated, this currently works "by accident" if no matching allow-policy for the VIP is installed. But we actually want to happen this indepedently of policy, with a proper drop reason. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
/test |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@julianwiedmann Looks great! Great job in appeasing the verifier. 🚀 The unit tests look good too.
@michaelasp Did you test the changes manually with policy? The behavior should be same as policy enforcement happens after svc xlate, but it'll be good double check.
Hey Aditi! I think I only manually verified this without network policy with tcpdump, so it might be a good idea to check, even though I don't have reason to believe that it would impact anything there. |
/test-1.24-5.4 |
/test-1.25-4.19 |
/test-1.26-net-next |
@michaelasp thanks for the PR. Just follow-up question, did you A/B test behavior against k8s / kube-proxy whether it's exactly in line what kube-proxy does if there's no backend on a node for a given svc? |
Looks like the backport was handled in #23034. |
This is a re-spin of #21539. Now with the complexity improvement from #22342 and passing the problematic test on 4.19.
Quoting from the original PR:
Fixes: #21453