Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change wording on toServices limitations (see #20067) #25796

Merged
merged 2 commits into from
Jun 26, 2023
Merged

Change wording on toServices limitations (see #20067) #25796

merged 2 commits into from
Jun 26, 2023

Commits on Jun 23, 2023

  1. Change wording on toServices limitations (see cilium#20067) 

    PR cilium#21052 updated Cilium documentation to say that, in network policy
rules, `toServices` statements cannot be combined with `toPorts`
statements. I believe it would be more informative for Cilium users
to say (following RFC 2119) that `toServices` _must not_ be combined
with `toPorts`, as technically Cilium accepts such a network policy
as valid but handles it in the unexpected and potentially dangerous
(e.g. if a setup relies on Cilium network policy to implement egress
filtering) manner described in cilium#20067.

Signed-off-by: Anton Tykhyy <atykhyy@gmail.com>
    @atykhyy
    atykhyy committed Jun 23, 2023
    Configuration menu
    Copy the full SHA
    46f062c View commit details
    Browse the repository at this point in the history

  2. Make rules combining toServices and toPorts fail validation 

    Currently, an egress rule combining toServices and toPorts has
the unexpected and potentially dangerous side effect of allowing egress
traffic to any remote endpoint on the port(s) specified (see cilium#20067).
This change makes such rules fail validation.

Signed-off-by: Anton Tykhyy <atykhyy@gmail.com>
    @atykhyy
    atykhyy committed Jun 23, 2023
    Configuration menu
    Copy the full SHA
    4b3fd29 View commit details
    Browse the repository at this point in the history