Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

k8s / policy: allow all services for toServices when using highscale ipcache #26127

Merged
merged 1 commit into from
Jun 15, 2023
Merged

k8s / policy: allow all services for toServices when using highscale ipcache #26127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 9 additions & 1 deletion pkg/k8s/rule_translate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"net/netip"

"github.com/cilium/cilium/pkg/k8s/slim/k8s/apis/labels"
"github.com/cilium/cilium/pkg/option"
"github.com/cilium/cilium/pkg/policy"
"github.com/cilium/cilium/pkg/policy/api"
"github.com/cilium/cilium/pkg/slices"
Expand Down Expand Up @@ -228,7 +229,14 @@ func PreprocessRules(r api.Rules, cache *ServiceCache) error {
}
for ns, ep := range cache.endpoints {
svc, ok := cache.services[ns]
if ok && svc.IsExternal() {
// Normally, only services without a label selector (i.e. empty services)
// are allowed as targets of a toServices rule.
// This is to minimize the chances of a pod IP being selected by this rule, which might
// cause conflicting entries in the ipcache.
//
// This requirement, however, is dropped for HighScale IPCache mode, because pod IPs are
// normally excluded from the ipcache regardless.
if ok && (option.Config.EnableHighScaleIPcache || svc.IsExternal()) {
tklauser marked this conversation as resolved.
Show resolved Hide resolved
eps := ep.GetEndpoints()
if eps != nil {
t := NewK8sTranslator(ns, Endpoints{}, *eps, false, svc.Labels)
Expand Down
11 changes: 9 additions & 2 deletions pkg/k8s/watchers/watcher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -608,7 +608,14 @@ func (k *K8sWatcher) k8sServiceHandler() {
scopedLog.WithError(err).Error("Unable to add/update service to implement k8s event")
}

if !svc.IsExternal() {
// Normally, only services without a label selector (i.e. "bottomless" or empty services)
// are allowed as targets of a toServices rule.
// This is to minimize the chances of a pod IP being selected by this rule, which might
// cause conflicting entries in the ipcache.
//
// This requirement, however, is dropped for HighScale IPCache mode, because pod IPs are
// normally excluded from the ipcache regardless.
if !option.Config.EnableHighScaleIPcache && !svc.IsExternal() {
return
}

Expand Down Expand Up @@ -638,7 +645,7 @@ func (k *K8sWatcher) k8sServiceHandler() {
scopedLog.WithError(err).Error("Unable to delete service to implement k8s event")
}

if !svc.IsExternal() {
if !option.Config.EnableHighScaleIPcache && !svc.IsExternal() {
return
}

Expand Down
27 changes: 27 additions & 0 deletions test/k8s/manifests/high-scale-ipcache.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,3 +81,30 @@ spec:
protocol: TCP
selector:
type: server
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: egress-dns
spec:
endpointSelector:
matchLabels:
type: client
egress:
- toEndpoints:
- matchLabels:
k8s-app: kube-dns
io.kubernetes.pod.namespace: kube-system
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: egress-l3
spec:
endpointSelector:
matchLabels:
type: client
egress:
- toServices:
- k8sService:
serviceName: http