enable hostPort in cilium

[nissessenap]

Hi

I'm trying to use a Kubernetes service called spegel, which is used to cache container images locally within the cluster.

As a part of solving this, they are using hostPorts.

I'm trying to understand if I can enable hostPorts within cello? I'm looking at this document https://docs.cilium.io/en/stable/installation/cni-chaining-portmap/and it points towards cillium 1.8.

Does the cello image deployed in my VKE cluster match the cilliuim version?
In my current cluster, I can see v1.7.9. If so I assume this config won't even work.

If it's possible to enable, would enabling this feature create any issues with cello?

[dakehero]

Hi, although using hostPort in VPC-CNI (cello) is not recommended, you can still use hostPort in VPC-CNI without adding an additional portmap CNI. All you need to do is add hostPort to your pod's spec and cilium will set up the datapath with eBPF. The version v1.7.9 you see is the version of cello, not cilium. The actual integrated cilium version in cello v1.7.9 is v1.10.4.

[dakehero]

@nissessenap please feel free to ask anything about CNI/VKE/VPC. We are willing to answer all your questions.

[nissessenap]

Okay that is great news, thanks for the quick response.

My eBPF skills are limited, is there an easy way for me to see which ports are open on the node?
My understanding is that the port won't be listed on the node using netstat.

Is there some easy way of viewing of it's open?
I have tried to connect to the hostPort that I created in my pod but, I'm unable to do so even when I'm on that specific node.

[WeeNews]

@nissessenap
first, please ensure:
The use of HostPort and NodePort should be avoided in the range of net.ipv4.ip_local_port_range
HostPort and NodePort cannot overlap
and then, you can check hostport config in cilium container which is in cello pod, like that:

cilium service list
...
3 172.17.32.14:8000 HostPort 1 => 172.17.0.44:80
...

[nissessenap]

So I can't get hostPorts to show in the cillium service list command.

I have created a pod that does nothing, but it should generate a hostPort, it looks like this:

apiVersion: v1
kind: Pod
metadata:
  name: debug
  namespace: default
spec:
  containers:
    - command:
        - /bin/sh
      resources:
        requests:
          memory: "16Mi"
          cpu: "10m"
        limits:
          memory: "64Mi"
          cpu: "100m"
      image: alpine:latest
      name: container-00
      tty: true
      ports:
        - name: registry
          containerPort: 5000
          hostPort: 30020
          protocol: TCP

This is how I tested.

➜ kgp debug -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP           NODE        NOMINATED NODE   READINESS GATES
debug   1/1     Running   0          43m   10.86.32.6   10.86.2.3   <none>           <none>

➜ kgp -n kube-system -o wide|grep 10.86.2.3 |grep cello
cello-qmjnr                           2/2     Running   0          23h   10.86.2.3     10.86.2.3    <none>           <none>

➜ kubectl exec -it -n kube-system cello-qmjnr -c cilium -- cilium service list |grep 300

Do you have any pointers for what I should test?

[dakehero]

It appears that the hostPort is within the NodePort range, which is typically set to 30000-32767 by default. As mentioned by @WeeNews, the hostport should not overlap with the NodePort range.Perhaps consider using a higher port number.

[nissessenap]

Ahh, I assumed it was just up to 1024. I will try with some new config and see if it does the trick. Thanks.

[nissessenap]

Hi, I finally had time to verify, and it worked perfectly after I lowered the port number.

Thanks for the quick help