L7 traffic examples need tunnelling datapath mode

cilium / cilium-service-mesh-beta

Instructions and issue tracking for Service Mesh capabilities of Cilium

Apache License 2.0

104 stars 14 forks source link

Open lizrice opened 2 years ago

lizrice commented 2 years ago

In direct routing datapath mode, traffic from the Envoy host process is not being subjected correctly to datapath processing. The symptoms are

Lack of L7 visibility for traffic from the proxy (for example, load-balanced traffic)
Failure to enforce network policy for these flows

The workaround is to run Cilium in tunnelling database mode, using --datapath-mode=vxlan on the cilium install command.

Seen on GKE and EKS.

gkjsa commented 2 years ago

Same on AKS. When using datapath-mode=azure (by detection) it won't route traffic. vxlan works.