search

cilium / cilium

eBPF-based Networking, Security, and Observability
https://cilium.io
Apache License 2.0
20.15k stars 2.96k forks source link

Host firewall doesn't work with portmap CNI chaining #12541

Open pchaigno opened 4 years ago

pchaigno commented 4 years ago

The host firewall currently doesn't work with portmap chaining when using kube-proxy. This limitation is related to the fact that we redirect traffic from pods to remote nodes through a tunnel when the host firewall is enabled.

Setting both global.hostFirewall=true and global.cni.chainingMode=portmap results in connection breakage, probably due to some masquerading issue. Packets are not dropped by the host firewall itself (i.e., it fails even with an allow-all policy).

To reproduce the bug, one can comment the following line in e2e tests: https://github.com/cilium/cilium/blob/f55ec9066e3a23461a0d14e20b3be8ab49a04c97/test/k8sT/Conformance.go#L79

Related: #12345.

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.