kimma
commented
1 year ago Chiming in to say i'm having the same problems. Looks like any use of fromCIDR or toCIDR in CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy impossible due to this.
The following CiliumNetworkPolicy:
- fromCIDR:
- 10.0.0.0/8
- 192.168.0.0/16
- 2a0e:97c0:250::/44
- 2a02:2c8:f000::/48
- fd00::/8
toPorts:
- ports:
- port: "8443"
protocol: TCP
- port: "8000"
protocol: TCPShould allow the following traffic, (and has worked flawlessly until upgrade) but it is now denied.
Ethernet {Contents=[..14..] Payload=[..50..] SrcMAC=b6:6a:89:17:4f:7a DstMAC=ae:9d:38:b9:4a:77 EthernetType=IPv4 Length=0}
IPv4 {Contents=[..20..] Payload=[..28..] Version=4 IHL=5 TOS=0 Length=48 Id=0 Flags=DF FragOffset=0 TTL=61 Protocol=TCP Checksum=60901 SrcIP=10.12.123.10 DstIP=10.12.192.192 Options=[] Padding=[]}
TCP {Contents=[..28..] Payload=[] SrcPort=53009 DstPort=8443(pcsync-https) Seq=3964054339 Ack=0 DataOffset=7 FIN=false SYN=true RST=false PSH=false ACK=false URG=false ECE=false CWR=false NS=false Window=65535 Checksum=44278 Urgent=0 Options=[TCPOption(MSS:1380 0x0564), TCPOption(SACKPermitted:), TCPOption(EndList:)] Padding=[0]}
CPU 08: MARK 0xc881a88a FROM 3257 DROP: 62 bytes, reason Policy denied, identity 16777228->136429, to endpoint 3257
jwitko
joestringer
carnerito
Is there an existing issue for this?
What happened?
I have
CililiumClusterwideNetworkPolicydeployed and Host Firewall enabled. Among other CCNPs that allow Cilium to function normally, I have CCNP that allows access from trusted subnets (private network, home VPN, etc...) and it looks like this:When this policy is applied for the first time everything works as expected. Problem occur 10 minutes after Cilium agent is restarted and is manifested by loosing connectivity to cluster from addresses defined in
whitelisted-cidrsCCNP.Since this is huge problem for me because I'm heavily relaying on Cilium Host Firewall feature, I did some investigation and these are my findings:
fromCIDRlist are cleared 10 minutes after Cilium agent startsreleaseIdentityblock, hereAfter I figured out what is happening, I reverted logic in
releaseIdentityto look like this:This change solved the issue, but since I'm new to Cilium code base, I'm not sure will this have some unwanted side effects. If this change looks good, I can submit PR.
How to reproduce in local Kind cluster
make kind && make kind-image && make kind-install-ciliumfromCIDRrule (like one from above)Cilium Version
v1.14.0
Kernel Version
.
Kubernetes Version
v1.27.3
Sysdump
No response
Relevant log output
No response
Anything else?
No response
Code of Conduct