search

cilium / design-cfps

Repo to store Cilium CFP design docs
Apache License 2.0
21 stars 19 forks source link

cfp: Added CFP for blocking traffic to certain endpoints with default allow #12

Closed tamilmani1989 closed 2 months ago

tamilmani1989 commented 8 months ago

Added CFP for blocking traffic to certain endpoints with default allow.

Github issue: https://github.com/cilium/cilium/issues/26135

joestringer commented 8 months ago

Oh, I meant to highlight that although I saw some example scenarios and how they are expected to perform, there wasn't a dedicated section to describe the intended testing scenarios. For the PR submission we'd need regression tests.

tamilmani1989 commented 8 months ago

Oh, I meant to highlight that although I saw some example scenarios and how they are expected to perform, there wasn't a dedicated section to describe the intended testing scenarios. For the PR submission we'd need regression tests.

yep definitely. I'm not aware that I should mention about regression tests in CFP. Let me add separate section for tests.

joestringer commented 2 months ago

As per https://github.com/cilium/cilium/pull/30060#issuecomment-1955250995, I think that there's two parts to the proposal here:

  1. Provide a "non-default-deny" semantic in the policy (now resolved by https://github.com/cilium/design-cfps/pull/16)
  2. Allow providers to create such a policy by default, for instance via commandline argument.

For the latter, if you think it would be useful to have a detailed discussion about the form of the solution then we can either repurpose this CFP or create a fresh PR for the CFP to solve that part of the problem. Alternatively I think it's potentially small enough that a CFP is no longer necessary, you could put together a PoC PR on the cilium/cilium repo and we could discuss further from there.

tamilmani1989 commented 2 months ago

@squeed and I discussed to have a directory with static network policies placed. Agent mounts this directory and load policies on start up . Directory location can be passed via cilium config. I have to do POC on this and will open up PR.