search

kubernetes-sigs / network-policy-api

This repo addresses further work involving Kubernetes network security beyond the initial NetworkPolicy resource
Apache License 2.0
50 stars 28 forks source link

Change udp port listeners on host-net pods #217

Closed tssurya closed 2 months ago

tssurya commented 2 months ago

Like reported in https://github.com/kubernetes/kubernetes/issues/95565 we saw flakes in https://github.com/ovn-org/ovn-kubernetes/pull/4235 as we were enabling nodes peer tests because agnhost was misbehaving by replying from a seconary nodeIP address instead of using the primary one which is not desired.

With this PR:

root@ovn-worker:/# conntrack -E | grep udp
    [NEW] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=42832 dport=34345 [UNREPLIED] src=172.19.0.4 dst=10.244.0.10 sport=34345 dport=42832 zone=19
    [NEW] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=42832 dport=34345 [UNREPLIED] src=172.19.0.4 dst=10.244.0.10 sport=34345 dport=42832 zone=15
    [NEW] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=42832 dport=34345 [UNREPLIED] src=172.19.0.4 dst=10.244.0.10 sport=34345 dport=42832
 [UPDATE] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=42832 dport=34345 src=172.19.0.4 dst=10.244.0.10 sport=34345 dport=42832

Without this PR:

    [NEW] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=38612 dport=34346 [UNREPLIED] src=172.19.0.4 dst=10.244.0.10 sport=34346 dport=38612 zone=19
    [NEW] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=38612 dport=34346 [UNREPLIED] src=172.19.0.4 dst=10.244.0.10 sport=34346 dport=38612 zone=15
    [NEW] udp      17 30 src=10.244.0.10 dst=172.19.0.4 sport=38612 dport=34346 [UNREPLIED] src=172.19.0.4 dst=10.244.0.10 sport=34346 dport=38612
    [NEW] udp      17 30 src=10.244.0.2 dst=10.244.0.10 sport=34346 dport=38612 [UNREPLIED] src=10.244.0.10 dst=10.244.0.2 sport=38612 dport=34346
    [NEW] udp      17 30 src=10.244.0.2 dst=10.244.0.10 sport=34346 dport=38612 [UNREPLIED] src=10.244.0.10 dst=10.244.0.2 sport=38612 dport=34346 zone=15
    [NEW] udp      17 30 src=10.244.0.2 dst=10.244.0.10 sport=34346 dport=38612 [UNREPLIED] src=10.244.0.10 dst=10.244.0.2 sport=38612 dport=34346 zone=19

also don't use well known ports like 53 and 5353 for host-networked pod tests as those ports can already be in use on the host.

tssurya commented 2 months ago

/label area/conformance

k8s-ci-robot commented 2 months ago

@tssurya: The label(s) /label area/conformance cannot be applied. These labels are supported: api-review, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, team/katacoda, refactor. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to [this](https://github.com/kubernetes-sigs/network-policy-api/pull/217#issuecomment-2053592399): >/label area/conformance Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
netlify[bot] commented 2 months ago

Deploy Preview for kubernetes-sigs-network-policy-api ready!

Name Link
Latest commit b22a34f840d7d84a65604e4006afa06f63ee5118
Latest deploy log https://app.netlify.com/sites/kubernetes-sigs-network-policy-api/deploys/661a63336a930a0008ed9475
Deploy Preview https://deploy-preview-217--kubernetes-sigs-network-policy-api.netlify.app
Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

tssurya commented 2 months ago

/area conformance

astoycos commented 2 months ago

/lgtm /approve

Thanks!

k8s-ci-robot commented 2 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: astoycos, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/kubernetes-sigs/network-policy-api/blob/main/OWNERS)~~ [astoycos] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment