Closed therealak12 closed 2 weeks ago
In not applying a configuration, this might be related to #2702 in which the OP says
With that said, it seems like there might be another issue where the TLS configuration is not being applied properly in this scenario.
Related issue: #2855
Any news about this issue ?
It looks like even without passthrough, ipAllowPolicy
is still not used with tcpproxy mode.
The Contour project currently lacks enough contributors to adequately respond to all Issues.
This bot triages Issues according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack
/remove-lifecycle stale
The Contour project currently lacks enough contributors to adequately respond to all Issues.
This bot triages Issues according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack
The Contour project currently lacks enough contributors to adequately respond to all Issues.
This bot triages Issues according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack
What steps did you take and what happened:
Create an
httpproxy
withpassthrough: true
andtcpproxy
set. Then try to access the host (example.com
here) from an IP not included in theipAllowPolicy
. It's still accessible.An example of such httpproxy:
What did you expect to happen: The host should only be accessible from the source IPs specified in the
ipAllowPolicy
list.Anything else you would like to add: This might be the cause:
ipAllowFilterPolicy
configured on the virtual host.VirtualHostsAndRoutes
function (which calls theipFilterConfig
).I was wondering what's the reasoning behind this
continue
statement. Omitting thiscontinue
statement might resolve the issue.Environment:
kubectl version
): 1.23.3/etc/os-release
): fcos