identity: Ensure ingress label is reserved label to be node-local #40791
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Increasing the scope of the backport due to the severity. EDIT: Looks like actually it doesn't impact v1.17. |
Nikhil77Sharma
approved these changes
Jul 29, 2025
|
Looks like CI is kinda blocked on #40801 |
If this check is not present, then Cilium consider global identity to be node-local if there is a label called "ingress" in the label set. For example, a workload pod could have the label set: ``` k8s:foo=bar k8s:ingress=allowed ``` and Cilium will incorrectly assign it a node-local identity because the "ingress" label is present, without checking the source. Hence why we need to add a check for the reserved source. A unit test is added to validate this behavior. Fixes: 226a978 ("identity: Allow local identity for ingress label") Signed-off-by: Chris Tarazi <chris@isovalent.com>
82f8942 to
9e3f981
Compare
|
/test Edit: #36428 |
14 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If this check is not present, then Cilium consider global identity to be
node-local if there is a label called "ingress" in the label set.
For example, a workload pod could have the label set:
and Cilium will incorrectly assign it a node-local identity because the
"ingress" label is present, without checking the source. Hence why we
need to add a check for the reserved source.
A unit test is added to validate this behavior.
Fixes: 226a978 ("identity: Allow local identity for ingress label")
Signed-off-by: Chris Tarazi chris@isovalent.com