iptables: Add a fallback to missing xt_socket module. #10299
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In non-tunneled datapath modes a missing xt_socket module breaks proxy redirection traffic. xt_socket is needed due to interaction between kernel's ip early demux logic and an explicit drop for skbs with a socket set in ip_forward(). If xt_socket is not available we can work around this problem by disabling ip early demux. Add a cilium configuration option 'enable-xt-socket-fallback' which is 'true' by default, meaning that cilium-agent is allowed to disable ip early demux if needed. This new option can be set to false to retain the current behavior (== ip early demux is not disabled, but Cilium policy enforcement may not function correctly in all datapath modes with L7 enforcement or visibility. Signed-off-by: Jarno Rajahalme <jarno@covalent.io>
|
Release note label not set, please set the appropriate release note. |
1 similar comment
|
Release note label not set, please set the appropriate release note. |
houndci-bot
reviewed
Feb 21, 2020
| haveIp6tables bool | ||
| haveSocketMatch bool | ||
| waitArgs []string | ||
| haveIp6tables bool |
There was a problem hiding this comment.
struct field haveIp6tables should be haveIP6tables
|
test-me-please |
f3bd304 to
f7dbd53
Compare
|
test-me-please |
aanm
requested changes
Feb 24, 2020
tgraf
approved these changes
Feb 24, 2020
Signed-off-by: Jarno Rajahalme <jarno@covalent.io>
|
Added docs. |
|
test-me-please |
|
k8s could not terminate pods before timing out, retesting. https://jenkins.cilium.io/job/Cilium-PR-Ginkgo-Tests-Validated/17447/execution/node/178/log/ |
|
test-me-please |
joestringer
requested changes
Feb 24, 2020
|
Issued #10325 to fix the Istio PODs lingering problem now plaguing k8s 1.17. |
82afd97 to
b8a25e9
Compare
|
test-docs-please |
|
test-me-please |
aanm
approved these changes
Feb 25, 2020
|
test-me-please |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In non-tunneled datapath modes a missing xt_socket module breaks proxy
redirection traffic. xt_socket is needed due to
interaction between kernel's ip early demux logic and an explicit drop
for skbs with a socket set in ip_forward(). If xt_socket is not
available we can work around this problem by disabling ip early demux.
Add a cilium configuration option 'enable-xt-socket-fallback' which is
'true' by default, meaning that cilium-agent is allowed to disable ip
early demux if needed. This new option can be set to false to retain
the current behavior (== ip early demux is not disabled, but Cilium
policy enforcement may not function correctly in all datapath modes
with L7 enforcement or visibility.
Signed-off-by: Jarno Rajahalme jarno@covalent.io
This change is