…tion

Add an agent knob for expert users who wish to run backend Pods on the
same ports as the NodePort service is exposed. We recently resolved this
by making cgroup BPF hooks netns aware in the kernel and Cilium via work
from d7bf451 ("bpf: fix init namespace handling in sock lb programs").
This works for 5.7 kernels.

However, if there is a need for older kernels to deploy Pods in this way
(or to opt out of the bind hooks entirely for different reasons), then one
can control this setting through --node-port-bind-protection. The knob
defaults to true (same as we do today), so that expert users can opt-out
from it if they need to.

With bind protection enabled:

  # ./daemon/cilium-agent  [...]
  # bpftool cgroup tree
  CgroupPath
  ID       AttachType      AttachFlags     Name
  /sys/fs/cgroup/unified
  48126    connect4
  48122    connect6
  48127    post_bind4   <---+ bind prevention enabled by default
  48123    post_bind6   <---`
  48128    sendmsg4
  48124    sendmsg6
  48129    recvmsg4
  48125    recvmsg6
  [...]

With bind protection disabled:

  # ./daemon/cilium-agent  [...] --node-port-bind-protection=false
  # bpftool cgroup tree
  CgroupPath
  ID       AttachType      AttachFlags     Name
  /sys/fs/cgroup/unified
  49607    connect4
  49604    connect6
  49608    sendmsg4
  49605    sendmsg6
  49609    recvmsg4
  49606    recvmsg6
  [...]

Reported-by: Rene Zbinden <rene.zbinden@postfinance.ch>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Add related documentation and options for helm to aid configuration
for the bindProtection setting.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>