-
Notifications
You must be signed in to change notification settings - Fork 3.4k
Add Kubernetes compatibility documentation #12783
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: André Martins <andre@cilium.io>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think ipBlock
must match pod IPs per the KNP specs? Otherwise LGTM
+-------------------------------+----------------------------------------------+ | ||
| Feature | Tracking Issue | | ||
+===============================+==============================================+ | ||
| ``ipBlock`` set with a pod IP | https://github.com/cilium/cilium/issues/9209 | |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
AFAIK this isn't actually specified in KNP standards.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's true, but it is also not specified anywhere that it can't be a pod IP. There are upstream k8s tests that were currently skipping because of this limitation.
cilium/test/kubernetes-test.sh
Lines 76 to 83 in d80e66f
# We currently skip the following tests: | |
# should not allow access by TCP when a policy specifies only SCTP | |
# - Cilium does not support SCTP yet | |
# should allow egress access to server in CIDR block and | |
# should ensure an IP overlapping both IPBlock.CIDR and IPBlock.Except is allowed | |
# - TL;DR Cilium does not allow to specify pod CIDRs as part of the policy | |
# because it conflicts with the pod's security identity. | |
# - More info at https://github.com/cilium/cilium/issues/9209 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I guess it's fair. Probably worth adding a comment to the related issue though to explain that the same traffic can (and should) be allowed via endpointSelector/podSelector policy instead of ipBlock - ie show the mitigation in case someone clicks through to that issue.
Marked for backport on all branches so that users are clarify about this on all Cilium versions. Ping me if the backport didn't apply correctly.