envoy: Update to pick up deny policy support #28862
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Keeping as draft until |
|
/test |
eb9f7cc to
321a225
Compare
|
|
|
/test |
tklauser
approved these changes
Oct 31, 2023
Not yet. Hopefully soon. |
christarazi
approved these changes
Nov 1, 2023
321a225 to
08b10d0
Compare
|
Rebased to figure out if the privileged runtime test fail is related to this PR or not. |
|
/test |
Ingress policy enforcement for Cilium Ingress was recently added (cilium#28126). Update cilium-envoy to a version that enforces also deny policies. The only functional change in Cilium agent itself is the setting of the new Deny flag for PortNetworkPolicyRules in pkg/xds_server.go. The updated cilium-envoy version also adds support for overlapping port ranges and hence also for overlapping port numbers, as in when using a named port that resolves to the same port number used as a number elsewhere in the policy. Fixes: cilium#27816 Fixes: cilium#28126 Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
08b10d0 to
1a7b295
Compare
|
rebased for CI fixes |
|
/test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Update Envoy build to pick up support for deny policies.
Ingress policy enforcement for Cilium Ingress was recently added (#28126, #28462), but deny policies were not enforced in Envoy yet. This PR updates
cilium-envoyto a version that enforces also deny policies. The only functional change in Cilium agent itself is the setting of the newDenyflag forPortNetworkPolicyRules inpkg/xds_server.go.The updated
cilium-envoyversion also adds support for overlapping port ranges and hence also for overlapping port numbers, fixing #27816.Fixes: #27816
Fixes: #28126