cilium: Add option for lb src ranges to act as deny cidr list #36120
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
b0a195d to
e8cf5a1
Compare
Extend BPF side to add a service flag for turning the loadBalancerSourceRanges into a deny CIDR list. The flag used is always on the master entry, actual non-master entries use the flag to indicate that a service backend is quarantined. Both usage is guaranteed to not overlap. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
39e3eac to
c4735f1
Compare
Add agent-side handling of the source ranges policy annotation in order to plumb the flag through into the BPF service map. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Extend the KPR guide to document the loadBalancerSourceRanges extension along with usage examples. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
c4735f1 to
af614fc
Compare
|
/test |
tklauser
approved these changes
Nov 26, 2024
aspsk
approved these changes
Nov 26, 2024
mhofstetter
approved these changes
Nov 26, 2024
nebril
approved these changes
Nov 26, 2024
joamaki
added a commit
to joamaki/cilium
that referenced
this pull request
May 14, 2025
This ports cilium#36120 to the new control-plane. Signed-off-by: Jussi Maki <jussi@isovalent.com>
joamaki
added a commit
to joamaki/cilium
that referenced
this pull request
May 14, 2025
This ports cilium#36120 to the new control-plane. Signed-off-by: Jussi Maki <jussi@isovalent.com>
joamaki
added a commit
to joamaki/cilium
that referenced
this pull request
May 19, 2025
This ports cilium#36120 to the new control-plane. Signed-off-by: Jussi Maki <jussi@isovalent.com>
github-merge-queue bot
pushed a commit
that referenced
this pull request
May 19, 2025
This ports #36120 to the new control-plane. Signed-off-by: Jussi Maki <jussi@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(see commit desc)