Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

node local traffic is not processed by network policies #66

Merged
merged 2 commits into from
Jul 23, 2024
Merged

node local traffic is not processed by network policies #66

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2e682f0
don't default ginkgo FOCUS and SKIP regex
aojea Jul 23, 2024
dff26fe
don't block traffic generated by the root user on the node
aojea Jul 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions hack/ci/e2e.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,8 +168,9 @@ run_tests() {
fi

# ginkgo regexes
SKIP="${SKIP:-"Feature|Federation|PerformanceDNS|DualStack|Disruptive|Serial|KubeProxy|GCE|Netpol|NetworkPolicy|256.search.list.characters|LoadBalancer.Service.without.NodePort|type.and.ports.of.a.TCP.service|loadbalancer.source.ranges"}"
FOCUS="${FOCUS:-"\\[sig-network\\]"}"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why?

Copy link
Contributor Author

@aojea aojea Jul 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we have now LABEL_FILTER that is the new cool kid on the block kubernetes/test-infra#33075 ... you can even read the filter and understand it 😄

SKIP="${SKIP:-}"
FOCUS="${FOCUS:-}"
LABEL_FILTER="${LABEL_FILTER:-"Feature: containsAny NetworkPolicy"}"
# if we set PARALLEL=true, skip serial tests set --ginkgo-parallel
if [ "${PARALLEL:-false}" = "true" ]; then
export GINKGO_PARALLEL=y
Expand Down
7 changes: 7 additions & 0 deletions pkg/networkpolicy/controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -695,6 +695,13 @@ func (c *Controller) syncNFTablesRules(ctx context.Context) error {
Rule: knftables.Concat(
"icmpv6", "type", "{", "nd-neighbor-solicit, nd-neighbor-advert", "}", "accept"),
})
// Don't process traffic generated from the root user in the Node, it can block kubelet probes
// or system daemons that depend on the internal node traffic to not be blocked.
// Ref: https://github.com/kubernetes-sigs/kube-network-policies/issues/65
tx.Add(&knftables.Rule{
Chain: chainName,
Rule: "meta skuid 0 accept",
})
// instead of aggregating all the expresion in one rule, use two different
// rules to understand if is causing issues with UDP packets with the same
// tuple (https://github.com/kubernetes-sigs/kube-network-policies/issues/12)
Expand Down
Loading