Cilium Feature Proposal

Is your feature request related to a problem?
Yes, currently it is not possible to allow/block access from/to nodes by their labels. The only way one can do that is by specifying remote-node identity, but this also allows access from nodes in remote clusters (in a clustermesh).

  ingress:
  - fromEntities:
    - remote-node

Describe the feature you'd like
It should be possible to allow/block only specific nodes by their labels in CNPs.

apiVersion: v1
kind: Node
metadata:
  labels:
    kubernetes.io/role: worker

(Optional) Describe your proposed solution

There are a few parts of the solution:

1. NodeManager currently doesn't have a way to allocate ID so we would need to extend the IPCache interface with a known method AllocateIdentity() which allocated IDs based on labels and this would be then pushed to ipcache. The current remote-node identity is hardcoded here and then inserted into ipcache so we could replace this with proper ID. The problem related to this is that ipToIdentityCache is a map of IPs and their identities so single IP can basically be present only once. It's a question how the upgrade path would look like and the case when users would want to have both options available. This
   brings us to 2nd point.

2. For the upgrade path we would imo need a new flag - something like --enable-per-node-identity which would supersede the "old" remote-node entity, but I haven't thought this through properly how old and new way could work together (meaning both options supported at the same time).

3. CNP would need a new section to allow only specific labels unrelated to endpoints. The question is if it should be somehow related to user-defined-entities or this as these should also be referenced by labels even though they have nothing to do with Node objects. A easy solution would be to add something like fromNodes with the same LabelSelector as EndpointSelector uses.

  endpointSelector:
    matchLabels:
      k8s-app: backend
  ingress:
  - fromNodes:
    - matchLabels:
        kubernetes.io/role: worker