General Information
- Cilium 0.13.90 a1b0d89ec858 Tue, 5 Dec 2017 18:05:34 -0800 go version go1.9.2 linux/amd64
- Linux cilium-master 4.9.17-040917-generic #201703220831 SMP Wed Mar 22 12:33:05 UTC 2017 x86_64 x86_64 x86_64GNU/Linux
- No orchestration layer (Just running the regular development VM with docker commands)
- Policies:
$ cat l3l4.json
[{
"endpointSelector": {"matchLabels":{"id":"app1"}},
"ingress": [{
"fromEndpoints": [
{"matchLabels":{"id":"app2"}}
],
"toPorts": [{
"ports": [{"port": "80", "protocol": "TCP"}]
}]
}]
}]
$ cat l3.json
[{
"endpointSelector": {"matchLabels":{"id":"app1"}},
"ingress": [{
"fromEndpoints": [
{"matchLabels":{"id":"app2"}}
]
}]
}]
How to reproduce the issue
docker run -d --name "app1" --net cilium-net -l "id=app1" cilium/demo-httpdcilium policy import l3l4.jsondocker run --rm -ti --net cilium-net -l "id=app2" cilium/demo-client curl 'http://app1/public'cilium policy delete --allcilium policy import l3.jsondocker run --rm -ti --net cilium-net -l "id=app2" cilium/demo-client curl 'http://app1/public'cilium bpf policy get <choose app1 epid>
$ cilium bpf policy get 173
Was impossible to retrieve label ID 260: [GET /identity/{id}][404] getIdentityIdNotFound
Was impossible to retrieve label ID 258: [GET /identity/{id}][404] getIdentityIdNotFound
LABELS (source:key[=value]) PORT ACTION BYTES PACKETS
260 any allowed 0 0
258 80 allowed 0 0
The IDs are different, but we can see that the old policy entry which filtered on specific L4 ports is still available, even though we deleted the cilium policy.
Final policy:
$ cilium policy get
[
{
"endpointSelector": {
"matchLabels": {
"any:id": "app1"
}
},
"ingress": [
{
"fromEndpoints": [
{
"matchLabels": {
"any:id": "app2"
}
}
]
}
]
}
]
Revision: 17
General Information
How to reproduce the issue
docker run -d --name "app1" --net cilium-net -l "id=app1" cilium/demo-httpdcilium policy import l3l4.jsondocker run --rm -ti --net cilium-net -l "id=app2" cilium/demo-client curl 'http://app1/public'cilium policy delete --allcilium policy import l3.jsondocker run --rm -ti --net cilium-net -l "id=app2" cilium/demo-client curl 'http://app1/public'cilium bpf policy get <choose app1 epid>The IDs are different, but we can see that the old policy entry which filtered on specific L4 ports is still available, even though we deleted the cilium policy.
Final policy: