pkg/default: set AddressScopeMax default value by liyihuang · Pull Request #41778 · cilium/cilium

liyihuang · 2025-09-19T16:26:31Z

see the commit message.

Move this commit to seperate PR so we can backport this one for other use cases based on discussion #41645 (comment)

Change the default AddressScopeMax to 254(host scope) so it works with new GKE meta data server and HCP use cases.
If you need to roll back to the previous behavior, you can set --local-max-addr-scope=252 for Cilium agent

liyihuang · 2025-09-19T16:47:11Z

/test

liyihuang · 2025-09-19T17:00:33Z

/test

bimmlerd

If this change is going through, then I don't see the point of retaining the AddressScopeMax constant. But I'm more worried about not knowing whether this has more impact than I can foresee.

pkg/defaults/defaults_linux.go

pkg/datapath/tables/node_address_test.go

liyihuang · 2025-09-22T18:47:04Z

/test

jrife · 2025-09-22T20:12:26Z

Thanks for the fix. We (GKE team people @Bigdelle @sypakine) have recently been looking into using Cilium LRP with GKE MDS, so this helps. I'm adding @sypakine as a reviewer here, since he has some more context on this and probably wants to take a look. So this PR in conjunction with #41671 should fix #41671?

liyihuang · 2025-09-22T20:31:27Z

Thanks for the fix. We (GKE team people @Bigdelle @sypakine) have recently been looking into using Cilium LRP with GKE MDS, so this helps. I'm adding @sypakine as a reviewer here, since he has some more context on this and probably wants to take a look. So this PR in conjunction with #41671 should fix #41671?

yes(I guess you have a typo on #41645). Based on my own test. I think you could just use the image from #41645 and manually configure AddressScopeMax to test it if you want.

This is reported here #28655 (comment) from the beginning. Where I can see that's the new behavior from newer GKE meta data server.

borkmann · 2025-09-23T09:36:58Z

For context, the diff is basically as follows:

Without flag:

cilium-dbg bpf endpoint list
IP ADDRESS        LOCAL ENDPOINT INFO
10.99.45.18:0     (localhost)   
147.28.227.91:0   (localhost)   
10.25.132.3:0     (localhost)

With --local-max-addr-scope=254 (aka what this PR is doing, 254 == RT_SCOPE_HOST):

cilium-dbg bpf endpoint list
IP ADDRESS          LOCAL ENDPOINT INFO
169.254.169.252:0   (localhost)   
10.99.45.18:0       (localhost)   
147.28.227.91:0     (localhost)   
10.25.132.3:0       (localhost)

... when the loopback has:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 169.254.169.252/32 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever

So essentially it is detecting the non-default scope host addresses and places them into the BPF endpoint map with host flag. My understanding is that in case of BPF host routing without the --local-max-addr-scope setting, traffic from Pod to 169.254.169.252 would not be detected that this needs to go up to the stack.

borkmann · 2025-09-23T09:41:33Z

Original work back then: ea75a72 (so this basically affects ipcache / ep maps when such address is present and considers it as "host" from Cilium PoV)

bimmlerd

OK, I'll trust your judgement :)

liyihuang · 2025-09-23T20:34:45Z

/test

borkmann · 2025-09-23T20:38:47Z

@liyihuang could you add some more context to the commit message? I feel like right now its lacking too many details, would be good to elaborate more, feel free to take the additional context from the comments in here. Just so we have it for future reference.

In GKE, metadata-server configures a secondary address on the loopback interface. Here is the example 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet 169.254.169.252/32 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever Cilium uses 252 as the default value, so it will skip the scope host ip address. With the old default value, Cilium will not consider the loopback address 169.254.169.252 as the localhost address since its scope is host. We could have the following bpf endpoint list cilium-dbg bpf endpoint list IP ADDRESS LOCAL ENDPOINT INFO 10.99.45.18:0 (localhost) 147.28.227.91:0 (localhost) 10.25.132.3:0 (localhost) With the new default value or using --local-max-addr-scope=254 We will get the following bpf endpoint list cilium-dbg bpf endpoint list IP ADDRESS LOCAL ENDPOINT INFO 169.254.169.252:0 (localhost) 10.99.45.18:0 (localhost) 147.28.227.91:0 (localhost) 10.25.132.3:0 (localhost) With the old default value could cause the problem for eBPF host routing since we can't redirect the packet to unknown endpoint. We have to ask users to use hostLegacyRouting or change the local-max-addr-scope to 254. However, local-max-addr-scope is a hidden flag where users dont know about it. That's why this PR is bumping the default value to 254. Signed-off-by: Liyi Huang <liyi.huang@isovalent.com>

liyihuang · 2025-09-24T02:32:45Z

/test

julianwiedmann · 2025-09-25T06:55:12Z

I'm surprised that we're not calling out this change (and how to roll it back) in the release notes. And slightly concerned about the suggestion to also change the default behavior in the v1.18 stable release. Without any soak time in the development branch.

(btw the correct tag would be needs-backport/1.18)

borkmann · 2025-09-25T08:12:12Z

And slightly concerned about the suggestion to also change the default behavior in the v1.18 stable release. Without any soak time in the development branch.

Agree, we should not backport this until ~v1.19.2 or such if there haven't been reports on regressions.

liyihuang · 2025-09-25T13:24:45Z

I'm surprised that we're not calling out this change (and how to roll it back) in the release notes. And slightly concerned about the suggestion to also change the default behavior in the v1.18 stable release. Without any soak time in the development branch.

(btw the correct tag would be needs-backport/1.18)

Thanks for the help. I have updated release notes. I'm trying to see if I need to attach some tag or I need to add the needs-backport/1.18 manually later once 1.19.2 is out.

Is there still any problem to merge this to the main? I'm asking because I will need this PR and #41645 together to solve #41671

julianwiedmann · 2026-03-25T06:33:42Z

And slightly concerned about the suggestion to also change the default behavior in the v1.18 stable release. Without any soak time in the development branch.

Agree, we should not backport this until ~v1.19.2 or such if there haven't been reports on regressions.

I believe this caused a regression in v1.19 (see #44778 (comment)).

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Sep 19, 2025

liyihuang added the release-note/misc This PR makes changes that have no direct user impact. label Sep 19, 2025

maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Sep 19, 2025

liyihuang added dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. backport/1.18 This PR represents a backport for Cilium 1.18.x of a PR that was merged to main. labels Sep 19, 2025

maintainer-s-little-helper bot removed dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. labels Sep 19, 2025

liyihuang requested a review from borkmann September 19, 2025 16:27

borkmann approved these changes Sep 19, 2025

View reviewed changes

liyihuang marked this pull request as ready for review September 19, 2025 20:45

liyihuang requested review from a team as code owners September 19, 2025 20:45

liyihuang requested review from bimmlerd and jrife September 19, 2025 20:45

bimmlerd requested changes Sep 22, 2025

View reviewed changes

pkg/defaults/defaults_linux.go Show resolved Hide resolved

pkg/datapath/tables/node_address_test.go Show resolved Hide resolved

liyihuang force-pushed the pr/liyihuang/set_address_scope_max branch from b599f98 to 86c973d Compare September 22, 2025 16:33

jrife requested a review from sypakine September 22, 2025 20:07

bimmlerd approved these changes Sep 23, 2025

View reviewed changes

jrife approved these changes Sep 23, 2025

View reviewed changes

liyihuang force-pushed the pr/liyihuang/set_address_scope_max branch from 86c973d to 7e8b44b Compare September 23, 2025 19:59

liyihuang force-pushed the pr/liyihuang/set_address_scope_max branch from 7e8b44b to 06a2426 Compare September 24, 2025 02:07

liyihuang force-pushed the pr/liyihuang/set_address_scope_max branch from 06a2426 to 26533c6 Compare September 24, 2025 02:07

sypakine approved these changes Sep 24, 2025

View reviewed changes

maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Sep 24, 2025

julianwiedmann removed the backport/1.18 This PR represents a backport for Cilium 1.18.x of a PR that was merged to main. label Sep 25, 2025

borkmann merged commit 7638b51 into cilium:main Sep 25, 2025
71 checks passed

julianwiedmann mentioned this pull request Oct 3, 2025

Support BPF Host Routing with IPsec #41997

Merged

liyihuang deleted the pr/liyihuang/set_address_scope_max branch November 12, 2025 18:31

cilium-release-bot bot added this to cilium v1.19.0 Feb 3, 2026

cilium-release-bot bot moved this to Released in cilium v1.19.0 Feb 3, 2026

julianwiedmann mentioned this pull request Mar 25, 2026

fix(datapath): ignore link-local IPv6 addresses for NodePort binding #44778

Merged

Conversation

liyihuang commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

liyihuang commented Sep 19, 2025

Uh oh!

liyihuang commented Sep 19, 2025

Uh oh!

bimmlerd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

liyihuang commented Sep 22, 2025

Uh oh!

jrife commented Sep 22, 2025

Uh oh!

liyihuang commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

borkmann commented Sep 23, 2025

Uh oh!

borkmann commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bimmlerd left a comment

Choose a reason for hiding this comment

Uh oh!

liyihuang commented Sep 23, 2025

Uh oh!

borkmann commented Sep 23, 2025

Uh oh!

liyihuang commented Sep 24, 2025

Uh oh!

julianwiedmann commented Sep 25, 2025

Uh oh!

borkmann commented Sep 25, 2025

Uh oh!

liyihuang commented Sep 25, 2025

Uh oh!

Uh oh!

julianwiedmann commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

liyihuang commented Sep 19, 2025 •

edited

Loading

liyihuang commented Sep 22, 2025 •

edited

Loading

borkmann commented Sep 23, 2025 •

edited

Loading