l7lb: fix bypassing ingress policies for local backends#44693
Merged
julianwiedmann merged 3 commits intomainfrom Mar 13, 2026
Merged
l7lb: fix bypassing ingress policies for local backends#44693julianwiedmann merged 3 commits intomainfrom
julianwiedmann merged 3 commits intomainfrom
Conversation
476148d to
b9aafb6
Compare
b9aafb6 to
1c0423f
Compare
julianwiedmann
approved these changes
Mar 12, 2026
Member
julianwiedmann
left a comment
There was a problem hiding this comment.
Looks good, thank you! Waiting for the pending tests ...
1c0423f to
77aba33
Compare
Contributor
Author
|
I pushed two tests:
|
nezdolik
approved these changes
Mar 13, 2026
Member
julianwiedmann
left a comment
There was a problem hiding this comment.
Just some minor nit-picks on the naming in the test, so that it's less confusing for others. Sorry :)
The idea is that we're in the path from envoy to the backend. So the destination IP/port should be named BACKEND_*. And then we're tail-calling back into the client's egress path, so let's use CLIENT_EP_ID.
This is to clarify the naming and distinguish with the new tests we are going to introduce in subsequent commits. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
This commits adds IPv4/IPv6 tests for the case in which L7LB is enabled and opens a connection on behalf of a pod destined to a local backend. In case per-endpoint routes are not enabled, the packet will be handled in the cil_from_host program, will tail call to the egress policy program, and then return to stack. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends. Without per-endpoint routes, the pod policies are checked from the tail call in bpf_host. We reach this code from cilium_host (ctx->ifindex). With per-endpoint routes, the packet is handled directly in the local backend pod `cil_to_container` path, completely skipping ingress policies. Returning CTX_ACT_OK at this point would bypass policies. To fix this, we need to hairpin the packet back to cil_to_container (the ctx->mark is already cleared at the beginning of the codepath). This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB") Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
77aba33 to
a48ed5d
Compare
Contributor
Author
|
/test |
This was referenced Mar 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"), we enabled support for re-entering the LXC egress path after a packet is processed by a L7 LB. This allows us to correctly apply egress policies to packets sent by a L7 LB to local backends.
When ENDPOINT_ROUTES are disabled, the pod policies are checked from the tail call in bpf_host.
With ENDPOINT_ROUTES enabled, the packet is handled directly in the local backend pod
cil_to_containerpath, completely skipping ingress policies. This is because the packet is already in the backend pod ingress path, and returning CTX_ACT_OK would bypass policies. To fix this, we need to hairpin the packet back to its ingress path (the ctx->mark is already cleared at the beginning of the codepath).This would allow us to correctly apply ingress policies on the local backend ingress path, restoring the expected behavior. For remote backends, it already works as expected, so we don't need adjustments.
Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB")