Skip to content

fix(connectivity): Add node-local-dns entitiy match for local ip usage case #997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tklauser merged 1 commit into from
Jan 24, 2023
Merged

fix(connectivity): Add node-local-dns entitiy match for local ip usage case #997

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,3 +24,4 @@ cilium-sysdump-*.zip

# Editor metas
.vscode/
.idea/
10 changes: 10 additions & 0 deletions connectivity/manifests/allow-all-except-world-pre-v1.11.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,16 @@ spec:
- health
- toEndpoints:
- {}
# When node-local-dns is deployed with local IP,
# Cilium labels its ip as world.
# This change prevents failing the connectivity
# test for such environments.
- toPorts:
- ports:
- port: "53"
protocol: UDP
toEntities:
- world
ingress:
- fromEntities:
- host
Expand Down
12 changes: 11 additions & 1 deletion connectivity/manifests/allow-all-except-world.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,17 @@ spec:
- health
- kube-apiserver
- toEndpoints:
- {}
- {}
# When node-local-dns is deployed with local IP,
Copy link
Copy Markdown
Member

@aditighag aditighag Jan 5, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not narrow this down further -

- matchExpressions:
          - { key: 'k8s-app', operator: In, values: [ "node-local-dns", "nodelocaldns" ] }
          - { key: 'io.kubernetes.pod.namespace', operator: In, values: [ "kube-system" ] }

Copy link
Copy Markdown
Contributor Author

@eminaktas eminaktas Jan 10, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I added and tested there wasn't any issue. thanks.

Copy link
Copy Markdown
Contributor Author

@eminaktas eminaktas Jan 10, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new change caused a failure for Multicluster test. You can find the logs here.

Copy link
Copy Markdown
Contributor Author

@eminaktas eminaktas Jan 13, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did not understand the why Multicluster test failed. So, I took the change back.

# Cilium labels its ip as world.
# This change prevents failing the connectivity
# test for such environments.
- toPorts:
- ports:
- port: "53"
protocol: UDP
toEntities:
- world
ingress:
- fromEntities:
- host
Expand Down
22 changes: 13 additions & 9 deletions connectivity/manifests/client-egress-only-dns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,16 @@ spec:
dns:
- matchPattern: "*"
toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: coredns
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: node-local-dns
- matchExpressions:
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns", "nodelocaldns" ] }
- { key: 'io.kubernetes.pod.namespace', operator: In, values: [ "kube-system" ] }
# When node-local-dns is deployed with local IP,
# Cilium labels its ip as world.
# This change prevents failing the connectivity
# test for such environments.
- toPorts:
- ports:
- port: "53"
protocol: UDP
toEntities:
- world
12 changes: 11 additions & 1 deletion connectivity/manifests/client-egress-to-echo.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,15 @@ spec:
protocol: ANY
toEndpoints:
- matchExpressions:
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns" ] }
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns", "nodelocaldns" ] }
- { key: 'io.kubernetes.pod.namespace', operator: In, values: [ "kube-system" ] }
# When node-local-dns is deployed with local IP,
# Cilium labels its ip as world.
# This change prevents failing the connectivity
# test for such environments.
- toPorts:
- ports:
- port: "53"
protocol: UDP
toEntities:
- world
12 changes: 11 additions & 1 deletion connectivity/manifests/client-egress-to-entities-world.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,19 @@ spec:
protocol: TCP
- toEndpoints:
- matchExpressions:
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns" ] }
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns", "nodelocaldns" ] }
- { key: 'io.kubernetes.pod.namespace', operator: In, values: [ "kube-system" ] }
toPorts:
- ports:
- port: "53"
protocol: ANY
# When node-local-dns is deployed with local IP,
# Cilium labels its ip as world.
# This change prevents failing the connectivity
# test for such environments.
- toPorts:
- ports:
- port: "53"
protocol: UDP
toEntities:
- world
12 changes: 11 additions & 1 deletion connectivity/manifests/client-egress-to-fqdns-one-one-one-one.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,5 +26,15 @@ spec:
- matchPattern: "*"
toEndpoints:
- matchExpressions:
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns" ] }
- { key: 'k8s-app', operator: In, values: [ "kube-dns", "coredns", "node-local-dns", "nodelocaldns" ] }
- { key: 'io.kubernetes.pod.namespace', operator: In, values: [ "kube-system" ] }
# When node-local-dns is deployed with local IP,
# Cilium labels its ip as world.
# This change prevents failing the connectivity
# test for such environments.
- toPorts:
- ports:
- port: "53"
protocol: UDP
toEntities:
- world