Only process traffic impacted by network policies #39
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aojea The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
approved
aojea
force-pushed
the
local_pods
branch
2 times, most recently
from
0bfd312
to
0390d5e
Compare
k8s-ci-robot
added
the
needs-rebase
k8s-ci-robot
removed
the
needs-rebase
aojea
force-pushed
the
local_pods
branch
3 times, most recently
from
f2b8372
to
6bfb5e7
Compare
|
/assign @danwinship Dan please take a look |
| if networkPolicy == nil { | ||
| return nil | ||
| } | ||
| podSelector, err := metav1.LabelSelectorAsSelector(&networkPolicy.Spec.PodSelector) |
There was a problem hiding this comment.
So FTR, with the existing code, if you have Pod A on Node 1 that denies all ingress, and Pod B on Node 2 tries to send to it, then Node 2 will drop the packets. With this new code, Node 2 would instead forward the packet to Node 1, and then Node 1 would drop it.
There was a problem hiding this comment.
yeah, is the trade off, but at least the rules are only evaluated once in one node, previously allowed rules were evaluated twice, one in each node
Cluster Wide Policies are hard to implement in the dataplane
Since the controller already has the pod information this looks simpler, kube-proxy does not watch pods and need to depend on those heuristics |
Instead of sending all traffic to user space, only process the traffic that is impacted by network policies. If admin network policies are enabled then we process all traffic.
|
It would still be better for it to be a command-line option, even if it's required. Required environment variables are terrible. |
I just want to fix the flake, let me open an issue to not forget and do the change |
optimize the datapath not having to send all packets to user space, only the ones that are subject of network policies
Fixes: #10, #31, #12