mattia-eleuteri 026b1c7811 [virtual-machine] Exclude external VM services from Cilium BPF LB ...

Add service.kubernetes.io/service-proxy-name label to LoadBalancer
services when external: true. This prevents Cilium from adding the
service to its BPF service map, fixing two issues:

1. Inter-tenant connectivity via public LB IPs: Cilium's kube-proxy
   replacement DNATs traffic to LB IPs before policy evaluation,
   causing the CiliumClusterwideNetworkPolicy to block legitimate
   cross-tenant traffic through public IPs.

2. WholeIP broken on Cilium 1.19+ (#2327): wildcard service drop
   entries block all ports not declared in the Service spec before
   traffic reaches cozy-proxy's nftables rules.

With this label, Cilium completely ignores the Service. Routing is
handled by kube-ovn (via the wholeIP annotation) and MetalLB
continues to advertise the IP via L2 unaffected.

Tested on Cilium 1.18.6 and 1.19.1: inter-tenant via LB IP works,
pod IP isolation preserved, external access unaffected.

Signed-off-by: mattia-eleuteri <mattia@hidora.io>

2026-04-08 15:20:58 +02:00

..

_helpers.tpl

feat(vm-instance): port cpuModel, instancetype switching, and runStrategy changes

2026-02-14 03:02:41 +01:00

dashboard-resourcemap.yaml

bugfix: vm and vmi add svc to dashboard

2025-07-08 10:02:34 +03:00

secret.yaml

[virtual-machine] add comment about sshKeys logic

2025-07-09 10:37:39 +02:00

service.yaml

[virtual-machine] Exclude external VM services from Cilium BPF LB

2026-04-08 15:20:58 +02:00

vm-update-hook.yaml

feat(vm-instance): port cpuModel, instancetype switching, and runStrategy changes

2026-02-14 03:02:41 +01:00

vm.yaml

fix(vm-instance): remove fail on both networks and subnets set

2026-03-30 11:11:56 +05:00