mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
b1662f7cf6
## What this PR does Cozystack enables Cilium's host firewall by default while the Cilium IPv6 datapath stays disabled (`ipv6.enabled=false`). In upstream Cilium this combination drops all node IPv6 on managed devices as "Unsupported L3 protocol" (`DROP_UNKNOWN_L3` in `bpf_host.c`) before any policy evaluation, in both directions. This breaks ICMPv6 Neighbor Discovery — and with it all node-level IPv6, e.g. BGP unnumbered over link-local addresses on L3 fabrics. No `CiliumClusterwideNetworkPolicy` can allow this traffic, because the drop happens before policy enforcement (upstream report: cilium/cilium#33155, closed stale). The cozystack cilium image now carries a minimal BPF patch that passes IPv6 to the kernel stack instead, mirroring the behavior with the host firewall disabled: - `packages/system/cilium/images/cilium/patches/` — three `ETH_P_IPV6` passthrough cases under `#ifndef ENABLE_IPV6` in `bpf_host.c`. The fourth `DROP_UNKNOWN_L3` site (`from_host_to_lxc`) is intentionally not covered: bpf_lxc drops IPv6 without the v6 datapath regardless, so a passthrough there restores nothing. - The multi-stage Dockerfile applies the patch with `patch --fuzz=0` plus a marker-count check, so upstream drift fails the image build loudly. - `make update` dry-runs the patch against the freshly vendored upstream tag, so a cilium version bump surfaces drift immediately. - `values.yaml` documents the consequence: Cilium host policies apply to IPv4 only; node IPv6 is not filtered by Cilium. The same fix was submitted upstream: cilium/cilium#46473. The local patch is carried until it lands in a release Cozystack ships. Verification: the image builds and contains the patched source; a corrupted patch context fails the build with a clear error; the upstream variant of this change passes new BPF unit tests that fail without the fix with exactly the "Unsupported L3 protocol" drop from the field report; existing host-firewall and IPv6 BPF tests still compile. PR e2e exercises runtime BPF compilation of the patched source, since the agent compiles `bpf_host.c` at startup. Docs: cozystack/website#574 Closes #2806 ### Screenshots Not a UI change. ### Release note ```release-note fix(cilium): node IPv6 (ICMPv6 Neighbor Discovery, BGP unnumbered over link-local) now works with the host firewall enabled; Cilium host policies apply to IPv4 only, node IPv6 is not filtered by Cilium ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Pass IPv6 traffic to the kernel stack when the Cilium IPv6 datapath is disabled, preventing it from being treated as an unknown L3 protocol. * **Documentation** * Added clarification on host firewall behavior: with hostFirewall enabled and IPv6 datapath disabled, policies apply to IPv4 only. * **Chores** * Improved the Cilium image build/update flow by validating the IPv6 patch against the upstream Cilium version to ensure compatibility. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
cilium:
|
|
kubeProxyReplacement: true
|
|
# Upstream cilium with hostFirewall enabled and the IPv6 datapath disabled
|
|
# (ipv6.enabled=false, the default here) drops ALL node IPv6 before any
|
|
# policy evaluation ("Unsupported L3 protocol", DROP_UNKNOWN_L3 in
|
|
# bpf/bpf_host.c), breaking ICMPv6 Neighbor Discovery and BGP unnumbered on
|
|
# IPv6/L3 fabrics. The cozystack cilium image carries a BPF patch
|
|
# (images/cilium/patches/) that passes IPv6 to the kernel stack instead.
|
|
# Consequence: Cilium host policies apply to IPv4 only; node IPv6 is not
|
|
# filtered by Cilium.
|
|
hostFirewall:
|
|
enabled: true
|
|
hubble:
|
|
enabled: false
|
|
externalIPs:
|
|
enabled: true
|
|
nodePort:
|
|
enabled: true
|
|
loadBalancer:
|
|
algorithm: maglev
|
|
serviceTopology: true
|
|
ipam:
|
|
mode: "kubernetes"
|
|
image:
|
|
repository: ghcr.io/cozystack/cozystack/cilium
|
|
tag: v1.5.0
|
|
digest: "sha256:94dc74c9301f0da5695c80e77b77ee0486ad0086b5be60a94136a2cafd410b73"
|
|
envoy:
|
|
enabled: true
|
|
# Upstream default is {} — no requests/limits. The embedded envoy DaemonSet
|
|
# idles at ~100 MB RAM/node and grows under L7 traffic; without requests
|
|
# the DaemonSet schedules onto any node with no reserved headroom, and
|
|
# without a memory limit a runaway listener could OOM the node.
|
|
# The baseline matches the commented-out example in the upstream Helm values.
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
gatewayAPI:
|
|
enabled: true
|
|
rollOutCiliumPods: true
|
|
operator:
|
|
rollOutPods: true
|
|
replicas: 1
|