Myasnikov Daniil
6a289cf6d0
Both admission-webhook deny policies name only their webhook's backend port. That covers a pod dialling the ClusterIP because Cilium translates a service to its backends before it enforces egress policy -- in v1.19.5, bpf/bpf_lxc.c runs __per_packet_lb_svc_xlate_4 and lb4_local() and only then tail-calls into handle_ipv4_from_lxc where policy_can_egress4 evaluates the rule. That ordering exists only while Cilium performs the DNAT, and the only reason it does is cilium's kubeProxyReplacement: true, set against an upstream chart default of "false". Set it false and the DNAT moves downstream of Cilium's egress hook: the packet arrives with dst = ClusterIP, matches no endpoint identity, and with default-deny off it is allowed. Both webhooks regain a pod -reachable ClusterIP path while the backend deny keeps working, so nothing fails and nothing is logged. Same shape as the port disagreement namespace-annotation-webhook.port already exists to prevent, and it had no pin. The suite asserts the rendered cilium-config key rather than .Values, so an upstream bump that renames it or stops honouring the override is caught too, and it spells out each of the five variant valuesFiles combinations from sources/networking.yaml so a future variant file that overrides the value reds here. Proven both ways: flipping values.yaml reds all six cases, and adding the override to values-kilo.yaml alone reds exactly the cilium-kilo case. The suite also records why a target-side ingressDeny is not available as a belt-and-braces fallback. A target-side rule needs a peer selector covering pods, and the peer selector is what carries namespace churn -- the failure being removed here. pkg/policy/selectorcache.go UpdateIdentities notifies a selector only when the churned identities were in its own cached selections, and pkg/policy/l4.go IdentitySelectionUpdated then writes the policy map of every endpoint the rule's endpointSelector selects, which for a target-side rule is the fail-closed webhook pods. The one churn-free peer is the wildcard, which Cilium collapses to a single ANY-identity entry and skips identity updates for -- but ANY covers reserved:host, remote-node and kube-apiserver, so it would deny the API server. There is no third shape. Refs #3983. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Cozystack
Cozystack is a free platform and framework for building clouds.
Cozystack is a CNCF Sandbox Level Project that was originally built and sponsored by Ænix.
With Cozystack, you can transform a bunch of servers into an intelligent system with a simple REST API for spawning Kubernetes clusters, Database-as-a-Service, virtual machines, load balancers, HTTP caching services, and other services with ease.
Use Cozystack to build your own cloud or provide a cost-effective development environment.
Use-Cases
-
Using Cozystack to build a public cloud
You can use Cozystack as a backend for a public cloud -
Using Cozystack to build a private cloud
You can use Cozystack as a platform to build a private cloud powered by Infrastructure-as-Code approach -
Using Cozystack as a Kubernetes distribution
You can use Cozystack as a Kubernetes distribution for Bare Metal
Documentation
The documentation is located on the cozystack.io website.
Read the Getting Started section for a quick start.
If you encounter any difficulties, start with the troubleshooting guide and work your way through the process that we've outlined.
Versioning
Versioning adheres to the Semantic Versioning principles.
A full list of the available releases is available in the GitHub repository's Release section.
Contributions
Contributions are highly appreciated and very welcomed!
In case of bugs, please check if the issue has already been opened by checking the GitHub Issues section. If it isn't, you can open a new one. A detailed report will help us replicate it, assess it, and work on a fix.
You can express your intention to on the fix on your own. Commits are used to generate the changelog, and their author will be referenced in it.
If you have a concrete feature request, open an issue. For a cross-cutting or architectural change, open a design proposal in the community repo. For questions or early ideas, use GitHub Discussions. See CONTRIBUTING.md for the full routing.
Community
You are welcome to join our Telegram group and come to our weekly community meetings. Add them to your Google Calendar or iCal for convenience.
License
Cozystack is licensed under Apache 2.0.
The code is provided as-is with no warranties.
Commercial Support
A list of companies providing commercial support for this project can be found on official site.