zeekay
679052fcc7
Fixes pod-network drops when hostNetwork ingress DaemonSet (hanzo-ingress in lux-system) sends cross-node traffic to pod-CIDR backends in hanzo ns. Cilium resolves source identity as remote-node for hostNetwork traffic, which doesn't match pod-label selectors in standard NetworkPolicies. fromEntities: [cluster, host, remote-node] covers all in-cluster sources. Unblocks: lux.finance, lux.industries, blog.lux.network, blog.lux.network/api/search, vote.lux.network (all were 504-ing at CF edge due to policy drops).
18 lines
377 B
YAML
18 lines
377 B
YAML
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: allow-cluster-ingress
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/component: network-policy
|
|
app.kubernetes.io/managed-by: lux-universe
|
|
app.kubernetes.io/part-of: lux-universe
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels: {}
|
|
ingress:
|
|
- fromEntities:
|
|
- cluster
|
|
- host
|
|
- remote-node
|