fix(istio): BPF-compatible egress rules for ztunnel and istiod policies#4632
Open
electricjesus wants to merge 2 commits intotigera:masterfrom
Open
fix(istio): BPF-compatible egress rules for ztunnel and istiod policies#4632electricjesus wants to merge 2 commits intotigera:masterfrom
electricjesus wants to merge 2 commits intotigera:masterfrom
Conversation
…licies When BPF dataplane is enabled, CTLB (connect-time load balancing) must be disabled for Istio ambient mode compatibility. Without CTLB and kube-proxy, the service-based egress selector in the ztunnel policy doesn't resolve correctly for cross-node traffic, and istiod's egress policy doesn't allow return traffic to remote ztunnel pods. This causes all ztunnel pods except the one co-located with istiod to fail with "XDS client connection error connecting to istiod" because the calico-system default-deny blocks the unmatched traffic. Fix by adding pod-selector-based egress rules (conditioned on BPF mode) so that: - ztunnel can reach istiod pods directly by pod IP (not just via service selector) - istiod can send return traffic to ztunnel pods on remote nodes
Verify that when BPF dataplane is enabled, the ztunnel and istiod policies include pod-selector-based egress rules for cross-node communication. Also verify these rules are absent when BPF is not enabled.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bug fix: When BPF dataplane is enabled with Istio ambient mode, CTLB must be disabled. Without CTLB and kube-proxy, the operator-managed calico-system tier policies for ztunnel and istiod block cross-node communication:
This causes 4/5 ztunnel pods to fail with
XDS client connection error connecting to istiod.calico-system.svc:15012— only the one co-located with istiod works.Fix: Add pod-selector-based egress rules (conditioned on
BPFEnabled()) to both policies:k8s-app == 'istiod'pods directlyk8s-app == 'ztunnel'podsTesting:
Components affected: Istio component renderer (
pkg/render/istio/istio.go)Related issues: CORE-12597
Related PRs:
Release Note
For PR author
make gen-filesmake gen-versions