Repository navigation
Add an option to exclude networks from egress - #386
Open
p-strusiewiczsurmacki-mobica wants to merge 5 commits into
Open
p-strusiewiczsurmacki-mobica wants to merge 5 commits into
p-strusiewiczsurmacki-mobica wants to merge 5 commits into
Conversation
Contributor
|
Hi, @p-strusiewiczsurmacki-mobica! |
chez-shanpu
self-requested a review
October 2, 2026 05:33
chez-shanpu
reviewed
Oct 6, 2026
p-strusiewiczsurmacki-mobica
force-pushed
the
feat/excluded-cidrs-v3
branch
from
October 19, 2026 14:22
883afa5 to
d549dde
Compare
chez-shanpu
self-requested a review
October 20, 2026 04:34
chez-shanpu
reviewed
Oct 20, 2026
chez-shanpu
left a comment
chez-shanpu
left a comment
Contributor
There was a problem hiding this comment.
Thank you for your fix!
I left some quick comments on the core logic.
Signed-off-by: Patryk Strusiewicz-Surmacki <patryk.strusiewiczsurmacki@cognizant.com>
Signed-off-by: Patryk Strusiewicz-Surmacki <patryk-pawel.strusiewicz-surmacki@external.telekom.de>
Signed-off-by: Patryk Strusiewicz-Surmacki <patryk-pawel.strusiewicz-surmacki@external.telekom.de>
p-strusiewiczsurmacki-mobica
force-pushed
the
feat/excluded-cidrs-v3
branch
2 times, most recently
from
October 23, 2026 13:36
3b030bb to
e691d9f
Compare
Signed-off-by: Patryk Strusiewicz-Surmacki <patryk.strusiewiczsurmacki@cognizant.com>
p-strusiewiczsurmacki-mobica
force-pushed
the
feat/excluded-cidrs-v3
branch
from
October 23, 2026 13:43
e691d9f to
af72906
Compare
Contributor
Author
|
@chez-shanpu Sorry you had to wait, but all the issues above should be fixed now, I think :) |
chez-shanpu
reviewed
Oct 26, 2026
p-strusiewiczsurmacki-mobica
force-pushed
the
feat/excluded-cidrs-v3
branch
from
October 26, 2026 10:54
9594a87 to
0f2fceb
Compare
Signed-off-by: Patryk Strusiewicz-Surmacki <patryk-pawel.strusiewicz-surmacki@external.telekom.de> Co-authored-by: Tomoki Sugiura <tomoki.sugiura@mail.shanpu.info>
p-strusiewiczsurmacki-mobica
force-pushed
the
feat/excluded-cidrs-v3
branch
from
October 26, 2026 12:16
0f2fceb to
d13f73e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was changed
This PR introduces new flag
--cluster-networksforcoild. When specified this flag will override the default non-egress addresses (IPv4 - RFC1918 -10.0.0.0/8,172.16.0.0/12,192.168.0.0/16and IPv6 - ULA&LLA -fc00::/7) with specified networks.Override will happen on per IP family basis - for example, if at least one IPv4 will be provided for
--cluster-networks, addresses for IPv4 will be overridden, but IPv6 will stay intact.Because of how
coiluse rule priorities, max 100 CIDRs can be added per IP family. The CIDRs should be separated with a comma.Example
Justification for the change
Today Egress NAT orders the
ip ruleslike this: "fwmark, more specific destinations, RFC1918 (IPv4)/ULA&LLA (IPv6), less specific destinations". Less specific destinations are e.g. 0.0.0.0/0 or ::/0.We use IPv6 addresses outside of ULA&LLA across our pods, services etc, and we would like to be able to change that parameter, as we don't want to route our internal cluster traffic then through the egress NAT, even if someone specifies for example
::/0as an egress NAT destination for a pod.Additional info
E2E tests added with this PR.