linkerd-proxy-init config.linkerd.io/skip-subnets skips only inbound traffic
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 11.5k
- Forks
- 1.4k
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 53
Description
### What is the issue?
config.linkerd.io/skip-subnets is only skipping inbound traffic for the subnet, and not exempting outbound traffic.
The documentation says `Comma-separated list of subnets in valid CIDR format that should be skipped by the proxy`. The documentation does not mention inbound only.
### How can it be reproduced?
Add linked-proxy as a sidecar
Add config.linkerd.io/skip-subnets annotation to the k8s app deployment.
Check the iptables in the linkerd-init container
### Logs, error output, etc
```level=info msg="/sbin/iptables -t nat -A PROXY_INIT_REDIRECT -p all -j RETURN -s 192.168.0.0/16 -m comment --comment proxy-init/ignore-subnet-192.168.0.0/16/1681151363"```
### output of `linkerd check -o short`
Status check results are √
### Environment
Kubernetes 1.25.4
AKS
Host OS: Mariner
Linkerd version: stable-2.12.3
### Possible solution
Given how `skip-inbound-ports` and `skip-outbound-ports` are named, we assumed that inbound and outbound traffic would be skipped for the subnets as no direction was implied in the naming or documentation. It seems for consistency with the other properties, this should be named `skip-inbound-subnets` with a corresponding `skip-outbound-subnets`.
Alternatively, if the intent was to skip both directions, then we should add an additional iptables rule to skip outbound traffic.
### Additional context
https://github.com/linkerd/linkerd2-proxy-init/blob/a18218e878664829d7a4a86905d80a5c45c09a32/internal/iptables/iptables.go#L302
### Would you like to work on fixing this bug?
yes
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with internal/iptables/iptables.go around the referenced line and reproduce the deployment with config.linkerd.io/skip-subnets, then inspect the iptables rules in the linkerd-init container. Compare the observed inbound and outbound behavior with the annotation documentation and naming of the other skip options; done means the intended subnet exemption and corresponding rules are clearly established and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100