linkerd / linkerd/linkerd2

linkerd-proxy-init config.linkerd.io/skip-subnets skips only inbound traffic

Open
#10,726 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement help wanted
Dominant language
Go
Stars
11.5k
Forks
1.4k
Avg merge
3d 22h
Merged PRs (30d)
53

Description

### What is the issue?

config.linkerd.io/skip-subnets is only skipping inbound traffic for the subnet, and not exempting outbound traffic.

The documentation says `Comma-separated list of subnets in valid CIDR format that should be skipped by the proxy`. The documentation does not mention inbound only.

### How can it be reproduced?

Add linked-proxy as a sidecar
Add config.linkerd.io/skip-subnets annotation to the k8s app deployment.
Check the iptables in the linkerd-init container

### Logs, error output, etc

```level=info msg="/sbin/iptables -t nat -A PROXY_INIT_REDIRECT -p all -j RETURN -s 192.168.0.0/16 -m comment --comment proxy-init/ignore-subnet-192.168.0.0/16/1681151363"```

### output of `linkerd check -o short`

Status check results are √

### Environment

Kubernetes 1.25.4
AKS
Host OS: Mariner
Linkerd version: stable-2.12.3

### Possible solution

Given how `skip-inbound-ports` and `skip-outbound-ports` are named, we assumed that inbound and outbound traffic would be skipped for the subnets as no direction was implied in the naming or documentation. It seems for consistency with the other properties, this should be named `skip-inbound-subnets` with a corresponding `skip-outbound-subnets`.

Alternatively, if the intent was to skip both directions, then we should add an additional iptables rule to skip outbound traffic.

### Additional context

https://github.com/linkerd/linkerd2-proxy-init/blob/a18218e878664829d7a4a86905d80a5c45c09a32/internal/iptables/iptables.go#L302

### Would you like to work on fixing this bug?

yes

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with internal/iptables/iptables.go around the referenced line and reproduce the deployment with config.linkerd.io/skip-subnets, then inspect the iptables rules in the linkerd-init container. Compare the observed inbound and outbound behavior with the annotation documentation and naming of the other skip options; done means the intended subnet exemption and corresponding rules are clearly established and verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.