Linux Socket Diag Subsystem #1028
Comments
|
seems to be a regression, probably enabling/disabling some config changed this |
|
Ah I found out it was included in KSPP recommendations https://kspp.github.io/Recommended_Settings
Does it make sense to enable this again? Cilium is probably used by many talos users and this could lead to unexpected network issues and Talos is far ahead of 4.1 |
|
Found the commit that changed: f4335dc |
it could have been by the KSPP recommendations or moving from 5.6 to 6.6 kernel |
Preisschild
added a commit
to Preisschild/talos-pkgs
that referenced
this issue
Sep 17, 2024
Fixes: siderolabs#1028 INET_DIAG_DESTROY is used by CNIs such as Cilium to terminate connections in other containers. KSPP recommends to disable it due to "Prior to v4.1, assists heap memory attacks; best to keep interface disabled.". Linux 4.1 was almost 10 years ago and Cilium with their eBPF-based kube-proxy replacement is widely used by the community and not having this enabled leads to weird networking issues (e.g. when coredns pods get a different IP due deployment restarts UDP dns clients keep sending connections to the old IP) Signed-off-by: Ströger Florian <[email protected]>
Merged
Preisschild
added a commit
to Preisschild/talos-pkgs
that referenced
this issue
Sep 17, 2024
Fixes: siderolabs#1028 INET_DIAG_DESTROY is used by CNIs such as Cilium to terminate connections in other containers. KSPP recommends to disable it due to "Prior to v4.1, assists heap memory attacks; best to keep interface disabled.". Linux 4.1 was almost 10 years ago and Cilium with their eBPF-based kube-proxy replacement is widely used by the community and not having this enabled leads to weird networking issues (e.g. when coredns pods get a different IP due deployment restarts UDP dns clients keep sending connections to the old IP) Signed-off-by: Ströger Florian <[email protected]>
Preisschild
added a commit
to Preisschild/talos-pkgs
that referenced
this issue
Sep 17, 2024
Fixes: siderolabs#1028 INET_DIAG_DESTROY is used by CNIs such as Cilium to terminate connections in other containers. KSPP recommends to disable it due to "Prior to v4.1, assists heap memory attacks; best to keep interface disabled.". Linux 4.1 was almost 10 years ago and Cilium with their eBPF-based kube-proxy replacement is widely used by the community and not having this enabled leads to weird networking issues (e.g. when coredns pods get a different IP due deployment restarts UDP dns clients keep sending connections to the old IP) Signed-off-by: Ströger Florian <[email protected]>
frezbo
pushed a commit
to Preisschild/talos-pkgs
that referenced
this issue
Sep 17, 2024
Fixes: siderolabs#1028 INET_DIAG_DESTROY is used by CNIs such as Cilium to terminate connections in other containers. KSPP recommends to disable it due to "Prior to v4.1, assists heap memory attacks; best to keep interface disabled.". Linux 4.1 was almost 10 years ago and Cilium with their eBPF-based kube-proxy replacement is widely used by the community and not having this enabled leads to weird networking issues (e.g. when coredns pods get a different IP due deployment restarts UDP dns clients keep sending connections to the old IP) Signed-off-by: Ströger Florian <[email protected]> Signed-off-by: Noel Georgi <[email protected]>
smira
pushed a commit
to smira/pkgs
that referenced
this issue
Sep 20, 2024
Fixes: siderolabs#1028 INET_DIAG_DESTROY is used by CNIs such as Cilium to terminate connections in other containers. KSPP recommends to disable it due to "Prior to v4.1, assists heap memory attacks; best to keep interface disabled.". Linux 4.1 was almost 10 years ago and Cilium with their eBPF-based kube-proxy replacement is widely used by the community and not having this enabled leads to weird networking issues (e.g. when coredns pods get a different IP due deployment restarts UDP dns clients keep sending connections to the old IP) Signed-off-by: Ströger Florian <[email protected]> Signed-off-by: Noel Georgi <[email protected]> (cherry picked from commit 79a4f92)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I just run into a problem with Cilium because it could not properly delete sockets. In the Cilium documentation it mentions that it depends on some kernel features:
https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#limitations
I noticed that those properties were once enabled (Issue: siderolabs/talos#6429, Commit: 98ef073), but they are not anymore.
Is there a specific reason why this was disabled?
The text was updated successfully, but these errors were encountered: