Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: enable INET_DIAG #1029

Merged
merged 1 commit into from
Sep 17, 2024
Merged

feat: enable INET_DIAG #1029

merged 1 commit into from
Sep 17, 2024

Commits on Sep 17, 2024

  1. feat: enable INET_DIAG 

    Fixes: siderolabs#1028

INET_DIAG_DESTROY is used by CNIs such as Cilium to terminate
connections in other containers. KSPP recommends to disable it due to
"Prior to v4.1, assists heap memory attacks; best to keep interface
disabled.".

Linux 4.1 was almost 10 years ago and Cilium with their eBPF-based
kube-proxy replacement is widely used by the community and not having
this enabled leads to weird networking issues (e.g. when coredns pods
get a different IP due deployment restarts UDP dns clients keep sending
connections to the old IP)

Signed-off-by: Ströger Florian <[email protected]>
Signed-off-by: Noel Georgi <[email protected]>
    @Preisschild @frezbo
    Preisschild authored and frezbo committed Sep 17, 2024
    Configuration menu
    Copy the full SHA
    79a4f92 View commit details
    Browse the repository at this point in the history