Egress: explicit TCP rules for named in-cluster services (databases, brokers)

Abierto
  • ¿Algo no está bien?
#3,243 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, kubernetes
Área
backend, networking

Línea de trabajo

Start with docs/egress-traffic.md and trace the actor TCP egress path through the Envoy dataplane and egress gateway. Identify where hostname and port rules are configured and how destinations are resolved; the issue proposes forwarding raw TCP bytes and limiting destinations to Service IPs or an operator CIDR allowlist. Done means explicit rules support named TCP destinations and ports without inspecting the connection.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

area/api area/network kind/feature

Use case

We run test workloads as actors. The tests need backing services such as PostgreSQL and a Kafka-compatible broker. docs/egress-traffic.md asks for an issue with the use case for blocked egress traffic, so here it is.

Today actor TCP egress is redirected to atunnel. The egress gateway supports HTTP/1.1, h2c, intercepted HTTPS and TLS passthrough. Any other TCP connection is accepted and then closed with no bytes. A PostgreSQL SSLRequest sent to a cluster Service through the gateway gets an HTTP 400 back.

So these services must run as extra containers inside the actor. Then all containers share one loopback, and ports collide between the services and the code under test. We hit this with two services that both bind the same admin port.

Request

An explicit TCP rule, for example:

rules:
- tcp:
    hostnames: [postgres.my-namespace.svc.cluster.local]
    ports: {numbers: [5432]}
  • The gateway forwards the bytes without inspecting them. It decides once per connection, on the resolved name and port, so server-first protocols (PostgreSQL, MySQL, SSH) work.
  • An operator can limit these rules to destinations that resolve to cluster Service IPs, or to a configured CIDR allowlist.

This differs from #1341: it does not sniff and does not pass unknown traffic through. A port carries TCP only when a rule names that port.

Tested on v0.6.0, Envoy dataplane, GKE 1.36.

Lenguaje dominante
Go
Estrellas
5.9k
Forks
637
Merge medio
2 d 1 h
PR fusionados (30 d)
523

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de agent-substrate/substrate

Todos los issues de agent-substrate/substrate

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.