Repository navigation
Conversation
#652 で外した防火壁(#646 の 5 つの文書・render.sh の needle・boot CI の検査)を戻す。 Pod からノード自身の IP の 443 番が conntrack の invalid で捨てられる件を CI で再現して 直すため、Pod から Gateway に届くかの検査を足す(このコミットでは落ちる想定)。 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T9PbUfqG4pPxus99UeLiJs
Envoy から Pod への帰りは Cilium が raw の OUTPUT で NOTRACK にするので、conntrack には 行きの SYN だけが残り、Pod の次の ACK とデータが invalid になって Talos の防火壁に捨てられる。 行きも NOTRACK にして往復を揃える。bootstrap 層(inline)に置き、boot CI で確かめる。 イメージは Cilium の agent(iptables 入り)で、Renovate で chart と同じ組にする。 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T9PbUfqG4pPxus99UeLiJs
Collaborator
Author
|
#658(Cilium の Host Firewall)にしたので閉じる。Talos の防火壁は invalid を捨てる規則を外せず、NOTRACK の DaemonSet が要る分こちらより複雑。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
作業中。#646 の受信の防火壁を戻し、#652 で外す原因になった「Pod からノード自身の IP の 443 番(Gateway)が conntrack の invalid で捨てられる」を直す。
実機には当てていない。
🤖 Generated with Claude Code
https://claude.ai/code/session_01T9PbUfqG4pPxus99UeLiJs