This repository was archived by the owner on Aug 10, 2026. It is now read-only.
Enable Kubernetes CNI, Service load balancing and NetworkPolicy kernel facilities - #29
Merged
gm-e2b merged 9 commits intoJul 28, 2026
Merged
Enable Kubernetes CNI, Service load balancing and NetworkPolicy kernel facilities#29gm-e2b merged 9 commits into
gm-e2b merged 9 commits into
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Allows kube-proxy in iptables mode and other networking tools to use
probabilistic packet matching for load balancing across multiple
endpoints. e.g. `iptables -m statistic ...`
Sets CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
On arm64, enable two Xtables options needed, already set on x86_64
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
Signed-off-by: Christian Kruse <christian@c-kruse.com>
Allows kube-proxy in nftables mode and other networking tools to use
random number generation for endpoint selection and forwarding
information base lookups for local-address dispatch. e.g. `nft add
rule ... numgen random mod 1 map { ... }`, `nft add rule ... fib
daddr type local`
Sets CONFIG_NFT_NUMGEN=y
Sets CONFIG_NFT_FIB_IPV4=y (selects CONFIG_NFT_FIB=y)
Sets CONFIG_NFT_FIB_IPV6=y
Signed-off-by: Christian Kruse <christian@c-kruse.com>
Allows kindnetd using the kube-network-policies reference implementation, firewalls, and other networking tools to enforce policy via first-packet NFQUEUE inspection with conntrack label caching. e.g. `nft add table inet ...`, `nft add rule ... queue num 101 bypass`, `ct label set 28` Sets CONFIG_NF_TABLES_INET=y Sets CONFIG_NETFILTER_NETLINK_QUEUE=y Sets CONFIG_NETFILTER_NETLINK_GLUE_CT=y Sets CONFIG_NF_CT_NETLINK=y Signed-off-by: Christian Kruse <christian@c-kruse.com>
Allows kube-proxy in iptables mode and other networking tools to implement session affinity, rate limiting and throttling with xtables recency rules. Sets CONFIG_NETFILTER_XT_MATCH_RECENT=y Signed-off-by: Christian Kruse <christian@c-kruse.com>
- DUMMY, VXLAN, GENEVE: flannel vxlan backend, Docker overlay networks, Cilium tunnels, dummy devices (NodeLocal DNS, kube-vip, IPVS) - IP_SET + set types, NETFILTER_XT_SET, rpfilter matches: Calico iptables dataplane, kube-router - NETFILTER_XT_TARGET_NFQUEUE: iptables-based NetworkPolicy engines - NET_SCH_INGRESS, NET_ACT_MIRRED: tc clsact hook for eBPF dataplanes - SCHEDSTATS, CRYPTO_USER_API_HASH: Cilium base requirements
Same CNI set as x86_64, plus arm64-only gaps: - NETFILTER_XT_MARK: emitted by kube-proxy iptables mode - nf_tables subsystem and conntrack/queue netlink: x86_64 parity, required by iptables-nft userspace and kube-proxy nftables mode
k3s's embedded network policy controller (kube-router) programs '-m physdev --physdev-is-bridged' rules for traffic crossing the CNI bridge. Without the match, iptables-restore fails with 'Extension physdev revision 0 not supported' and NetworkPolicy silently does not enforce.
gm-e2b
force-pushed
the
kube-networking-cni
branch
from
6b56773 to
379c044
Compare
July 28, 2026 10:29
kube-router's per-policy chains end with rate-limited logging of
denied traffic ('-m limit ... -j NFLOG') before REJECT. Without
xt_limit the whole iptables-restore aborts (exit status 4) and no
pod firewall rules are programmed, so NetworkPolicy does not enforce
even with xt_physdev present.
- NETFILTER_XT_TARGET_CT: Calico felix programs NOTRACK/CT rules in the
raw table; without the target its iptables-restore fails
('Extension CT revision 0 not supported') and calico-node never
reports Ready
- MACVLAN, IPVLAN, VLAN_8021Q: secondary pod networks (Multus) and
Docker macvlan/ipvlan network drivers
Copy link
Copy Markdown
Contributor
Author
|
Validation results for this branch (amd64 build of 56bcb8d, dev cluster, stock k3s v1.36.2+k3s1 template with flannel default vxlan backend — no host-gw workaround):
The three follow-up commits (xt_physdev, xt_limit+NFLOG, xt_CT+macvlan/ipvlan/vlan) each came out of this loop: one unsupported extension aborts an entire iptables-restore, so kube-router programmed zero pod-firewall rules and Calico's felix never reported Ready until these were added. Cilium remains blocked regardless of this PR: cilium-agent hard-fails at startup with Require support for the eBPF JIT (CONFIG_BPF_JIT=y), and BPF_JIT (like KPROBES) has a Kconfig hard dependency on MODULES on 6.1 — relaxed upstream only in 6.8+/6.12+. |
Sorry, something went wrong.
gm-e2b
marked this pull request as ready for review
July 28, 2026 14:22
tomassrnka
approved these changes
Jul 28, 2026
tomassrnka
left a comment
Copy link
Copy Markdown
Member
There was a problem hiding this comment.
lgtm based on slack conv
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Reviewers
1 more reviewer3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Includes the commits from #28 (thanks @c-kruse!); its four commits are unchanged.
Why
A customer reported that the e2b/k3s docs page doesn't work because the sandbox kernel lacks xt_statistic. Reproduced on the production e2b/k3s template: a Service with two ready endpoints sends all in-cluster traffic to one pod — kube-proxy cannot program random endpoint selection in either iptables or nftables mode. A capability audit found the same class of gap across CNIs, NetworkPolicy engines, and tunneling.
What this adds on top of #28
CONFIG_MODULES stays off everywhere: no runtime module loading in the guest, capabilities are added one by one as built-ins. (Consequence on 6.1: BPF_JIT and KPROBES cannot be enabled — Kconfig hard dependency on MODULES, relaxed upstream only in 6.8+/6.12+.)