Cilium
Hard
Networking
Why do Cilium L2-announced Services with externalTrafficPolicy: Local sometimes drop traffic?
Select your answer:
Show answer and explanation
Answer: The IP may be announced by a node with no local backend pod
Explanation
L2 announcements doesn't take externalTrafficPolicy into account, so the Lease can go to any node the policy selects. With Local, that node must not forward to pods on other nodes, so it drops the traffic when it has no backend. The Cilium docs recommend externalTrafficPolicy: Cluster for announced Services.
More hard Cilium questions
- What is the purpose of Cilium's egress gateway feature?
- What is the purpose of Cilium's 'prefilter' feature?
- In Cilium's tunnel mode (VXLAN or Geneve), how does the receiving node learn the security identity of a packet sent by a pod on another node?
- A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?
- How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?
- With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?