Enable Kubernetes CNI, Service load balancing and NetworkPolicy kernel facilities - #29
Merged
Conversation
Allows kube-proxy in iptables mode and other networking tools to use
probabilistic packet matching for load balancing across multiple
endpoints. e.g. `iptables -m statistic ...`
Sets CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
On arm64, enable two Xtables options needed, already set on x86_64
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
Signed-off-by: Christian Kruse <christian@c-kruse.com>
Allows kube-proxy in nftables mode and other networking tools to use
random number generation for endpoint selection and forwarding
information base lookups for local-address dispatch. e.g. `nft add
rule ... numgen random mod 1 map { ... }`, `nft add rule ... fib
daddr type local`
Sets CONFIG_NFT_NUMGEN=y
Sets CONFIG_NFT_FIB_IPV4=y (selects CONFIG_NFT_FIB=y)
Sets CONFIG_NFT_FIB_IPV6=y
Signed-off-by: Christian Kruse <christian@c-kruse.com>
Allows kindnetd using the kube-network-policies reference implementation, firewalls, and other networking tools to enforce policy via first-packet NFQUEUE inspection with conntrack label caching. e.g. `nft add table inet ...`, `nft add rule ... queue num 101 bypass`, `ct label set 28` Sets CONFIG_NF_TABLES_INET=y Sets CONFIG_NETFILTER_NETLINK_QUEUE=y Sets CONFIG_NETFILTER_NETLINK_GLUE_CT=y Sets CONFIG_NF_CT_NETLINK=y Signed-off-by: Christian Kruse <christian@c-kruse.com>
Allows kube-proxy in iptables mode and other networking tools to implement session affinity, rate limiting and throttling with xtables recency rules. Sets CONFIG_NETFILTER_XT_MATCH_RECENT=y Signed-off-by: Christian Kruse <christian@c-kruse.com>
- DUMMY, VXLAN, GENEVE: flannel vxlan backend, Docker overlay networks, Cilium tunnels, dummy devices (NodeLocal DNS, kube-vip, IPVS) - IP_SET + set types, NETFILTER_XT_SET, rpfilter matches: Calico iptables dataplane, kube-router - NETFILTER_XT_TARGET_NFQUEUE: iptables-based NetworkPolicy engines - NET_SCH_INGRESS, NET_ACT_MIRRED: tc clsact hook for eBPF dataplanes - SCHEDSTATS, CRYPTO_USER_API_HASH: Cilium base requirements
Same CNI set as x86_64, plus arm64-only gaps: - NETFILTER_XT_MARK: emitted by kube-proxy iptables mode - nf_tables subsystem and conntrack/queue netlink: x86_64 parity, required by iptables-nft userspace and kube-proxy nftables mode
k3s's embedded network policy controller (kube-router) programs '-m physdev --physdev-is-bridged' rules for traffic crossing the CNI bridge. Without the match, iptables-restore fails with 'Extension physdev revision 0 not supported' and NetworkPolicy silently does not enforce.
gm-e2b
force-pushed
the
kube-networking-cni
branch
from
July 28, 2026 10:29
6b56773 to
379c044
Compare
kube-router's per-policy chains end with rate-limited logging of
denied traffic ('-m limit ... -j NFLOG') before REJECT. Without
xt_limit the whole iptables-restore aborts (exit status 4) and no
pod firewall rules are programmed, so NetworkPolicy does not enforce
even with xt_physdev present.
- NETFILTER_XT_TARGET_CT: Calico felix programs NOTRACK/CT rules in the
raw table; without the target its iptables-restore fails
('Extension CT revision 0 not supported') and calico-node never
reports Ready
- MACVLAN, IPVLAN, VLAN_8021Q: secondary pod networks (Multus) and
Docker macvlan/ipvlan network drivers
Contributor
Author
|
Validation results for this branch (amd64 build of
The three follow-up commits ( Cilium remains blocked regardless of this PR: cilium-agent hard-fails at startup with |
gm-e2b
marked this pull request as ready for review
July 28, 2026 14:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Includes the commits from #28 (thanks @c-kruse!); its four commits are unchanged.
Why
A customer reported that the
e2b/k3sdocs page doesn't work because the sandbox kernel lacksxt_statistic. Reproduced on the productione2b/k3stemplate: a Service with two ready endpoints sends all in-cluster traffic to one pod — kube-proxy cannot program random endpoint selection in either iptables or nftables mode. A capability audit found the same class of gap across CNIs, NetworkPolicy engines, and tunneling.What this adds on top of #28
DUMMY,VXLAN,GENEVE(flannel's default vxlan backend, Docker overlay, Cilium tunnels, dummy devices);IP_SET+ set types +NETFILTER_XT_SET+ rpfilter matches (Calico, kube-router);NETFILTER_XT_TARGET_NFQUEUE;NET_SCH_INGRESS+NET_ACT_MIRRED(tcclsactfor eBPF dataplanes);SCHEDSTATS,CRYPTO_USER_API_HASH(Cilium).NETFILTER_XT_MARK(emitted by kube-proxy iptables mode) and thenf_tablessubsystem — closing the arm64-vs-x86_64 delta Add kube networking facilities #28 flagged as an open question.xt_physdev: k3s's embedded NetworkPolicy controller (kube-router) programs-m physdev --physdev-is-bridgedrules; without the match,iptables-restorefails and every NetworkPolicy silently does not enforce.CONFIG_MODULESstays off everywhere: no runtime module loading in the guest, capabilities are added one by one as built-ins. (Consequence on 6.1:BPF_JITandKPROBEScannot be enabled — Kconfig hard dependency onMODULES, relaxed upstream only in 6.8+/6.12+.)