Skip to content

Conversation

@Camelron
Copy link

@Camelron Camelron commented Mar 14, 2025

Merge Checklist
Summary

Introduce rules for UpdateInterfaceRequest and UpdateRoutesRequest and genpolicy tests for them.

goal is to:

  • have strong promises about loopback traffic; local traffic has no tls
  • prevent loopback traffic from being routed to network devices controlled by the hypervisor
  • prevent hypervisor network devices from spoofing loopback
Test Methodology

Upstream review and CI

Introduce rule to block routes from source addresses which are the
loopback. Block routes added to the lo device.

Signed-off-by: Cameron Baird <[email protected]>
@Camelron Camelron requested review from a team as code owners March 14, 2025 00:20
@Camelron Camelron added the upstream/merged PRs that have been merged upstream label Mar 14, 2025
@Camelron Camelron force-pushed the cameronbaird/backport-network-policy branch from c22dab1 to 7c3933c Compare March 14, 2025 15:55
@Camelron
Copy link
Author

Amended commit with updated policy samples.

@Redent0r
Copy link

Could we update the samples on a separate commit? eg https://github.com/microsoft/kata-containers/pull/327/commits

@Camelron Camelron force-pushed the cameronbaird/backport-network-policy branch from 7c3933c to 6a274be Compare March 14, 2025 16:57
@Camelron
Copy link
Author

Split sample policy changes into own commit

Introduce rules for UpdateInterfaceRequest and genpolicy tests for them.

Signed-off-by: Cameron Baird <[email protected]>
Update samples

Signed-off-by: Cameron Baird <[email protected]>
@Camelron Camelron force-pushed the cameronbaird/backport-network-policy branch from 6a274be to 1e703f8 Compare March 14, 2025 17:13
@Redent0r Redent0r merged commit b648d32 into msft-main Mar 14, 2025
45 of 55 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

upstream/merged PRs that have been merged upstream

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants