Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CoreDNS stops working when activating Hubble #1630

Open
bashilias opened this issue Dec 10, 2024 · 0 comments
Open

CoreDNS stops working when activating Hubble #1630

bashilias opened this issue Dec 10, 2024 · 0 comments

Comments

@bashilias
Copy link

Hi, I'm not sure if this is the right repository to create this issue in, however I would like to explain my current situation.
I have a RKE2 downstream running and I'm using Cilium as CNI. Cilium config has been deployed using a HelmChartConfig, all policies are being enforced and it's working fine.

However, the moment I active Hubble by changing policyAuditMode to 'true', all outgoing traffic are being 'dropped'. Every query in the CoreDNS pods are failed. I wil get a timeout. I also tried to activarte Hubble by opening port 4244 on all nodes for Hubble.

The strange thing is that with both methods Hubble works. The hubble pods and services are being deployed and I can access the Hubble UI. However all outgoing connections within the cluster seems to be 'dropped', every query in CoreDNS gets a timeout.

Anybody has any ideas? Is this a bug or a feature, can Hubble be used while policies are being enforced in the first place?

Method 1 to activate Hubble (helmchartconfig):

policyEnforcementMode: always
    policyAuditMode: TRUE
    hostFirewall:
      enabled: true
    image:
      pullPolicy: IfNotPresent
    ipam:
      mode: kubernetes
    hubble:
      enabled: true
      relay:
        enabled: true
      ui:
        enabled: true

Method 2 to active Hubble (CCNP on all nodes):

 - fromEndpoints:
    - matchLabels:
        k8s-app: hubble-relay
    toPorts:
    - ports:
      - port: "4244"
        protocol: "TCP"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant