You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
proxy-init/README.md: update enforce-redirect to describe in-cluster TCP capture (only in-cluster DNS-over-TCP + non-TCP/UDP left direct via CLUSTER_CIDRS), the AuthBridge->ztunnel composition for re-originated egress, and correct the now-wrong 'add it to CLUSTER_CIDRS to bypass' guidance (CLUSTER_CIDRS is DNS-only, not a TCP bypass).
CLAUDE.md + authbridge/CLAUDE.md: proxy-init/init-iptables.sh is no longer 'envoy-sidecar mode only' — enforce-redirect is the proxy-sidecar egress guard. PR Title Convention: the CI check (action-pr-title) is case-sensitive and requires a capitalized prefix (Fix:/Feat:/Docs:), distinct from the lowercase commit-message examples.
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>
|`authbridge-lite`|`authbridge/cmd/authbridge-lite/Dockerfile`| proxy-sidecar lite combined image: authbridge-lite (auth gates only, parsers dropped) + spiffe-helper. Same listener layout as `authbridge`; not yet referenced by the operator's default config |
@@ -48,39 +48,50 @@ nat-table target but the nat table forbids `DROP` (`iptables` errors with
48
48
49
49
-**`nat` OUTPUT / `AB_REDIRECT`** (position 1): `RETURN` ztunnel mark
50
50
`0x539`, the proxy UID (`--uid-owner $PROXY_UID`, avoids the loop),
51
-
loopback, and `CLUSTER_CIDRS`; then `REDIRECT` external **TCP** to
52
-
`TRANSPARENT_PORT`.
51
+
loopback, and in-cluster **DNS-over-TCP** (`-p tcp --dport 53` to
52
+
`CLUSTER_CIDRS`, so cluster name resolution stays direct); then
53
+
`REDIRECT` all remaining **TCP** — external **and** in-cluster — to
54
+
`TRANSPARENT_PORT`, so agent→in-cluster calls (e.g. agent→tool) are
55
+
captured by the egress pipeline too.
53
56
-**`mangle` OUTPUT / `AB_NOTCP`** (position 1): the same exemptions
54
57
(plus `ESTABLISHED,RELATED` first, so UDP conntrack replies like DNS
55
-
pass), then `-p tcp -j RETURN` (TCP is handled by the nat REDIRECT) and
56
-
a terminal `DROP` for external **non-TCP** (UDP/QUIC), so HTTP/3 cannot
57
-
bypass — well-behaved clients fall back to TCP and get captured.
58
+
pass), **including the full `CLUSTER_CIDRS``RETURN`** so in-cluster
59
+
non-TCP (DNS-over-UDP and any other in-cluster UDP) stays direct; then
60
+
`-p tcp -j RETURN` (TCP is handled by the nat REDIRECT) and a terminal
61
+
`DROP` for external **non-TCP** (UDP/QUIC), so HTTP/3 cannot bypass —
62
+
well-behaved clients fall back to TCP and get captured.
58
63
59
64
Because the OUTPUT hook order is `raw → mangle → nat → filter`, the
60
65
mangle chain drops non-TCP on its original destination while TCP falls
61
66
through to the nat REDIRECT. Both chains are inserted at position 1,
62
-
ahead of Istio's appended (`-A`) chains, so they preempt ambient's nat
63
-
redirect for external destinations — exactly as `redirect` mode does for
64
-
the Envoy path. IPv6 mirrors apply the same rules. See
67
+
ahead of Istio's appended (`-A`) chains. The proxy's own re-originated
68
+
egress (`--uid-owner $PROXY_UID`, `RETURN`ed) falls through to
69
+
`ISTIO_OUTPUT` → ztunnel for transport mTLS under Istio ambient, and goes
70
+
out plain without a mesh — so capturing in-cluster TCP **composes with**
71
+
the mesh (AuthBridge does L7, ztunnel does transport) rather than
72
+
bypassing it. IPv6 mirrors apply the same rules. See
65
73
[`test-enforce-redirect.sh`](./test-enforce-redirect.sh), which proves
66
74
the capture, the preemption, and the non-TCP drop via packet counters.
67
75
68
-
> **`CLUSTER_CIDRS` is Kind-shaped by default.** The `10.0.0.0/8` default
69
-
> covers Kind (pods `10.244.0.0/16` + services `10.96.0.0/16`). Other
70
-
> distros differ — **OpenShift** uses services `172.30.0.0/16` and pods
71
-
> `10.128.0.0/14`, and `172.30.0.0/16` is **outside**`10/8`, so the
72
-
> default would drop in-cluster service traffic. On OCP/EKS/etc. you
73
-
> **must** override `CLUSTER_CIDRS` with the cluster's real pod+service
74
-
> ranges. The script logs the resolved value at startup, and the
75
-
> operator sets it from the cluster's CIDRs.
76
+
> **`CLUSTER_CIDRS` is Kind-shaped by default.** It now governs only what
77
+
> stays **direct**: in-cluster DNS-over-TCP (`tcp/53`) and in-cluster
78
+
> non-TCP (so cluster DNS keeps working). The `10.0.0.0/8` default covers
79
+
> Kind (pods `10.244.0.0/16` + services `10.96.0.0/16`). Other distros
80
+
> differ — **OpenShift** uses services `172.30.0.0/16` and pods
81
+
> `10.128.0.0/14`, and `172.30.0.0/16` is **outside**`10/8`, so with the
82
+
> default, cluster DNS (CoreDNS on `172.30.x`) is no longer left direct and
83
+
> **resolution breaks**. On OCP/EKS/etc. you **must** override
84
+
> `CLUSTER_CIDRS` with the cluster's real pod+service ranges. The script
85
+
> logs the resolved value at startup, and the operator sets it from the
86
+
> cluster's CIDRs.
76
87
77
88
> **`enforce-redirect` intentionally ignores `OUTBOUND_PORTS_EXCLUDE`** (a
78
89
> `redirect`-mode knob). Any destination previously bypassed that way —
79
90
> e.g. a direct LLM endpoint at `host.docker.internal:11434` — is now
80
-
> captured (external TCP) or dropped (external non-TCP) unless it falls
81
-
> within `CLUSTER_CIDRS`. That is the point: `enforce-redirect` closes
82
-
> direct-egress holes. Operators relying on a bypass for an in-cluster
83
-
> target must include it in `CLUSTER_CIDRS`.
91
+
> captured (external TCP) or dropped (external non-TCP). In-cluster TCP is
92
+
> captured as well (only in-cluster DNS stays direct), so `CLUSTER_CIDRS`
93
+
> is **not** a TCP bypass — it only keeps cluster DNS and in-cluster UDP
94
+
> direct. That is the point: `enforce-redirect` closes direct-egress holes.
84
95
85
96
## iptables backend
86
97
@@ -100,7 +111,7 @@ whichever the host kernel exposes. Override with `IPTABLES_CMD` (and
100
111
|`OUTBOUND_PORTS_EXCLUDE`| (empty) | redirect | Comma-separated outbound port list to skip (e.g. `8080`) |
101
112
|`INBOUND_PORTS_EXCLUDE`| (empty) | redirect | Comma-separated inbound port list to skip |
102
113
|`POD_IP`| (required in `redirect`) | redirect | Set via Downward API; DNAT target for ambient-mesh inbound. Not used by `enforce-redirect`. |
103
-
|`CLUSTER_CIDRS`|`10.0.0.0/8`| enforce-redirect | Comma-separated in-cluster CIDRs allowed direct (pods/services/DNS)|
114
+
|`CLUSTER_CIDRS`|`10.0.0.0/8`| enforce-redirect | Comma-separated in-cluster CIDRs kept direct **for DNS only**: DNS-over-TCP (`tcp/53`) + all in-cluster non-TCP (UDP). Other in-cluster TCP is captured.|
0 commit comments