cilium: Can't ping services via kubeproxyreplacement
Bug report
The expected behavior is that kubeproxyreplacement either responds or forwards icmp to the destination pod. With kube-proxy, icmp works as expected and we can ping service IPs.
General Information
- Cilium version (run
cilium version) 1.9.0
We’re running cilium w/ maglev + dsr.
How to reproduce the issue
- Attempt to ping the service IP and see a hoplimit exceeded error from ICMP
- Run a traceroute to the service IP
- Observe ICMP packets loop between routers and workers running kubeproxyreplacement
About this issue
- Original URL
- State: open
- Created 4 years ago
- Reactions: 1
- Comments: 32 (21 by maintainers)
IMO icmp should be dropped until the service spec supports defining icmp and it’s been explicitly set/enabled on the service.
Is metallb strictly necessary? Can’t we just detect it’s a LB ip and base the logic on that?
As for the end result I agree that dropping the packet seems the appropriate thing to do (and would love to see this implemented)!
I believe nobody has made any progress on this. I think the proper fix would be to make the LB to answer to the ICMP echo requests instead of forwarding to stack. If you are wiling to work on this, let us know to discuss details (you can also reach us at
#sig-datapathin the Cilium slack).What are we thinking of doing with this?
@gpl can you provide a pcap for the ICMP’s working with kube-proxy captured in the host with
tcpdump -i any icmp -w icmp.pcap? Thank you