Cilium v.1.15 host firewall ignores virtual IPs on the localhost (lo) interface about cilium HOT 4 OPEN

Any update on this? Curious whether this is expected behavior or not.

from cilium.

This could be related to #33234. The fix for that has been merged and will be in the next v1.15 release. The loopback interface is usually ignored unless it's explicitly listed with "devices" option though, so that might also be needed in addition to this. In addition to the "cilium-dbg ip list" command you can also see addresses that Cilium considers as the node's addresses can also be inspected with "cilium-dbg statedb node-addresses".

from cilium.

I don't see a release note in the upgrade guide here, so I'm not sure whether this was intentional:
https://docs.cilium.io/en/v1.15/operations/upgrade/#upgrade-notes

from cilium.

Thanks, looking forward to trying the next release to see if it fixes this issue.
In our case we do not have enable-runtime-device-detection but from what I can tell this is related to the fix in the second commit.
We've never had to explicitly list lo under devices (and it works fine in 1.14) but maybe that's a change in 1.15. Although I've tried adding lo to the devices list in v1.15.6 and it didn't make a difference.

from cilium.