Named ports in initContainer sidecars do not work with NetworkPolicies about kubernetes HOT 10 OPEN

CNI: Calico v3.27.3

Assuming Calico is your implementation of network policies you should open the bug in that project, as Kubernetes only defines the APIs ...

however, it will be helpful to add an e2e test to get coverage so the implementations can validate this behavior

/help
/sig network

from kubernetes.

Created an issue with Calico: projectcalico/calico#8881

from kubernetes.

Not sure if related but I'm seeing strange results with kubectl port-forward and named ports for native sidecar containers as well.

Example:

kubectl port-forward svc/adguard-metrics metrics (named port on service)
error: Pod 'adguard-primary-7cc5d498f4-67zs4' does not have a named port 'metrics'

kubectl port-forward adguard-primary-7cc5d498f4-67zs4 metrics (named port on native sidecar)
error: Pod 'adguard-primary-7cc5d498f4-67zs4' does not have a named port 'metrics'

Prometheus also does not seem to be able to discover the endpoints for the native sidecar so metric scraping is also not working for me in this case.

Probes on this pod are able to use the named container port.

Reference:

• https://github.com/broersma-forslund/homelab/blob/7f2062102b8821106da64d425a83458113ac1ef7/apps/adguard/templates/primary/deployment.yaml#L39-L54
• https://github.com/broersma-forslund/homelab/blob/7f2062102b8821106da64d425a83458113ac1ef7/apps/adguard/templates/primary/metrics-service.yaml#L13-L15

@rouke-broersma please open a new issue, port-forward is a different subsystem that depend on sig-cli, please tag me there as well

from kubernetes.

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

from kubernetes.

/sig network

from kubernetes.

/assign

from kubernetes.

@aojea:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

from kubernetes.

Created an issue with Calico: projectcalico/calico#8881

Thanks! I'll give it a try implementing it in Calico and will follow up with the e2e test here.

from kubernetes.

Do we know if Cilium and others handle this? It's a fun aspect that probably was not broadcasted well.

from kubernetes.

Not sure if related but I'm seeing strange results with kubectl port-forward and named ports for native sidecar containers as well.

Example:

kubectl port-forward svc/adguard-metrics metrics (named port on service)
error: Pod 'adguard-primary-7cc5d498f4-67zs4' does not have a named port 'metrics'

kubectl port-forward adguard-primary-7cc5d498f4-67zs4 metrics (named port on native sidecar)
error: Pod 'adguard-primary-7cc5d498f4-67zs4' does not have a named port 'metrics'

Prometheus also does not seem to be able to discover the endpoints for the native sidecar so metric scraping is also not working for me in this case.

Probes on this pod are able to use the named container port.

Reference:

• https://github.com/broersma-forslund/homelab/blob/7f2062102b8821106da64d425a83458113ac1ef7/apps/adguard/templates/primary/deployment.yaml#L39-L54
• https://github.com/broersma-forslund/homelab/blob/7f2062102b8821106da64d425a83458113ac1ef7/apps/adguard/templates/primary/metrics-service.yaml#L13-L15

from kubernetes.