An optional feature to filter out the packets coming into the system by destination IP.
This is incompatible with native pod IP routing (e.g. BGP), so it should be optional.
For CNIs with encapsulation, the following should hold: any packet arriving from the external interface (to be specified by the user) should have a destination of one of the host addresses.
A proposed machine config rule (draft):
apiVersion: v1alpha1
kind: InputFilterConfig (?)
name: enp0s2 # name of the external link
addresses: # if not specified, defaults to host addresses, otherwise an explicit rule is used
- 10.0.0.0/24
The rule should be injected into the prerouting chain of nftables, before any processing happens.
An optional feature to filter out the packets coming into the system by destination IP.
This is incompatible with native pod IP routing (e.g. BGP), so it should be optional.
For CNIs with encapsulation, the following should hold: any packet arriving from the external interface (to be specified by the user) should have a destination of one of the host addresses.
A proposed machine config rule (draft):
The rule should be injected into the prerouting chain of nftables, before any processing happens.