This message was deleted.
# elementala
adamant-kite-43734
03/01/2024, 12:37 PMThis message was deleted.
b
bland-account-99790
03/01/2024, 2:14 PMwhat do you mean by firewall rules?
bland-account-99790
03/01/2024, 2:23 PMIf you mean firewalld rules, in rke2 we recommend disabling firewalld because of conflicts and unexpected behaviour: https://docs.rke2.io/known_issues#firewalld-conflicts-with-default-networking
b
bland-book-71921
03/01/2024, 2:36 PMI’m talking about the netfilter rules that calico provisions (iptables)
bland-book-71921
03/01/2024, 2:37 PMon the host node itself (harvester node)
b
bland-account-99790
03/01/2024, 2:41 PMCalico uses iptables to enforce network policies. These are used to restrict traffic within the cluster
b
bland-book-71921
03/01/2024, 2:43 PMCorrect. I see that when listing the iptables rules on the harvester/rancher node. I also see that if I manually use iptables and insert rules at the top, calico will eventually (quite quickly) move its own calico-INPUT rule to the top.
b
bland-account-99790
03/01/2024, 2:43 PMYes, Calico is in full control of the iptables
b
bland-book-71921
03/01/2024, 2:44 PMaye. So how would I add my own custom netfilter rules through calico that persist across harvester/rancher node boot?
b
bland-account-99790
03/01/2024, 2:47 PMIf there are no calico rules in the chain, then Calico should not touch them. If there are, depending on what you want to add, you can use calico GlobalNetworkPolicy which allows to create policies for nodes: https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts
bland-account-99790
03/01/2024, 2:48 PMAnd there is another option, which is telling Calico to not touch iptables, but of course this can be a bit dangerous because if you touch something that breaks Calico's iptable rules, Calico won't be able to recover automatically
bland-account-99790
03/01/2024, 2:50 PMIf I remember correctly, to tell Calico to not update iptables you must set
iptablesRefreshInterval=0bland-account-99790
03/01/2024, 2:50 PMThere are several
iptables👀 1
b
bland-book-71921
03/01/2024, 2:52 PMThanks! I’d like to have it continue to manage it OR harvester will break. So, I need to go down the path of doing it properly.
1. Once I can do so.
2. I need to make this persistent across harvester/elemental node reboots.
3. Then I need to apply it to the harvester install.yaml so that it provisions on cluster creation
👍 1
b
bland-account-99790
03/01/2024, 2:57 PMI see, good luck Kristian! ;)
b
bland-book-71921
03/01/2024, 3:03 PM🙏
5 Views