Skip to content

Define hairpin traffic capability model for socket-layer load balancers - #405

Merged
kubernetes-prow[bot] merged 1 commit into
kubernetes-sigs:mainfrom
TheBeeZee:hairpin
Oct 6, 2026
Merged

Define hairpin traffic capability model for socket-layer load balancers#405
kubernetes-prow[bot] merged 1 commit into
kubernetes-sigs:mainfrom
TheBeeZee:hairpin

Conversation

@TheBeeZee

@TheBeeZee TheBeeZee commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR updates the ClusterNetworkPolicy overview documentation around service hairpin traffic. It explicitly exempts implementations using connect-time load balancing (e.g., eBPF socket LB) from enforcement. A new HairpinServicePolicyEnforcement feature is added to the conformance profile framework.

Refs #343

@kubernetes-prow kubernetes-prow Bot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Sep 14, 2026
@netlify

netlify Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Name Link
🔨 Latest commit d947734
🔍 Latest deploy log https://app.netlify.com/projects/kubernetes-sigs-network-policy-api/deploys/6ac513b00b268200088bc8b3
😎 Deploy Preview https://deploy-preview-405--kubernetes-sigs-network-policy-api.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@kubernetes-prow kubernetes-prow Bot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Sep 14, 2026
@kubernetes-prow

kubernetes-prow Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Hi @TheBeeZee. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubernetes-prow
kubernetes-prow Bot requested review from aojea and npinaeva September 14, 2026 21:57
@kubernetes-prow kubernetes-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Sep 14, 2026
@TheBeeZee TheBeeZee mentioned this pull request Sep 14, 2026
Closed
@kubernetes-prow kubernetes-prow Bot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Sep 14, 2026
danwinship
danwinship reviewed Sep 15, 2026
View reviewed changes
Comment thread site-src/api-overview.md Outdated
@kubernetes-prow kubernetes-prow Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 15, 2026
@kubernetes-prow kubernetes-prow Bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Sep 15, 2026
@kubernetes-prow kubernetes-prow Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 15, 2026
@TheBeeZee
TheBeeZee force-pushed the hairpin branch 2 times, most recently from 10380ad to d1a2cd7 Compare September 15, 2026 21:16
@TheBeeZee TheBeeZee changed the title docs: clarify hairpin traffic rule and exemption for connect-time LB Define hairpin traffic capability model for socket-layer load balancers Sep 15, 2026
@kubernetes-prow kubernetes-prow Bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 1, 2026
@TheBeeZee
TheBeeZee force-pushed the hairpin branch 2 times, most recently from 30b1bf3 to c5b86d9 Compare October 1, 2026 17:47
@TheBeeZee

TheBeeZee commented Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

@danwinship @npinaeva I have updated the wording regarding the hairpin traffic. Please take another look.

@danwinship

danwinship commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

works for me

@danwinship

danwinship commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

/ok-to-test

@kubernetes-prow kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 1, 2026
@npinaeva

npinaeva commented Oct 5, 2026

Copy link
Copy Markdown
Member

@netlify retry

@npinaeva

npinaeva commented Oct 5, 2026

Copy link
Copy Markdown
Member

I am fixing netlify failure here #410
this probably can be merged independently

@npinaeva

npinaeva commented Oct 5, 2026

Copy link
Copy Markdown
Member

/lgtm

@kubernetes-prow kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 5, 2026
@npinaeva

npinaeva commented Oct 5, 2026

Copy link
Copy Markdown
Member

@danwinship do you want to approve and remove the hold?

@danwinship

danwinship commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

/approve
/hold cancel

@kubernetes-prow kubernetes-prow Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 5, 2026
@kubernetes-prow

kubernetes-prow Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, TheBeeZee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 5, 2026
@npinaeva

npinaeva commented Oct 5, 2026

Copy link
Copy Markdown
Member

ok it won't merge until CI is green, @danwinship can you please review #410 and then we rebase?

@TheBeeZee
docs: mark service hairpin policy enforcement as preferred for beta
d947734 
Update ClusterNetworkPolicy hairpin semantics documentation to clarify that
service hairpin enforcement is preferred but not required for beta
conformance, reserving the right to mandate it in a future release.

Refs kubernetes-sigs#343
@kubernetes-prow kubernetes-prow Bot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 6, 2026
@TheBeeZee

TheBeeZee commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

@danwinship I have rebased the PR to get the netlify fix.

@tssurya tssurya mentioned this pull request Oct 6, 2026
Open
@danwinship

danwinship commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@kubernetes-prow kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 6, 2026
@kubernetes-prow
kubernetes-prow Bot merged commit c4572b0 into kubernetes-sigs:main Oct 6, 2026
8 checks passed
@TheBeeZee
TheBeeZee deleted the hairpin branch October 6, 2026 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danwinship danwinship danwinship left review comments
@aojea aojea Awaiting requested review from aojea
@npinaeva npinaeva Awaiting requested review from npinaeva

Assignees

@danwinship danwinship

@npinaeva npinaeva

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TheBeeZee @danwinship @npinaeva