From e2c8ef0fdeb8dc45985f7c9a5c7b50f4981f979a Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Mon, 17 Aug 2026 20:51:47 -0500 Subject: [PATCH] Commit crowdsec-firewall-bouncer headless-service fix (was uncommitted) This fix for the EPERM ClusterIP-from-hostNetwork issue (Cilium socketLB hostNamespaceOnly + hostNetwork bouncer + ClusterIP VIP) was made and verified earlier but never committed - ArgoCD's selfHeal kept reverting the live ConfigMap back to the broken crowdsec-service URL against git's stale version, causing a fresh bouncer pod to crash-loop with the original EPERM error again. Co-Authored-By: Claude Sonnet 5 --- .../crowdsec/manifests/firewall-bouncer.yaml | 30 ++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/infrastructure/crowdsec/manifests/firewall-bouncer.yaml b/infrastructure/crowdsec/manifests/firewall-bouncer.yaml index 947c738..0d1f23b 100644 --- a/infrastructure/crowdsec/manifests/firewall-bouncer.yaml +++ b/infrastructure/crowdsec/manifests/firewall-bouncer.yaml @@ -2,6 +2,34 @@ # Blocks malicious IPs before they reach Cilium eBPF processing # Requires: hostNetwork + privileged (nftables management) # Image: community Docker build of cs-firewall-bouncer (no official image exists) +# +# api_url points at a headless Service (below), not the normal ClusterIP +# crowdsec-service. Cilium's socketLB is configured hostNamespaceOnly (see +# infrastructure/cilium/values.yaml, needed for Istio ambient compatibility), +# which means socket-level Service translation/policy enforcement applies to +# host-namespace traffic - and this bouncer runs hostNetwork: true, so it IS +# host-namespace traffic. Connecting to a ClusterIP VIP from there gets an +# immediate EPERM on connect() (confirmed live 2026-08-17, been broken since +# this DaemonSet was first deployed 2026-03-03 - not a regression from any +# recent change). A headless Service resolves straight to pod IPs via DNS - +# no VIP, nothing for socket-LB to intercept - and connects cleanly. +--- +apiVersion: v1 +kind: Service +metadata: + name: crowdsec-lapi-headless + namespace: crowdsec +spec: + clusterIP: None + selector: + k8s-app: crowdsec + type: lapi + version: v1 + ports: + - name: lapi + port: 8080 + protocol: TCP + targetPort: 8080 --- apiVersion: v1 kind: ConfigMap @@ -14,7 +42,7 @@ data: update_frequency: 10s log_mode: stdout log_level: info - api_url: http://crowdsec-service.crowdsec.svc:8080/ + api_url: http://crowdsec-lapi-headless.crowdsec.svc:8080/ api_key: ${API_KEY} insecure_skip_verify: false disable_ipv6: false