You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add a new DIRECTION supported value, auto, and set it as default.
As opposed to ingress, egress and both, which attach ALL rules to the specified direction(s), auto would split and load funneling rules to EGRESS and unfunneling rules INGRESS, effectively being equivalent to two runs of sfunnel with the corresponding subset of rules.
This would allow turning this:
--- a/nginx.yaml+++ b/nginx.yaml@@ -1,21 +1,31 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx-deployment
spec:
replicas: 4
selector:
matchLabels:
app: my-nginx-app
template:
metadata:
labels:
app: my-nginx-app
spec:
containers:
+ - name: sfunnel-init+ env:+ - name: SFUNNEL_RULESET+ value: ip tcp dport 80 sport 540 actions unfunnel tcp+ image: ghcr.io/datahangar/sfunnel:0.0.11+ securityContext:+ privileged: false #Set to true for some public clouds (e.g. GKE standard)+ capabilities:+ add: [BPF, NET_ADMIN, SYS_ADMIN]+ volumeMounts:+ - name: bpffs+ mountPath: /sys/fs/bpf+ - name: sfunnel-init-egress+ env:+ - name: SFUNNEL_RULESET+ value: ip tcp sport 8080 actions funnel tcp dport 540 sport 80+ - name: DIRECTION+ value: egress+ image: ghcr.io/datahangar/sfunnel:0.0.11+ securityContext:+ privileged: false #Set to true for some public clouds (e.g. GKE standard)+ capabilities:+ add: [BPF, NET_ADMIN, SYS_ADMIN]+ volumeMounts:+ - name: bpffs+ mountPath: /sys/fs/bpf
into this:
--- a/nginx.yaml+++ b/nginx.yaml@@ -1,21 +1,31 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx-deployment
spec:
replicas: 4
selector:
matchLabels:
app: my-nginx-app
template:
metadata:
labels:
app: my-nginx-app
spec:
containers:
+ - name: sfunnel-init+ env:+ - name: SFUNNEL_RULESET+ value: ip tcp dport 80 sport 540 actions unfunnel tcp; ip tcp dport 80 sport 540 actions unfunnel tcp+ image: ghcr.io/datahangar/sfunnel:0.0.11+ securityContext:+ privileged: false #Set to true for some public clouds (e.g. GKE standard)+ capabilities:+ add: [BPF, NET_ADMIN, SYS_ADMIN]+ volumeMounts:+ - name: bpffs+ mountPath: /sys/fs/bpf
The text was updated successfully, but these errors were encountered:
Add a new
DIRECTION
supported value,auto
, and set it as default.As opposed to
ingress
,egress
andboth
, which attach ALL rules to the specified direction(s),auto
would split and load funneling rules to EGRESS and unfunneling rules INGRESS, effectively being equivalent to two runs ofsfunnel
with the corresponding subset of rules.This would allow turning this:
into this:
The text was updated successfully, but these errors were encountered: