| Field | Type | Description | Value(s) |
|---|---|---|---|
name | string | Name of the link (interface) to filter the incoming packets on. | |
destinationAddresses | []Prefix | Destination addresses to accept on this link, as a list of CIDRs. This is an override: when specified, only packets destined to one of these addresses are accepted, and neither the node’s own addresses nor the broadcast, multicast and link-local addresses are implicitly allowed. An empty list allows no destination at all, i.e. all packets arriving on the link are dropped. Default value: the node’s own addresses, the broadcast addresses of their IPv4 subnets, 255.255.255.255/32, 224.0.0.0/4, ff00::/8 and fe80::/10. |
Network
NetworkLinkIngressConfig
NetworkLinkIngressConfig is a config document to filter out the packets coming into the system based on destination IP and interface. Filters incoming packets on a link by destination address: only packets destined to one of the node’s own addresses are accepted, anything else is dropped. This is meant for clusters using an encapsulating CNI, where pod/service CIDR destinations should never arrive unencapsulated on an external interface; it is incompatible with native pod IP routing (e.g. BGP).
The set of accepted destinations can be overridden with the destinationAddresses option.