Unable to use kube-image-keeper - Calico in eBPF doesn't support Host Ports about kube-image-keeper

[rdegez]

Damn :-)
We will look at this and maybe try to find a work-around since we don't want to exclude eBPF users from using kuik!

[szinn]

I had the same issue running on cilium / talos. I was able to get it to work by deleting the hostIP from the daemonset. That means that port 7439 is a little more visible since the proxy is listening on all devices, but it is able to resolve the localhost:7439/image...

Perhaps the hostIP can be parameterized in the helm chart, defaulting to localhost but can be set to the empty string and left off?

[donch]

Hi,

It seems you are unable to pull images on localhost:7439.
As mentionned in the README, you need to enable HostPort feature in your CNI configuration. Hostport are disabled according to your Calico configuration : https://github.com/onedr0p/home-ops/blob/main/kubernetes/apps/tigera-operator/tigera-operator/app/helmrelease.yaml#L38

I hope it will solve your issue.

[onedr0p]

Ah, darn. I'm using eBPF with Calico and they explicitly tell you to disable host ports since it's not supported.

https://projectcalico.docs.tigera.io/maintenance/ebpf/enabling-ebpf

you must also clear the hostPorts setting because host ports are not supported in BPF mode:

[donch]

May the docs be outdated ? According to this issue projectcalico/calico#6766, it should works ?

[onedr0p]

Doesn't appear to be possible :(

    - lastTransitionTime: "2023-02-07T13:49:12Z"
      message: 'Invalid Installation provided: spec.calicoNetwork.hostPorts is not
        supported with the eBPF dataplane'

[onedr0p]

If I ever decide to drop ebpf in my homelab I'll be sure to check out this project again.

[rdegez]

What calico version are you using ?
projectcalico/calico#6522 suggest that it should indeed be ok now ? (starting from 3.24.2)

[onedr0p]

I read that too, I am on 3.25.

[onedr0p]

You can close this issue, or keep it open if you think there's a way around those using eBPF. I am not sure if other CNIs have this issue with eBPF e.g. Cilium

[donch]

Hi @onedr0p, i didn't catch if Cilium has this kind of limitation.
Anyway, i've updated the Chart to deploy the daemonSet with hostNetwork: true instead of using hostPort.
Would you mind test it on your setup please ? https://github.com/enix/kube-image-keeper/tree/test-proxy-hostnet

Thanks !