Skip to content

VM network policy bug for non-isolated tenants #1601

New issue
New issue
Closed
#1611
Closed
VM network policy bug for non-isolated tenants#1601
#1611
Assignees
lllamnyp
Labels
kind/bugCategorizes issue or PR as related to a bug

Description

@lllamnyp
Timofei Larkin (lllamnyp)
opened on Nov 5, 2025

Reported by cozystack_ru Telegram community.

Describe the bug
When creating a VM in a tenant without network isolation, the accompanying CiliumNetworkPolicy prevents the VM from accessing in-cluster resources, such as DNS.

To Reproduce

  1. Create a tenant with isolated: false
  2. Create a VM with external: true
  3. Try to resolve DNS from inside the VM.

Expected behaviour
The VM should not be restricted from accessing cluster resources, just as all other pods in a non-isolated tenant.

Actual behaviour
The network policies only allow access to the internet.

In a non-isolated tenant there are initially no network policies, so nothing prevents applications from intra-cluster communications. When a VM is created, the accompanying policy has an egress rule targeting this VM. Once the VM is targeted by at least one egress rule, its network communication is now policed. An isolated tenant would also have other network policies that explicitly allow communication with the DNS server, but a non-isolated tenant starts with no network policies, so the VM is only allowed to talk to external endpoints.

Activity

  1. Timofei Larkin (lllamnyp)
    self-assigned this
    on Nov 5, 2025
  2. Timofei Larkin (lllamnyp)
    added
    kind/bugCategorizes issue or PR as related to a bug
    on Nov 5, 2025

  3. coderabbitai commented on Nov 5, 2025

    @coderabbitai
    coderabbitaiBot
    on Nov 5, 2025 – with coderabbitai
    Contributor

    A summary of the changes CodeRabbit can apply:

    • Update VM CiliumNetworkPolicy egress in packages/apps/virtual-machine/templates/service.yaml and packages/apps/vm-instance/templates/service.yaml (line 55): add "cluster" to toEntities alongside "world" so non-isolated VMs keep external access and regain in-cluster access (DNS, dashboard, keycloak, etc.).

    • Add "cluster" to the egress toEntities list in both packages/apps/virtual-machine/templates/service.yaml and packages/apps/vm-instance/templates/service.yaml so services can egress to the cluster in addition to world.

    • ✅ Create PR with these edits
    • 📋 Get copyable edits
  4. Timofei Larkin (lllamnyp)
    added 5 commits that reference this issue on Nov 5, 2025

    [vm] Remove egress restrictions on non-isolated vm

    e6df544

    [vm] Remove egress restrictions on non-isolated vm

    590337a

    [vm] Remove egress restrictions on non-isolated vm

    60c1f15

    [vm] Remove egress restrictions on non-isolated vm

    6622496

    [vm] Remove egress restrictions on non-isolated vm

    e997495
  5. Timofei Larkin (lllamnyp)
    closed this as completedon Nov 7, 2025
  6. Andrei Kvapil (kvaps)
    added 3 commits that reference this issue on Nov 7, 2025

    [virtual-machine] Revert per-vm network policies (#1611)

    83c3b0c

    [virtual-machine] Revert per-vm network policies (#1611)

    739d9d1

    [virtual-machine] Revert per-vm network policies (#1611)

    4cbf562
  7. Timofei Larkin (lllamnyp)
    added a commit that references this issue on Apr 8, 2026

    [virtual-machine] Exclude external VM services from Cilium BPF LB (#2357

    d2361f3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

kind/bugCategorizes issue or PR as related to a bug

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions