feat: per-service ingress port filtering#11

Merged

kvaps merged 11 commits into

cozystack:mainfrom

mattia-eleuteri:feat/port-filtering

Apr 27, 2026

Commits on Apr 27, 2026

proxy: add EnsurePortFilter/DeletePortFilter/CleanupPortFilters interface methods
mattia-eleuteri
committed
controllers: add wholeIPPassthrough helper and wire port-filter calls
mattia-eleuteri
committed
proxy/nft: implement per-service port filtering with port_filter chain
mattia-eleuteri
committed
proxy/nft: accept ct state established,related in port_filter chain
mattia-eleuteri
committed
proxy/nft: filter on pod IP at filter priority, fixes egress in PortList mode
mattia-eleuteri
committed
proxy/nft: split early_snat into egress_snat (raw) and ingress_dnat (mangle)
mattia-eleuteri
committed
docs: document wholeIP annotation values and port-filter mode
mattia-eleuteri
committed
controllers: wire port-filter calls into endpoint event handlers
mattia-eleuteri
committed
proxy/nft: batch netlink ops in EnsurePortFilter and CleanupPortFilters
mattia-eleuteri
committed
proxy/nft: short-circuit EnsurePortFilter when ports list is empty
mattia-eleuteri
committed
proxy: refresh stale early_snat references in comments
mattia-eleuteri
committed