package drops despite egress rule

[JoergReinhold]

we have an egress rule:

spec:
  egress:
  - ports:
    - port: 32023
      protocol: TCP
  - to:
    - cidr: 100.127.129.202/32
status: {}

it worked fine for month, but since some time we get drops:

2023-08-28 05:14:39 +0000 UTC {"ACTION":"drop","DF":"","DPT":"32023","DST":"100.127.129.202","ID":"53164","IN":"vrf1226","LEN":"60","MAC":"12:7c:16:1e:ba:eb:f8:8e:a1:f2:20:53:08:00","OUT":"vlan104010","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"36921","SRC":"10.79.132.4","SYN":"","TOS":"0x00","TTL":"61","URGP":"0","WINDOW":"65535","timestamp":"2023-08-28 05:14:39 +0000 UTC"}
2023-08-28 05:14:55 +0000 UTC {"ACTION":"drop","DF":"","DPT":"32023","DST":"100.127.129.202","ID":"53165","IN":"vrf1226","LEN":"60","MAC":"12:7c:16:1e:ba:eb:f8:8e:a1:f2:20:53:08:00","OUT":"vlan104010","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"36921","SRC":"10.79.132.4","SYN":"","TOS":"0x00","TTL":"61","URGP":"0","WINDOW":"65535","timestamp":"2023-08-28 05:14:55 +0000 UTC"}
2023-08-28 05:15:30 +0000 UTC {"ACTION":"drop","DF":"","DPT":"32023","DST":"100.127.129.202","ID":"53166","IN":"vrf1226","LEN":"60","MAC":"12:7c:16:1e:ba:eb:f8:8e:a1:f2:20:53:08:00","OUT":"vlan104010","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"36921","SRC":"10.79.132.4","SYN":"","TOS":"0x00","TTL":"61","URGP":"0","WINDOW":"65535","timestamp":"2023-08-28 05:15:30 +0000 UTC"}

[majst01]

Looking at the output of nft list ruleset there is indeed no rule for this ip/port combination present.

[mwennrich]

should be:

spec:
  egress:
  - ports:
    - port: 32023
      protocol: TCP
    to:
    - cidr: 100.127.129.202/32

[majst01]

We must add some additional validation which is more strict to prevent such hard to find issues.

see #150

[mwennrich]

relates to: #151

[JoergReinhold]

it was my fault, the syntax was not correct (but accepted by the API); this is correct:

spec:
  egress:
  - ports:
    - port: 32023
      protocol: TCP
    to:
    - cidr: 100.127.129.202/32

and know everything works fine - thank you