From 4ab68b48ae73f9986a5b01f88731ad191267c6cb Mon Sep 17 00:00:00 2001 From: Phil Gran Date: Thu, 16 Jul 2026 13:02:44 +0200 Subject: [PATCH 1/3] Adding an externalTrafficPolicy to allow load balancers to keep traffic local or cross-node within cluster --- helm/.gitignore => .gitignore | 1 + helm/README.md | 1 + helm/templates/service.yaml | 3 +++ helm/values.yaml | 6 ++++++ 4 files changed, 11 insertions(+) rename helm/.gitignore => .gitignore (92%) diff --git a/helm/.gitignore b/.gitignore similarity index 92% rename from helm/.gitignore rename to .gitignore index 6ee1d9b..2dbd412 100644 --- a/helm/.gitignore +++ b/.gitignore @@ -5,6 +5,7 @@ charts/ # IDE .idea/ .vscode/ +settings.json *.swp *.swo diff --git a/helm/README.md b/helm/README.md index ab52417..c9d9244 100644 --- a/helm/README.md +++ b/helm/README.md @@ -126,6 +126,7 @@ registries: | `tls.generateSelfSigned` | Generate self-signed certs | `true` | | `tls.existingSecret` | Use existing TLS secret | `""` | | `service.type` | Service type | `ClusterIP` | +| `service.externalTrafficPolicy` | `Cluster` or `Local` (NodePort/LoadBalancer only); use `Local` to preserve client source IPs | `""` | | `ingress.enabled` | Enable Ingress | `false` | | `ingress.className` | Ingress class (nginx, alb, traefik) | `""` | | `autoscaling.enabled` | Enable HorizontalPodAutoscaler | `false` | diff --git a/helm/templates/service.yaml b/helm/templates/service.yaml index f06a872..8f19854 100644 --- a/helm/templates/service.yaml +++ b/helm/templates/service.yaml @@ -10,6 +10,9 @@ metadata: {{- end }} spec: type: {{ .Values.service.type }} + {{- if and .Values.service.externalTrafficPolicy (has .Values.service.type (list "NodePort" "LoadBalancer")) }} + externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }} + {{- end }} ports: - port: {{ .Values.service.httpPort }} targetPort: http diff --git a/helm/values.yaml b/helm/values.yaml index 2b463ef..95d2bb3 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -600,6 +600,12 @@ service: containerHttpsPort: "" # Override HTTPS targetPort (set to "http" when TLS is terminated at the load balancer) httpsTargetPort: "" + # External traffic policy (Cluster or Local). Only applies when type is + # NodePort or LoadBalancer. Set to "Local" to preserve client source IPs; + # the default "Cluster" policy SNATs traffic forwarded across nodes (e.g. to + # a link-local 169.254.x.x address on GKE Dataplane v2 passthrough LBs). + # Note: with "Local", only nodes running a firewall pod receive traffic. + externalTrafficPolicy: "" annotations: {} # service.beta.kubernetes.io/aws-load-balancer-internal: "true" # service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" From b1a70dc96c069220a9379b4595786244ef896d96 Mon Sep 17 00:00:00 2001 From: Phil Gran Date: Thu, 16 Jul 2026 13:11:50 +0200 Subject: [PATCH 2/3] Incrementing version to latest --- helm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm/Chart.yaml b/helm/Chart.yaml index 6f0cb5d..c37a8bd 100644 --- a/helm/Chart.yaml +++ b/helm/Chart.yaml @@ -5,7 +5,7 @@ type: application version: 0.8.0 # appVersion is the single source of truth for the firewall image version. # image.tag in values.yaml defaults to this (see templates/_helpers.tpl). -appVersion: "2.0.3" +appVersion: "2.0.5" keywords: - security - supply-chain From c5ac772bbc70887c093258af4687c5377ec299e8 Mon Sep 17 00:00:00 2001 From: Phil Gran Date: Thu, 16 Jul 2026 20:34:57 +0200 Subject: [PATCH 3/3] Incrementing version --- helm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm/Chart.yaml b/helm/Chart.yaml index c37a8bd..95c7ebf 100644 --- a/helm/Chart.yaml +++ b/helm/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: socket-firewall description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster type: application -version: 0.8.0 +version: 0.9.0 # appVersion is the single source of truth for the firewall image version. # image.tag in values.yaml defaults to this (see templates/_helpers.tpl). appVersion: "2.0.5"