From d045db2f41b5dea92634ef1f82b82e206b9f8aaf Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Mon, 20 Jul 2026 13:12:24 -0700 Subject: [PATCH 1/9] Enable xtables statistic match for all platforms Allows kube-proxy in iptables mode and other networking tools to use probabilistic packet matching for load balancing across multiple endpoints. e.g. `iptables -m statistic ...` Sets CONFIG_NETFILTER_XT_MATCH_STATISTIC=y On arm64, enable two Xtables options needed, already set on x86_64 CONFIG_NETFILTER_XT_MATCH_COMMENT=y CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y Signed-off-by: Christian Kruse --- configs/arm64/6.1.158.config | 6 +++--- configs/x86_64/6.1.158.config | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 77a1050..b42987c 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1162,7 +1162,7 @@ CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y # CONFIG_NETFILTER_XT_MATCH_BPF is not set # CONFIG_NETFILTER_XT_MATCH_CGROUP is not set # CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set -# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set +CONFIG_NETFILTER_XT_MATCH_COMMENT=y # CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set # CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set # CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set @@ -1184,7 +1184,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_LIMIT is not set # CONFIG_NETFILTER_XT_MATCH_MAC is not set # CONFIG_NETFILTER_XT_MATCH_MARK is not set -# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set # CONFIG_NETFILTER_XT_MATCH_OSF is not set # CONFIG_NETFILTER_XT_MATCH_OWNER is not set @@ -1198,7 +1198,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set -# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y # CONFIG_NETFILTER_XT_MATCH_STRING is not set # CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set # CONFIG_NETFILTER_XT_MATCH_TIME is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 2129f5d..3c89091 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1203,7 +1203,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set -# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y # CONFIG_NETFILTER_XT_MATCH_STRING is not set # CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set # CONFIG_NETFILTER_XT_MATCH_TIME is not set From a2bbe7e4919a0322b6b86627e229e91b3878d8b4 Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Tue, 21 Jul 2026 11:33:02 -0700 Subject: [PATCH 2/9] Enable nftables numgen and fib expressions for x86_64 Allows kube-proxy in nftables mode and other networking tools to use random number generation for endpoint selection and forwarding information base lookups for local-address dispatch. e.g. `nft add rule ... numgen random mod 1 map { ... }`, `nft add rule ... fib daddr type local` Sets CONFIG_NFT_NUMGEN=y Sets CONFIG_NFT_FIB_IPV4=y (selects CONFIG_NFT_FIB=y) Sets CONFIG_NFT_FIB_IPV6=y Signed-off-by: Christian Kruse --- configs/x86_64/6.1.158.config | 3 +++ 1 file changed, 3 insertions(+) diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 3c89091..6612c70 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1101,6 +1101,7 @@ CONFIG_NF_TABLES_IPV4=y CONFIG_NF_TABLES_IPV6=y CONFIG_NFT_EXTHDR=y CONFIG_NFT_META=y +CONFIG_NFT_NUMGEN=y CONFIG_NFT_CT=y CONFIG_NFT_RBTREE=y CONFIG_NFT_HASH=y @@ -1116,11 +1117,13 @@ CONFIG_NFT_REJECT_INET=y CONFIG_NFT_COMPAT=y CONFIG_NFT_CHAIN_ROUTE_IPV4=y CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_FIB_IPV4=y CONFIG_NFT_CHAIN_NAT_IPV4=y CONFIG_NFT_MASQ_IPV4=y # CONFIG_NFT_REDIR_IPV4 is not set CONFIG_NFT_CHAIN_ROUTE_IPV6=y CONFIG_NFT_REJECT_IPV6=y +CONFIG_NFT_FIB_IPV6=y CONFIG_NFT_CHAIN_NAT_IPV6=y CONFIG_NFT_MASQ_IPV6=y # CONFIG_NFT_REDIR_IPV6 is not set From 1849240d7a76d2152360faf7d6d4d120c1326b77 Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Tue, 21 Jul 2026 13:16:10 -0700 Subject: [PATCH 3/9] Enable nftables NFQUEUE policy enforcement for x86_64 Allows kindnetd using the kube-network-policies reference implementation, firewalls, and other networking tools to enforce policy via first-packet NFQUEUE inspection with conntrack label caching. e.g. `nft add table inet ...`, `nft add rule ... queue num 101 bypass`, `ct label set 28` Sets CONFIG_NF_TABLES_INET=y Sets CONFIG_NETFILTER_NETLINK_QUEUE=y Sets CONFIG_NETFILTER_NETLINK_GLUE_CT=y Sets CONFIG_NF_CT_NETLINK=y Signed-off-by: Christian Kruse --- configs/x86_64/6.1.158.config | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 6612c70..4cb875f 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1060,7 +1060,8 @@ CONFIG_NETFILTER_INGRESS=y # CONFIG_NETFILTER_EGRESS is not set CONFIG_NETFILTER_FAMILY_BRIDGE=y # CONFIG_NETFILTER_NETLINK_ACCT is not set -# CONFIG_NETFILTER_NETLINK_QUEUE is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y # CONFIG_NETFILTER_NETLINK_LOG is not set # CONFIG_NETFILTER_NETLINK_OSF is not set CONFIG_NF_CONNTRACK=y @@ -1086,7 +1087,7 @@ CONFIG_NF_CT_PROTO_UDPLITE=y # CONFIG_NF_CONNTRACK_SANE is not set # CONFIG_NF_CONNTRACK_SIP is not set # CONFIG_NF_CONNTRACK_TFTP is not set -# CONFIG_NF_CT_NETLINK is not set +CONFIG_NF_CT_NETLINK=y # CONFIG_NF_CT_NETLINK_TIMEOUT is not set CONFIG_NF_NAT=y CONFIG_NF_NAT_REDIRECT=y @@ -1097,6 +1098,7 @@ CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XTABLES_COMPAT=y # nf_tables targets +CONFIG_NF_TABLES_INET=y CONFIG_NF_TABLES_IPV4=y CONFIG_NF_TABLES_IPV6=y CONFIG_NFT_EXTHDR=y From ee876be2f8deb07e43b5dfd95943cb05baa4409a Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Wed, 22 Jul 2026 09:23:26 -0700 Subject: [PATCH 4/9] Enable xtables recent match for all platforms Allows kube-proxy in iptables mode and other networking tools to implement session affinity, rate limiting and throttling with xtables recency rules. Sets CONFIG_NETFILTER_XT_MATCH_RECENT=y Signed-off-by: Christian Kruse --- configs/arm64/6.1.158.config | 2 +- configs/x86_64/6.1.158.config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index b42987c..3425186 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1194,7 +1194,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set # CONFIG_NETFILTER_XT_MATCH_REALM is not set -# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_RECENT=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 4cb875f..94f672c 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1204,7 +1204,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set # CONFIG_NETFILTER_XT_MATCH_REALM is not set -# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_RECENT=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set From 4068818107c9acb530dc010f69c69f28c2e8a041 Mon Sep 17 00:00:00 2001 From: Giulio Micheloni Date: Tue, 28 Jul 2026 12:29:14 +0200 Subject: [PATCH 5/9] Enable CNI networking facilities for x86_64 - DUMMY, VXLAN, GENEVE: flannel vxlan backend, Docker overlay networks, Cilium tunnels, dummy devices (NodeLocal DNS, kube-vip, IPVS) - IP_SET + set types, NETFILTER_XT_SET, rpfilter matches: Calico iptables dataplane, kube-router - NETFILTER_XT_TARGET_NFQUEUE: iptables-based NetworkPolicy engines - NET_SCH_INGRESS, NET_ACT_MIRRED: tc clsact hook for eBPF dataplanes - SCHEDSTATS, CRYPTO_USER_API_HASH: Cilium base requirements --- configs/x86_64/6.1.158.config | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 94f672c..d0a844c 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1096,6 +1096,7 @@ CONFIG_NETFILTER_SYNPROXY=y CONFIG_NF_TABLES=y CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XTABLES_COMPAT=y +CONFIG_NETFILTER_XT_SET=y # nf_tables targets CONFIG_NF_TABLES_INET=y @@ -1155,7 +1156,7 @@ CONFIG_NETFILTER_XT_MARK=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_TARGET_NETMAP=y # CONFIG_NETFILTER_XT_TARGET_NFLOG is not set -# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y @@ -1215,7 +1216,16 @@ CONFIG_NETFILTER_XT_MATCH_STATISTIC=y # CONFIG_NETFILTER_XT_MATCH_U32 is not set # end of Core Netfilter Configuration -# CONFIG_IP_SET is not set +CONFIG_IP_SET=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETNET=y +CONFIG_IP_SET_HASH_NETPORT=y +CONFIG_IP_SET_HASH_NETIFACE=y # CONFIG_IP_VS is not set # @@ -1231,7 +1241,7 @@ CONFIG_NF_REJECT_IPV4=y CONFIG_IP_NF_IPTABLES=y # CONFIG_IP_NF_MATCH_AH is not set # CONFIG_IP_NF_MATCH_ECN is not set -# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_RPFILTER=y # CONFIG_IP_NF_MATCH_TTL is not set CONFIG_IP_NF_FILTER=y CONFIG_IP_NF_TARGET_REJECT=y @@ -1265,7 +1275,7 @@ CONFIG_IP6_NF_IPTABLES=y # CONFIG_IP6_NF_MATCH_HL is not set # CONFIG_IP6_NF_MATCH_IPV6HEADER is not set # CONFIG_IP6_NF_MATCH_MH is not set -# CONFIG_IP6_NF_MATCH_RPFILTER is not set +CONFIG_IP6_NF_MATCH_RPFILTER=y # CONFIG_IP6_NF_MATCH_RT is not set # CONFIG_IP6_NF_MATCH_SRH is not set # CONFIG_IP6_NF_TARGET_HL is not set @@ -1336,7 +1346,7 @@ CONFIG_NET_SCHED=y # CONFIG_NET_SCH_FQ is not set # CONFIG_NET_SCH_HHF is not set # CONFIG_NET_SCH_PIE is not set -# CONFIG_NET_SCH_INGRESS is not set +CONFIG_NET_SCH_INGRESS=y # CONFIG_NET_SCH_PLUG is not set # CONFIG_NET_SCH_ETS is not set # CONFIG_NET_SCH_DEFAULT is not set @@ -1365,7 +1375,7 @@ CONFIG_NET_EMATCH_STACK=32 CONFIG_NET_CLS_ACT=y # CONFIG_NET_ACT_POLICE is not set # CONFIG_NET_ACT_GACT is not set -# CONFIG_NET_ACT_MIRRED is not set +CONFIG_NET_ACT_MIRRED=y # CONFIG_NET_ACT_SAMPLE is not set # CONFIG_NET_ACT_IPT is not set # CONFIG_NET_ACT_NAT is not set @@ -1639,15 +1649,15 @@ CONFIG_ISCSI_TCP=y CONFIG_NETDEVICES=y CONFIG_NET_CORE=y # CONFIG_BONDING is not set -# CONFIG_DUMMY is not set +CONFIG_DUMMY=y CONFIG_WIREGUARD=y # CONFIG_WIREGUARD_DEBUG is not set # CONFIG_EQUALIZER is not set # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set -# CONFIG_VXLAN is not set -# CONFIG_GENEVE is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y # CONFIG_BAREUDP is not set # CONFIG_GTP is not set # CONFIG_AMT is not set @@ -2846,7 +2856,8 @@ CONFIG_CRYPTO_JITTERENTROPY=y # # Userspace interface # -# CONFIG_CRYPTO_USER_API_HASH is not set +CONFIG_CRYPTO_USER_API_HASH=y +# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set # CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set @@ -3161,7 +3172,7 @@ CONFIG_WQ_WATCHDOG=y # # CONFIG_SCHED_DEBUG is not set CONFIG_SCHED_INFO=y -# CONFIG_SCHEDSTATS is not set +CONFIG_SCHEDSTATS=y # end of Scheduler Debugging # CONFIG_DEBUG_TIMEKEEPING is not set From 7c4bf109ee7633daa497f2d4c27d74eb16620705 Mon Sep 17 00:00:00 2001 From: Giulio Micheloni Date: Tue, 28 Jul 2026 12:29:14 +0200 Subject: [PATCH 6/9] Enable CNI networking facilities and nftables parity for arm64 Same CNI set as x86_64, plus arm64-only gaps: - NETFILTER_XT_MARK: emitted by kube-proxy iptables mode - nf_tables subsystem and conntrack/queue netlink: x86_64 parity, required by iptables-nft userspace and kube-proxy nftables mode --- configs/arm64/6.1.158.config | 61 +++++++++++++++++++++++++++--------- 1 file changed, 46 insertions(+), 15 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 3425186..227d44b 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1086,7 +1086,8 @@ CONFIG_NETFILTER_INGRESS=y # CONFIG_NETFILTER_EGRESS is not set CONFIG_NETFILTER_FAMILY_BRIDGE=y # CONFIG_NETFILTER_NETLINK_ACCT is not set -# CONFIG_NETFILTER_NETLINK_QUEUE is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y # CONFIG_NETFILTER_NETLINK_LOG is not set # CONFIG_NETFILTER_NETLINK_OSF is not set CONFIG_NF_CONNTRACK=y @@ -1112,20 +1113,40 @@ CONFIG_NF_CT_PROTO_UDPLITE=y # CONFIG_NF_CONNTRACK_SANE is not set # CONFIG_NF_CONNTRACK_SIP is not set # CONFIG_NF_CONNTRACK_TFTP is not set -# CONFIG_NF_CT_NETLINK is not set +CONFIG_NF_CT_NETLINK=y # CONFIG_NF_CT_NETLINK_TIMEOUT is not set CONFIG_NF_NAT=y CONFIG_NF_NAT_REDIRECT=y CONFIG_NF_NAT_MASQUERADE=y CONFIG_NETFILTER_SYNPROXY=y -# CONFIG_NF_TABLES is not set +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_IPV4=y +CONFIG_NF_TABLES_IPV6=y +CONFIG_NFT_NUMGEN=y +CONFIG_NFT_CT=y +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_REDIR=y +CONFIG_NFT_NAT=y +CONFIG_NFT_QUEUE=y +CONFIG_NFT_REJECT=y +CONFIG_NFT_REJECT_INET=y +CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_REJECT_IPV6=y +CONFIG_NFT_COMPAT=y +CONFIG_NFT_HASH=y +CONFIG_NFT_FIB_IPV4=y +CONFIG_NFT_FIB_IPV6=y CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XTABLES_COMPAT=y +CONFIG_NETFILTER_XT_SET=y # # Xtables combined modules # -# CONFIG_NETFILTER_XT_MARK is not set +CONFIG_NETFILTER_XT_MARK=y # CONFIG_NETFILTER_XT_CONNMARK is not set # @@ -1145,7 +1166,7 @@ CONFIG_NETFILTER_XTABLES_COMPAT=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_TARGET_NETMAP=y # CONFIG_NETFILTER_XT_TARGET_NFLOG is not set -# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y @@ -1205,7 +1226,16 @@ CONFIG_NETFILTER_XT_MATCH_STATISTIC=y # CONFIG_NETFILTER_XT_MATCH_U32 is not set # end of Core Netfilter Configuration -# CONFIG_IP_SET is not set +CONFIG_IP_SET=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETNET=y +CONFIG_IP_SET_HASH_NETPORT=y +CONFIG_IP_SET_HASH_NETIFACE=y # CONFIG_IP_VS is not set # @@ -1221,7 +1251,7 @@ CONFIG_NF_REJECT_IPV4=y CONFIG_IP_NF_IPTABLES=y # CONFIG_IP_NF_MATCH_AH is not set # CONFIG_IP_NF_MATCH_ECN is not set -# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_RPFILTER=y # CONFIG_IP_NF_MATCH_TTL is not set CONFIG_IP_NF_FILTER=y CONFIG_IP_NF_TARGET_REJECT=y @@ -1255,7 +1285,7 @@ CONFIG_IP6_NF_IPTABLES=y # CONFIG_IP6_NF_MATCH_HL is not set # CONFIG_IP6_NF_MATCH_IPV6HEADER is not set # CONFIG_IP6_NF_MATCH_MH is not set -# CONFIG_IP6_NF_MATCH_RPFILTER is not set +CONFIG_IP6_NF_MATCH_RPFILTER=y # CONFIG_IP6_NF_MATCH_RT is not set # CONFIG_IP6_NF_MATCH_SRH is not set # CONFIG_IP6_NF_TARGET_HL is not set @@ -1326,7 +1356,7 @@ CONFIG_NET_SCHED=y # CONFIG_NET_SCH_FQ is not set # CONFIG_NET_SCH_HHF is not set # CONFIG_NET_SCH_PIE is not set -# CONFIG_NET_SCH_INGRESS is not set +CONFIG_NET_SCH_INGRESS=y # CONFIG_NET_SCH_PLUG is not set # CONFIG_NET_SCH_ETS is not set # CONFIG_NET_SCH_DEFAULT is not set @@ -1355,7 +1385,7 @@ CONFIG_NET_EMATCH_STACK=32 CONFIG_NET_CLS_ACT=y # CONFIG_NET_ACT_POLICE is not set # CONFIG_NET_ACT_GACT is not set -# CONFIG_NET_ACT_MIRRED is not set +CONFIG_NET_ACT_MIRRED=y # CONFIG_NET_ACT_SAMPLE is not set # CONFIG_NET_ACT_IPT is not set # CONFIG_NET_ACT_NAT is not set @@ -1668,14 +1698,14 @@ CONFIG_ISCSI_TCP=y CONFIG_NETDEVICES=y CONFIG_NET_CORE=y # CONFIG_BONDING is not set -# CONFIG_DUMMY is not set +CONFIG_DUMMY=y CONFIG_WIREGUARD=y # CONFIG_EQUALIZER is not set # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set -# CONFIG_VXLAN is not set -# CONFIG_GENEVE is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y # CONFIG_BAREUDP is not set # CONFIG_GTP is not set # CONFIG_AMT is not set @@ -2941,7 +2971,8 @@ CONFIG_CRYPTO_JITTERENTROPY=y # # Userspace interface # -# CONFIG_CRYPTO_USER_API_HASH is not set +CONFIG_CRYPTO_USER_API_HASH=y +# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set # CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set @@ -3258,7 +3289,7 @@ CONFIG_WQ_WATCHDOG=y # # CONFIG_SCHED_DEBUG is not set CONFIG_SCHED_INFO=y -# CONFIG_SCHEDSTATS is not set +CONFIG_SCHEDSTATS=y # end of Scheduler Debugging # CONFIG_DEBUG_TIMEKEEPING is not set From 379c0445e97e133b7e738e704a324b7d29da93b7 Mon Sep 17 00:00:00 2001 From: Giulio Micheloni Date: Tue, 28 Jul 2026 12:29:14 +0200 Subject: [PATCH 7/9] Enable xt_physdev match for NetworkPolicy enforcement k3s's embedded network policy controller (kube-router) programs '-m physdev --physdev-is-bridged' rules for traffic crossing the CNI bridge. Without the match, iptables-restore fails with 'Extension physdev revision 0 not supported' and NetworkPolicy silently does not enforce. --- configs/arm64/6.1.158.config | 2 +- configs/x86_64/6.1.158.config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 227d44b..5997c1f 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1210,7 +1210,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_OSF is not set # CONFIG_NETFILTER_XT_MATCH_OWNER is not set # CONFIG_NETFILTER_XT_MATCH_POLICY is not set -# CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index d0a844c..cbcd9cf 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1200,7 +1200,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_OSF is not set # CONFIG_NETFILTER_XT_MATCH_OWNER is not set # CONFIG_NETFILTER_XT_MATCH_POLICY is not set -# CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set From 94e5393d2b1ae0ca40f4dbbe494b919fe73a3769 Mon Sep 17 00:00:00 2001 From: Giulio Micheloni Date: Tue, 28 Jul 2026 14:54:54 +0200 Subject: [PATCH 8/9] Enable xt_limit and NFLOG for NetworkPolicy deny logging kube-router's per-policy chains end with rate-limited logging of denied traffic ('-m limit ... -j NFLOG') before REJECT. Without xt_limit the whole iptables-restore aborts (exit status 4) and no pod firewall rules are programmed, so NetworkPolicy does not enforce even with xt_physdev present. --- configs/arm64/6.1.158.config | 6 +++--- configs/x86_64/6.1.158.config | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 5997c1f..875c540 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1088,7 +1088,7 @@ CONFIG_NETFILTER_FAMILY_BRIDGE=y # CONFIG_NETFILTER_NETLINK_ACCT is not set CONFIG_NETFILTER_NETLINK_QUEUE=y CONFIG_NETFILTER_NETLINK_GLUE_CT=y -# CONFIG_NETFILTER_NETLINK_LOG is not set +CONFIG_NETFILTER_NETLINK_LOG=y # CONFIG_NETFILTER_NETLINK_OSF is not set CONFIG_NF_CONNTRACK=y CONFIG_NF_LOG_SYSLOG=y @@ -1165,7 +1165,7 @@ CONFIG_NETFILTER_XT_MARK=y # CONFIG_NETFILTER_XT_TARGET_MARK is not set CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_TARGET_NETMAP=y -# CONFIG_NETFILTER_XT_TARGET_NFLOG is not set +CONFIG_NETFILTER_XT_TARGET_NFLOG=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y @@ -1202,7 +1202,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set # CONFIG_NETFILTER_XT_MATCH_L2TP is not set # CONFIG_NETFILTER_XT_MATCH_LENGTH is not set -# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set +CONFIG_NETFILTER_XT_MATCH_LIMIT=y # CONFIG_NETFILTER_XT_MATCH_MAC is not set # CONFIG_NETFILTER_XT_MATCH_MARK is not set CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index cbcd9cf..4864643 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1062,7 +1062,7 @@ CONFIG_NETFILTER_FAMILY_BRIDGE=y # CONFIG_NETFILTER_NETLINK_ACCT is not set CONFIG_NETFILTER_NETLINK_QUEUE=y CONFIG_NETFILTER_NETLINK_GLUE_CT=y -# CONFIG_NETFILTER_NETLINK_LOG is not set +CONFIG_NETFILTER_NETLINK_LOG=y # CONFIG_NETFILTER_NETLINK_OSF is not set CONFIG_NF_CONNTRACK=y CONFIG_NF_LOG_SYSLOG=y @@ -1155,7 +1155,7 @@ CONFIG_NETFILTER_XT_MARK=y # CONFIG_NETFILTER_XT_TARGET_MARK is not set CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_TARGET_NETMAP=y -# CONFIG_NETFILTER_XT_TARGET_NFLOG is not set +CONFIG_NETFILTER_XT_TARGET_NFLOG=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y @@ -1192,7 +1192,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set # CONFIG_NETFILTER_XT_MATCH_L2TP is not set # CONFIG_NETFILTER_XT_MATCH_LENGTH is not set -# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set +CONFIG_NETFILTER_XT_MATCH_LIMIT=y # CONFIG_NETFILTER_XT_MATCH_MAC is not set # CONFIG_NETFILTER_XT_MATCH_MARK is not set CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y From 56bcb8dc9896f1aae8c24a256c3b9ebae0e3aa85 Mon Sep 17 00:00:00 2001 From: Giulio Micheloni Date: Tue, 28 Jul 2026 15:38:22 +0200 Subject: [PATCH 9/9] Enable xt_CT target and macvlan/ipvlan/vlan devices - NETFILTER_XT_TARGET_CT: Calico felix programs NOTRACK/CT rules in the raw table; without the target its iptables-restore fails ('Extension CT revision 0 not supported') and calico-node never reports Ready - MACVLAN, IPVLAN, VLAN_8021Q: secondary pod networks (Multus) and Docker macvlan/ipvlan network drivers --- configs/arm64/6.1.158.config | 7 ++++--- configs/x86_64/6.1.158.config | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 875c540..a5f521e 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1166,6 +1166,7 @@ CONFIG_NETFILTER_XT_MARK=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_TARGET_NETMAP=y CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_CT=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y @@ -1317,7 +1318,7 @@ CONFIG_BRIDGE_IGMP_SNOOPING=y # CONFIG_BRIDGE_MRP is not set # CONFIG_BRIDGE_CFM is not set # CONFIG_NET_DSA is not set -# CONFIG_VLAN_8021Q is not set +CONFIG_VLAN_8021Q=y CONFIG_LLC=y # CONFIG_LLC2 is not set # CONFIG_ATALK is not set @@ -1702,8 +1703,8 @@ CONFIG_DUMMY=y CONFIG_WIREGUARD=y # CONFIG_EQUALIZER is not set # CONFIG_NET_TEAM is not set -# CONFIG_MACVLAN is not set -# CONFIG_IPVLAN is not set +CONFIG_MACVLAN=y +CONFIG_IPVLAN=y CONFIG_VXLAN=y CONFIG_GENEVE=y # CONFIG_BAREUDP is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 4864643..cffc9e9 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1156,6 +1156,7 @@ CONFIG_NETFILTER_XT_MARK=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_TARGET_NETMAP=y CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_CT=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set CONFIG_NETFILTER_XT_TARGET_REDIRECT=y @@ -1307,7 +1308,7 @@ CONFIG_BRIDGE_IGMP_SNOOPING=y # CONFIG_BRIDGE_MRP is not set # CONFIG_BRIDGE_CFM is not set # CONFIG_NET_DSA is not set -# CONFIG_VLAN_8021Q is not set +CONFIG_VLAN_8021Q=y CONFIG_LLC=y # CONFIG_LLC2 is not set # CONFIG_ATALK is not set @@ -1654,8 +1655,8 @@ CONFIG_WIREGUARD=y # CONFIG_WIREGUARD_DEBUG is not set # CONFIG_EQUALIZER is not set # CONFIG_NET_TEAM is not set -# CONFIG_MACVLAN is not set -# CONFIG_IPVLAN is not set +CONFIG_MACVLAN=y +CONFIG_IPVLAN=y CONFIG_VXLAN=y CONFIG_GENEVE=y # CONFIG_BAREUDP is not set