toFQDNs policies have no effect on the default kube-ovn + Cilium stack, and nothing documents that #3820

toFQDNs in a CiliumNetworkPolicy has no effect on a default Cozystack install, and nothing in the docs says so. Two people ran into it in the community chat this week and both went debugging their own policy first.

The default networking stack chains Cilium onto kube-ovn. packages/system/cilium/values-kubeovn.yaml sets cni.chainingMode: generic-veth with chainingTarget: kube-ovn, and packages/core/platform/templates/bundles/system.yaml selects the kubeovn-cilium variant for isp-full (kubeovn-cilium-generic for the non-Talos bundle). Upstream lists Layer 7 policy as limited in that mode, and toFQDNs is enforced by the DNS proxy, which is an L7 redirect. The upstream issue their docs point at, cilium/cilium#12454, was closed as not-planned in May 2024, so this is the state of things and not a passing bug.

The cilium and cilium-generic variants never load the kube-ovn values file, so nothing is chained there and L7 should work. That costs you kube-ovn, which is a heavy trade for one policy feature.

Two things I would like to come out of this:

1. Say it in the networking docs. FQDN-based egress does not work on the default stack, and CIDR or entity selectors are what to reach for instead.
2. Decide whether FQDN egress belongs in the SecurityGroup API. There is no such field today and grep finds no mention of FQDN anywhere in the tree, so anyone who needs it has no supported path.

Reported in the community chat: https://t.me/cozystack/16968 and https://t.me/cozystack_ru/12488