From 80ccbbbb02c24b1be69a2394f8b163fdb4739655 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Sat, 18 Jul 2026 04:44:22 -0700 Subject: [PATCH] kernel: enable ipset hash:netport set type kube-router NetworkPolicy enforcement in k3s requires the netfilter ipset set types it creates at startup. The kernel config already enables ipset core, xt_set and most hash/bitmap set types as modules installed into the rootfs, but hash:netport was missing, causing `ipset save` to fail and kube-router to silently skip policy enforcement. Enable CONFIG_IP_SET_HASH_NETPORT=m and install the module into the rootfs image. Closes #792 --- .../meta-dstack/recipes-core/images/dstack-rootfs-base.inc | 1 + .../meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg | 1 + 2 files changed, 2 insertions(+) diff --git a/os/yocto/layers/meta-dstack/recipes-core/images/dstack-rootfs-base.inc b/os/yocto/layers/meta-dstack/recipes-core/images/dstack-rootfs-base.inc index 4862014ff..abe684ac6 100644 --- a/os/yocto/layers/meta-dstack/recipes-core/images/dstack-rootfs-base.inc +++ b/os/yocto/layers/meta-dstack/recipes-core/images/dstack-rootfs-base.inc @@ -53,6 +53,7 @@ IMAGE_INSTALL = "\ kernel-module-ip-set-hash-ipport \ kernel-module-ip-set-hash-ipportip \ kernel-module-ip-set-hash-ipportnet \ + kernel-module-ip-set-hash-netport \ kernel-module-ip-set-hash-netiface \ kernel-module-ip-set-bitmap-ip \ kernel-module-ip-set-bitmap-port \ diff --git a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg index 99f4607ff..df656498c 100644 --- a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg +++ b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg @@ -57,6 +57,7 @@ CONFIG_IP_SET_HASH_NET=m CONFIG_IP_SET_HASH_IPPORT=m CONFIG_IP_SET_HASH_IPPORTIP=m CONFIG_IP_SET_HASH_IPPORTNET=m +CONFIG_IP_SET_HASH_NETPORT=m CONFIG_IP_SET_HASH_NETIFACE=m CONFIG_IP_SET_BITMAP_IP=m CONFIG_IP_SET_BITMAP_PORT=m