Merge 6b99f62877 into a9d5883a3a

cmd/kg/main.go

@@ -115,6 +115,7 @@ var (
 	resyncPeriod          time.Duration
 	iptablesForwardRule   bool
 	prioritisePrivateAddr bool
+	dropOtherIpIpTraffic  bool
 
 	printVersion bool
 	logLevel     string
@@ -145,6 +146,7 @@ func init() {
 	cmd.Flags().DurationVar(&resyncPeriod, "resync-period", 30*time.Second, "How often should the Kilo controllers reconcile?")
 	cmd.Flags().BoolVar(&iptablesForwardRule, "iptables-forward-rules", false, "Add default accept rules to the FORWARD chain in iptables. Warning: this may break firewalls with a deny all policy and is potentially insecure!")
 	cmd.Flags().BoolVar(&prioritisePrivateAddr, "prioritise-private-addresses", false, "Prefer to assign a private IP address to the node's endpoint.")
+	cmd.Flags().BoolVar(&dropOtherIpIpTraffic, "drop-other-ipip-traffic", true, "Should Kilo drop other IP-over-IP traffic (not available in compatibility mode)?")
 
 	cmd.PersistentFlags().BoolVar(&printVersion, "version", false, "Print version and exit")
 	cmd.PersistentFlags().StringVar(&logLevel, "log-level", logLevelInfo, fmt.Sprintf("Log level to use. Possible values: %s", availableLogLevels))
@@ -216,7 +218,7 @@ func runRoot(_ *cobra.Command, _ []string) error {
 	case "cilium":
 		enc = encapsulation.NewCilium(e)
 	default:
-		enc = encapsulation.NewIPIP(e)
+		enc = encapsulation.NewIPIP(e, dropOtherIpIpTraffic)
 	}
 
 	gr := mesh.Granularity(granularity)