config.linkerd.io/default-inbound-policy setting in annotations not working

[wuzhuoquan]

According to the document https://linkerd.io/2.14/features/server-policy/, config.linkerd.io/default-inbound-policy default is all-unauthenticated
Then I want to test my workload to set it to deny, but after that, i still can request my workload api every where

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    config.linkerd.io/default-inbound-policy: "deny"
  name: app-1-v1
  namespace: five-test-2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app-1
  template:
    metadata:
      labels:
        app: app-1
        version: v1
      annotations:
        config.linkerd.io/default-inbound-policy: "deny"
    spec:
      containers:
      - env:
        - name: PORT
          value: "8080"
        - name: VERSION
          value: v1
        image: registry.yingmi-inc.com/app/test:python-demo-20231116
        imagePullPolicy: Always
        name: app
        ports:
        - containerPort: 8080
          name: app
          protocol: TCP
        readinessProbe:
          failureThreshold: 2
          httpGet:
            path: /hostname
            port: 8080
          initialDelaySeconds: 0
          timeoutSeconds: 3
          periodSeconds: 5
          successThreshold: 2
      enableServiceLinks: false
      imagePullSecrets:
      - name: ym-docker-registry-secrets
      restartPolicy: Always

curl from other pod

root@jump-5d4d555c44-8vkcz:/# curl http://app-1.five-test-2:8080/hostname
app-1-v1-6c7b7b6f77-t8cpqroot@jump-5d4d555c44-8vkcz:/#

And no mather I set this annotation in namespace or deployment or pod, it just can't work
the iptables rule

# Generated by iptables-save v1.4.21 on Fri Nov 24 16:03:44 2023
*raw
:PREROUTING ACCEPT [8291:668243]
:OUTPUT ACCEPT [8257:1525862]
COMMIT
# Completed on Fri Nov 24 16:03:44 2023
# Generated by iptables-save v1.4.21 on Fri Nov 24 16:03:44 2023
*nat
:PREROUTING ACCEPT [337:20220]
:INPUT ACCEPT [676:40560]
:OUTPUT ACCEPT [488:33450]
:POSTROUTING ACCEPT [488:33450]
:PROXY_INIT_OUTPUT - [0:0]
:PROXY_INIT_REDIRECT - [0:0]
-A PREROUTING -m comment --comment "proxy-init/install-proxy-init-prerouting/1700811354" -j PROXY_INIT_REDIRECT
-A OUTPUT -m comment --comment "proxy-init/install-proxy-init-output/1700811354" -j PROXY_INIT_OUTPUT
-A PROXY_INIT_OUTPUT -m owner --uid-owner 2102 -m comment --comment "proxy-init/ignore-proxy-user-id/1700811354" -j RETURN
-A PROXY_INIT_OUTPUT -o lo -m comment --comment "proxy-init/ignore-loopback/1700811354" -j RETURN
-A PROXY_INIT_OUTPUT -p tcp -m multiport --dports 4567,4568 -m comment --comment "proxy-init/ignore-port-4567,4568/1700811354" -j RETURN
-A PROXY_INIT_OUTPUT -p tcp -m comment --comment "proxy-init/redirect-all-outgoing-to-proxy-port/1700811354" -j REDIRECT --to-ports 4140
-A PROXY_INIT_REDIRECT -p tcp -m multiport --dports 4190,4191,4567,4568 -m comment --comment "proxy-init/ignore-port-4190,4191,4567,4568/1700811354" -j RETURN
-A PROXY_INIT_REDIRECT -p tcp -m comment --comment "proxy-init/redirect-all-incoming-to-proxy-port/1700811354" -j REDIRECT --to-ports 4143
COMMIT
# Completed on Fri Nov 24 16:03:44 2023
# Generated by iptables-save v1.4.21 on Fri Nov 24 16:03:44 2023
*filter
:INPUT ACCEPT [8291:668243]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [8257:1525862]
COMMIT
# Completed on Fri Nov 24 16:03:44 2023
# Generated by iptables-save v1.4.21 on Fri Nov 24 16:03:44 2023
*mangle
:PREROUTING ACCEPT [8291:668243]
:INPUT ACCEPT [8291:668243]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [8257:1525862]
:POSTROUTING ACCEPT [8257:1525862]
COMMIT
# Completed on Fri Nov 24 16:03:44 2023

[wuzhuoquan]

and linkerd check is

wuzq@wuzhuoqanmbp211 linkerd % linkerd check -n five-test-2
kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version

linkerd-existence
-----------------
√ 'linkerd-config' config map exists
√ heartbeat ServiceAccount exist
√ control plane replica sets are ready
√ no unschedulable pods
√ control plane pods are ready
√ cluster networks contains all node podCIDRs
√ cluster networks contains all pods
√ cluster networks contains all services

linkerd-config
--------------
√ control plane Namespace exists
√ control plane ClusterRoles exist
√ control plane ClusterRoleBindings exist
√ control plane ServiceAccounts exist
√ control plane CustomResourceDefinitions exist
√ control plane MutatingWebhookConfigurations exist
√ control plane ValidatingWebhookConfigurations exist
√ proxy-init container runs as root user if docker container runtime is used

linkerd-identity
----------------
√ certificate config is valid
√ trust anchors are using supported crypto algorithm
√ trust anchors are within their validity period
√ trust anchors are valid for at least 60 days
√ issuer cert is using supported crypto algorithm
√ issuer cert is within its validity period
√ issuer cert is valid for at least 60 days
√ issuer cert is issued by the trust anchor

linkerd-webhooks-and-apisvc-tls
-------------------------------
√ proxy-injector webhook has valid cert
√ proxy-injector cert is valid for at least 60 days
√ sp-validator webhook has valid cert
√ sp-validator cert is valid for at least 60 days
√ policy-validator webhook has valid cert
√ policy-validator cert is valid for at least 60 days

linkerd-version
---------------
√ can determine the latest version
‼ cli is up-to-date
    is running version 2.14.4 but the latest stable version is 2.14.5
    see https://linkerd.io/2.14/checks/#l5d-version-cli for hints

control-plane-version
---------------------
√ can retrieve the control plane version
‼ control plane is up-to-date
    is running version 2.14.4 but the latest stable version is 2.14.5
    see https://linkerd.io/2.14/checks/#l5d-version-control for hints
√ control plane and cli versions match

linkerd-control-plane-proxy
---------------------------
√ control plane proxies are healthy
‼ control plane proxies are up-to-date
    some proxies are not running the current version:
	* linkerd-destination-d6555ff86-rtb5p (stable-2.14.4)
	* linkerd-identity-76559cf74b-vg7p9 (stable-2.14.4)
	* linkerd-proxy-injector-7498ccb4c-6mthj (stable-2.14.4)
    see https://linkerd.io/2.14/checks/#l5d-cp-proxy-version for hints
√ control plane proxies and cli versions match

linkerd-viz
-----------
√ linkerd-viz Namespace exists
√ can initialize the client
√ linkerd-viz ClusterRoles exist
√ linkerd-viz ClusterRoleBindings exist
√ tap API server has valid cert
√ tap API server cert is valid for at least 60 days
√ tap API service is running
√ linkerd-viz pods are injected
√ viz extension pods are running
√ viz extension proxies are healthy
‼ viz extension proxies are up-to-date
    some proxies are not running the current version:
	* metrics-api-678f5fbb69-r75hq (stable-2.14.4)
	* prometheus-5556f7ccc6-6pdp5 (stable-2.14.4)
	* tap-6b978b49b-xtpb9 (stable-2.14.4)
	* tap-injector-54b7b8c7d4-rwhkl (stable-2.14.4)
	* web-85c6d46469-d8lkl (stable-2.14.4)
    see https://linkerd.io/2.14/checks/#l5d-viz-proxy-cp-version for hints
√ viz extension proxies and cli versions match
√ prometheus is installed and configured correctly
√ viz extension self-check

Status check results are √

[wuzhuoquan]

the probe path will always allow !!!