Hubble doesn't log DROP_NO_SERVICE for Service with no pods behind it

[anupamdialpad]

As per this comment cilium/cilium#31786 (comment). Hubble should be logging DROP_NO_SERVICE if a Service has no backend pods behind it. But I am not seeing it.

There is a Service deployed with external ip 199.27.150.149

I try to connect to the service ip on port 5060 from within on of the pod

Hubble observe doesn't show anything

[mterwill]

👋 I am also seeing this issue on the latest 1.17.3.

Doing something like this:

1. Create a service with no backends

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app.kubernetes.io/name: nothing
  ports:
    - protocol: TCP
      port: 80
      targetPort: 9376

2. Attempt to reach that service from another pod inside the cluster

root@test:/go# curl -v my-service
* Host my-service:80 was resolved.
* IPv6: (none)
* IPv4: 10.96.190.73
*   Trying 10.96.190.73:80...
* Immediate connect fail for 10.96.190.73: Operation not permitted
* Failed to connect to my-service port 80 after 15 ms: Couldn't connect to server
* Closing connection
curl: (7) Failed to connect to my-service port 80 after 15 ms: Couldn't connect to server

3. Observe no relevant events in a hubble observe -f.

I'm fairly sure the request is going through Cilium:

KubeProxyReplacement Details:
  Status:                 True
  Socket LB:              Enabled
  Socket LB Tracing:      Enabled
  Socket LB Coverage:     Full
  Devices:                eth0    172.18.0.7 fc00:f853:ccd:e793::7 fe80::e4a3:c6ff:fefe:cc5c (Direct Routing)
  Mode:                   SNAT
  Backend Selection:      Random
  Session Affinity:       Enabled
  Graceful Termination:   Enabled
  NAT46/64 Support:       Disabled
  XDP Acceleration:       Disabled
  Services:
  - ClusterIP:      Enabled
  - NodePort:       Enabled (Range: 30000-32767)
  - LoadBalancer:   Enabled
  - externalIPs:    Enabled
  - HostPort:       Enabled
  Annotations:
  - service.cilium.io/node
  - service.cilium.io/src-ranges-policy
  - service.cilium.io/type

I'd love to be able to use this in conjunction with cilium/cilium#29565 to report to users on their pods when they're trying to contact a service that's not ready. We are using cilium in our development environments and would like to raise visibility of these events in our UI.