Whisker didn't record hostendpoint connection

In calico 3.30, I can use ufw to protect hostendpoint connection and use GlobalNetworkPolicy to protect pod-svc connection. After using calico 3.32, I can't use the old way, seem the behaviour of eBPF is different now. (I tested many time...) So I tried to disable ufw, and use GlobalNetworkPolicy to do all the protection. But the behaviour is really strange. Even I disable failsafe rule and apply a StagedGlobalNetworkPolicy for default deny. Whisker didn't show deny record for hostendpoint. But if I apply a GlobalNetworkPolicy for default deny, system will total crash. (I know it is 'of course')

If Whisker can't record hostendpoint connection, it is very hard to troubleshoot. I don't know if it is my fault. If yes, please let me know how to set a StagedGlobalNetworkPolicy for whisker to capture hostendpoint connection, so I can setup policy according to them.

Expected Behavior

Whisker record hostendpoint connection .

Current Behavior

Whisker didn't record hostendpoint connection .

Possible Solution

Nope

Steps to Reproduce (for bugs)

1. disable all node firewall (ufw)
2. Enable hostEndpoint calicoctl patch kubecontrollersconfiguration default --patch='{"spec": {"controllers": {"node": {"hostEndpoint": {"autoCreate": "Enabled"}}}}}'
3. Disable fail safe kubectl patch felixconfiguration default --type merge -p '{"spec": {"failsafeInboundHostPorts": [], "failsafeOutboundHostPorts": []}}'
4. Set StagedGlobalNetworkPolicy tee deny-all.yaml <<EOFapiVersion: projectcalico.org/v3 kind: StagedGlobalNetworkPolicy metadata: name: deny-all spec: ingress: egress: EOF kubectl apply -f deny-all.yaml
5. Whisker didn't show any record about stage deny when I check using other server to telnet 22 port
6. I expect nothing really deny, then use apply GlobalNetworkPolicy tee deny-all.yaml <<EOF apiVersion: projectcalico.org/v3 kind: GlobalNetworkPolicy metadata: name: deny-all spec: ingress: egress: EOF calicoctl apply -f deny-all.yaml
7. Whole systemc down, can not ssh anymore

Context

Your Environment

Calico 3.32.1 bpf k8s v1.36 Ubuntu 24.04.4 LTS 6.8.0-136-generic

• Link to your project (optional):