Skip to main content

Browse the archive

https://github.com/cilium/cilium
12 July 2024, 03:14:21 UTC
sort by:
Revision Author Date Message Commit Date
e66114f Martynas Pumputis 15 January 2020, 14:27:23 UTC WIP Signed-off-by: Martynas Pumputis <m@lambda.lt> 15 January 2020, 14:27:23 UTC
130bddf Martynas Pumputis 15 January 2020, 10:49:54 UTC daemon: Replace --enable-dsr with --node-port-mode As we are planning to support multiple mutually inclusive modes for NodePort, introduce a flag to store them. Also, re-use the flag for enabling the DSR option. Signed-off-by: Martynas Pumputis <m@lambda.lt> 15 January 2020, 10:49:54 UTC
04c6f1d Martynas Pumputis 10 January 2020, 16:56:06 UTC test: Fix DatapathConfiguration tests when running on >2 nodes Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
c31b62d Martynas Pumputis 10 January 2020, 16:31:46 UTC test: Improve indentation of kubeproxy-free tests Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
5dd1114 Martynas Pumputis 10 January 2020, 16:06:14 UTC test: Run curl from k8s3 instead of client-from-outside container Previously, we ran curl from the "client-from-outside" container in the tests which required sending requests from a third host. We simulated the third host by running a container ("client-from-outside") in a Docker network which was not managed by Cilium. Unfortunately, requests sent to a NodePort service from the container were handled by bpf_sock.c which prevented from testing the NodePort implementation in bpf_netdev.c. Fix it by introducing a "real" host, and run curl from it. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
b0db339 Martynas Pumputis 10 January 2020, 15:56:54 UTC test: Run k8s1-1.11 net-next on 3 VMs This is going to be needed by some k8sT/Services.go tests. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
f338bdc Martynas Pumputis 09 January 2020, 11:40:15 UTC test: Allow provisioning arbitrary number of VMs Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
5bb6748 Martynas Pumputis 08 January 2020, 10:55:07 UTC nat: GC NAT entries created by DSR In the case of DSR, the following CT and NAT entries are created on a host which runs a service endpoint and to which a client request is forwarded: * NAT: endpoint -> client (XLATE_SRC aka TUPLE_F_OUT) * CT: client -> endpoint (TUPLE_F_IN) Previously, the CT GC ignored NAT entries when a corresponding CT entry was of the TUPLE_F_IN type. Therefore, the DSR NAT entries could not have been collected. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
ded49cc Martynas Pumputis 23 December 2019, 17:36:11 UTC test: Schedule test-nodeport-local pod on k8s2 For the DSR test case, we need to schedule the test-k8s2 (prev. test-k8s1) pod on k8s2. Otherwise, a request from the client-from-outside Docker container running on k8s1 to the pod via k8s2 (sending via k8s1 does not test the DSR) would be dropped by the kernel due to a routing loop detection mechanism: 1) k8s2 recv: client-from-outside (192.168.10.10) @ k8s1 -> k8s2:NodePort 2) k8s2 fwd to k8s1: client-from-outside (192.168.10.10) @ k8s1 -> Pod @ k8s1 3) k8s1 recv the packet on enp0s8, and has a route "192.168.10.0/24 dev $DOCKER_BRIDGE" <- kernel detects a potential loop. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
2fdfb91 Martynas Pumputis 19 December 2019, 17:16:57 UTC test: Add DSR IPv4 integration tests Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:16 UTC
d6a7fcb Martynas Pumputis 22 October 2019, 12:51:04 UTC datapath: Add DSR for NodePort BPF IPv4 This commit adds a direct server return (DSR) support for the NodePort BPF for IPv4 and in the direct routing mode. The main idea of DSR is to avoid SNAT'ing an original request sent to an LB, so that a backend could directly reply to a client (the originator of the request) and the original source IP could be preserved. To achieve this, we introduce a new IPv4 option which stores a NodePort service IP and port number. The option is set by bpf_netdev running on a public iface of an intermediate node which received the original request. Once the option has been set, the request (the dst IP addr of the request is DNAT'd to the backend IP addr) is forwarded to a node running the backend. After receiving the fwd'd request, bpf_lxc of the backend parses the option, stores the svc addr:port in the NAT table and sets the "dsr" bit in a CT entry. When sending a reply to the client, bpf_lxc finds out that the "dsr" bit was set, does a lookup in the NAT table to find the mapping, and finally rewrites the source addr and port to the svc addr and port. The current approach has a shortcoming that if the request size is > (MTU - 8bytes), the request will be dropped after we append the IPv4 option. To partially solve this, in the case of TCP we set the option only for SYN packets which should have an empty payload. However, the problem still exists for TCP with SYN cookies and UDP packets. For those cases, a client needs to decrease its MTU by 8bytes. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 15:10:10 UTC
d16ebad Martynas Pumputis 22 October 2019, 12:41:46 UTC helm: Add global.nodePort.dsr Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 14:09:25 UTC
83d2199 Martynas Pumputis 22 October 2019, 12:41:13 UTC daemon: Add --enable-dsr param The param is used to enable direct server return (DSR) for the NodePort BPF. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 14:09:25 UTC
2fbeebc André Martins 16 December 2019, 15:58:43 UTC docs: remove disable container runtime documentation Since container runtime integration has been removed from Cilium, we can remove this part of the documentation as well. Signed-off-by: André Martins <andre@cilium.io> 14 January 2020, 12:54:54 UTC
46141ff Martynas Pumputis 13 January 2020, 14:28:12 UTC bpf: Compile bpf_netdev.c with build permutations Add a make target for bpf_netdev.c to compile it against permutations of the most common options. Helps to catch bpf_netdev.c compile errors faster than waiting until cilium-agent -> bpf/init.sh returns them. Signed-off-by: Martynas Pumputis <m@lambda.lt> 14 January 2020, 12:40:41 UTC
c4c4596 Daniel Borkmann 13 January 2020, 21:30:08 UTC docs, minor: update mailmap and authors file Given we're doing misc doc updates, also do a round of AUTHORS file sync. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 14 January 2020, 08:52:38 UTC
b439f53 Daniel Borkmann 13 January 2020, 20:29:21 UTC docs: slightly improve USERS.md description - Move example entry into 'Adding yourself as a user' section - Add optional 'L:' with link for further information - Fix typo ClusteMesh - Fix underline for 'Users' title - Link to Cilium Slack community Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 14 January 2020, 08:52:38 UTC
4f7e033 Laurent Bernaille 13 January 2020, 15:12:09 UTC Add Datadog to users Signed-off-by: Laurent Bernaille <laurent.bernaille@datadoghq.com> 13 January 2020, 19:48:46 UTC
a8c6834 André Martins 13 January 2020, 17:26:28 UTC README: update weekly meeting hours Signed-off-by: André Martins <andre@cilium.io> 13 January 2020, 18:22:48 UTC
dd38573 Thomas Graf 13 January 2020, 13:20:59 UTC eni: Fix releases of excess IPs The release of excess IPs has been incorrect due to not taking into account the max-above-watermark limit in combination with min-allocate. This bug was hidden in the unit test as min-allocate was set to a value equal to the max IP limit of the interface which rendered the value of max-above-watermark (4) to never be taken into account as min-allocate had already maxed out the interface limit. Fix the calculation of excess IPs to never fall below min-allocate + max-above-watermark and change the unit tests to cover this scenario. This fixes a bug where IPs would always be immediately released again if min-allocate was greater than pre-allocate and the number of used IPs did not make up for that gap. Signed-off-by: Thomas Graf <thomas@cilium.io> 13 January 2020, 18:16:29 UTC
43be0e6 Dharma Bellamkonda 12 January 2020, 01:03:00 UTC Update USERS.md Signed-off-by: Dharma Bellamkonda <dharma.Bellamkonda@gmail.com> 13 January 2020, 18:15:54 UTC
8e24b5a Martynas Pumputis 13 January 2020, 13:56:52 UTC datapath: Return err if default route is not found Previously, cilium-agent was panicking if no default route was found: panic: runtime error: index out of range [0] with length 0 goroutine 1 [running]: github.com/cilium/cilium/pkg/datapath/linux/route.lookupDefaultRoute(0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /go/src/github.com/cilium/cilium/pkg/datapath/linux/route/route.go:104 +0x445 To fix this, return an error instead. Fixes: 63297f3085 ("cilium, daemon: fix device detection for default route") Signed-off-by: Martynas Pumputis <m@lambda.lt> 13 January 2020, 16:21:43 UTC
e490829 Daniel Borkmann 13 January 2020, 13:36:30 UTC cilium: slightly improve bpf lb flags output Before: # ./cilium/cilium bpf lb list SERVICE ADDRESS BACKEND ADDRESS 8.8.8.8:30003 0.0.0.0:0 (3) [FLAGS: NONE] 10.12.164.240:80 (3) 8.8.8.8:30002 0.0.0.0:0 (2) [FLAGS: NodePort] 10.12.164.240:80 (2) 8.8.8.8:30001 10.12.164.240:80 (1) 0.0.0.0:0 (1) [FLAGS: ExternalIPs] After: # ./cilium/cilium bpf lb list SERVICE ADDRESS BACKEND ADDRESS 8.8.8.8:30003 0.0.0.0:0 (3) [ClusterIP] 10.12.164.240:80 (3) 8.8.8.8:30002 0.0.0.0:0 (2) [NodePort] 10.12.164.240:80 (2) 8.8.8.8:30001 10.12.164.240:80 (1) 0.0.0.0:0 (1) [ExternalIPs] Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 13 January 2020, 16:08:37 UTC
b4e0402 Daniel Borkmann 13 January 2020, 10:17:00 UTC bpf, nodeport: add nodeport flag to nodeport services Similar to ExternalIPs add a NodePort flag to services in order to distinguish NodePort exposed services vs ClusterIP ones and reject bogus requests from outside trying to reach ClusterIP ones. Similarly, assert in bpf_sock that the second lookup is really a NodePort service. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 13 January 2020, 16:08:37 UTC
acfc27e Daniel Borkmann 13 January 2020, 09:40:22 UTC bpf, external ip: always build in external ip check logic Simplify the ifdef hackery to always build-in the code that checks on external ip. Latter is also needed for follow-up code in NodePort; we can compile out the actual check for svc->external when it is disabled. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 13 January 2020, 16:08:37 UTC
cc100d0 Robin Hahling 13 January 2020, 09:09:57 UTC SECURITY.md: update versions of supported releases Current supported versions are 1.6, 1.5 and 1.4. Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> 13 January 2020, 13:43:55 UTC
4f6184b Eric Bailey 10 January 2020, 18:54:35 UTC USERS.md: add Sportradar Signed-off-by: Eric Bailey <e.bailey@sportradar.com> 11 January 2020, 14:41:15 UTC
6426c86 Daniel Borkmann 10 January 2020, 19:03:29 UTC bpf, external ip: fix service xlation for containers We need to compile the service lookup back in for bpf_lxc when in the config ENABLE_EXTERNAL_IP is set. Reason is that for !local IPs we correctly bypass the xlation in the host ns, but given BPF cgroups hook is not ns aware, it's also bypassed for containers which is not the behavior of iptables based kube-proxy. Therefore, the only way to fix it is to rely in this case on the veth ingress hook and finalize the external IP xlation there. Spotted by Andre's amazing kube-proxy test suite. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 23:02:13 UTC
4ac28ce Daniel Borkmann 10 January 2020, 18:58:59 UTC bpf: make bpf_sock REMOTE_NODE_ID aware Retain the same behavior when remote node IDs are enabled in order to retain xlation of i) NodePort services at the node as well as ii) external IP entries. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 23:02:13 UTC
6ac70c8 Daniel Borkmann 10 January 2020, 17:26:46 UTC bpf: fix sock6_xlate when not all host service protocols are enabled We have the case in v4, and the v6 one got accidentally removed in commit 2bf35ed2f2a0 ("add correct implementation of k8s externalIPs in datapath"). Restore it back. Fixes: 2bf35ed2f2a0 ("add correct implementation of k8s externalIPs in datapath") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 23:02:13 UTC
19b18f2 Daniel Borkmann 10 January 2020, 16:07:12 UTC bpf, misc, trivial: cleanup external service naming The BPF datapath is not and should not be aware of any k8s details, thus drop the k8s from external IP name. Also, we'll add nodeport bit next, which would otherwise need to have a k8s_nodeport name. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 23:02:13 UTC
33f32a0 Jarno Rajahalme 09 January 2020, 23:06:25 UTC policy: Do not merge rules for reserved:none toFQDN currently translates to "reserved:none" as an endpoint selector. Apparently this is needed due to logic requiring that the list of endpoint selectors be not empty. This has the side-effect that we currently create also populate and merge rules for the cached selector for "reserved:none". This merging currently fails if any of the TLS details for the to-be-merged rules are different, as in the case of terminating TLS for two different domain names. As the first level fix, skip merging rules for a cached selector represtation of "reserved:none". Longer term we should seek solutions where "reserved:none" would not be used in the first place. Change the TLS CI test to use two different domain names. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
718637f Jarno Rajahalme 09 January 2020, 23:06:24 UTC test: TLS test with swapi.co Change the TLS toFQDN test us use 'swapi.co' instead of 'www.lyft.com' Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
d97c95b Jarno Rajahalme 09 January 2020, 23:06:24 UTC test: Use more TLS client CA certs Use a newly generated 'testCA' for signing TLS interception certificates. Passphrase for the 'testCA' key is 'cilium'. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
cabf83c Jarno Rajahalme 09 January 2020, 23:06:23 UTC crypto: Add local GetSecrets(). Factor out code reading secrets from the local file system or k8s to GetSecrets(). This cleans up the code and allows the same semantics to be used to getting secret strings as for TLS contexts. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
998c07a Jarno Rajahalme 09 January 2020, 23:06:24 UTC envoy: Increase max log token length to 1MB Long log lines may stop the Envoy log scanner within cilium-agent. Increase the max token size from the default 64kB to 1MB to be safe, but note that such long logs should normally not happen. Signed-off-by: Jarno Rajahalme <jarno@colalent.io> 10 January 2020, 22:09:27 UTC
abc1e9b Jarno Rajahalme 10 January 2020, 00:13:42 UTC daemon: Increase default max DNS policy update wait time from 50 to 100ms CI tests fail due to policy updates to Envoy taking longer than 50 ms. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
f8ea5cf Jarno Rajahalme 09 January 2020, 23:06:25 UTC envoy: Avoid logging policy Policy can contain sensitive information, so avoid logging it. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
f081e20 Jarno Rajahalme 09 January 2020, 23:06:23 UTC Dockerfile: Use fixed Envoy image Use Envoy image with fixed upstream SNI support for the original destination cluster & reduced logging. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 10 January 2020, 22:09:27 UTC
88b012a Daniel Borkmann 10 January 2020, 15:18:16 UTC cilium: use %v for dumping frontend struct on error Lets not pretend we try to make users happy with small Haikus on service update errors. ;-) The U+7532 is dumped due to the service port: # ./cilium/cilium service update --frontend "8.8.8.8:30002" --backends "10.12.164.240:80" --id 3 Updating existing service with id '3' Error: Cannot add/update service: [PUT /service/{id}][500] putServiceIdFailure Unable to allocate service ID 3 for {{"8.8.8.8" {"TCP" '甲'}} '\x03'}: Service ID 3 is already registered to "192.168.178.29:30002" Use %v instead of %q format string to fix it: # ./cilium/cilium service update --frontend "8.8.8.8:30002" --backends "10.12.164.240:80" --id 3 Updating existing service with id '3' Error: Cannot add/update service: [PUT /service/{id}][500] putServiceIdFailure Unable to allocate service ID 3 for {{8.8.8.8 {TCP 30002}} 3}: Service ID 3 is already registered to "192.168.178.29:30002" Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 19:25:18 UTC
63297f3 Daniel Borkmann 10 January 2020, 14:17:11 UTC cilium, daemon: fix device detection for default route I noticed on one of my test machines that the agent refuses to start up when IPv6 and NodePort gets enabled: [...] level=info msg=" - !:pod-template-generation" subsys=labels-filter level=info msg=" - !:pod-template-hash" subsys=labels-filter level=info msg=" - !:controller-revision-hash" subsys=labels-filter level=info msg=" - !:annotation.*" subsys=labels-filter level=info msg=" - !:etcd_node" subsys=labels-filter level=info msg="Auto-enabling host reachable services for UDP and TCP as required by BPF NodePort." subsys=daemon level=fatal msg="BPF NodePort's external facing device could not be determined. Use --device to specify." error="Found (2) default routes" subsys=daemon # Turns out in case of IPv6 the machine had the same route but different MTU metric: # ip -6 r | grep default default via fe80::9a9b:cbff:fe05:1eae dev eno1 proto ra metric 100 mtu 1492 pref medium default via fe80::9a9b:cbff:fe05:1eae dev eno1 proto ra metric 1024 pref medium # ip -4 r | grep default default via 192.168.178.1 dev eno1 proto dhcp src 192.168.178.28 metric 100 Fix the detection to walk and check all ifindices wrt whether they are equal, and if that is the case then proceed normally. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 18:53:09 UTC
e45140c Daniel Borkmann 10 January 2020, 13:49:31 UTC bpf: simplify error codes for connect/sndmsg/rcvmsg progs Noticed that the v6 UDP sendmsg prog had CONNECT_PROCEED instead of SENDMSG_PROCEED. In the end they end up with the same code, but lets get rid of the different defines and have a single SYS_PROCEED and SYS_REJECT. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 17:19:00 UTC
f0de246 Daniel Borkmann 10 January 2020, 10:56:57 UTC bpf: fix regular service lookup in nodeport range for host services Rework and simplify the externalIP handling code in BPF cgroup progs in order to also handle the case of a regular ClusterIP service where its exposed port sits in the NodePort range. Right now, connectivity fails for such corner case since we always assume NodePort in this range. Therefore, i) do the regular non-wildcarded lookup always in the first step to cover externalIP, ClusterIP and a part of the NodePort lookup on public/private interface and only if nothing is found there, perform the wildcarded lookup for covering the rest of the NodePort cases (other, local IPs and loopback IP). Reported-by: Andre Martins <andre@cilium.io> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 10 January 2020, 17:19:00 UTC
2b8e26c Vlad Ungureanu 09 January 2020, 22:14:16 UTC Add Palantir Technologies to USERS.md Signed-off-by: Vlad Ungureanu <vladu@palantir.com> 09 January 2020, 22:21:54 UTC
f45ca16 ap4y 07 January 2020, 00:52:58 UTC Add cilium-monitor sidecar container for agent pods Cilium debugging across a cluster involves running cilium monitor manually on every node of the cluster. This MR introduces optional monitor sidecar container for agent's daemon set. This will simplify monitor startup across a cluster and will expose monitor event to the 'kubectl logs'. Monitor container is disabled by default (monitor.enabled), event types can be adjusted via monitor.eventTypes. Signed-off-by: Arthur Evstifeev <aevstifeev@gitlab.com> 08 January 2020, 22:47:38 UTC
3382082 André Martins 08 January 2020, 15:39:27 UTC docs: fix kubernetes configmap The ConfigMap is not correctly formated. This commit fixes it so that users won't have problems using this configuration as an example for their setups. Signed-off-by: André Martins <andre@cilium.io> 08 January 2020, 20:00:04 UTC
ad6fed8 Daniel Borkmann 08 January 2020, 13:47:42 UTC bpf, nat: clamp original source port into dest nat range If a source port has been selected by the remote which is not in our destination NAT range, we need to clamp it. Spotted by Martynas. Also add v6 support for 0d5062e99cfb ("bpf, nat: initially try snat by preserving source port"). Fixes: 0d5062e99cfb ("bpf, nat: initially try snat by preserving source port") Reported-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 08 January 2020, 17:55:18 UTC
89aee18 Daniel Borkmann 08 January 2020, 12:11:23 UTC identity: require global identity for empty labels On recent master, I noticed that there's a lack of connectivity when going over vxlan tunnel. Git bisection pointed me to commit 28dc941544f1 ("bpf: Map HOST_ID to REMOTE_NODE_ID when encapsulating"). After a closer look, it turns out however that 28dc941544f1 itself does nothing wrong, and for tunnel ID the reserved REMOTE_NODE_ID was properly set for traffic going out of the node via curl from hostns. However, the packets got dropped due to the identity == HOST_ID check on replies even though they are originating from a remote container. Turns out those containers had identity of 16777217 which is 0b100000000000000000000001 and therefore get truncated in case of vxlan tunnel id since it's 24 bits width. Moreover, packets with such 0dab1b63b87c ("identity: Introduce local scope for numeric identity") identity are only for local scope and not destined to leave the node. Turns out for empty labels f3bbcd8e886d ("identity: Use local identities to represent CIDR") RequiresGlobalIdentity() returns false which is not correct; fix gets connectivity working again. Fixes: f3bbcd8e886d ("identity: Use local identities to represent CIDR") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 08 January 2020, 17:38:59 UTC
6c23f97 Jarno Rajahalme 03 January 2020, 22:30:16 UTC policy/api: Factor out Secret.Equal() Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 08 January 2020, 15:47:34 UTC
78dcf61 Jarno Rajahalme 03 January 2020, 22:29:23 UTC tls: Fix comments and logging Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 08 January 2020, 15:47:34 UTC
9a6c605 Jarno Rajahalme 03 January 2020, 22:27:44 UTC k8s: Make secret name and TLS context secret required policy fields. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 08 January 2020, 15:47:34 UTC
fa34e8f Jarno Rajahalme 03 January 2020, 22:26:13 UTC crypto: Simplify error handling in certificatesmanager. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 08 January 2020, 15:47:34 UTC
aab7482 Ray Bejjani 09 December 2019, 14:50:26 UTC CI: On EKS, skip K8sServicesTest Bookinfo Demo Ingress proxying doesn't work when chaining, and so won't work on EKS. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
51af00c Ray Bejjani 09 December 2019, 14:18:53 UTC CI: On EKS, skip K8sServicesTest Checks service across nodes with L7 policy Ingress proxying doesn't work when chaining, and so won't work on EKS. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
22ee8bb Ray Bejjani 30 November 2019, 21:36:46 UTC CI: On EKS, skip cilium-health --probe endpoint-endpoint checks fail, and the healthcheck --probe will do that. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
2409974 Ray Bejjani 26 November 2019, 14:00:41 UTC CI: On EKS, skip cilium-health test cilium-health probe doesn't work when chaining, such as on flannel & EKS. The health test cannot pass in this case, and should be skipped. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
ba531da Ray Bejjani 29 November 2019, 11:06:55 UTC CI: Refactor SkipIfFlannel to handle any integration We need to skip tests for various reasons, often predicated on the integration chosen. For the common case of "skip if we're running with integration X" the `SkipIf` function is a simple and clean way to indicate this. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
6604570 Ray Bejjani 26 November 2019, 17:25:12 UTC CI: Add GetNodeIPByLabel helper Some tests need the node's IP but this can change based on the test environment. We can derive these easily instead of hard-coding them. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
11bb75d Ray Bejjani 29 November 2019, 12:58:07 UTC CI: Add GetNodeNameByLabel helpers We switched to labelling nodes instead of using fixed names to facilitate varied testing environments. These functions help with lookups when trying to run on a specific node. Signed-off-by: Ray Bejjani <ray@isovalent.com> 08 January 2020, 13:20:03 UTC
0d5062e Daniel Borkmann 06 January 2020, 17:15:31 UTC bpf, nat: initially try snat by preserving source port Originally we moved the prandom call out of the unrolled port collision loop in order to reduce verifier complexity but it seems better if we first try to preserve as much as possible before doing any rewrites. For latter we need to reduce the retry loop on older kernels when v4 + v6 is enabled as a trade-off between 4.19.57 and 5.3. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 07 January 2020, 10:51:16 UTC
0c01497 Michal Rostecki 24 December 2019, 12:59:38 UTC bpf: Remove unused BPF feature probes/macros The following macros were used in the old implementation of load balancer, but are not used anymore: - HAVE_MAP_VAL_ADJ - HAVE_MARK_MAP_VALS Also, those feature are available in kernel 4.9+, which is already required for running Cilium. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> 06 January 2020, 16:20:50 UTC
e270c23 Thomas Graf 06 January 2020, 14:06:10 UTC Adding USERS directory to create a list of Cilium users Sharing experiences and learning from other users is important. We are frequently asked who is using a particular feature of Cilium in order to get in contact with other users of a particular features to share experiences and best-practices. While the Slack community allows users to get in touch, it can be challenging to quickly find users of a particular feature. Signed-off-by: Thomas Graf <thomas@cilium.io> 06 January 2020, 15:40:57 UTC
353a20c Joe Stringer 23 December 2019, 18:00:50 UTC test: Make helm fetch more quiet Recent CI builds have consumed as many as 4300 lines of CLI output per attempt to download the helm client, over the course of about 6 seconds. Use the `-nv` (no verbose) option to quieten this output to only info/error/warnings; converts into about one line of output: $ wget -nv https://get.helm.sh/helm-v2.14.2-linux-amd64.tar.gz 2019-12-23 10:00:32 URL:https://get.helm.sh/helm-v2.14.2-linux-amd64.tar.gz [26534215/26534215] -> "helm-v2.14.2-linux-amd64.tar.gz" [1] Signed-off-by: Joe Stringer <joe@cilium.io> 02 January 2020, 21:37:28 UTC
d7ff1c8 Thomas Graf 27 December 2019, 15:21:15 UTC operator: Only start kvstore GC if kvstore is enabled The log line indicating the kvstore GC has been started is confusing if kvstore mode is not enabled. Signed-off-by: Thomas Graf <thomas@cilium.io> 27 December 2019, 17:59:48 UTC
8c2247d Thomas Graf 27 December 2019, 15:14:34 UTC operator: Improve identity GC logging No log line indicated whether the CRD identity GC has been started or not. Signed-off-by: Thomas Graf <thomas@cilium.io> 27 December 2019, 17:59:48 UTC
0b27e79 Thomas Graf 18 December 2019, 16:29:32 UTC helm: Enable remote-node identity for all new deployments by default Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
87eeaa2 Thomas Graf 20 December 2019, 13:20:32 UTC bpf: Prohibit the IPv6 flowlabel transport to represent HOST_ID The existing codepath was already never presenting HOST_ID as the source identity and with the introduction of REMOTE_NODE_ID, this is guarnateed to be impossible. Drop such packets with an appropriate error code. Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
28dc941 Thomas Graf 18 December 2019, 16:29:32 UTC bpf: Map HOST_ID to REMOTE_NODE_ID when encapsulating When encapsulating to other nodes, any traffic originating from the local host must be presented as remote node traffic as it is being received. Therefore, map any use of HOST_ID to REMOTE_NODE_ID. Consequently, drop any traffic received as HOST_ID in bpf_overlay. Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
bbfabcf Thomas Graf 18 December 2019, 16:29:32 UTC node: Assign remote node identity to all node IPs Node IPs other than the Cilium internal IPs where only added to the ipcache so far when encryption was enabled. This commit adds all node IPs to the ipcache and assign the correct node identity. The code is cleaned up while doing so. `n.GetNodeIP(false)` always returns the IPv4 node address and is not dependant on the current address while iterating over all node addresses. Calling it inside the loop is therefore unnecessary as the result is always the same. Similarly, the `nodeIP4` variable is redundant as the nodeIP is always an IPv4 address anyway. Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
becf7dd Thomas Graf 18 December 2019, 16:29:32 UTC policy: Add remote-node entity This allows matching remote nodes with a policy entity. Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
975f7b7 Thomas Graf 18 December 2019, 16:29:32 UTC node: Use remote-node identity when enabled Assign the new remote-node identity to all remote hosts if the option is enabled. The option is disabled by default as it has the potential to change existing policy rules where users are relying on the behavior that allowing from the host will allow traffic from all hosts in the cluster. Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
702913d Thomas Graf 18 December 2019, 16:29:32 UTC policy: Introduce reserved identity for remote cluster nodes Signed-off-by: Thomas Graf <thomas@cilium.io> 26 December 2019, 14:10:06 UTC
70c2eae dhsathiya 24 December 2019, 10:23:59 UTC Fix table markdown spacing issue Columns on row 3 of the table were not getting seperated due to it. Signed-off-by: dhsathiya <devarshisathiya5@gmail.com> 24 December 2019, 11:53:43 UTC
6b784d8 Ray Bejjani 20 December 2019, 14:02:35 UTC daemon: Upgrade spf13/viper We began using .IsSet to handle --tofqdns-min-ttl=0 invocations but older viper versions always returned true from this function. This then caused the default value to never be used, instead using the 0 default used when initializing the variable. fixes 078f19d6b52ebc099edc2ed2a48a25818b6e4a56 Signed-off-by: Ray Bejjani <ray@isovalent.com> 23 December 2019, 17:20:39 UTC
da34687 Jarno Rajahalme 12 December 2019, 17:21:22 UTC k8s: TLS testing Add simple TLS test to access an external resource via the proxy. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 20 December 2019, 15:46:59 UTC
32b3025 Jarno Rajahalme 12 December 2019, 17:21:22 UTC test: Add runtime test for imposing an HTTP header Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 20 December 2019, 15:46:59 UTC
13db448 Jarno Rajahalme 12 December 2019, 17:24:26 UTC policy: Add API for actions on header mismatches Allow replacing logging, deleting, adding, and replacing mismatching headers. Now that we can have rules with side-effect, we must track if HTTP rules can be short circuited. If no rules have side-effects, then the policy evaluationn can be stopped as soon as a decision to pass traffic has been found. If rules include side-effects, we must evaluate all applicable rules. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 20 December 2019, 15:46:59 UTC
c8f4b5b Jarno Rajahalme 12 December 2019, 17:21:21 UTC policy: Map Envoy HTTP rules when translating policy Supporting secrets is easier if we translate HTTP policies while in the policy computation context. Translating HTTP policies erlier also reduces unnecessary work of re-translating them when policy remains but IDs change. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 20 December 2019, 15:46:59 UTC
7393662 Jarno Rajahalme 12 December 2019, 17:21:21 UTC policy: Translate TLS contexts into PerEpData Resolve TLS contexts earlier in the process. Get the default namespace from the security identity rather than the rule. This allows for a default namespace to be well defined even if none of the rules have a namespace label. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 20 December 2019, 15:46:59 UTC
c17f5c2 Jarno Rajahalme 12 December 2019, 17:21:20 UTC policy: Add PolicyContext Add PolicyContext, a collection of references to resources needed during policy computation. Initially this holds just a SelectorCache, but later commits will add more items without then needing to update and bloat all the function prototypes. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 20 December 2019, 15:46:59 UTC
8610686 Jarno Rajahalme 12 December 2019, 17:21:20 UTC api: Add API support for k8s secrets Add API definitions for k8s secrets and plumb them into Envoy policy updates. Add certificate manager to find certificates either locally or in k8s Map keys "tls.key" and "tls.crt" are used for the private key and the certificate, respectively, when creating a TLS secret like so: $ kubectl create secret tls test-tls --key="file1" --cert="file2" Support explicit overrides for the default item names. If given, these must be found. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: André Martins <andre@cilium.io> 20 December 2019, 15:46:59 UTC
1371911 André Martins 12 December 2019, 17:21:19 UTC pkg/k8s: add wrapper to get k8s secrets Signed-off-by: André Martins <andre@cilium.io> 20 December 2019, 15:46:59 UTC
60a846b Jarno Rajahalme 12 December 2019, 17:21:19 UTC option: add 'certificates-directory' option to look for TLS certificates This option will set the root certificate used to search for TLS certificates defined in a CNP for L7 TLS policy enforcement. Signed-off-by: André Martins <andre@cilium.io> 20 December 2019, 15:46:59 UTC
7721c8a Joe Stringer 16 December 2019, 14:00:59 UTC docs: Describe cluster restriction to CIDR policy Describe the restrictions of which traffic CIDR- and DNS-based policies apply in a bit more detail. Signed-off-by: Joe Stringer <joe@cilium.io> 20 December 2019, 10:21:56 UTC
b78e761 Joe Stringer 16 December 2019, 10:07:59 UTC docs: Fix reference to init id with k8s With the kubernetes Cilium CNI, the labels are typically fetched during endpoint creation, so the lifecycle text here was a bit out-of-date. Fix it up to be more clear in which cases the init identity is used, and reference it from the relevant code. Signed-off-by: Joe Stringer <joe@cilium.io> 20 December 2019, 10:21:56 UTC
5430481 Sebastian Wicki 19 December 2019, 22:46:48 UTC test: Extend externalTrafficPolicy=Local tests Adds an additional check for NodePort services with externalTrafficPolicy=Local where only a single node is running a service endpoint. Therefore, we test that only direct connections to that node will succeed, while any requests to a node without a local backend are dropped. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> 20 December 2019, 10:16:00 UTC
78e3c9b Sebastian Wicki 19 December 2019, 22:46:48 UTC lbmap: Include services without backends in DumpServiceMaps This changes the behavior of DumpServiceMaps to include services without any backends. This is required when DumpServiceMaps is used to restore services in the service cache. Without this change, services without any backends (e.g. NodePort services with externalTrafficPolicy=Local) will not be restored from the datapath and are consequently not garbage collected once cilium-agent recognizes that these services have been removed from Kubernetes. This commit therefore fixes a case where the Cilium CI status preflight check fails to pass, as the lbmap contains such leftover entries. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> 20 December 2019, 10:16:00 UTC
51a1f21 Joe Stringer 18 December 2019, 17:03:45 UTC release: Add guardrails for mixing releases As a sanity check, make sure that the cilium source directory that is being used to generate the release specifies the same version as the one being specified on the uploadrev commandline. Signed-off-by: Joe Stringer <joe@cilium.io> 20 December 2019, 06:08:42 UTC
3cc2e51 Joe Stringer 18 December 2019, 16:45:10 UTC release: Fix helm chart paths Store the helm chart artifacts in a release-specific directory so we don't have to upload all resources each time if a particular maintainer reuses the same directory; and ensure that the helm template files are pulled from $CILIUM_SOURCE rather than the current directory. Signed-off-by: Joe Stringer <joe@cilium.io> 20 December 2019, 06:08:42 UTC
07b9cba Joe Stringer 18 December 2019, 16:46:19 UTC release: Print SHAs for helm chart artifacts Signed-off-by: Joe Stringer <joe@cilium.io> 20 December 2019, 06:08:42 UTC
2e6e8d1 Michal Rostecki 18 December 2019, 23:14:20 UTC datapath: Use the new probes module Use the new `probes` module for checking BPF features in the kernel configuraation. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> 20 December 2019, 06:06:09 UTC
6c98e94 Michal Rostecki 18 December 2019, 22:29:54 UTC datapath: New package `probes` with BPF checks based on bpftool This change introduces the new package `pkg/datapath/linux/probes` which uses BPF feature probes from bpftool in JSON format. In the current shape, it handles kernel feature probes with the public function `SystemConfigProbes`. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> 20 December 2019, 06:06:09 UTC
512d948 Michal Rostecki 18 December 2019, 22:21:22 UTC bpf: Remove old kernel probes This change removes old kernel probes from run_probes.sh. Kernel probes are going to be implemented in Go and are going to use bpftool. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> 20 December 2019, 06:06:09 UTC
2854434 Maciej Kwiek 05 December 2019, 15:52:31 UTC [CI] parallel image build and cluster setup for eks Signed-off-by: Maciej Kwiek <maciej@isovalent.com> 19 December 2019, 16:15:54 UTC
ba85129 Valas Valancius 15 December 2019, 22:13:21 UTC test: Add conntrack entry timeout validation tests. Partially fixes #9303. Signed-off-by: Valas Valancius <valas@google.com> 19 December 2019, 12:40:42 UTC
7acf046 ap4y 16 December 2019, 01:45:28 UTC Improve nodeinit uninstalls by reverting nodeinit changes Uninstalls are not well supported by the nodeinit and requires manual operations on each node of a cluster. This patch introduces optional preStop hook to the nodeinit containers that will revert changes made on start. Changes to the nodeinit's helm chart: - Add new variable 'nodeinit.revertReconfigureKubelet', defaults to false - If enabled preStop hook will be installed to revert changes made by nodeinit Signed-off-by: Arthur Evstifeev <aevstifeev@gitlab.com> 18 December 2019, 16:28:21 UTC
999ba19 Sebastian Wicki 16 December 2019, 16:36:18 UTC docs: externalTrafficPolicy is now supported by BPF NodePort Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> 18 December 2019, 15:24:24 UTC
5922546 Sebastian Wicki 16 December 2019, 16:34:49 UTC test: Add BPF NodePort externalTrafficPolicy=Local tests This tests externalTrafficPolicy=Local in BPF NodePort with both vxlan and direct routing mode. A new context is added to share the setup of the Cilium deployment in either modes. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> 18 December 2019, 15:24:24 UTC
b46078c Sebastian Wicki 16 December 2019, 16:26:03 UTC service: Add support for externalTrafficPolicy=Local This adds a new TrafficPolicy field to Cilium's service representation and implements the "Local" traffic policy. When externalTrafficPolicy is set to Local, only backends where the node name matches the current node are selected and added to the BPF lbmap. This check of the node name to determine local backends is the same mechanism that is also used by kube-proxy. When a service has TrafficPolicy=Local, the Cilium API only shows and accepts local backends for that service. Fixes: #8698 Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> 18 December 2019, 15:24:24 UTC
e9d5079 Sebastian Wicki 16 December 2019, 15:40:43 UTC k8s: Add NodeName field to backend IPs The Kubernetes EndpointAddress object contains the node name of each backend. This can be used to determine if an endpoint is local to a node. This commit adds an equivalent NodeName field to Cilium's internal representation of a service backend and populates it in the K8s watcher. The node name is not added to the ClusterService object, as a ClusterService will never be node-local. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> 18 December 2019, 15:24:24 UTC
back to top