https://github.com/cilium/cilium
- HEAD
- refs/heads/1.2.7-hotfix1-fqdn-regen
- refs/heads/EndpointPolicyEnformcement
- refs/heads/address
- refs/heads/all-scalability-improvements
- refs/heads/beta/service-mesh
- refs/heads/bpf-metrics
- refs/heads/brb/brb-patch-2
- refs/heads/cilium-envoy-crd-pre-beta
- refs/heads/cilium-no-gopath
- refs/heads/cli-upgrade-v1.12-ci-test
- refs/heads/clustermesh511-upgrade-test
- refs/heads/committers-codeowners
- refs/heads/debug
- refs/heads/dev/joe/v1.8-with-hostfw-fixes
- refs/heads/enable_cnp_latency
- refs/heads/encrypt-node-fixes
- refs/heads/ensure-macos-build-succeeds
- refs/heads/envoy-policy-precedence
- refs/heads/envoy-warnings-cleanup
- refs/heads/extension-mysql
- refs/heads/feature/cep-scalability
- refs/heads/feature/devices-and-addresses
- refs/heads/feature/devices-reconciliation-v1.16
- refs/heads/feature/main/svc-icmp-response
- refs/heads/feature/service-refactor
- refs/heads/feature/service-refactor-fresh
- refs/heads/feature/v1.11/beta-test
- refs/heads/feature/v1.11/k8s-ingress
- refs/heads/fix-iphealth
- refs/heads/fqdn-fixl3-wildcard
- refs/heads/fristonio/iptables-manager-fix
- refs/heads/ft/main/chancez/push-dev-charts
- refs/heads/ft/main/push_chart_stable_branches_fix
- refs/heads/ft/main/test_push_chart_updates
- refs/heads/gce-example
- refs/heads/gh-readonly-queue/main/pr-27509-78a5f177693fb443cd946441f45826bf7fa2437a
- refs/heads/ginkgo-better-timeout
- refs/heads/graduation
- refs/heads/hf/main/ipam-pools-build-230605
- refs/heads/hf/master/v1.12-rc2-health-dbg-v1
- refs/heads/hf/master/wg-fix-ipam-k8s-v2
- refs/heads/hf/v1.10/cls-prio2
- refs/heads/hf/v1.10/debug-taint-removal
- refs/heads/hf/v1.10/v1.10.10-with-19452
- refs/heads/hf/v1.10/v1.10.2-fix-ipsec-ep-routes
- refs/heads/hf/v1.10/v1.10.5-with-identity-leak-fix
- refs/heads/hf/v1.10/v1.10.7-additional-logs
- refs/heads/hf/v1.10/v1.10.7-exclude-local
- refs/heads/hf/v1.10/v1.10.7-exclude-loopback
- refs/heads/hf/v1.10/v1.10.7-extra-logs
- refs/heads/hf/v1.10/v1.10.7-more-logs
- refs/heads/hf/v1.10/v1.10.8-deadlock-and-complexity-fix
- refs/heads/hf/v1.10/v1.10.8-deadlock-fix
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v3
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v4
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v5
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v6
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v7
- refs/heads/hf/v1.11/1.11.4-custom-taint
- refs/heads/hf/v1.11/19247-custom-taint-key
- refs/heads/hf/v1.11/dbg-svc-restore
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak-eni-attach-and-logging
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak-eni-attachment
- refs/heads/hf/v1.11/v1.11.3-with-19259
- refs/heads/hf/v1.11/v1.11.4-custom-taint
- refs/heads/hf/v1.11/v1.11.5-and-19247-eed5544
- refs/heads/hf/v1.11/xdp-multidev-v1
- refs/heads/hf/v1.11/xdp-multidev-v2-ipcache-fix
- refs/heads/hf/v1.12/next-net-v1
- refs/heads/hf/v1.12/v1.12.18-994
- refs/heads/hf/v1.12/v1.12.3-debug-k8s-heartbeat
- refs/heads/hf/v1.12/v1.12.3-debug-k8s-heartbeat-v2
- refs/heads/hf/v1.13/bpf-sock-l7-fix
- refs/heads/hf/v1.13/v1.13.12-without-deny-precedence
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence-debug
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence-with-xfrm-fix
- refs/heads/hf/v1.13/v1.13.2-with-24875
- refs/heads/hf/v1.13/v1.13.3-with-26242
- refs/heads/hf/v1.14/cidr-identity-refcnt-fix
- refs/heads/hf/v1.14/v1.14-with-27327
- refs/heads/hf/v1.7/v1.7.15-with-neighbor-fix
- refs/heads/hf/v1.7/v1.7.15-with-neighbor-fix-2
- refs/heads/hf/v1.8/v1.8.13-with-19452
- refs/heads/hf/v1.8/v1.8.6-eni-cidr-fix-1
- refs/heads/hf/v1.8/v1.8.6-eni-cidr-fix-15303
- refs/heads/hf/v1.8/v1.8.7-with-fqdn-underscore-fix
- refs/heads/hf/v1.8/v1.8.8-eni-cidr-fix-1
- refs/heads/hf/v1.8/v1.8.8-with-encrypt-fixes
- refs/heads/hf/v1.9/v1.9.8-azure-ipam-fix
- refs/heads/hf/v1.9/v1.9.9-azure-pod-egress-fix
- refs/heads/hpabla/bgpv2/deprecate-localport
- refs/heads/images/runtime/20210830
- refs/heads/ipc-demo
- refs/heads/ktls-tx-only
- refs/heads/ktls-tx-only-v2
- refs/heads/ktls-tx-rx
- refs/heads/ktls-tx-rx-v2
- refs/heads/ktls-tx-rx-v3
- refs/heads/ktls-tx-rx-v4
- refs/heads/ktls-tx-rx-v5
- refs/heads/ldelossa/feat/bgp-control-plane
- refs/heads/ldelossa/keep-mark-definitions-consistent
- refs/heads/ldelossa/segment-makefiles
- refs/heads/ldelossa/segment-makefiles-v2
- refs/heads/ldelossa/srv6-encap-fib
- refs/heads/lizrice/pr/cli-confusion
- refs/heads/main
- refs/heads/mio/wireguard-restore-allowed-ips
- refs/heads/multi-stack-dev-vm
- refs/heads/pr/1-9-ci-test
- refs/heads/pr/aanm-update-k8s-conformance
- refs/heads/pr/aanm/bisect
- refs/heads/pr/add-controller-identity
- refs/heads/pr/aditighag/lrp-skip-lb
- refs/heads/pr/asauber/link-local-as-host
- refs/heads/pr/asauber/max-ifindex-metric
- refs/heads/pr/avoid-ct-for-dsr
- refs/heads/pr/backend-state
- refs/heads/pr/bbb-cpy
- refs/heads/pr/bimmlerd/modularize-bandwidth-manager
- refs/heads/pr/bimmlerd/v1.12-backport-quay-org-from-env
- refs/heads/pr/bounded-loops
- refs/heads/pr/bpf-based-masquerading
- refs/heads/pr/bpf-edt-proxy
- refs/heads/pr/brb/arping-nexthop
- refs/heads/pr/brb/arping-via-gw
- refs/heads/pr/brb/auto-multi-dev-v2
- refs/heads/pr/brb/backport-1.8.5-nat-gc
- refs/heads/pr/brb/bpf-host-routing-wg
- refs/heads/pr/brb/bpf-lxc-no-redirect
- refs/heads/pr/brb/bpf-masq-veth
- refs/heads/pr/brb/bpf-multihoming
- refs/heads/pr/brb/cgroup-v2-test
- refs/heads/pr/brb/check-errors-in-logs
- refs/heads/pr/brb/check-wg
- refs/heads/pr/brb/ci
- refs/heads/pr/brb/ci-1111
- refs/heads/pr/brb/ci-2
- refs/heads/pr/brb/ci-4.19
- refs/heads/pr/brb/ci-arping-flake
- refs/heads/pr/brb/ci-bigtcp
- refs/heads/pr/brb/ci-bpf-netdev-without-egress
- refs/heads/pr/brb/ci-cleanup-svc
- refs/heads/pr/brb/ci-dbg-conformance-kind
- refs/heads/pr/brb/ci-dbg-external
- refs/heads/pr/brb/ci-dbg-flake-from-outside
- refs/heads/pr/brb/ci-demo
- refs/heads/pr/brb/ci-disable-ces-for-egress-gw
- refs/heads/pr/brb/ci-dp-disable-bpf-host-routing
- refs/heads/pr/brb/ci-dp-hubble-flows
- refs/heads/pr/brb/ci-dp-more-diversity
- refs/heads/pr/brb/ci-dp-v1.13
- refs/heads/pr/brb/ci-dp-v6
- refs/heads/pr/brb/ci-dp-verifier
- refs/heads/pr/brb/ci-e2e-enable-debug-ipsec
- refs/heads/pr/brb/ci-e2e-geneve-dsr
- refs/heads/pr/brb/ci-e2e-helm-mode-v1.13
- refs/heads/pr/brb/ci-e2e-lvh-retry
- refs/heads/pr/brb/ci-e2e-more-nodes
- refs/heads/pr/brb/ci-e2e-new-cli
- refs/heads/pr/brb/ci-e2e-nft
- refs/heads/pr/brb/ci-e2e-unsafe
- refs/heads/pr/brb/ci-e2e-unsafe-v2
- refs/heads/pr/brb/ci-e2e-upgrade-tests
- refs/heads/pr/brb/ci-e2e-upgrade-tests-ipsec
- refs/heads/pr/brb/ci-early-terminate-conn-disrupt
- refs/heads/pr/brb/ci-eks-ipsec-upgrade
- refs/heads/pr/brb/ci-encrypt-l7
- refs/heads/pr/brb/ci-fix-ip-masq-dry-run
- refs/heads/pr/brb/ci-ipsec-upgrade-fix
- refs/heads/pr/brb/ci-ipsec-upgrade-missed-tail-calls
- refs/heads/pr/brb/ci-ipsec-upgrade-v1.13
- refs/heads/pr/brb/ci-ipsec-upgrade-vol2
- refs/heads/pr/brb/ci-keep-missed-tail-calls
- refs/heads/pr/brb/ci-l7-nodeport
- refs/heads/pr/brb/ci-lvh-4.19
- refs/heads/pr/brb/ci-lvh-5.4
- refs/heads/pr/brb/ci-lvh-5.4-v2
- refs/heads/pr/brb/ci-lvh-bpf-next
- refs/heads/pr/brb/ci-no-self-hosted
- refs/heads/pr/brb/ci-pass-kernel-env
- refs/heads/pr/brb/ci-prepull-l4lb
- refs/heads/pr/brb/ci-refactor-svc-suite
- refs/heads/pr/brb/ci-rm-smoke-tests
- refs/heads/pr/brb/ci-sanity
- refs/heads/pr/brb/ci-test
- refs/heads/pr/brb/ci-test-2
- refs/heads/pr/brb/ci-test-k8s-vsn-swap
- refs/heads/pr/brb/ci-test-large-runners
- refs/heads/pr/brb/ci-uffff
- refs/heads/pr/brb/ci-upgrade-vol-2
- refs/heads/pr/brb/ci-upgrade-vol-3
- refs/heads/pr/brb/ci-wg-mtu
- refs/heads/pr/brb/ci-wg-mtu-vol2
- refs/heads/pr/brb/cilium-host-v6-from-ipam
- refs/heads/pr/brb/cli-bump-test
- refs/heads/pr/brb/datapath-loop-dbg
- refs/heads/pr/brb/dbg-ci
- refs/heads/pr/brb/dbg-conformance-gke
- refs/heads/pr/brb/dbg-master-np-vxlan-ipcache-ci
- refs/heads/pr/brb/debug-nodeport-bpf-flake
- refs/heads/pr/brb/do-not-derive-pod-cidrs-from-dev
- refs/heads/pr/brb/do-not-query-dev-for-arping
- refs/heads/pr/brb/docs-clarify-egress-gw-ip-addr-dp
- refs/heads/pr/brb/drop-notify
- refs/heads/pr/brb/dsr
- refs/heads/pr/brb/dsr-v2
- refs/heads/pr/brb/dualstack-ci
- refs/heads/pr/brb/enable-ipv6-per-endpoint-routes
- refs/heads/pr/brb/enable-route-mtu-cni
- refs/heads/pr/brb/fib-lookup-src
- refs/heads/pr/brb/fix-backend-id-u32
- refs/heads/pr/brb/fix-ci-dp-deprecation-warn
- refs/heads/pr/brb/fix-clang-vsn-regexp
- refs/heads/pr/brb/fix-egress-ip-16147
- refs/heads/pr/brb/fix-external-ip-dp
- refs/heads/pr/brb/fix-maglev-del
- refs/heads/pr/brb/fix-nodeport-hostnetns
- refs/heads/pr/brb/fix-stale-dsr
- refs/heads/pr/brb/fix-svc-backend-selection
- refs/heads/pr/brb/fix-third-host
- refs/heads/pr/brb/gh-action-cgr
- refs/heads/pr/brb/gh-action-lvh
- refs/heads/pr/brb/gh-install-cli-backup
- refs/heads/pr/brb/ginkgo-kpr-strict
- refs/heads/pr/brb/ginkgo-rm-update-tests
- refs/heads/pr/brb/go-crazy
- refs/heads/pr/brb/hubble-tcp-ack-seq-no
- refs/heads/pr/brb/improve-svc-restore
- refs/heads/pr/brb/istio-getsockopt
- refs/heads/pr/brb/it-cannot-be-truth
- refs/heads/pr/brb/kpr-svc-mesh
- refs/heads/pr/brb/kubeproxy-free-ci
- refs/heads/pr/brb/l7-np-bpf
- refs/heads/pr/brb/l7-rerevert
- refs/heads/pr/brb/lets-be-friends-with-ipsec
- refs/heads/pr/brb/lvh-kind-127
- refs/heads/pr/brb/lvh-kind-ipsec-upgrade
- refs/heads/pr/brb/meyskens/auth-ep-gc-locks
- refs/heads/pr/brb/multi-network
- refs/heads/pr/brb/no-cache-snat
- refs/heads/pr/brb/no-rev-nat-bpf-lxc-ingress
- refs/heads/pr/brb/node-id-per-fam
- refs/heads/pr/brb/nodeport-xlr-flag
- refs/heads/pr/brb/perf-wg
- refs/heads/pr/brb/pin-lvh
- refs/heads/pr/brb/push-ci-charts
- refs/heads/pr/brb/pwru
- refs/heads/pr/brb/rm-arping-l2-addr-check
- refs/heads/pr/brb/rm-no-redirect
- refs/heads/pr/brb/rm-np-deadcode
- refs/heads/pr/brb/rm-partial-host-svc
- refs/heads/pr/brb/rm-test-gke
- refs/heads/pr/brb/test-bpf-masq
- refs/heads/pr/brb/test-ci-e2e
- refs/heads/pr/brb/test-ci-e2e-v1.13
- refs/heads/pr/brb/test-kind
- refs/heads/pr/brb/third-host-more-pain
- refs/heads/pr/brb/timing-l4lb-gh-action
- refs/heads/pr/brb/triage-flake-v2
- refs/heads/pr/brb/triage-lb-flake
- refs/heads/pr/brb/unquarantine-svc
- refs/heads/pr/brb/v1.10-istio-snat
- refs/heads/pr/brb/v1.12-ci-e2e
- refs/heads/pr/brb/v1.12-ci-ipsec-upgrade
- refs/heads/pr/brb/v1.12-test-ipsec-upgrade
- refs/heads/pr/brb/v1.13-ci-e2e
- refs/heads/pr/brb/v1.13-remote-np
- refs/heads/pr/brb/v1.13-upgrade-fixes
- refs/heads/pr/brb/v1.14-ci-e2e-upgrade
- refs/heads/pr/brb/v1.14-drop-notify
- refs/heads/pr/brb/v1.15-enable-route-mtu-cni
- refs/heads/pr/brb/v1.6.9-iptables-W
- refs/heads/pr/brb/v1.8-fix-icmp-port-check
- refs/heads/pr/brb/wg-duplicate-node-ip
- refs/heads/pr/brb/wg-encrypt-node-test
- refs/heads/pr/brb/wg-hack
- refs/heads/pr/brb/wg-ipam-fix
- refs/heads/pr/brb/wg-kpr
- refs/heads/pr/brb/wg-test
- refs/heads/pr/brb/wip
- refs/heads/pr/brb/wip-ci
- refs/heads/pr/brb/wip-sync-policy-map
- refs/heads/pr/brb/xdp-egress-gw
- refs/heads/pr/brb/xdp-multidev-with-bpf-multihoming
- refs/heads/pr/brb/xdp-multidev-with-bpf-multihoming-v2
- refs/heads/pr/bruno/sleepy-pawn
- refs/heads/pr/bugtool-systemd
- refs/heads/pr/bwm-base2
- refs/heads/pr/bwm-fq
- refs/heads/pr/bwm-priority
- refs/heads/pr/chancez/add_hubble_l7_dashboard_prometheus_example
- refs/heads/pr/chancez/fix_websocket_l7_policies
- refs/heads/pr/chancez/flow_filter_namespace
- refs/heads/pr/chancez/hubble_plus_plus
- refs/heads/pr/chancez/static_peers_hubble_relay
- refs/heads/pr/christarazi/controlplane-fqdn
- refs/heads/pr/christarazi/ipcache-async-cep-pods-namedports
- refs/heads/pr/christarazi/prep-from-cidr-tests
- refs/heads/pr/ci-k8s-1.30
- refs/heads/pr/ci-nk-ep
- refs/heads/pr/datapath-opt
- refs/heads/pr/dbkm/nodeport-lb
- refs/heads/pr/debug-dns-timeout
- refs/heads/pr/eproutes-redir
- refs/heads/pr/example/neigh-state-manager
- refs/heads/pr/fastdp
- refs/heads/pr/fastdp2
- refs/heads/pr/feroz/allow-sbom-read
- refs/heads/pr/feroz/set-container-scan-failure-flag
- refs/heads/pr/feroz/test-cosign-attest
- refs/heads/pr/fib-consolidation
- refs/heads/pr/fix-aks-workflow
- refs/heads/pr/fix-data-race
- refs/heads/pr/fix-k8s-all-sha1
- refs/heads/pr/fix-pod-pacing
- refs/heads/pr/fix-tail-call-replace
- refs/heads/pr/fristonio/feat-19038
- refs/heads/pr/fristonio/fix-istio-k8sT
- refs/heads/pr/fristonio/ipv6-masquerading
- refs/heads/pr/fristonio/test-dual-stack
- refs/heads/pr/fristonio/test-ipv6-dualstack
- refs/heads/pr/gandro+brb/fix-monitor-aggregation-np-v2
- refs/heads/pr/gandro+brb/mv-trace-point-to-rev-nodeport
- refs/heads/pr/gandro+brb/wg-host-encryption-v3
- refs/heads/pr/gandro+brb/wg-host2host
- refs/heads/pr/gandro+brb/wg-host2host-kind
- refs/heads/pr/gandro/bump-hubble-2020-03-25
- refs/heads/pr/gandro/ci-conformance-multicluster-fix-log-gathering
- refs/heads/pr/gandro/ci-delete-crds-in-cleanupcomponents
- refs/heads/pr/gandro/ci-fix-status-if-workflows-are-skipped
- refs/heads/pr/gandro/ci-wait-for-all-relevant-images-do-not-merge-test
- refs/heads/pr/gandro/enable-hubble-by-default
- refs/heads/pr/gandro/portmap-refcount
- refs/heads/pr/gandro/re-enable-wireguard-in-multicluster-ci
- refs/heads/pr/gandro/svc-healthchecknodeport
- refs/heads/pr/gc-on-svc-update
- refs/heads/pr/getname-hooks
- refs/heads/pr/giorio94/1.14/test-cilium-cli-2184
- refs/heads/pr/giorio94/main/cluster-name-validation-strict
- refs/heads/pr/giorio94/main/gha-cluster-name
- refs/heads/pr/giorio94/main/gha-conformance-clustermesh-lb
- refs/heads/pr/giorio94/main/test-cilium-cli-2184
- refs/heads/pr/giorio94/main/tests-clustermesh-upgrade-interrupted
- refs/heads/pr/giorio94/v1.13/bump-gke-version
- refs/heads/pr/gray/30837-with-pwru
- refs/heads/pr/gray/ipsec-proxy-kpr-revdnat-ci-test
- refs/heads/pr/gray/ipsec-proxy-kpr-revdnat-test
- refs/heads/pr/gray/main/connectivity-wg-proxy-nodeport
- refs/heads/pr/gray/main/decouple-ipsec-gh-actions
- refs/heads/pr/gray/main/egress-proxy-ipsec-fix2
- refs/heads/pr/gray/main/fix-leak-detection-race
- refs/heads/pr/gray/main/xfrm-delete-flake
- refs/heads/pr/gray/main/xfrm-delete-flake2
- refs/heads/pr/gray/new-cli-test-pr-2759
- refs/heads/pr/gray/pwru-action
- refs/heads/pr/gray/v1.15/decouple-ipsec-gh-actions
- refs/heads/pr/health-data-path
- refs/heads/pr/hubble-tls-cert-gen-via-k8s-job
- refs/heads/pr/ianvernon/kvstore-client-type
- refs/heads/pr/ianvernon/kvstore-context
- refs/heads/pr/ianvernon/more-endpoint-cleanup
- refs/heads/pr/ianvernon/resolve-cidr-policy-perf-improvement
- refs/heads/pr/increase-verifier-test-build-timeout
- refs/heads/pr/ipip
- refs/heads/pr/ipip-encap
- refs/heads/pr/ipip-encap2
- refs/heads/pr/ipip2
- refs/heads/pr/ipip4
- refs/heads/pr/ipip6
- refs/heads/pr/jibi/fix-differentiate-udp-tcp-svc-upgrade
- refs/heads/pr/jibi/ip-list-contains-addr
- refs/heads/pr/joamaki/gather-network-info
- refs/heads/pr/joamaki/idless-service-restapi
- refs/heads/pr/joamaki/lb-experimental-e2e
- refs/heads/pr/joe/ariane-scheduled-cilium-only
- refs/heads/pr/joe/backport-28007-1.11
- refs/heads/pr/joe/bump-ginkgo-seed
- refs/heads/pr/joe/docker-build-log-tracing
- refs/heads/pr/joe/docs-builder-latex
- refs/heads/pr/joe/docs-workflow-repo+test
- refs/heads/pr/joe/ipcache-cidr-policy
- refs/heads/pr/joe/lost-identity
- refs/heads/pr/joe/release-codeowners
- refs/heads/pr/joe/sw-quay
- refs/heads/pr/joe/test-labeler
- refs/heads/pr/joe/test-lvh-fix
- refs/heads/pr/joe/v1.13-stability-check
- refs/heads/pr/joe/v1.7-dev-env
- refs/heads/pr/jrajahalme/gh-filter-test-files
- refs/heads/pr/jrfastab/backport-ooo-ipsec-fixes
- refs/heads/pr/jrfastab/backport-v115
- refs/heads/pr/jrfastab/dbgNodeId
- refs/heads/pr/jrfastab/dbgNodeId111
- refs/heads/pr/jrfastab/dbgNodeId111v2
- refs/heads/pr/jrfastab/dbgv114
- refs/heads/pr/jrfastab/eks-encrypt-ipamupdate
- refs/heads/pr/jrfastab/fix-encrypt-subnets
- refs/heads/pr/jrfastab/fix-ixsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/fixes-ipsec-init
- refs/heads/pr/jrfastab/v1.8-fix-ipsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/v1.9-fix-ipsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/v111-debug-ooo
- refs/heads/pr/jrfastab/v111-debug-ooo-v2
- refs/heads/pr/jwi/main/bpf-dsr-geneve
- refs/heads/pr/jwi/main/ci-e2e-upgrade
- refs/heads/pr/jwi/main/ci-geneve-dsr
- refs/heads/pr/jwi/main/ipsec-rhel8
- refs/heads/pr/jwi/main/ipv6-ci
- refs/heads/pr/jwi/v1.15/bpf-complexity
- refs/heads/pr/jwi/v1.16/tophat
- refs/heads/pr/k8s-nat46x64
- refs/heads/pr/k8s-nat46x64-2
- refs/heads/pr/kaworu/helm-hubble-cli.yaml
- refs/heads/pr/kkourt/azure-ipam-test-race
- refs/heads/pr/kkourt/bpftool-update
- refs/heads/pr/kkourt/ct-rst-timeout-wip
- refs/heads/pr/kkourt/v1.11-backport-2022-01-26
- refs/heads/pr/kkourt/v1.9-lxc-complexity
- refs/heads/pr/l4lb-improvements-tmp
- refs/heads/pr/learnitall/ginkgo-race-workflow
- refs/heads/pr/learnitall/init-egw-scale-test
- refs/heads/pr/learnitall/test-startup-script-changes
- refs/heads/pr/lmb/1.14-cni
- refs/heads/pr/lmb/1.15-cni
- refs/heads/pr/lmb/update-cni-plugin
- refs/heads/pr/marga/v1.11-without-deny-precedence
- refs/heads/pr/marseel/improve_net_perf
- refs/heads/pr/marseel/move_cli_changes
- refs/heads/pr/marseel/scale_np
- refs/heads/pr/marseel/scale_test_1_15
- refs/heads/pr/max/llvm18-fixes
- refs/heads/pr/max/upgrade-llvm-18-1-6
- refs/heads/pr/mhofstetter/guestbook-registry
- refs/heads/pr/mhofstetter/junit-fetch-nullglob
- refs/heads/pr/mhofstetter/ssh-store-consolelog
- refs/heads/pr/mhofstetter/test-ingress
- refs/heads/pr/michi/circular-struggle
- refs/heads/pr/michi/crdregister
- refs/heads/pr/michi/debug
- refs/heads/pr/michi/description
- refs/heads/pr/michi/dns-refactor12
- refs/heads/pr/michi/faster
- refs/heads/pr/michi/l7drop
- refs/heads/pr/michi/majestic-ketchup
- refs/heads/pr/michi/mega-ketchup
- refs/heads/pr/michi/peerapi
- refs/heads/pr/michi/sleep-on-it
- refs/heads/pr/michi/test
- refs/heads/pr/michi/weekly-bot
- refs/heads/pr/monitor-wait-ci
- refs/heads/pr/move-image-to-one-repo
- refs/heads/pr/nat-gw-tests
- refs/heads/pr/nathanjsweet/add-complex-allow-test-to-policy-map-tests
- refs/heads/pr/nathanjsweet/add-lockdown-mode-for-policy-map-overflows
- refs/heads/pr/nathanjsweet/differentiate-protocol-in-services
- refs/heads/pr/nathanjsweet/node-port-addresses
- refs/heads/pr/nathanjsweet/refactor-has-same-owners
- refs/heads/pr/nathanjsweet/refactor-mapstate
- refs/heads/pr/nathanjsweet/update-k8s-control-plane-tests-to-1-27
- refs/heads/pr/nebril/add-dns-concurrency-limit
- refs/heads/pr/nebril/fix-precheck
- refs/heads/pr/nebril/fqdn-proxy-ha
- refs/heads/pr/nebril/fqdn-proxy-interface
- refs/heads/pr/nebril/gke-workflow-migrate-from-cli
- refs/heads/pr/nebril/quarantine-1.14-nodeport
- refs/heads/pr/nebril/test-bottlerocket
- refs/heads/pr/nebril/test-helm-gke-fix
- refs/heads/pr/nebril/test-our-ghaction-shenanigans
- refs/heads/pr/nebril/test-rebase-helm
- refs/heads/pr/nebril/trololo
- refs/heads/pr/nebril/update-cli-9.1-test
- refs/heads/pr/netkit
- refs/heads/pr/netkit3
- refs/heads/pr/netns-switch
- refs/heads/pr/netns-switch-no-peer
- refs/heads/pr/nodeport-fix
- refs/heads/pr/nodeport-improvements2
- refs/heads/pr/nodeport-nat-improvements
- refs/heads/pr/nodeport-nat-improvements2
- refs/heads/pr/nodeport-retry-sport
- refs/heads/pr/pchaigno/deprecate-bpf_network-f
- refs/heads/pr/pchaigno/fix-4.19-bpf-program-size
- refs/heads/pr/pchaigno/hotfix1-ipsec-fix
- refs/heads/pr/pchaigno/hotfix1-ipsec-fix-brb-v0
- refs/heads/pr/pchaigno/optim-complexity-ipcache-lookup
- refs/heads/pr/pchaigno/rework-config-probes
- refs/heads/pr/pchaigno/tmp-base-branch
- refs/heads/pr/pin-1.10-workflows-k8s-version
- refs/heads/pr/pin-1.11-workflows-k8s-version
- refs/heads/pr/pin-1.12-workflows-k8s-version
- refs/heads/pr/pin-1.13-workflows-k8s-version
- refs/heads/pr/pin-cloud-provider-master-workflows
- refs/heads/pr/pr/fix-ipam-node-manager-semaphore-error-handling
- refs/heads/pr/publish-test-images
- refs/heads/pr/qmonnet/docs-20230224
- refs/heads/pr/qmonnet/docs-bump
- refs/heads/pr/qmonnet/standalone-lb-docs
- refs/heads/pr/ray/late-dns-proxy
- refs/heads/pr/remove-1.13-references
- refs/heads/pr/rgo3/1.12-run-no-unexpected-drops-for-patch
- refs/heads/pr/rgo3/fix-k8s-vm-provisioning-1.13
- refs/heads/pr/rgo3/fix-missing-health-endpoint
- refs/heads/pr/rolinh/better-policy-verdict
- refs/heads/pr/rolinh/hubble-dump-all
- refs/heads/pr/rolinh/hubble-fix-maxflows-rounding
- refs/heads/pr/route-test
- refs/heads/pr/run-tests-in-parallel
- refs/heads/pr/scalability-crd-only
- refs/heads/pr/squeed/make-ccache
- refs/heads/pr/squeed/per-node-config
- refs/heads/pr/squeed/remote-cluster-leak
- refs/heads/pr/stacy/docs-update
- refs/heads/pr/tammach/accesslog-envoy
- refs/heads/pr/tammach/avoid-wildcard-cert
- refs/heads/pr/tammach/ci-cm
- refs/heads/pr/tammach/cleanup-helm-1.16
- refs/heads/pr/tammach/gateway-api-mirror-fraction
- refs/heads/pr/tammach/headless-service-flake
- refs/heads/pr/tammach/ingress-controller-e2e-config6
- refs/heads/pr/tammach/ingress-dedicated
- refs/heads/pr/tammach/k8s-upgrade
- refs/heads/pr/tammach/kind-host-dns-again
- refs/heads/pr/tammach/more-ingress-tests
- refs/heads/pr/tammach/rennovate-statedb
- refs/heads/pr/tammach/revert/fib-lookup
- refs/heads/pr/tammach/upgrade-test-ingress
- refs/heads/pr/tc-np-test
- refs/heads/pr/tcx
- refs/heads/pr/tcx-helm
- refs/heads/pr/tcx-misc
- refs/heads/pr/test-419-ci
- refs/heads/pr/test-increase-update-delete-timeout
- refs/heads/pr/test-k8s-all-tests
- refs/heads/pr/test-lb-super-netperf
- refs/heads/pr/test-nightly
- refs/heads/pr/test-upstream-timeout
- refs/heads/pr/tgraf/chaos-testing
- refs/heads/pr/tgraf/clustermesh-stale-state
- refs/heads/pr/tgraf/eni-ipam
- refs/heads/pr/tgraf/new-endpoint-state
- refs/heads/pr/tgraf/new-policy
- refs/heads/pr/tgraf/remove-tunnel-map
- refs/heads/pr/tgraf/scoped-ipam
- refs/heads/pr/tgraf/sctp
- refs/heads/pr/tgraf/split-lxc-prog
- refs/heads/pr/thorn3r/cesBlanketTest
- refs/heads/pr/thorn3r/clustermesh511
- refs/heads/pr/thorn3r/scaleTest5k
- refs/heads/pr/tklauser/build-push-images-env-var
- refs/heads/pr/tklauser/demo-customcalls
- refs/heads/pr/tklauser/update-go-1.23
- refs/heads/pr/tommyp1ckles/debugging-aks-conformance
- refs/heads/pr/tp/add-logging-for-wait-for-pods-term-condition
- refs/heads/pr/tp/backport-31380
- refs/heads/pr/tp/bump-cilium-cli
- refs/heads/pr/tp/cleanup-ipam-ips-metric-docs
- refs/heads/pr/tp/complexity-issue-verifier-case-main
- refs/heads/pr/tp/dont-terminate-on-node-config-changee
- refs/heads/pr/tp/eps-modular-health
- refs/heads/pr/tp/fix-stuck-ginko-pod-v2
- refs/heads/pr/tp/forward-hubble-for-e2e
- refs/heads/pr/tp/forward-hubble-for-e2e-v2
- refs/heads/pr/tp/make-nat-purge-async
- refs/heads/pr/tp/preload-test-kind-images
- refs/heads/pr/tp/switch-1.24-eks-region
- refs/heads/pr/tp/switch-1.24-eks-region-v1.13
- refs/heads/pr/tp/treat-flags-as-bitmask
- refs/heads/pr/tp/use-helm-default-vars-for-clustermesh-downgrade-c1
- refs/heads/pr/tweak-github-action-ref
- refs/heads/pr/twpayne/hubble-recent-events-buffer
- refs/heads/pr/twpayne/hubble-ring-buffer-benchmarks
- refs/heads/pr/update-azure
- refs/heads/pr/update-readme-for-releases
- refs/heads/pr/update-tm-network
- refs/heads/pr/v1.10-backport-2022-06-13
- refs/heads/pr/v1.10-backport-2022-10-03
- refs/heads/pr/v1.10-eni-stability-improvements-v1
- refs/heads/pr/v1.10-neigh-clean
- refs/heads/pr/v1.11-backport-2022-10-03
- refs/heads/pr/v1.11-test/issue-692
- refs/heads/pr/v1.12-backport-2023-10-10
- refs/heads/pr/v1.12-test/issue-692
- refs/heads/pr/v1.13-backport-2023-10-31
- refs/heads/pr/v1.13-backport-2024-04-22-03-42
- refs/heads/pr/v1.13-test/issue-692
- refs/heads/pr/v1.14-backport-2024-06-18-02-46
- refs/heads/pr/v1.14-backport-2024-08-19-11-14
- refs/heads/pr/v1.14.1
- refs/heads/pr/v1.15-backport-2024-08-19-10-46
- refs/heads/pr/v1.15-backport-2024-08-27-03-25
- refs/heads/pr/v1.15-backport-2024-08-28-07-59
- refs/heads/pr/v1.16-backport-2024-08-27-11-24
- refs/heads/pr/v1.7-stability-test
- refs/heads/pr/v1.7.9-hf-13205
- refs/heads/pr/v3-cpu
- refs/heads/pr/v6-host-addr2
- refs/heads/pr/vk/bpf/csum
- refs/heads/pr/vk/bpf/test/l4/csum
- refs/heads/pr/vk/bpf/tests/csum
- refs/heads/pr/vk/doc/ipsec
- refs/heads/pr/vk/ipsec/key/rotate
- refs/heads/pr/vk/ipsec/tests/concurrency
- refs/heads/pr/wip/bijective-nodemap
- refs/heads/regex_improved
- refs/heads/renovate/main-all-dependencies
- refs/heads/renovate/main-all-github-action
- refs/heads/renovate/main-all-go-deps-main
- refs/heads/renovate/main-go
- refs/heads/renovate/main-opentelemetry-go-monorepo
- refs/heads/renovate/main-patch-all-lvh-images-main
- refs/heads/renovate/v1.14-all-github-action
- refs/heads/renovate/v1.14-patch-stable-lvh-images
- refs/heads/renovate/v1.15-aanm-test
- refs/heads/renovate/v1.15-all-github-action
- refs/heads/renovate/v1.15-patch-stable-lvh-images
- refs/heads/renovate/v1.16-all-github-action
- refs/heads/renovate/v1.16-cilium-cli
- refs/heads/renovate/v1.16-go
- refs/heads/renovate/v1.16-patch-all-github-action
- refs/heads/renovate/v1.16-patch-stable-lvh-images
- refs/heads/revert-29086-2023-11-09-backport-1.14
- refs/heads/revert-33302-policy-catch-invalid-port-wildcard
- refs/heads/rib
- refs/heads/run-ci-wihout-building-cilium
- refs/heads/sh-dep-test-l4lb
- refs/heads/sidecar-http-proxy
- refs/heads/sockmap-v5
- refs/heads/sockops-build-fix
- refs/heads/tam/integration-tests
- refs/heads/tam/more-ingress-tests
- refs/heads/tb/bpf-remove-bear
- refs/heads/test-branch
- refs/heads/test-ipsec
- refs/heads/test-sig-bgp-notifs
- refs/heads/test/brlbil/upload
- refs/heads/test/skip-workflows
- refs/heads/tgraf/process-policy
- refs/heads/thorn3r/cesScaleTest
- refs/heads/thorn3rCES
- refs/heads/tinker/learnitall/scale-test-1
- refs/heads/tinker/learnitall/scale-test-2
- refs/heads/tklauser+brb/wip/multi-homing
- refs/heads/unit-test-ipsec
- refs/heads/v0.10
- refs/heads/v0.11
- refs/heads/v0.12
- refs/heads/v0.13
- refs/heads/v0.8
- refs/heads/v0.9
- refs/heads/v1.0
- refs/heads/v1.0.0-rc2
- refs/heads/v1.0.0-rc3
- refs/heads/v1.1
- refs/heads/v1.10
- refs/heads/v1.11
- refs/heads/v1.12
- refs/heads/v1.12.11-base
- refs/heads/v1.13
- refs/heads/v1.14
- refs/heads/v1.15
- refs/heads/v1.16
- refs/heads/v1.2
- refs/heads/v1.3
- refs/heads/v1.3.1
- refs/heads/v1.3.1-release
- refs/heads/v1.3.7-release
- refs/heads/v1.4
- refs/heads/v1.4.5-release
- refs/heads/v1.5
- refs/heads/v1.5.2-rc1-with-clusterip-fix
- refs/heads/v1.5.4-release
- refs/heads/v1.6
- refs/heads/v1.7
- refs/heads/v1.7.9-1
- refs/heads/v1.7.9.1
- refs/heads/v1.8
- refs/heads/v1.9
- refs/heads/verify-external-workload-dns-setup-redux
- refs/heads/vladu/identity-type-metrics
- refs/heads/weavescope
- refs/heads/wip-debug-link-not-found
- refs/heads/wip-ktls-tx-rx
- refs/heads/wip-sockmap
- refs/heads/wip-sockmap-v2
- refs/heads/wip-sockmap-v3
- refs/heads/wip-sockmap-v4
- refs/heads/xfrm-subnet-test
- refs/heads/yutaro/bgp-cplane-etp-local/doc
- refs/heads/yutaro/oss/eni-overlapping-mark
- refs/remotes/bruno/hf/v1.10/v1.10.3-bpf-snat-and-masq-fixes
- refs/remotes/joe/submit/quarantine-etcd
- refs/remotes/origin/1.2-backports-18-09-12
- refs/remotes/origin/ipvlan3
- refs/remotes/origin/pr/add-reserved-health
- refs/remotes/origin/pr/brb/nodeport-lb
- refs/remotes/origin/pr/ianvernon/5859
- refs/remotes/origin/pr/ianvernon/dynamic-ep-cfg
- refs/remotes/origin/pr/tgraf/kube-dns-fixed-identity
- refs/semaphoreci/6384f501b324813e55cfbe818c04a40f2a923765
- refs/semaphoreci/7f69b285bac8a1be414e8769799962ae1408d9e1
- refs/semaphoreci/b5eb6622da121ad36b8f375a084392f7feeec64a
- refs/semaphoreci/d9e7e28f39d34a7050a9c1cad2a26d84f5f4eff1
- refs/semaphoreci/f55ec535d85f387ef981265967fabb3c1b5f1ec6
- refs/tags/0.10.1
- refs/tags/1.1.1
- refs/tags/1.9.0-rc0
- refs/tags/v0.11
- refs/tags/v0.12.0
- refs/tags/v0.13.1
- Branches list truncated to 713 entries, 10 were omitted.
- v0.10.0
- 1.9.9
- 1.9.8
- 1.9.7
- 1.9.6
- 1.9.5
- 1.9.4
- 1.9.3
- 1.9.2
- 1.9.18
- 1.9.17
- 1.9.16
- 1.9.15
- 1.9.14
- 1.9.13
- 1.9.12
- 1.9.11
- 1.9.10
- 1.9.1
- 1.9.0-rc3
- 1.9.0-rc2
- 1.9.0-rc1
- 1.9.0
- 1.8.9
- 1.8.8
- 1.8.7
- 1.8.6
- 1.8.5
- 1.8.4
- 1.8.3
- 1.8.2
- 1.8.13
- 1.8.12
- 1.8.11
- 1.8.10
- 1.8.1
- 1.8.0-rc4
- 1.8.0-rc3
- 1.8.0-rc2
- 1.8.0-rc1
- 1.8.0
- 1.7.9
- 1.7.8
- 1.7.7
- 1.7.6
- 1.7.5
- 1.7.4
- 1.7.3
- 1.7.2
- 1.7.16
- 1.7.15
- 1.7.14
- 1.7.13
- 1.7.12
- 1.7.11
- 1.7.10
- 1.7.1
- 1.7.0-rc4
- 1.7.0-rc3
- 1.7.0
- 1.6.9
- 1.6.8
- 1.6.7
- 1.6.6
- 1.6.5
- 1.6.4
- 1.6.3
- 1.6.2
- 1.6.12
- 1.6.11
- 1.6.10
- 1.6.1
- 1.6.0
- 1.5.9
- 1.5.8
- 1.5.7
- 1.5.6
- 1.5.5
- 1.5.4
- 1.5.3
- 1.5.2
- 1.5.13
- 1.5.12
- 1.5.11
- 1.5.10
- 1.5.1
- 1.5.0-rc6
- 1.5.0-rc5
- 1.5.0-rc4
- 1.5.0-rc3
- 1.5.0-rc2
- 1.5.0
- 1.4.9
- 1.4.8
- 1.4.7
- 1.4.6
- 1.4.5
- 1.4.4
- 1.4.3
- 1.4.2
- 1.4.10
- 1.4.1
- 1.4.0-rc9
- 1.4.0-rc8
- 1.4.0-rc7
- 1.4.0-rc6
- 1.4.0-rc5
- 1.4.0-rc2
- 1.4.0
- 1.3.8
- 1.3.7
- 1.3.6
- 1.3.5
- 1.3.4
- 1.3.3
- 1.3.2
- 1.3.1
- 1.3.0-rc5
- 1.3.0-rc4
- 1.3.0
- 1.2.8
- 1.2.7
- 1.2.6
- 1.2.5
- 1.2.4
- 1.2.3
- 1.2.2
- 1.2.1
- 1.2.0-rc3
- 1.2.0-rc2
- 1.2.0-rc1
- 1.2.0
- 1.16.1
- 1.16.0-rc.2
- 1.16.0-rc.1
- 1.16.0-rc.0
- 1.16.0-pre.3
- 1.16.0-pre.2
- 1.16.0-pre.1
- 1.16.0-pre.0
- 1.16.0
- 1.15.8
- 1.15.7
- 1.15.6
- 1.15.5
- 1.15.4
- 1.15.3
- 1.15.2
- 1.15.1
- 1.15.0-rc.1
- 1.15.0-rc.0
- 1.15.0-pre.3
- 1.15.0-pre.2
- 1.15.0-pre.1
- 1.15.0-pre.0
- 1.15.0
- 1.14.9
- 1.14.8
- 1.14.7
- 1.14.6
- 1.14.5
- 1.14.4
- 1.14.3
- 1.14.2
- 1.14.14
- 1.14.13
- 1.14.12
- 1.14.11
- 1.14.10
- 1.14.1
- 1.14.0-snapshot.4
- 1.14.0-snapshot.3
- 1.14.0-snapshot.2
- 1.14.0-snapshot.1
- 1.14.0-snapshot.0
- 1.14.0-rc.1
- 1.14.0-rc.0
- 1.14.0-pre.2
- 1.14.0
- 1.13.9
- 1.13.8
- 1.13.7
- 1.13.6
- 1.13.5
- 1.13.4
- 1.13.3
- 1.13.2
- 1.13.18
- 1.13.17
- 1.13.16
- 1.13.15
- 1.13.14
- 1.13.13
- 1.13.12
- 1.13.11
- 1.13.10
- 1.13.1
- 1.13.0-rc5
- 1.13.0-rc4
- 1.13.0-rc3
- 1.13.0-rc2
- 1.13.0-rc1
- 1.13.0-rc0
- 1.13.0
- 1.12.9
- 1.12.8
- 1.12.7
- 1.12.6
- 1.12.5
- 1.12.4
- 1.12.3
- 1.12.2
- 1.12.19
- 1.12.18
- 1.12.17
- 1.12.16
- 1.12.15
- 1.12.14
- 1.12.13
- 1.12.12
- 1.12.11
- 1.12.10
- 1.12.1
- 1.12.0-rc3
- 1.12.0-rc2
- 1.12.0-rc1
- 1.12.0-rc0
- 1.12.0
- 1.11.9
- 1.11.8
- 1.11.7
- 1.11.6
- 1.11.5
- 1.11.4
- 1.11.3
- 1.11.20
- 1.11.2
- 1.11.19
- 1.11.18
- 1.11.17
- 1.11.16
- 1.11.15
- 1.11.14
- 1.11.13
- 1.11.12
- 1.11.11
- 1.11.10
- 1.11.1
- 1.11.0-rc3
- 1.11.0-rc2
- 1.11.0-rc1
- 1.11.0-rc0
- 1.11.0
- 1.10.9
- 1.10.8
- 1.10.7
- 1.10.6
- 1.10.5
- 1.10.4
- 1.10.3
- 1.10.20
- 1.10.2
- 1.10.19
- 1.10.18
- 1.10.17
- 1.10.16
- 1.10.15
- 1.10.14
- 1.10.13
- 1.10.12
- 1.10.11
- 1.10.10
- 1.10.1
- 1.10.0-rc2
- 1.10.0-rc1
- 1.10.0-rc0
- 1.10.0
- 1.1.6
- 1.1.5
- 1.1.4
- 1.1.3
- 1.1.2
- 1.1.0
- 1.0.7
- 1.0.6
- 1.0.5
- 1.0.4
- Releases list truncated to 287 entries, 361 were omitted.
Take a new snapshot of a software origin
If the archived software origin currently browsed is not synchronized with its upstream version (for instance when new commits have been issued), you can explicitly request Software Heritage to take a new snapshot of it.
Use the form below to proceed. Once a request has been submitted and accepted, it will be processed as soon as possible. You can then check its processing state by visiting this dedicated page.![swh spinner](/static/img/swh-spinner.gif)
Processing "take a new snapshot" request ...
Permalinks
To reference or cite the objects present in the Software Heritage archive, permalinks based on SoftWare Hash IDentifiers (SWHIDs) must be used.
Select below a type of object currently browsed in order to display its associated SWHID and permalink.
Revision | Author | Date | Message | Commit Date |
---|---|---|---|---|
58b3111 | Daniel Borkmann | 24 August 2023, 18:47:17 UTC | bpf: still todo Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 24 August 2023, 18:50:59 UTC |
5051850 | Daniel Borkmann | 24 August 2023, 18:45:43 UTC | bpf: Simplify srv6_refib Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 24 August 2023, 18:50:50 UTC |
db64887 | Daniel Borkmann | 24 August 2023, 18:34:38 UTC | bpf: Add fib wrapper functions to pass params from caller Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 24 August 2023, 18:37:27 UTC |
2400f64 | Daniel Borkmann | 24 August 2023, 18:25:02 UTC | Revert "bpf,fib: introduce fib_do_redirect function" This reverts commit 5fff05daf9f04e69c8372d9bd46ddbfc876663d6. | 24 August 2023, 18:25:02 UTC |
feb3fd6 | Daniel Borkmann | 24 August 2023, 18:24:44 UTC | Revert "bpf,fib: introduce fib_lookup_v4/6 functions" This reverts commit e275bcf57491d751babda286848c0f11a2672ee6. | 24 August 2023, 18:24:44 UTC |
0eec38d | Daniel Borkmann | 24 August 2023, 18:24:40 UTC | Revert "bpf: fib: delay smac selection until fib_do_redirect() has picked the oif" This reverts commit 7eb280114341d39a00c0b4057a2c05e02d643930. | 24 August 2023, 18:24:40 UTC |
6217d01 | Daniel Borkmann | 24 August 2023, 08:46:18 UTC | cilium, docs: Add a note about KPR and nfs dependencies Add a note under limitations to the needed kernel commit for getting nfs working, and reference to the GH issue, so that the discussion is easier to find. Once we get this into stable releases, we can update this bullet with more info. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 24 August 2023, 18:16:22 UTC |
d1b8613 | Kaloyan Yordanov | 31 July 2023, 15:02:48 UTC | fix: add check if debug is enabled when adding trace levels to envoy deamonset. Signed-off-by: Kaloyan Yordanov <kaloian995@gmail.com> | 24 August 2023, 17:02:22 UTC |
dcef00d | weizhou.lan@daocloud.io | 23 August 2023, 13:06:27 UTC | doc: typo of the mesh secret name Signed-off-by: weizhou.lan@daocloud.io <weizhou.lan@daocloud.io> | 24 August 2023, 13:41:12 UTC |
87518a3 | Andrii Iuspin | 08 August 2023, 17:55:03 UTC | Read FQDNRejectResponseCode from config Currently dnsProxy.dnsRejectResponseCode helm value is ignored because FQDNRejectResponseCode is not populated from viper Signed-off-by: Andrii Iuspin <yuspin@gmail.com> | 24 August 2023, 08:07:28 UTC |
eb1f266 | Cilium Imagebot | 22 August 2023, 13:56:56 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 24 August 2023, 04:44:21 UTC |
97387b4 | renovate[bot] | 22 August 2023, 13:10:32 UTC | chore(deps): update docker.io/library/golang:1.21.0 docker digest to b490ae1 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 24 August 2023, 04:44:21 UTC |
69c3a5d | Jaff Cheng | 20 July 2023, 10:11:23 UTC | ipam/test: Avoid using a shared metricsapi in unit tests Create a separate metricsapi for every test case to prevent interference between each other. Related: #26617 Signed-off-by: Jaff Cheng <jaff.cheng.sh@gmail.com> | 24 August 2023, 04:41:29 UTC |
5683e2a | Jaff Cheng | 18 July 2023, 07:54:36 UTC | ipam: Fix race in NodeManager.Resync TestNodeManagerManyNodes had been flaky before ported from aws/eni, and was eventually disabled in aws tests: https://github.com/cilium/cilium/issues/11560 One of the sources of this flake is the races in the values of metricsapi, e.g. `metricsapi.Nodes("total")` and `metricsapi.AllocatedIPs("available")`, which is not protected from concurrent writes in NodeManager.Resync. Allowing multiple goroutines to execute Resync simultaneously doesn't really make sense, since `Node.resyncNode` is already executed in parallel and controlled by semaphore. this patch serializes NodeManager.Resync to avoid data races on metricsAPI. Some excerpts of failed tests: --- FAIL: Test (17.29s) --- FAIL: Test/IPAMSuite (17.29s) --- FAIL: Test/IPAMSuite/TestIPAMMetadata (0.01s) testing.go:1446: race detected during execution of test --- FAIL: Test/IPAMSuite/TestNodeManagerManyNodes (3.88s) node_manager_test.go:610: ... obtained int = 850 ... expected int = 1000 --- FAIL: Test (17.74s) --- FAIL: Test/IPAMSuite (17.74s) --- FAIL: Test/IPAMSuite/TestNodeManagerManyNodes (4.36s) node_manager_test.go:606: ... obtained int = 87 ... expected int = 100 Related: #26617 Signed-off-by: Jaff Cheng <jaff.cheng.sh@gmail.com> | 24 August 2023, 04:41:29 UTC |
615f5d5 | Dan Everton | 26 July 2023, 06:16:52 UTC | Extend API/CLI to support updating policy by label This change extends the HTTP API to allow updating the agent policy repository by label. This is existing functionality that this change just exposes over the HTTP API as well. The `cilium policy import` command has been updated to make this functionality available from the CLI. Signed-off-by: Dan Everton <deverton@godaddy.com> | 24 August 2023, 04:24:41 UTC |
c976dd1 | Andrew Sauber | 22 August 2023, 22:07:51 UTC | Update stable releases Signed-off-by: Andrew Sauber <andrew.sauber@isovalent.com> | 24 August 2023, 03:56:11 UTC |
6367398 | Marco Iorio | 23 August 2023, 09:00:39 UTC | gha: set kvstoremesh image when pushing the development helm chart Configure the kvstoremesh repository and tag to match the one of the other cilium components. Additionally, explicitly disable the digest, which is otherwise configured in stable branches. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 23 August 2023, 21:50:15 UTC |
49919da | Dylan Reimerink | 10 August 2023, 13:09:22 UTC | bpf,tests: Change makefile cache to rebuild on header changes During BPF test development, it is common to make changes in dependencies of the test C file and then re-test. However, because we don't explicitly list header files and don't use them in the traditional way of only containing forward declarations and using other C files for the contents, the makefile doesn't understand it needs to rebuild. This commit makes clang emit a dependency file for each C file, this dependency file is then fed into `make` so it is aware of all files that contribute to the test C file, this makes it so any changes to any dependent file including .h files will invalidate the `make` cache. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com> | 23 August 2023, 21:21:18 UTC |
2cdeb6a | Cilium Imagebot | 23 August 2023, 05:57:44 UTC | ci: update docs-builder Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 23 August 2023, 20:01:01 UTC |
ae5b99d | dependabot[bot] | 23 August 2023, 03:50:56 UTC | build(deps): bump tornado from 6.2 to 6.3.3 in /Documentation Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.2 to 6.3.3. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](https://github.com/tornadoweb/tornado/compare/v6.2.0...v6.3.3) --- updated-dependencies: - dependency-name: tornado dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> | 23 August 2023, 20:01:01 UTC |
6ef4736 | renovate[bot] | 21 August 2023, 16:40:58 UTC | chore(deps): update dependency cilium/cilium-cli to v0.15.6 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 23 August 2023, 19:47:11 UTC |
9389b2c | Martynas Pumputis | 23 August 2023, 08:50:22 UTC | ci-ipsec-upgrade: Skip upon test/Documentation changes Reported-by: Joe Stringer <joe@cilium.io> Signed-off-by: Martynas Pumputis <m@lambda.lt> | 23 August 2023, 19:10:08 UTC |
e5d5afe | Maartje Eyskens | 02 August 2023, 12:20:38 UTC | Add a bpf auth flush command This command in cilium-agent allows the user to flush the auth map. This can be used to force re-auths between all enteties for debugging purposes. Signed-off-by: Maartje Eyskens <maartje@eyskens.me> Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com> | 23 August 2023, 18:59:54 UTC |
48023b9 | gray | 17 August 2023, 12:26:55 UTC | Add conn-disrupt-test action for reuse This commit makes conn-disrupt-test a github action, so upgrade test and IPsec key rotation test don't have to copy and paste everywhere. The idea is to allow caller workflow to specify the commands to execute, then this action will follow the steps: 1. Run "cilium-cli connectivity test --conn-disrupt-test-setup"; 2. Run whatever caller workflow passes: could be upgrade operation or IPsec key rotation; 3. Run "cilium-cli connectivity test --include-conn-disrupt-test"; Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com> | 23 August 2023, 18:43:45 UTC |
0d10aca | Daniel Borkmann | 23 August 2023, 15:15:50 UTC | cilium, iptables: Extend to cover default route in enable-masquerade-to-route-source Extend the enable-masquerade-to-route-source option to cover also SNAT targets for the default route on a given interface. The example from commit e731cbe27ef2 ("cilium, iptables: Support option to masquerade source IP from routing layer") now extends to inserting a default route (***): [...] [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -m set --match-set cilium_node_set_v4 dst -m comment --comment "exclude traffic to cluster nodes from masquerade" -j ACCEPT [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -d 1.1.1.1/32 -m comment --comment "cilium snat non-cluster via source route" -j SNAT --to-source 192.168.2.99 [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -d 192.168.2.13/32 -o enp5s0 -m comment --comment "cilium snat non-cluster via source route" -j SNAT --to-source 192.168.2.99 [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -o enp5s0 -m comment --comment "cilium snat non-cluster via source route" -j SNAT --to-source 192.168.2.12 (***) [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 ! -d 10.244.0.0/16 ! -o cilium_+ -m comment --comment "cilium masquerade non-cluster" -j MASQUERADE [...] This needs to be done in a second pass as otherwise iptables' linear processing would not be able to process the more specific rules. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 23 August 2023, 18:43:14 UTC |
23d2dc5 | Maciej Kwiek | 23 August 2023, 10:09:26 UTC | contrib: fix bump-readme script bump-readme script failed when there were two matches for version in README.rst. take only the first match. Signed-off-by: Maciej Kwiek <maciej@isovalent.com> | 23 August 2023, 18:37:46 UTC |
f08e6f8 | Dylan Reimerink | 23 August 2023, 12:45:21 UTC | statedb: Disable StateDB metrics by default The StateDB metrics have the potential to be high cardinality. Most of the metrics were implemented to monitor the performance StateDB which is more of a developer concern than an operator concern. By disabling them by default, we keep the amount of metrics lean for normal users but allow developers or advanced users to enable them if they need to. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com> | 23 August 2023, 16:15:53 UTC |
b22bc6d | Marco Hofstetter | 22 August 2023, 12:09:24 UTC | envoy: log access log server listening start This commit introduces a log message once the Envoy access log server starts to listen for incoming connections. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> | 23 August 2023, 13:01:53 UTC |
04b07fd | Marco Hofstetter | 22 August 2023, 05:59:40 UTC | envoy: introduce dependency xDS server -> accesslog server In addition to introducing the LocalEndpointStore to get rid of the direct dependency between accesslog and xDS server, the dependency from the xDS server to the accesslog server gets introduced. This dependency only serves the purpose of enforcing the accesslog server being initialized first before the xDS server is started up. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> | 23 August 2023, 13:01:53 UTC |
e555f7a | Marco Hofstetter | 22 August 2023, 05:52:31 UTC | envoy: introduce LocalEndPointStore Currently, the envoy accesslog server depends on the xDS server to get information about local endpoints. This leads to the xDS server being initialized and started before the accesslog server. Therefore, the accesslog server might not be ready when Envoy is receiving the xDS resources and starts to initialize Cilium components in envoy. This results in silent errors. This commit introduces the LocalEndPointStore which contains this information and is shared between the two components. The direct dependency between the accesslog server and xDS server can be replaced - and the components start initializing at the same time. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> | 23 August 2023, 13:01:53 UTC |
3f23ba7 | Tam Mach | 11 August 2023, 13:03:30 UTC | helm: Add validation rule for Envoy L7 Load Balancer This is to ensure that proxy must be enabled if Envoy L7 Load balancer feature is enabled. Signed-off-by: Tam Mach <tam.mach@cilium.io> | 23 August 2023, 12:45:48 UTC |
fe37586 | Tam Mach | 11 August 2023, 12:58:14 UTC | proxy: Ignore visibility annotation if proxy is disabled This is to avoid the below error if proxy is disabled as part of installation, but the visibility annotation is added to pods later. ``` 2023-08-11T12:42:41.390575371Z goroutine 1522 [running]: 2023-08-11T12:42:41.390581994Z github.com/cilium/cilium/pkg/proxy.(*Proxy).CreateOrUpdateRedirect(0x0, {0x3ae74b8, 0xc000650280}, {0x3aeb440?, 0xc0016e4560?}, {0xc0010ba1b0, 0x12}, {0x3afd260, 0xc000982000}, 0xc001c9c980) 2023-08-11T12:42:41.390589198Z github.com/cilium/cilium/pkg/proxy/proxy.go:459 +0xb7 2023-08-11T12:42:41.390596081Z github.com/cilium/cilium/pkg/endpoint.(*Endpoint).addVisibilityRedirects(0xc000982000, 0x1, 0xc001874ba0?, 0xc001c9c980?) 2023-08-11T12:42:41.390602613Z github.com/cilium/cilium/pkg/endpoint/bpf.go:343 +0x443 2023-08-11T12:42:41.390614345Z github.com/cilium/cilium/pkg/endpoint.(*Endpoint).addNewRedirects(0xc000982000, 0xc001874870?) 2023-08-11T12:42:41.390651325Z github.com/cilium/cilium/pkg/endpoint/bpf.go:424 +0x3c5 2023-08-11T12:42:41.390658068Z github.com/cilium/cilium/pkg/endpoint.(*Endpoint).runPreCompilationSteps(0xc000982000, 0xc000e31800, 0x0) 2023-08-11T12:42:41.390663999Z github.com/cilium/cilium/pkg/endpoint/bpf.go:802 +0x4fe 2023-08-11T12:42:41.390669690Z github.com/cilium/cilium/pkg/endpoint.(*Endpoint).regenerateBPF(0xc000982000, 0xc000e31800) 2023-08-11T12:42:41.390675451Z github.com/cilium/cilium/pkg/endpoint/bpf.go:542 +0x1a5 2023-08-11T12:42:41.390681112Z github.com/cilium/cilium/pkg/endpoint.(*Endpoint).regenerate(0xc000982000, 0xc000e31800) 2023-08-11T12:42:41.390686893Z github.com/cilium/cilium/pkg/endpoint/policy.go:467 +0x9c6 2023-08-11T12:42:41.390692564Z github.com/cilium/cilium/pkg/endpoint.(*EndpointRegenerationEvent).Handle(0xc000131b50, 0x0?) 2023-08-11T12:42:41.390698385Z github.com/cilium/cilium/pkg/endpoint/events.go:53 +0x325 2023-08-11T12:42:41.390704045Z github.com/cilium/cilium/pkg/eventqueue.(*EventQueue).run.func1() 2023-08-11T12:42:41.390709716Z github.com/cilium/cilium/pkg/eventqueue/eventqueue.go:245 +0x142 ``` Fixes: #27594 Signed-off-by: Tam Mach <tam.mach@cilium.io> | 23 August 2023, 12:45:48 UTC |
f6eb7aa | Tam Mach | 18 August 2023, 14:17:11 UTC | k8s: Replace generate-internal-groups.sh script This commit is to change to kube_codegen.sh as per the suggestion in the output. ``` $ make generate-k8s-api ... WARNING: generate-internal-groups.sh is deprecated. WARNING: Please use k8s.io/code-generator/kube_codegen.sh instead. .. ``` Relates: https://github.com/kubernetes/code-generator/commit/13056260ff7da3927a710f720f22440f65b4bf8a Signed-off-by: Tam Mach <tam.mach@cilium.io> | 23 August 2023, 11:33:27 UTC |
21964b6 | Haiyue Wang | 23 August 2023, 03:09:27 UTC | docs: Update the mutual authentication key format The commit 31592e7ce066 ("auth: optimize log output for pending auth") adds new field 'key' to beautify the log message. So update the authentication key format according to the real log message captured: 2023-08-23T10:22:04.308373113+08:00 level=debug msg="Policy is requiring authentication" key="localIdentity=13137, remoteIdentity=43715, remoteNodeID=54264, authType=spire" subsys=auth 2023-08-23T10:22:04.313513823+08:00 level=debug msg="Validating Server SNI" SNI ID=43715 subsys=auth 2023-08-23T10:22:04.313513823+08:00 level=debug msg="Validated certificate" subsys=auth uri-san="[spiffe://spiffe.cilium/identity/43715]" 2023-08-23T10:22:04.314043168+08:00 level=debug msg="Successfully authenticated" key="localIdentity=13137, remoteIdentity=43715, remoteNodeID=54264, authType=spire" remote_node_ip=10.10.10.1 subsys=auth Signed-off-by: Haiyue Wang <haiyue.wang@intel.com> | 23 August 2023, 06:57:04 UTC |
e183014 | weizhou.lan@daocloud.io | 22 August 2023, 13:12:17 UTC | typo in the debug document Signed-off-by: weizhou.lan@daocloud.io <weizhou.lan@daocloud.io> | 23 August 2023, 06:18:07 UTC |
44b86b3 | AwesomePatrol | 22 August 2023, 06:42:54 UTC | Apply suggestions from code review Co-authored-by: ZSC <zacharysarah@users.noreply.github.com> Signed-off-by: AwesomePatrol <AwesomePatrol@users.noreply.github.com> | 23 August 2023, 06:17:25 UTC |
f33f09b | Aleksander Mistewicz | 21 August 2023, 10:13:08 UTC | Add documentation on Hubble Exporter Fixes #26970 Signed-off-by: Aleksander Mistewicz <amistewicz@google.com> | 23 August 2023, 06:17:25 UTC |
163e575 | Quentin Monnet | 07 August 2023, 10:07:08 UTC | docs: Update references to legacy kube-proxy replacement modes The "strict" and "partial" mode for kube-proxy replacement (KPR) were deprecated in Cilium 1.14, in favour of the feature being enabled (the flag is set to "true" and all related options are turned on) or disabled (leaving users free to pick the options they want). This commit updates some references to the legacy modes, and update the surrouinding documentation accordingly. For L7 traffic management, we can narrow the minimal requirements (NodePort rather than full KPR set), and also remove the requirement on Kubernetes version 1.19+, now that 1.19 is the minimal version supported by Cilium anyway. Signed-off-by: Quentin Monnet <quentin@isovalent.com> | 23 August 2023, 06:16:48 UTC |
333ab95 | Quentin Monnet | 07 August 2023, 10:04:20 UTC | docs: Replace deprecated "kubeProxyReplacement=strict" with "...=true" The "strict" and "partial" mode for kube-proxy replacement (KPR) were deprecated in Cilium 1.14, in favour of the feature being enabled (the flag is set to "true" and all related options are turned on) or disabled (leaving users free to pick the options they want). This commit is a simple update for the cases where "strict" can be replaced with "true" in the documentation. Signed-off-by: Quentin Monnet <quentin@isovalent.com> | 23 August 2023, 06:16:48 UTC |
d97cd7a | Quentin Monnet | 07 August 2023, 09:55:17 UTC | docs: Replace mentions to KPR strict mode for per-node-config docs The "strict" and "partial" mode for kube-proxy replacement (KPR) were deprecated in Cilium 1.14, in favour of the feature being enabled (the flag is set to "true" and all related options are turned on) or disabled (leaving users free to pick the options they want). Let's update the documentation for per-node configuration accordingly and use "true" instead of "strict". Signed-off-by: Quentin Monnet <quentin@isovalent.com> | 23 August 2023, 06:16:48 UTC |
c0a5fbe | Hemanth Malla | 18 August 2023, 13:14:21 UTC | Fix a bug where cilium host IP is not read from k8s node annotations After https://github.com/cilium/cilium/commit/0696874a932a07f9a5ed2b7a5f7aeb2db0757379 refactored the logic to read annotations and change the default behavior, addrs array was never assigned to newNode.IPAddresses after it was populated. Signed-off-by: Hemanth Malla <hemanth.malla@datadoghq.com> | 23 August 2023, 03:46:42 UTC |
2cec846 | Aditi Ghag | 23 August 2023, 01:34:02 UTC | gha: Extend source directory for build runs Previously, the GHA ran only for PRs with changes in the test directory. However, this failed to catch build regressions in certain cases where PR changes affected ginkgo builds. Suggested-by: Joe Stringer <joe@cilium.io> Signed-off-by: Aditi Ghag <aditi@cilium.io> | 23 August 2023, 03:35:08 UTC |
b6bd49d | Aditi Ghag | 22 August 2023, 23:23:53 UTC | pkg/cidr: Move linux specific variable references from netlink The netlink consts are linux specific, so move them accordingly. Reported-by: Tim Horner <timothy.horner@isovalent.com> Fixes: e731cbe27e "cilium, iptables: Support option to masquerade source IP from routing layer" Signed-off-by: Aditi Ghag <aditi@cilium.io> | 23 August 2023, 03:35:08 UTC |
c7bf490 | Hemanth Malla | 15 June 2023, 21:14:10 UTC | Operator: Add missing observability for Azure API calls Currently we're not capturing response status and duration for some of the calls made to Azure. This commit calls ObserveAPICall() with status and duration for the operations missing them. Signed-off-by: Hemanth Malla <hemanth.malla@datadoghq.com> | 22 August 2023, 21:06:24 UTC |
edec2dc | Daneyon Hansen | 03 July 2023, 15:54:39 UTC | Removes Unused TransformToNode() Func Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> | 22 August 2023, 21:05:30 UTC |
bc3aa26 | Jussi Maki | 22 August 2023, 14:35:27 UTC | statedb2: Add /statedb/dump REST API handler Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 20:08:47 UTC |
ce81e6a | Jussi Maki | 22 August 2023, 14:15:52 UTC | CODEOWNERS: statedb to statedb2 Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 20:08:47 UTC |
5de12bb | Jussi Maki | 22 August 2023, 14:13:11 UTC | statedb2: Fix metrics observing in Abort() The metrics should be observed only if it was a write transaction and it wasn't committed/aborted already. Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 20:08:47 UTC |
fe0f9a2 | Jussi Maki | 22 August 2023, 13:34:45 UTC | statedb: Delete pkg/statedb and remove go-memdb dependency pkg/statedb has been replaced by pkg/statedb2. Follow-up PR will rename pkg/statedb2 to pkg/statedb. Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 20:08:47 UTC |
8abf620 | Dylan Reimerink | 22 August 2023, 13:08:54 UTC | devices_controller: Switched devices and routes from StateDB to StateDB2 This commit switches the devices controller over from the old StateDB to the new StateDB2 implementation. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com> | 22 August 2023, 20:08:47 UTC |
a845cdf | Dylan Reimerink | 22 August 2023, 11:40:29 UTC | l2announcement: Switch from StateDB to StateDB2 This commit switches the l2announcer and datapath/l2responder to use StateDB2 instead of the original StateDB. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com> | 22 August 2023, 20:08:47 UTC |
e731cbe | Daniel Borkmann | 21 August 2023, 09:43:29 UTC | cilium, iptables: Support option to masquerade source IP from routing layer Add a new `--enable-masquerade-to-route-source` option to the agent which supports more fine-grained masquerading for advanced use cases. For example, a routing agent installs several CIDRs for a given interface and each of the CIDRs have a different source address selection criteria. Moreover, the next hops could even be part of a next hop group where the underlying next hops are reachable via different interfaces which may not be known to Cilium. Anyway, if the option is enabled, then the regular MASQUERADE target will only act as a catchall/fallback, and we install several j SNAT --to-source rules before that based on the routing setup (destination CIDR & source IP to use), so that Pod traffic can be masqueraded differenty. For the default route we keep relying on MASQUERADE target. Note that the user needs to ensure that there are no overlapping destination prefixes since iptables is only processing its rules linearly as opposed to routing layer. Example: --enable-masquerade-to-route-source=false (default): [...] [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -m set --match-set cilium_node_set_v4 dst -m comment --comment "exclude traffic to cluster nodes from masquerade" -j ACCEPT [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 ! -d 10.244.0.0/16 ! -o cilium_+ -m comment --comment "cilium masquerade non-cluster" -j MASQUERADE [...] --enable-masquerade-to-route-source=true: [...] [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -m set --match-set cilium_node_set_v4 dst -m comment --comment "exclude traffic to cluster nodes from masquerade" -j ACCEPT [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -d 1.1.1.1/32 -m comment --comment "cilium snat non-cluster via source route" -j SNAT --to-source 192.168.2.99 [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 -d 192.168.2.13/32 -o enp5s0 -m comment --comment "cilium snat non-cluster via source route" -j SNAT --to-source 192.168.2.99 [0:0] -A CILIUM_POST_nat -s 10.244.0.0/24 ! -d 10.244.0.0/16 ! -o cilium_+ -m comment --comment "cilium masquerade non-cluster" -j MASQUERADE [...] In the latter, for the destination of 1.1.1.1/32 we SNAT to 192.168.2.99 instead of 192.168.2.12 which is the interface primary address. Similar for 192.168.2.13/32 which also has the -o enp5s0 as device: # ip r [...] 1.1.1.1 nhid 40 src 192.168.2.99 nexthop via 192.168.2.1 dev enp5s0 weight 1 nexthop via 192.168.2.2 dev enp5s0 weight 1 192.168.2.13 dev enp5s0 scope link src 192.168.2.99 [...] Support has been implemented for IPv4 and IPv6 masquerading. BPF-based masquerading is out of scope for now as we first need to land fib lookup extensions into the kernel (@brb). Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 22 August 2023, 19:37:00 UTC |
dd10304 | Daniel Borkmann | 22 August 2023, 14:52:01 UTC | cilium, iptables: Convert EgressMasqueradeInterfaces to string slice Convert EgressMasqueradeInterfaces to string slice so that it can be easily iterated rather than first having to call into ... strings.Split(option.Config.EgressMasqueradeInterfaces, ",") ... to get to the array. For the existing cases this means, we need to join the array instead. Suggested-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 22 August 2023, 19:37:00 UTC |
44f0b0a | Daniel Borkmann | 22 August 2023, 07:12:04 UTC | cilium, iptables: Do not hard-code ip6tables string Don't hardcode, but check based on prog as we do elsewhere. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 22 August 2023, 19:37:00 UTC |
9c47083 | Tobias Klauser | 22 August 2023, 13:56:44 UTC | renovate: ignore all gops updates Otherwise the gops version in images/runtime/build-gops.sh will still be bumped, see https://github.com/cilium/cilium/pull/27624 Fixes: 14760a1b2ffb ("vendor: downgrade github.com/shirou/gopsutil/v3 to v3.23.2") Signed-off-by: Tobias Klauser <tobias@cilium.io> | 22 August 2023, 14:46:46 UTC |
917f625 | weizhou.lan@daocloud.io | 18 August 2023, 10:09:29 UTC | fix: mtls does not work when kubelet does not listen on 0.0.0.0 Signed-off-by: weizhou.lan@daocloud.io <weizhou.lan@daocloud.io> | 22 August 2023, 14:26:19 UTC |
6b93a07 | renovate[bot] | 22 August 2023, 08:41:18 UTC | chore(deps): update golangci/golangci-lint docker tag to v1.54.2 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 22 August 2023, 14:01:49 UTC |
96e8bf8 | renovate[bot] | 22 August 2023, 09:16:11 UTC | fix(deps): update all go dependencies main Signed-off-by: renovate[bot] <bot@renovateapp.com> | 22 August 2023, 13:24:21 UTC |
323b4cb | Daniel Borkmann | 22 August 2023, 11:07:08 UTC | bpf, complexity-tests: Add HAVE_FIB_IFINDEX coverage Commit d1c362e1dd68 ("bpf: Always return target ifindex in bpf_fib_lookup") which HAVE_FIB_IFINDEX reflects is part of is 5.10+ kernels. Add the define to the complexity tests for 5.10 and net-next to better reflect real world. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 22 August 2023, 12:28:02 UTC |
bd8b4d0 | Daniel Borkmann | 22 August 2023, 09:02:20 UTC | cilium: Fix 16bit ifindex limitation The limitation exists mainly on old kernels where the fib lookup helper does not populate the outgoing ifindex. Only for this case we rely on the CT lookup stored ifindex which back then was added as a 16bit field due to limited padding space available. Nowadays this can be lifted after the big rework in #23884. We've seen users with high netdevice churn run into this limitation where the agent bails out. Apart from fixing the bleed, this can be further refined by not relying on the asm.FnRedirectPeer helper presence but by actually doing a runtime BPF program probe so that stable kernels can even be covered. Fixes: #16260 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 22 August 2023, 12:28:02 UTC |
6f676a3 | Dylan Reimerink | 07 August 2023, 13:33:39 UTC | statedb2: Add metrics This commit adds metrics to statedb2, metrics mostly center around locking, contention, number of entries and duration of certain operations since these topics are the most interesting to us. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com> Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 12:25:34 UTC |
ef41d11 | Jussi Maki | 04 August 2023, 13:26:23 UTC | statedb2: Simple fuzz test Add a simple fuzz test to test different random combinations of write transactions and operations. Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 12:25:34 UTC |
f945558 | Jussi Maki | 04 August 2023, 12:11:33 UTC | statedb2: Add example application Add an example usage of statedb2 that showcases the pattern for implementing a resilient reconciliation loop on top of the library. Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 12:25:34 UTC |
23b0492 | Jussi Maki | 04 August 2023, 12:10:47 UTC | statedb2: StateDB v2.0 with per-table locks and deletion tracking This introduces an evolution of pkg/statedb that solves the following issues: * Per-table locking instead of global writer lock for increased resiliency. * No more use of reflection in indexing. Indexes are defined in a type-safe way. * Revisions are built into the database so it does not need to be reimplemented by each table. * Deletions on a table can now be tracked and a consistent sequence of inserts and deletes can be derived from it to e.g. implement retryable reconciliation loops. It is introduced as pkg/statedb2 for easier code reviewing (no need to rewrite uses of pkg/statedb in this PR) and to allow some time for it to mature before replacing pkg/statedb. Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 12:25:34 UTC |
e7b569b | Jussi Maki | 04 August 2023, 12:06:05 UTC | lock: SortableMutex for ordered locking of a mutex set SortableMutex is a mutex paired with a (globally unique) sequence number which allows sorting a set of them into a predicable order for ordered locking. This will be used in a follow-up commit to implement per-table locks for StateDB in a way that avoids deadlocks due to misordered locking sequence (A->B and B->A). Signed-off-by: Jussi Maki <jussi@isovalent.com> | 22 August 2023, 12:25:34 UTC |
c1edbf0 | André Martins | 22 August 2023, 10:54:26 UTC | images: update cilium-{runtime,builder} Signed-off-by: André Martins <andre@cilium.io> | 22 August 2023, 12:25:03 UTC |
14760a1 | André Martins | 22 August 2023, 09:34:52 UTC | vendor: downgrade github.com/shirou/gopsutil/v3 to v3.23.2 Until github.com/shoenig/go-m1cpu is added as an exception in the list of libraries that we can use, we need to downgrade this dependency down to the version that it didn't have the "github.com/shoenig/go-m1cpu" as part of it. Signed-off-by: André Martins <andre@cilium.io> | 22 August 2023, 12:25:03 UTC |
e6a7df4 | Marco Iorio | 28 July 2023, 13:14:46 UTC | maps: refactor per-cluster CT maps manager Let's simplify the per-cluster CT maps management logic, removing the dependency on the global variable (which does not play well with the hive framework) and splitting the creation/removal tasks from the retrieval of inner maps. While being at it, let's also slightly improve the performance around these operations by avoiding to attempt opening the inner maps when not strictly necessary, as well as keeping the list of known Cluster IDs. Additionally, let's also move the fake implementation for testing purposes to a separate package, for better separation. Finally, let's validate the ClusterID in the `bpf ct list cluster <ID>` CLI command, to properly return an error in case it is invalid. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 22 August 2023, 08:47:34 UTC |
c926ac3 | Marco Iorio | 28 July 2023, 15:29:19 UTC | maps: retrieve per-cluster maps for GC through Hive Currently, the per-cluster maps are accessed by the GC logic through a global variable. Let's instead propagate a function to retrieve them through the Hive framework, to prepare for the subsequent removal of the global variable and better align with the overall dependency injection approach. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 22 August 2023, 08:47:34 UTC |
b00b6f0 | renovate[bot] | 14 August 2023, 02:05:24 UTC | chore(deps): update all kind-images main Signed-off-by: renovate[bot] <bot@renovateapp.com> | 22 August 2023, 08:40:31 UTC |
7b6d9b7 | renovate[bot] | 14 August 2023, 03:50:23 UTC | chore(deps): update all kind-images main Signed-off-by: renovate[bot] <bot@renovateapp.com> | 22 August 2023, 08:39:56 UTC |
86d8999 | Marco Hofstetter | 17 August 2023, 08:54:15 UTC | helm: put extraConfig to the end of ConfigMap cilium-config This commit puts the extraConfig back to the end of the ConfigMap cilium-config. This way all existing properties can be overwritten. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> | 22 August 2023, 07:08:08 UTC |
a112cab | Tobias Klauser | 17 August 2023, 14:26:45 UTC | contrib/scripts/kind.sh: specify IPv4 prefix and range on secondary network Otherwise a default would be used. This allows to clearly distinguish it from the default primary network. Signed-off-by: Tobias Klauser <tobias@cilium.io> | 21 August 2023, 21:06:21 UTC |
cbfd29e | Tobias Klauser | 17 August 2023, 14:25:45 UTC | contrib/scripts/kind.sh: simplify secondary network attachment Instead of relying on `docker ps` and filtering for the well-known label, use `kind get nodes` to list the nodes to attach to the secondary network. Signed-off-by: Tobias Klauser <tobias@cilium.io> | 21 August 2023, 21:06:21 UTC |
9e9665d | renovate[bot] | 21 August 2023, 04:20:27 UTC | chore(deps): update cilium/cilium-cli action to v0.15.6 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 21 August 2023, 16:39:29 UTC |
896d312 | Nate Sweet | 28 April 2023, 20:16:57 UTC | docs: Document Potential Dual-Stack Upgrade Issues for 1.15 Signed-off-by: Nate Sweet <nathanjsweet@pm.me> Signed-off-by: Joe Stringer <joe@cilium.io> | 21 August 2023, 16:37:05 UTC |
603235d | Andrei Kvapil | 17 August 2023, 10:33:50 UTC | cgroups: Fix race to load cgroup.hostRoot option While loading, the package 'pkg/cgroups/manager' sets the global variable 'cgroupRoot' from the 'pkg/cgroups' package. This occurs before the configuration is fully loaded and the correct path is set in the 'pkg/cgroups' package. This variable is later used by the 'validateCgroupPath' function. As a result, the 'validateCgroupPath' function always works with the default value instead of the user-defined one. Signed-off-by: Andrei Kvapil <kvapss@gmail.com> | 21 August 2023, 16:25:53 UTC |
8b9eff9 | ishuar | 13 August 2023, 19:58:06 UTC | added affinity to `cillium-preflight` daemonset Signed-off-by: ishuar <ishansharma887@gmail.com> | 21 August 2023, 16:20:27 UTC |
d0d3a86 | Marco Iorio | 14 August 2023, 16:25:59 UTC | cli: retrieve IPv6 NAT per-cluster maps if IPv6 is enabled Currently, the `bpf nat list cluster ID` command always return only IPv4 maps. Let's additionally retrieve the IPv6 ones when this address family is enabled, for consistency with the NAT global maps retrieval. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 21 August 2023, 16:20:16 UTC |
70d98f4 | Marco Iorio | 28 July 2023, 08:53:12 UTC | maps: refactor per-cluster NAT maps manager Let's simplify the per-cluster NAT maps management logic, removing the dependency on the global variable (which does not play well with the hive framework) and splitting the creation/removal tasks from the retrieval of inner maps. While being at it, let's also slightly improve the performance around these operations by avoiding to attempt opening the inner maps when not strictly necessary. Finally, let's also move the fake implementation for testing purposes to a separate package, for better separation. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 21 August 2023, 16:20:16 UTC |
1d3a948 | Marco Iorio | 10 August 2023, 10:18:05 UTC | maps: use typed constants for IP family in NAT maps Currently, IPv4 and IPv6 NAT maps are distinguished using untyped boolean constants. Let's replace that with an ad-hoc IPFamily type, and the corresponding IPv4 and IPv6 constants, for additional clarity. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 21 August 2023, 16:20:16 UTC |
eba103c | ishuar | 08 August 2023, 23:42:52 UTC | added the securityContext in Spire server pod and container. - Updated docs (used gnu-sed in macOS for helm-values.rst) permanent fix in https://github.com/cilium/cilium/pull/27495 Signed-off-by: ishuar <ishansharma887@gmail.com> | 21 August 2023, 16:19:36 UTC |
9c4cd22 | Marco Iorio | 08 August 2023, 10:03:03 UTC | node: introduce configurable prefix cluster mutator Introduce the possibility of configuring a prefix cluster mutator to customize the prefixes used as key when inserting and removing tunnel map entries. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 21 August 2023, 14:08:13 UTC |
4da2f4c | Marco Iorio | 08 August 2023, 09:39:30 UTC | clustermesh: refactor PrefixClusterFrom* helpers Currently, these helpers always take the cluster ID as last parameter. Let's drop it in favor of possible extra options, to favor extensibility and simplify the usages when it is not required. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 21 August 2023, 14:08:13 UTC |
0f11ce8 | Julian Wiedmann | 21 August 2023, 07:33:32 UTC | bpf: lxc: clarify kube-proxy workaround in to-container path ipv*_policy() (the pod ingress policy code) can be called in two ways: 1. as an EP-specific tail-call via CILIUM_MAP_POLICY (here tail_ipv*_policy() calls the policy code), or 2. when cil_to_container() is attached to the veth interface (here tail_ipv*_to_endpoint() is the caller) Lift the kube-proxy workaround into the callers, so we can fine-tune its behaviour. As cil_to_container() calls bpf_clear_meta(), we can trust that CB_IFINDEX is 0 and don't need to include the call to redirect_ep() from this path. This makes it perfectly clear that the cil_to_container() path simply lets the packet pass through to the veth peer. Note: it's *very* likely that we could also remove the PACKET_HOST part, but let's not change behaviour for now. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> | 21 August 2023, 13:07:07 UTC |
55e13b4 | Julian Wiedmann | 26 June 2023, 07:34:43 UTC | bpf: lxc: clarify that RevNAT in from-container is only for loopback Per-packet RevDNAT for in-cluster access to services typically happens in the to-container path, as replies flow back to the client. It is applied when the CT lookup in CT_INGRESS direction returns a CT_REPLY result (ie it matches a CT_EGRESS entry) with a populated .rev_nat_index field. There is one exception though: in the loopback case, replies are already RevNATed in the from-container path, as they exit the backend. Here the CT_REPLY result is for a lookup in CT_EGRESS direction (ie it matches a CT_INGRESS entry). The only time a CT_INGRESS entry would have its .rev_nat_index field populated is when it's pre-populated by ct_create4() as part of creating a loopback CT_EGRESS entry. We can therefore remove the unused IPv6 code (there's no IPv6 loopback support). Also add a comment to the IPv4 path that explains its purpose. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> | 21 August 2023, 12:34:41 UTC |
3ae5ff1 | Julian Wiedmann | 17 June 2023, 10:05:03 UTC | bpf: lxc: remove loopback artifacts from IPv6 path There's no IPv6 loopback support, and keeping this up-to-date with the IPv4 path is an annoyance. Let's add it back when actually needed. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> | 21 August 2023, 12:34:41 UTC |
ae5e182 | Tam Mach | 18 August 2023, 11:40:17 UTC | gateway-api: Bump version to v0.8.0-rc1 This is to regularly sync-up with upstream releases, which will make things easy for v1.0.0 later. Uptream release: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.8.0-rc1 Signed-off-by: Tam Mach <tam.mach@cilium.io> | 21 August 2023, 10:39:05 UTC |
957e953 | Alex Waring | 15 August 2023, 20:33:39 UTC | docs: Correct comment on toFQDN API definition The comment is 5 years old and no longer valid, removing and updating the CRD. Signed-off-by: Alex Waring <ajmwaring@gmail.com> | 18 August 2023, 17:05:47 UTC |
eda13ea | Tam Mach | 18 August 2023, 12:10:16 UTC | contrib: Make hint command copy and paste friendly This is to make it easier for contributor to copy and paste in case of failure. Similar was done in other scripts like below https://github.com/cilium/cilium/blob/cda37f604391d676e0812cda6e9510530acb976e/contrib/scripts/check-api-code-gen.sh#L46 Signed-off-by: Tam Mach <tam.mach@cilium.io> | 18 August 2023, 16:53:52 UTC |
2f0657e | renovate[bot] | 14 August 2023, 02:05:34 UTC | chore(deps): update all github action dependencies Signed-off-by: renovate[bot] <bot@renovateapp.com> | 18 August 2023, 15:09:20 UTC |
9b6c8cf | Robin Hahling | 18 August 2023, 11:39:49 UTC | images/builder: update cilium-builder Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 18 August 2023, 14:15:58 UTC |
1793120 | Robin Hahling | 17 August 2023, 11:57:31 UTC | images/builder: bump proto plugins Release notes for protoc-gen-go: https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.31.0 Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 18 August 2023, 14:15:58 UTC |
fe79d2e | Robin Hahling | 17 August 2023, 11:51:28 UTC | images/builder: bump protoc to v24.0 Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 18 August 2023, 14:15:58 UTC |
5b93574 | Marco Hofstetter | 17 August 2023, 09:28:48 UTC | codeowners: include sig-servicemesh into cilium envoy & spire helm This commit adds the team cilium/sig-servicemesh to the list of codeowners for helm chart changes specific to the cilium-envoy & spire deployments. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> | 18 August 2023, 14:06:16 UTC |
cda37f6 | Tam Mach | 17 August 2023, 11:42:06 UTC | gateway-api: Support HTTP request mirror All validation logic in HTTPRoute is applied the same as with the normal backend, as backend for mirror requests is consolidated and merged with other backends in the same HTTPRoute. Signed-off-by: Tam Mach <tam.mach@cilium.io> | 18 August 2023, 11:15:40 UTC |
8dc1ae8 | Tam Mach | 16 August 2023, 11:38:36 UTC | gateway-api: Enable HTTP redirect filter This commit is to enable HTTP redirect for port, schema and path. Small fix for TLS filter match on server name is done to avoid the below issue. As part of recent changes in upstream, if scheme and port are not specified, gateway listener port must be used. ```console 2023-08-16T11:28:20.797264246Z level=warning msg="NACK received for versions after 52 and up to 53; waiting for a version update before sending again" subsys=xds xdsAckedVersion=52 xdsClientNode="host~127.0.0.1~no-id~localdomain" xdsDetail="Error adding/updating listener(s) gateway-conformance-infra/cilium-gateway-same-namespace-with-https-listener/listener: error adding listener '127.0.0.1:10605': partial wildcards are not supported in \"server_names\"\n" xdsNonce=53 xdsStreamID=2 xdsTypeURL=type.googleapis.com/envoy.config.listener.v3.Listener ``` Signed-off-by: Tam Mach <tam.mach@cilium.io> | 18 August 2023, 11:15:40 UTC |
3cf560f | Tam Mach | 13 August 2023, 11:16:11 UTC | gateway-api: Add support for rewrite path filter For prefix rewrite to work, we need to change the prefix match based on regex to PathSeparatedPrefix route match, so that the prefix match is recognized correctly. Signed-off-by: Tam Mach <tam.mach@cilium.io> | 18 August 2023, 11:15:40 UTC |
86bd1f8 | Tam Mach | 13 August 2023, 06:16:03 UTC | gateway-api: Add support for rewrite host This is to add the support for extended feature HTTPRouteHostRewrite. Signed-off-by: Tam Mach <tam.mach@cilium.io> | 18 August 2023, 11:15:40 UTC |
182edfe | Tobias Klauser | 17 August 2023, 11:12:45 UTC | k8s/resource: replace custom atomic counter type by sync/atomic type Use the sync/atomic.Int64 type introduced in Go 1.19. Signed-off-by: Tobias Klauser <tobias@cilium.io> | 18 August 2023, 08:14:31 UTC |