https://github.com/cilium/cilium
- HEAD
- refs/heads/1.2.7-hotfix1-fqdn-regen
- refs/heads/EndpointPolicyEnformcement
- refs/heads/address
- refs/heads/all-scalability-improvements
- refs/heads/beta/service-mesh
- refs/heads/bpf-metrics
- refs/heads/brb/brb-patch-2
- refs/heads/cilium-envoy-crd-pre-beta
- refs/heads/cilium-no-gopath
- refs/heads/cli-upgrade-v1.12-ci-test
- refs/heads/clustermesh511-upgrade-test
- refs/heads/committers-codeowners
- refs/heads/debug
- refs/heads/dev/joe/v1.8-with-hostfw-fixes
- refs/heads/enable_cnp_latency
- refs/heads/encrypt-node-fixes
- refs/heads/ensure-macos-build-succeeds
- refs/heads/envoy-policy-precedence
- refs/heads/envoy-warnings-cleanup
- refs/heads/extension-mysql
- refs/heads/feature/cep-scalability
- refs/heads/feature/devices-and-addresses
- refs/heads/feature/devices-reconciliation-v1.16
- refs/heads/feature/main/svc-icmp-response
- refs/heads/feature/service-refactor
- refs/heads/feature/service-refactor-fresh
- refs/heads/feature/v1.11/beta-test
- refs/heads/feature/v1.11/k8s-ingress
- refs/heads/fix-iphealth
- refs/heads/fqdn-fixl3-wildcard
- refs/heads/fristonio/iptables-manager-fix
- refs/heads/ft/main/chancez/push-dev-charts
- refs/heads/ft/main/push_chart_stable_branches_fix
- refs/heads/ft/main/test_push_chart_updates
- refs/heads/gce-example
- refs/heads/gh-readonly-queue/main/pr-27509-78a5f177693fb443cd946441f45826bf7fa2437a
- refs/heads/ginkgo-better-timeout
- refs/heads/graduation
- refs/heads/hf/main/ipam-pools-build-230605
- refs/heads/hf/master/v1.12-rc2-health-dbg-v1
- refs/heads/hf/master/wg-fix-ipam-k8s-v2
- refs/heads/hf/v1.10/cls-prio2
- refs/heads/hf/v1.10/debug-taint-removal
- refs/heads/hf/v1.10/v1.10.10-with-19452
- refs/heads/hf/v1.10/v1.10.2-fix-ipsec-ep-routes
- refs/heads/hf/v1.10/v1.10.5-with-identity-leak-fix
- refs/heads/hf/v1.10/v1.10.7-additional-logs
- refs/heads/hf/v1.10/v1.10.7-exclude-local
- refs/heads/hf/v1.10/v1.10.7-exclude-loopback
- refs/heads/hf/v1.10/v1.10.7-extra-logs
- refs/heads/hf/v1.10/v1.10.7-more-logs
- refs/heads/hf/v1.10/v1.10.8-deadlock-and-complexity-fix
- refs/heads/hf/v1.10/v1.10.8-deadlock-fix
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v3
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v4
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v5
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v6
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v7
- refs/heads/hf/v1.11/1.11.4-custom-taint
- refs/heads/hf/v1.11/19247-custom-taint-key
- refs/heads/hf/v1.11/dbg-svc-restore
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak-eni-attach-and-logging
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak-eni-attachment
- refs/heads/hf/v1.11/v1.11.3-with-19259
- refs/heads/hf/v1.11/v1.11.4-custom-taint
- refs/heads/hf/v1.11/v1.11.5-and-19247-eed5544
- refs/heads/hf/v1.11/xdp-multidev-v1
- refs/heads/hf/v1.11/xdp-multidev-v2-ipcache-fix
- refs/heads/hf/v1.12/next-net-v1
- refs/heads/hf/v1.12/v1.12.18-994
- refs/heads/hf/v1.12/v1.12.3-debug-k8s-heartbeat
- refs/heads/hf/v1.12/v1.12.3-debug-k8s-heartbeat-v2
- refs/heads/hf/v1.13/bpf-sock-l7-fix
- refs/heads/hf/v1.13/v1.13.12-without-deny-precedence
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence-debug
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence-with-xfrm-fix
- refs/heads/hf/v1.13/v1.13.2-with-24875
- refs/heads/hf/v1.13/v1.13.3-with-26242
- refs/heads/hf/v1.14/cidr-identity-refcnt-fix
- refs/heads/hf/v1.14/v1.14-with-27327
- refs/heads/hf/v1.7/v1.7.15-with-neighbor-fix
- refs/heads/hf/v1.7/v1.7.15-with-neighbor-fix-2
- refs/heads/hf/v1.8/v1.8.13-with-19452
- refs/heads/hf/v1.8/v1.8.6-eni-cidr-fix-1
- refs/heads/hf/v1.8/v1.8.6-eni-cidr-fix-15303
- refs/heads/hf/v1.8/v1.8.7-with-fqdn-underscore-fix
- refs/heads/hf/v1.8/v1.8.8-eni-cidr-fix-1
- refs/heads/hf/v1.8/v1.8.8-with-encrypt-fixes
- refs/heads/hf/v1.9/v1.9.8-azure-ipam-fix
- refs/heads/hf/v1.9/v1.9.9-azure-pod-egress-fix
- refs/heads/hpabla/bgpv2/deprecate-localport
- refs/heads/images/runtime/20210830
- refs/heads/ipc-demo
- refs/heads/ktls-tx-only
- refs/heads/ktls-tx-only-v2
- refs/heads/ktls-tx-rx
- refs/heads/ktls-tx-rx-v2
- refs/heads/ktls-tx-rx-v3
- refs/heads/ktls-tx-rx-v4
- refs/heads/ktls-tx-rx-v5
- refs/heads/ldelossa/feat/bgp-control-plane
- refs/heads/ldelossa/keep-mark-definitions-consistent
- refs/heads/ldelossa/segment-makefiles
- refs/heads/ldelossa/segment-makefiles-v2
- refs/heads/ldelossa/srv6-encap-fib
- refs/heads/lizrice/pr/cli-confusion
- refs/heads/main
- refs/heads/mio/wireguard-restore-allowed-ips
- refs/heads/multi-stack-dev-vm
- refs/heads/pr/1-9-ci-test
- refs/heads/pr/aanm-update-k8s-conformance
- refs/heads/pr/aanm/bisect
- refs/heads/pr/add-controller-identity
- refs/heads/pr/aditighag/lrp-skip-lb
- refs/heads/pr/asauber/link-local-as-host
- refs/heads/pr/asauber/max-ifindex-metric
- refs/heads/pr/avoid-ct-for-dsr
- refs/heads/pr/backend-state
- refs/heads/pr/bbb-cpy
- refs/heads/pr/bimmlerd/modularize-bandwidth-manager
- refs/heads/pr/bimmlerd/v1.12-backport-quay-org-from-env
- refs/heads/pr/bounded-loops
- refs/heads/pr/bpf-based-masquerading
- refs/heads/pr/bpf-edt-proxy
- refs/heads/pr/brb/arping-nexthop
- refs/heads/pr/brb/arping-via-gw
- refs/heads/pr/brb/auto-multi-dev-v2
- refs/heads/pr/brb/backport-1.8.5-nat-gc
- refs/heads/pr/brb/bpf-host-routing-wg
- refs/heads/pr/brb/bpf-lxc-no-redirect
- refs/heads/pr/brb/bpf-masq-veth
- refs/heads/pr/brb/bpf-multihoming
- refs/heads/pr/brb/cgroup-v2-test
- refs/heads/pr/brb/check-errors-in-logs
- refs/heads/pr/brb/check-wg
- refs/heads/pr/brb/ci
- refs/heads/pr/brb/ci-1111
- refs/heads/pr/brb/ci-2
- refs/heads/pr/brb/ci-4.19
- refs/heads/pr/brb/ci-arping-flake
- refs/heads/pr/brb/ci-bigtcp
- refs/heads/pr/brb/ci-bpf-netdev-without-egress
- refs/heads/pr/brb/ci-cleanup-svc
- refs/heads/pr/brb/ci-dbg-conformance-kind
- refs/heads/pr/brb/ci-dbg-external
- refs/heads/pr/brb/ci-dbg-flake-from-outside
- refs/heads/pr/brb/ci-demo
- refs/heads/pr/brb/ci-disable-ces-for-egress-gw
- refs/heads/pr/brb/ci-dp-disable-bpf-host-routing
- refs/heads/pr/brb/ci-dp-hubble-flows
- refs/heads/pr/brb/ci-dp-more-diversity
- refs/heads/pr/brb/ci-dp-v1.13
- refs/heads/pr/brb/ci-dp-v6
- refs/heads/pr/brb/ci-dp-verifier
- refs/heads/pr/brb/ci-e2e-enable-debug-ipsec
- refs/heads/pr/brb/ci-e2e-geneve-dsr
- refs/heads/pr/brb/ci-e2e-helm-mode-v1.13
- refs/heads/pr/brb/ci-e2e-lvh-retry
- refs/heads/pr/brb/ci-e2e-more-nodes
- refs/heads/pr/brb/ci-e2e-new-cli
- refs/heads/pr/brb/ci-e2e-nft
- refs/heads/pr/brb/ci-e2e-unsafe
- refs/heads/pr/brb/ci-e2e-unsafe-v2
- refs/heads/pr/brb/ci-e2e-upgrade-tests
- refs/heads/pr/brb/ci-e2e-upgrade-tests-ipsec
- refs/heads/pr/brb/ci-early-terminate-conn-disrupt
- refs/heads/pr/brb/ci-eks-ipsec-upgrade
- refs/heads/pr/brb/ci-encrypt-l7
- refs/heads/pr/brb/ci-fix-ip-masq-dry-run
- refs/heads/pr/brb/ci-ipsec-upgrade-fix
- refs/heads/pr/brb/ci-ipsec-upgrade-missed-tail-calls
- refs/heads/pr/brb/ci-ipsec-upgrade-v1.13
- refs/heads/pr/brb/ci-ipsec-upgrade-vol2
- refs/heads/pr/brb/ci-keep-missed-tail-calls
- refs/heads/pr/brb/ci-l7-nodeport
- refs/heads/pr/brb/ci-lvh-4.19
- refs/heads/pr/brb/ci-lvh-5.4
- refs/heads/pr/brb/ci-lvh-5.4-v2
- refs/heads/pr/brb/ci-lvh-bpf-next
- refs/heads/pr/brb/ci-no-self-hosted
- refs/heads/pr/brb/ci-pass-kernel-env
- refs/heads/pr/brb/ci-prepull-l4lb
- refs/heads/pr/brb/ci-refactor-svc-suite
- refs/heads/pr/brb/ci-rm-smoke-tests
- refs/heads/pr/brb/ci-sanity
- refs/heads/pr/brb/ci-test
- refs/heads/pr/brb/ci-test-2
- refs/heads/pr/brb/ci-test-k8s-vsn-swap
- refs/heads/pr/brb/ci-test-large-runners
- refs/heads/pr/brb/ci-uffff
- refs/heads/pr/brb/ci-upgrade-vol-2
- refs/heads/pr/brb/ci-upgrade-vol-3
- refs/heads/pr/brb/ci-wg-mtu
- refs/heads/pr/brb/ci-wg-mtu-vol2
- refs/heads/pr/brb/cilium-host-v6-from-ipam
- refs/heads/pr/brb/cli-bump-test
- refs/heads/pr/brb/datapath-loop-dbg
- refs/heads/pr/brb/dbg-ci
- refs/heads/pr/brb/dbg-conformance-gke
- refs/heads/pr/brb/dbg-master-np-vxlan-ipcache-ci
- refs/heads/pr/brb/debug-nodeport-bpf-flake
- refs/heads/pr/brb/do-not-derive-pod-cidrs-from-dev
- refs/heads/pr/brb/do-not-query-dev-for-arping
- refs/heads/pr/brb/docs-clarify-egress-gw-ip-addr-dp
- refs/heads/pr/brb/drop-notify
- refs/heads/pr/brb/dsr
- refs/heads/pr/brb/dsr-v2
- refs/heads/pr/brb/dualstack-ci
- refs/heads/pr/brb/enable-ipv6-per-endpoint-routes
- refs/heads/pr/brb/enable-route-mtu-cni
- refs/heads/pr/brb/fib-lookup-src
- refs/heads/pr/brb/fix-backend-id-u32
- refs/heads/pr/brb/fix-ci-dp-deprecation-warn
- refs/heads/pr/brb/fix-clang-vsn-regexp
- refs/heads/pr/brb/fix-egress-ip-16147
- refs/heads/pr/brb/fix-external-ip-dp
- refs/heads/pr/brb/fix-maglev-del
- refs/heads/pr/brb/fix-nodeport-hostnetns
- refs/heads/pr/brb/fix-stale-dsr
- refs/heads/pr/brb/fix-svc-backend-selection
- refs/heads/pr/brb/fix-third-host
- refs/heads/pr/brb/gh-action-cgr
- refs/heads/pr/brb/gh-action-lvh
- refs/heads/pr/brb/gh-install-cli-backup
- refs/heads/pr/brb/ginkgo-kpr-strict
- refs/heads/pr/brb/ginkgo-rm-update-tests
- refs/heads/pr/brb/go-crazy
- refs/heads/pr/brb/hubble-tcp-ack-seq-no
- refs/heads/pr/brb/improve-svc-restore
- refs/heads/pr/brb/istio-getsockopt
- refs/heads/pr/brb/it-cannot-be-truth
- refs/heads/pr/brb/kpr-svc-mesh
- refs/heads/pr/brb/kubeproxy-free-ci
- refs/heads/pr/brb/l7-np-bpf
- refs/heads/pr/brb/l7-rerevert
- refs/heads/pr/brb/lets-be-friends-with-ipsec
- refs/heads/pr/brb/lvh-kind-127
- refs/heads/pr/brb/lvh-kind-ipsec-upgrade
- refs/heads/pr/brb/meyskens/auth-ep-gc-locks
- refs/heads/pr/brb/multi-network
- refs/heads/pr/brb/no-cache-snat
- refs/heads/pr/brb/no-rev-nat-bpf-lxc-ingress
- refs/heads/pr/brb/node-id-per-fam
- refs/heads/pr/brb/nodeport-xlr-flag
- refs/heads/pr/brb/perf-wg
- refs/heads/pr/brb/pin-lvh
- refs/heads/pr/brb/push-ci-charts
- refs/heads/pr/brb/pwru
- refs/heads/pr/brb/rm-arping-l2-addr-check
- refs/heads/pr/brb/rm-no-redirect
- refs/heads/pr/brb/rm-np-deadcode
- refs/heads/pr/brb/rm-partial-host-svc
- refs/heads/pr/brb/rm-test-gke
- refs/heads/pr/brb/test-bpf-masq
- refs/heads/pr/brb/test-ci-e2e
- refs/heads/pr/brb/test-ci-e2e-v1.13
- refs/heads/pr/brb/test-kind
- refs/heads/pr/brb/third-host-more-pain
- refs/heads/pr/brb/timing-l4lb-gh-action
- refs/heads/pr/brb/triage-flake-v2
- refs/heads/pr/brb/triage-lb-flake
- refs/heads/pr/brb/unquarantine-svc
- refs/heads/pr/brb/v1.10-istio-snat
- refs/heads/pr/brb/v1.12-ci-e2e
- refs/heads/pr/brb/v1.12-ci-ipsec-upgrade
- refs/heads/pr/brb/v1.12-test-ipsec-upgrade
- refs/heads/pr/brb/v1.13-ci-e2e
- refs/heads/pr/brb/v1.13-remote-np
- refs/heads/pr/brb/v1.13-upgrade-fixes
- refs/heads/pr/brb/v1.14-ci-e2e-upgrade
- refs/heads/pr/brb/v1.14-drop-notify
- refs/heads/pr/brb/v1.15-enable-route-mtu-cni
- refs/heads/pr/brb/v1.6.9-iptables-W
- refs/heads/pr/brb/v1.8-fix-icmp-port-check
- refs/heads/pr/brb/wg-duplicate-node-ip
- refs/heads/pr/brb/wg-encrypt-node-test
- refs/heads/pr/brb/wg-hack
- refs/heads/pr/brb/wg-ipam-fix
- refs/heads/pr/brb/wg-kpr
- refs/heads/pr/brb/wg-test
- refs/heads/pr/brb/wip
- refs/heads/pr/brb/wip-ci
- refs/heads/pr/brb/wip-sync-policy-map
- refs/heads/pr/brb/xdp-egress-gw
- refs/heads/pr/brb/xdp-multidev-with-bpf-multihoming
- refs/heads/pr/brb/xdp-multidev-with-bpf-multihoming-v2
- refs/heads/pr/bruno/sleepy-pawn
- refs/heads/pr/bugtool-systemd
- refs/heads/pr/bwm-base2
- refs/heads/pr/bwm-fq
- refs/heads/pr/bwm-priority
- refs/heads/pr/chancez/add_hubble_l7_dashboard_prometheus_example
- refs/heads/pr/chancez/fix_websocket_l7_policies
- refs/heads/pr/chancez/flow_filter_namespace
- refs/heads/pr/chancez/hubble_plus_plus
- refs/heads/pr/chancez/hubble_tls_validation_troubleshooting
- refs/heads/pr/chancez/static_peers_hubble_relay
- refs/heads/pr/christarazi/controlplane-fqdn
- refs/heads/pr/christarazi/ipcache-async-cep-pods-namedports
- refs/heads/pr/christarazi/prep-from-cidr-tests
- refs/heads/pr/ci-k8s-1.30
- refs/heads/pr/datapath-opt
- refs/heads/pr/dbkm/nodeport-lb
- refs/heads/pr/debug-dns-timeout
- refs/heads/pr/eproutes-redir
- refs/heads/pr/example/neigh-state-manager
- refs/heads/pr/fastdp
- refs/heads/pr/fastdp2
- refs/heads/pr/feroz/allow-sbom-read
- refs/heads/pr/feroz/set-container-scan-failure-flag
- refs/heads/pr/feroz/test-cosign-attest
- refs/heads/pr/fib-consolidation
- refs/heads/pr/fix-aks-workflow
- refs/heads/pr/fix-data-race
- refs/heads/pr/fix-k8s-all-sha1
- refs/heads/pr/fix-pod-pacing
- refs/heads/pr/fix-tail-call-replace
- refs/heads/pr/fristonio/feat-19038
- refs/heads/pr/fristonio/fix-istio-k8sT
- refs/heads/pr/fristonio/ipv6-masquerading
- refs/heads/pr/fristonio/test-dual-stack
- refs/heads/pr/fristonio/test-ipv6-dualstack
- refs/heads/pr/gandro+brb/fix-monitor-aggregation-np-v2
- refs/heads/pr/gandro+brb/mv-trace-point-to-rev-nodeport
- refs/heads/pr/gandro+brb/wg-host-encryption-v3
- refs/heads/pr/gandro+brb/wg-host2host
- refs/heads/pr/gandro+brb/wg-host2host-kind
- refs/heads/pr/gandro/bump-hubble-2020-03-25
- refs/heads/pr/gandro/ci-conformance-multicluster-fix-log-gathering
- refs/heads/pr/gandro/ci-delete-crds-in-cleanupcomponents
- refs/heads/pr/gandro/ci-fix-status-if-workflows-are-skipped
- refs/heads/pr/gandro/ci-wait-for-all-relevant-images-do-not-merge-test
- refs/heads/pr/gandro/enable-hubble-by-default
- refs/heads/pr/gandro/portmap-refcount
- refs/heads/pr/gandro/re-enable-wireguard-in-multicluster-ci
- refs/heads/pr/gandro/svc-healthchecknodeport
- refs/heads/pr/gc-on-svc-update
- refs/heads/pr/getname-hooks
- refs/heads/pr/giorio94/1.14/test-cilium-cli-2184
- refs/heads/pr/giorio94/main/cluster-name-validation-strict
- refs/heads/pr/giorio94/main/gha-cluster-name
- refs/heads/pr/giorio94/main/gha-conformance-clustermesh-lb
- refs/heads/pr/giorio94/main/test-cilium-cli-2184
- refs/heads/pr/giorio94/main/tests-clustermesh-upgrade-interrupted
- refs/heads/pr/giorio94/v1.13/bump-gke-version
- refs/heads/pr/gray/30837-with-pwru
- refs/heads/pr/gray/ipsec-proxy-kpr-revdnat-test
- refs/heads/pr/gray/main/connectivity-wg-proxy-nodeport
- refs/heads/pr/gray/main/decouple-ipsec-gh-actions
- refs/heads/pr/gray/main/egress-proxy-ipsec-fix2
- refs/heads/pr/gray/main/fix-leak-detection-race
- refs/heads/pr/gray/main/xfrm-delete-flake
- refs/heads/pr/gray/main/xfrm-delete-flake2
- refs/heads/pr/gray/new-cli-test-pr-2759
- refs/heads/pr/gray/pwru-action
- refs/heads/pr/gray/v1.15/decouple-ipsec-gh-actions
- refs/heads/pr/health-data-path
- refs/heads/pr/hubble-tls-cert-gen-via-k8s-job
- refs/heads/pr/ianvernon/kvstore-client-type
- refs/heads/pr/ianvernon/kvstore-context
- refs/heads/pr/ianvernon/more-endpoint-cleanup
- refs/heads/pr/ianvernon/resolve-cidr-policy-perf-improvement
- refs/heads/pr/increase-verifier-test-build-timeout
- refs/heads/pr/ipip
- refs/heads/pr/ipip-encap
- refs/heads/pr/ipip-encap2
- refs/heads/pr/ipip2
- refs/heads/pr/ipip4
- refs/heads/pr/ipip6
- refs/heads/pr/jibi/differentiate-udp-tcp-svcs-take-4
- refs/heads/pr/jibi/fix-differentiate-udp-tcp-svc-upgrade
- refs/heads/pr/jibi/ip-list-contains-addr
- refs/heads/pr/jibi/wip
- refs/heads/pr/joamaki/gather-network-info
- refs/heads/pr/joamaki/idless-service-restapi
- refs/heads/pr/joe/ariane-scheduled-cilium-only
- refs/heads/pr/joe/backport-28007-1.11
- refs/heads/pr/joe/bump-ginkgo-seed
- refs/heads/pr/joe/docker-build-log-tracing
- refs/heads/pr/joe/docs-builder-latex
- refs/heads/pr/joe/docs-workflow-repo+test
- refs/heads/pr/joe/initialize-helm-flags
- refs/heads/pr/joe/ipcache-cidr-policy
- refs/heads/pr/joe/lost-identity
- refs/heads/pr/joe/release-codeowners
- refs/heads/pr/joe/sw-quay
- refs/heads/pr/joe/test-labeler
- refs/heads/pr/joe/test-lvh-fix
- refs/heads/pr/joe/v1.13-stability-check
- refs/heads/pr/joe/v1.7-dev-env
- refs/heads/pr/jrajahalme/gh-filter-test-files
- refs/heads/pr/jrfastab/backport-ooo-ipsec-fixes
- refs/heads/pr/jrfastab/backport-v115
- refs/heads/pr/jrfastab/dbgNodeId
- refs/heads/pr/jrfastab/dbgNodeId111
- refs/heads/pr/jrfastab/dbgNodeId111v2
- refs/heads/pr/jrfastab/dbgv114
- refs/heads/pr/jrfastab/eks-encrypt-ipamupdate
- refs/heads/pr/jrfastab/fix-encrypt-subnets
- refs/heads/pr/jrfastab/fix-ixsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/fixes-ipsec-init
- refs/heads/pr/jrfastab/v1.8-fix-ipsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/v1.9-fix-ipsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/v111-debug-ooo
- refs/heads/pr/jrfastab/v111-debug-ooo-v2
- refs/heads/pr/jwi/main/bpf-dsr-geneve
- refs/heads/pr/jwi/main/ci-e2e-upgrade
- refs/heads/pr/jwi/main/ci-geneve-dsr
- refs/heads/pr/jwi/main/ipsec-rhel8
- refs/heads/pr/jwi/main/ipv6-ci
- refs/heads/pr/jwi/v1.14/foo
- refs/heads/pr/jwi/v1.15/bpf-complexity
- refs/heads/pr/jwi/v1.16/tophat
- refs/heads/pr/k8s-nat46x64
- refs/heads/pr/k8s-nat46x64-2
- refs/heads/pr/kaworu/helm-hubble-cli.yaml
- refs/heads/pr/kkourt/azure-ipam-test-race
- refs/heads/pr/kkourt/bpftool-update
- refs/heads/pr/kkourt/ct-rst-timeout-wip
- refs/heads/pr/kkourt/v1.11-backport-2022-01-26
- refs/heads/pr/kkourt/v1.9-lxc-complexity
- refs/heads/pr/l4lb-improvements-tmp
- refs/heads/pr/learnitall/ginkgo-race-workflow
- refs/heads/pr/learnitall/init-egw-scale-test
- refs/heads/pr/learnitall/test-startup-script-changes
- refs/heads/pr/lmb/1.14-cni
- refs/heads/pr/lmb/1.15-cni
- refs/heads/pr/lmb/update-cni-plugin
- refs/heads/pr/marga/v1.11-without-deny-precedence
- refs/heads/pr/marseel/improve_net_perf
- refs/heads/pr/marseel/scale_test_1_15
- refs/heads/pr/max/upgrade-llvm-18-1-6
- refs/heads/pr/mhofstetter/guestbook-registry
- refs/heads/pr/mhofstetter/junit-fetch-nullglob
- refs/heads/pr/mhofstetter/ssh-store-consolelog
- refs/heads/pr/mhofstetter/test-ingress
- refs/heads/pr/michi/circular-struggle
- refs/heads/pr/michi/crdregister
- refs/heads/pr/michi/debug
- refs/heads/pr/michi/description
- refs/heads/pr/michi/dns-refactor12
- refs/heads/pr/michi/faster
- refs/heads/pr/michi/l7drop
- refs/heads/pr/michi/majestic-ketchup
- refs/heads/pr/michi/mega-ketchup
- refs/heads/pr/michi/peerapi
- refs/heads/pr/michi/sleep-on-it
- refs/heads/pr/michi/test
- refs/heads/pr/michi/weekly-bot
- refs/heads/pr/monitor-wait-ci
- refs/heads/pr/move-image-to-one-repo
- refs/heads/pr/nat-gw-tests
- refs/heads/pr/nathanjsweet/add-complex-allow-test-to-policy-map-tests
- refs/heads/pr/nathanjsweet/add-lockdown-mode-for-policy-map-overflows
- refs/heads/pr/nathanjsweet/differentiate-protocol-in-services
- refs/heads/pr/nathanjsweet/node-port-addresses
- refs/heads/pr/nathanjsweet/refactor-has-same-owners
- refs/heads/pr/nathanjsweet/refactor-mapstate
- refs/heads/pr/nathanjsweet/update-k8s-control-plane-tests-to-1-27
- refs/heads/pr/nebril/add-dns-concurrency-limit
- refs/heads/pr/nebril/fix-precheck
- refs/heads/pr/nebril/fqdn-proxy-ha
- refs/heads/pr/nebril/fqdn-proxy-interface
- refs/heads/pr/nebril/gke-workflow-migrate-from-cli
- refs/heads/pr/nebril/quarantine-1.14-nodeport
- refs/heads/pr/nebril/test-bottlerocket
- refs/heads/pr/nebril/test-helm-gke-fix
- refs/heads/pr/nebril/test-our-ghaction-shenanigans
- refs/heads/pr/nebril/test-rebase-helm
- refs/heads/pr/nebril/trololo
- refs/heads/pr/nebril/update-cli-9.1-test
- refs/heads/pr/netkit
- refs/heads/pr/netkit3
- refs/heads/pr/netns-switch
- refs/heads/pr/netns-switch-no-peer
- refs/heads/pr/nodeport-fix
- refs/heads/pr/nodeport-improvements2
- refs/heads/pr/nodeport-nat-improvements
- refs/heads/pr/nodeport-nat-improvements2
- refs/heads/pr/nodeport-retry-sport
- refs/heads/pr/pchaigno/deprecate-bpf_network-f
- refs/heads/pr/pchaigno/fix-4.19-bpf-program-size
- refs/heads/pr/pchaigno/hotfix1-ipsec-fix
- refs/heads/pr/pchaigno/hotfix1-ipsec-fix-brb-v0
- refs/heads/pr/pchaigno/optim-complexity-ipcache-lookup
- refs/heads/pr/pchaigno/rework-config-probes
- refs/heads/pr/pchaigno/tmp-base-branch
- refs/heads/pr/pin-1.10-workflows-k8s-version
- refs/heads/pr/pin-1.11-workflows-k8s-version
- refs/heads/pr/pin-1.12-workflows-k8s-version
- refs/heads/pr/pin-1.13-workflows-k8s-version
- refs/heads/pr/pin-cloud-provider-master-workflows
- refs/heads/pr/pr/fix-ipam-node-manager-semaphore-error-handling
- refs/heads/pr/publish-test-images
- refs/heads/pr/qmonnet/docs-20230224
- refs/heads/pr/qmonnet/docs-bump
- refs/heads/pr/qmonnet/standalone-lb-docs
- refs/heads/pr/ray/late-dns-proxy
- refs/heads/pr/remove-1.13-references
- refs/heads/pr/rgo3/1.12-run-no-unexpected-drops-for-patch
- refs/heads/pr/rgo3/fix-k8s-vm-provisioning-1.13
- refs/heads/pr/rgo3/fix-missing-health-endpoint
- refs/heads/pr/rolinh/better-policy-verdict
- refs/heads/pr/rolinh/hubble-dump-all
- refs/heads/pr/rolinh/hubble-fix-maxflows-rounding
- refs/heads/pr/route-test
- refs/heads/pr/run-tests-in-parallel
- refs/heads/pr/scalability-crd-only
- refs/heads/pr/squeed/make-ccache
- refs/heads/pr/squeed/per-node-config
- refs/heads/pr/squeed/remote-cluster-leak
- refs/heads/pr/stacy/docs-update
- refs/heads/pr/tammach/accesslog-envoy
- refs/heads/pr/tammach/ci-cm
- refs/heads/pr/tammach/cleanup-helm-1.16
- refs/heads/pr/tammach/headless-service-flake
- refs/heads/pr/tammach/ingress-controller-e2e-config6
- refs/heads/pr/tammach/kind-host-dns-again
- refs/heads/pr/tammach/more-ingress-tests
- refs/heads/pr/tammach/rennovate-statedb
- refs/heads/pr/tammach/revert/fib-lookup
- refs/heads/pr/tammach/upgrade-test-ingress
- refs/heads/pr/tc-np-test
- refs/heads/pr/tcx
- refs/heads/pr/tcx-helm
- refs/heads/pr/tcx-misc
- refs/heads/pr/test-419-ci
- refs/heads/pr/test-increase-update-delete-timeout
- refs/heads/pr/test-k8s-all-tests
- refs/heads/pr/test-lb-super-netperf
- refs/heads/pr/test-nightly
- refs/heads/pr/test-upstream-timeout
- refs/heads/pr/tgraf/chaos-testing
- refs/heads/pr/tgraf/clustermesh-stale-state
- refs/heads/pr/tgraf/eni-ipam
- refs/heads/pr/tgraf/new-endpoint-state
- refs/heads/pr/tgraf/new-policy
- refs/heads/pr/tgraf/remove-tunnel-map
- refs/heads/pr/tgraf/scoped-ipam
- refs/heads/pr/tgraf/sctp
- refs/heads/pr/tgraf/split-lxc-prog
- refs/heads/pr/thorn3r/cesBlanketTest
- refs/heads/pr/thorn3r/clustermesh511
- refs/heads/pr/thorn3r/scaleTest5k
- refs/heads/pr/tklauser/build-push-images-env-var
- refs/heads/pr/tklauser/netipx-switch
- refs/heads/pr/tklauser/replace-k8s-strings-slices
- refs/heads/pr/tommyp1ckles/debugging-aks-conformance
- refs/heads/pr/tp/add-logging-for-integration-etcd
- refs/heads/pr/tp/add-logging-for-wait-for-pods-term-condition
- refs/heads/pr/tp/backport-31380
- refs/heads/pr/tp/bump-cilium-cli
- refs/heads/pr/tp/cleanup-ipam-ips-metric-docs
- refs/heads/pr/tp/complexity-issue-verifier-case-main
- refs/heads/pr/tp/dont-terminate-on-node-config-changee
- refs/heads/pr/tp/eps-modular-health
- refs/heads/pr/tp/fix-stuck-ginko-pod-v2
- refs/heads/pr/tp/forward-hubble-for-e2e
- refs/heads/pr/tp/forward-hubble-for-e2e-v2
- refs/heads/pr/tp/make-nat-purge-async
- refs/heads/pr/tp/preload-test-kind-images
- refs/heads/pr/tp/switch-1.24-eks-region
- refs/heads/pr/tp/switch-1.24-eks-region-v1.13
- refs/heads/pr/tp/use-helm-default-vars-for-clustermesh-downgrade-c1
- refs/heads/pr/tweak-github-action-ref
- refs/heads/pr/twpayne/hubble-recent-events-buffer
- refs/heads/pr/twpayne/hubble-ring-buffer-benchmarks
- refs/heads/pr/update-azure
- refs/heads/pr/update-readme-for-releases
- refs/heads/pr/update-tm-network
- refs/heads/pr/v1.10-backport-2022-06-13
- refs/heads/pr/v1.10-backport-2022-10-03
- refs/heads/pr/v1.10-eni-stability-improvements-v1
- refs/heads/pr/v1.10-neigh-clean
- refs/heads/pr/v1.11-backport-2022-10-03
- refs/heads/pr/v1.11-test/issue-692
- refs/heads/pr/v1.12-backport-2023-10-10
- refs/heads/pr/v1.12-test/issue-692
- refs/heads/pr/v1.13-backport-2023-10-31
- refs/heads/pr/v1.13-backport-2024-04-22-03-42
- refs/heads/pr/v1.13-test/issue-692
- refs/heads/pr/v1.14-backport-2024-06-18-02-46
- refs/heads/pr/v1.14.1
- refs/heads/pr/v1.7-stability-test
- refs/heads/pr/v1.7.9-hf-13205
- refs/heads/pr/v3-cpu
- refs/heads/pr/v6-host-addr2
- refs/heads/pr/vk/bpf/csum
- refs/heads/pr/vk/bpf/test/l4/csum
- refs/heads/pr/vk/bpf/tests/csum
- refs/heads/pr/vk/conn/test/hooks
- refs/heads/pr/vk/doc/ipsec
- refs/heads/pr/vk/eks/tests/concurrent/run
- refs/heads/pr/vk/ipsec/key/rotate
- refs/heads/pr/vk/ipsec/tests/concurrency
- refs/heads/pr/wip/bijective-nodemap
- refs/heads/regex_improved
- refs/heads/renovate/main-all-go-deps-main
- refs/heads/renovate/main-go
- refs/heads/renovate/main-golangci-lint
- refs/heads/renovate/main-patch-all-lvh-images-main
- refs/heads/renovate/v1.13-go
- refs/heads/renovate/v1.14-patch-stable-lvh-images
- refs/heads/renovate/v1.15-aanm-test
- refs/heads/renovate/v1.15-patch-stable-lvh-images
- refs/heads/renovate/v1.16-cilium-cli
- refs/heads/renovate/v1.16-go
- refs/heads/renovate/v1.16-patch-stable-lvh-images
- refs/heads/revert-29086-2023-11-09-backport-1.14
- refs/heads/revert-33302-policy-catch-invalid-port-wildcard
- refs/heads/rib
- refs/heads/run-ci-wihout-building-cilium
- refs/heads/service-over-srv6-main3
- refs/heads/sh-dep-test-l4lb
- refs/heads/sidecar-http-proxy
- refs/heads/sockmap-v5
- refs/heads/sockops-build-fix
- refs/heads/tam/integration-tests
- refs/heads/tam/more-ingress-tests
- refs/heads/tb/bpf-remove-bear
- refs/heads/test-branch
- refs/heads/test-ipsec
- refs/heads/test-sig-bgp-notifs
- refs/heads/test/brlbil/upload
- refs/heads/test/skip-workflows
- refs/heads/tgraf/process-policy
- refs/heads/thorn3r/cesScaleTest
- refs/heads/thorn3rCES
- refs/heads/tinker/learnitall/scale-test-1
- refs/heads/tinker/learnitall/scale-test-2
- refs/heads/tklauser+brb/wip/multi-homing
- refs/heads/unit-test-ipsec
- refs/heads/v0.10
- refs/heads/v0.11
- refs/heads/v0.12
- refs/heads/v0.13
- refs/heads/v0.8
- refs/heads/v0.9
- refs/heads/v1.0
- refs/heads/v1.0.0-rc2
- refs/heads/v1.0.0-rc3
- refs/heads/v1.1
- refs/heads/v1.10
- refs/heads/v1.11
- refs/heads/v1.12
- refs/heads/v1.12.11-base
- refs/heads/v1.13
- refs/heads/v1.14
- refs/heads/v1.15
- refs/heads/v1.16
- refs/heads/v1.2
- refs/heads/v1.3
- refs/heads/v1.3.1
- refs/heads/v1.3.1-release
- refs/heads/v1.3.7-release
- refs/heads/v1.4
- refs/heads/v1.4.5-release
- refs/heads/v1.5
- refs/heads/v1.5.2-rc1-with-clusterip-fix
- refs/heads/v1.5.4-release
- refs/heads/v1.6
- refs/heads/v1.7
- refs/heads/v1.7.9-1
- refs/heads/v1.7.9.1
- refs/heads/v1.8
- refs/heads/v1.9
- refs/heads/verify-external-workload-dns-setup-redux
- refs/heads/vladu/identity-type-metrics
- refs/heads/weavescope
- refs/heads/wip-debug-link-not-found
- refs/heads/wip-debug-link-not-found-v2
- refs/heads/wip-ktls-tx-rx
- refs/heads/wip-sockmap
- refs/heads/wip-sockmap-v2
- refs/heads/wip-sockmap-v3
- refs/heads/wip-sockmap-v4
- refs/heads/xfrm-subnet-test
- refs/heads/yutaro/bgp-cplane-etp-local/doc
- refs/heads/yutaro/oss/eni-overlapping-mark
- refs/remotes/bruno/hf/v1.10/v1.10.3-bpf-snat-and-masq-fixes
- refs/remotes/joe/submit/quarantine-etcd
- refs/remotes/origin/1.2-backports-18-09-12
- refs/remotes/origin/ipvlan3
- refs/remotes/origin/pr/add-reserved-health
- refs/remotes/origin/pr/brb/nodeport-lb
- refs/remotes/origin/pr/ianvernon/5859
- refs/remotes/origin/pr/ianvernon/dynamic-ep-cfg
- refs/remotes/origin/pr/tgraf/kube-dns-fixed-identity
- refs/semaphoreci/6384f501b324813e55cfbe818c04a40f2a923765
- refs/semaphoreci/7f69b285bac8a1be414e8769799962ae1408d9e1
- refs/semaphoreci/b5eb6622da121ad36b8f375a084392f7feeec64a
- refs/semaphoreci/d9e7e28f39d34a7050a9c1cad2a26d84f5f4eff1
- refs/semaphoreci/f55ec535d85f387ef981265967fabb3c1b5f1ec6
- refs/tags/0.10.1
- refs/tags/1.1.1
- refs/tags/1.9.0-rc0
- refs/tags/v0.11
- refs/tags/v0.12.0
- refs/tags/v0.13.1
- Branches list truncated to 702 entries, 10 were omitted.
- v0.13.2
- v0.13.19
- v0.13.18
- v0.13.17
- v0.13.16
- v0.13.15
- v0.13.14
- v0.13.13
- v0.13.12
- v0.13.11
- v0.13.10
- v0.10.0
- 1.9.9
- 1.9.8
- 1.9.7
- 1.9.6
- 1.9.5
- 1.9.4
- 1.9.3
- 1.9.2
- 1.9.18
- 1.9.17
- 1.9.16
- 1.9.15
- 1.9.14
- 1.9.13
- 1.9.12
- 1.9.11
- 1.9.10
- 1.9.1
- 1.9.0-rc3
- 1.9.0-rc2
- 1.9.0-rc1
- 1.9.0
- 1.8.9
- 1.8.8
- 1.8.7
- 1.8.6
- 1.8.5
- 1.8.4
- 1.8.3
- 1.8.2
- 1.8.13
- 1.8.12
- 1.8.11
- 1.8.10
- 1.8.1
- 1.8.0-rc4
- 1.8.0-rc3
- 1.8.0-rc2
- 1.8.0-rc1
- 1.8.0
- 1.7.9
- 1.7.8
- 1.7.7
- 1.7.6
- 1.7.5
- 1.7.4
- 1.7.3
- 1.7.2
- 1.7.16
- 1.7.15
- 1.7.14
- 1.7.13
- 1.7.12
- 1.7.11
- 1.7.10
- 1.7.1
- 1.7.0-rc4
- 1.7.0-rc3
- 1.7.0
- 1.6.9
- 1.6.8
- 1.6.7
- 1.6.6
- 1.6.5
- 1.6.4
- 1.6.3
- 1.6.2
- 1.6.12
- 1.6.11
- 1.6.10
- 1.6.1
- 1.6.0
- 1.5.9
- 1.5.8
- 1.5.7
- 1.5.6
- 1.5.5
- 1.5.4
- 1.5.3
- 1.5.2
- 1.5.13
- 1.5.12
- 1.5.11
- 1.5.10
- 1.5.1
- 1.5.0-rc6
- 1.5.0-rc5
- 1.5.0-rc4
- 1.5.0-rc3
- 1.5.0-rc2
- 1.5.0
- 1.4.9
- 1.4.8
- 1.4.7
- 1.4.6
- 1.4.5
- 1.4.4
- 1.4.3
- 1.4.2
- 1.4.10
- 1.4.1
- 1.4.0-rc9
- 1.4.0-rc8
- 1.4.0-rc7
- 1.4.0-rc6
- 1.4.0-rc5
- 1.4.0-rc2
- 1.4.0
- 1.3.8
- 1.3.7
- 1.3.6
- 1.3.5
- 1.3.4
- 1.3.3
- 1.3.2
- 1.3.1
- 1.3.0-rc5
- 1.3.0-rc4
- 1.3.0
- 1.2.8
- 1.2.7
- 1.2.6
- 1.2.5
- 1.2.4
- 1.2.3
- 1.2.2
- 1.2.1
- 1.2.0-rc3
- 1.2.0-rc2
- 1.2.0-rc1
- 1.2.0
- 1.16.1
- 1.16.0-rc.2
- 1.16.0-rc.1
- 1.16.0-rc.0
- 1.16.0-pre.3
- 1.16.0-pre.2
- 1.16.0-pre.1
- 1.16.0-pre.0
- 1.16.0
- 1.15.8
- 1.15.7
- 1.15.6
- 1.15.5
- 1.15.4
- 1.15.3
- 1.15.2
- 1.15.1
- 1.15.0-rc.1
- 1.15.0-rc.0
- 1.15.0-pre.3
- 1.15.0-pre.2
- 1.15.0-pre.1
- 1.15.0-pre.0
- 1.15.0
- 1.14.9
- 1.14.8
- 1.14.7
- 1.14.6
- 1.14.5
- 1.14.4
- 1.14.3
- 1.14.2
- 1.14.14
- 1.14.13
- 1.14.12
- 1.14.11
- 1.14.10
- 1.14.1
- 1.14.0-snapshot.4
- 1.14.0-snapshot.3
- 1.14.0-snapshot.2
- 1.14.0-snapshot.1
- 1.14.0-snapshot.0
- 1.14.0-rc.1
- 1.14.0-rc.0
- 1.14.0-pre.2
- 1.14.0
- 1.13.9
- 1.13.8
- 1.13.7
- 1.13.6
- 1.13.5
- 1.13.4
- 1.13.3
- 1.13.2
- 1.13.18
- 1.13.17
- 1.13.16
- 1.13.15
- 1.13.14
- 1.13.13
- 1.13.12
- 1.13.11
- 1.13.10
- 1.13.1
- 1.13.0-rc5
- 1.13.0-rc4
- 1.13.0-rc3
- 1.13.0-rc2
- 1.13.0-rc1
- 1.13.0-rc0
- 1.13.0
- 1.12.9
- 1.12.8
- 1.12.7
- 1.12.6
- 1.12.5
- 1.12.4
- 1.12.3
- 1.12.2
- 1.12.19
- 1.12.18
- 1.12.17
- 1.12.16
- 1.12.15
- 1.12.14
- 1.12.13
- 1.12.12
- 1.12.11
- 1.12.10
- 1.12.1
- 1.12.0-rc3
- 1.12.0-rc2
- 1.12.0-rc1
- 1.12.0-rc0
- 1.12.0
- 1.11.9
- 1.11.8
- 1.11.7
- 1.11.6
- 1.11.5
- 1.11.4
- 1.11.3
- 1.11.20
- 1.11.2
- 1.11.19
- 1.11.18
- 1.11.17
- 1.11.16
- 1.11.15
- 1.11.14
- 1.11.13
- 1.11.12
- 1.11.11
- 1.11.10
- 1.11.1
- 1.11.0-rc3
- 1.11.0-rc2
- 1.11.0-rc1
- 1.11.0-rc0
- 1.11.0
- 1.10.9
- 1.10.8
- 1.10.7
- 1.10.6
- 1.10.5
- 1.10.4
- 1.10.3
- 1.10.20
- 1.10.2
- 1.10.19
- 1.10.18
- 1.10.17
- 1.10.16
- 1.10.15
- 1.10.14
- 1.10.13
- 1.10.12
- 1.10.11
- 1.10.10
- 1.10.1
- 1.10.0-rc2
- 1.10.0-rc1
- 1.10.0-rc0
- 1.10.0
- 1.1.6
- 1.1.5
- 1.1.4
- 1.1.3
- 1.1.2
- 1.1.0
- 1.0.7
- 1.0.6
- 1.0.5
- 1.0.4
- Releases list truncated to 298 entries, 350 were omitted.
Take a new snapshot of a software origin
If the archived software origin currently browsed is not synchronized with its upstream version (for instance when new commits have been issued), you can explicitly request Software Heritage to take a new snapshot of it.
Use the form below to proceed. Once a request has been submitted and accepted, it will be processed as soon as possible. You can then check its processing state by visiting this dedicated page.![swh spinner](/static/img/swh-spinner.gif)
Processing "take a new snapshot" request ...
Permalinks
To reference or cite the objects present in the Software Heritage archive, permalinks based on SoftWare Hash IDentifiers (SWHIDs) must be used.
Select below a type of object currently browsed in order to display its associated SWHID and permalink.
Revision | Author | Date | Message | Commit Date |
---|---|---|---|---|
324d212 | Michi Mutsuzaki | 04 May 2020, 16:54:39 UTC | Add state change num Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 21 May 2020, 20:20:32 UTC |
4afb2f1 | Michi Mutsuzaki | 21 April 2020, 03:31:41 UTC | Clean up EventFilter Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 21 May 2020, 20:20:32 UTC |
1851bfc | Michi Mutsuzaki | 17 April 2020, 04:37:41 UTC | WIP Draft for relay API Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 21 May 2020, 20:20:32 UTC |
054dd16 | Joe Stringer | 21 May 2020, 01:59:30 UTC | matchpattern: Support matchPattern="*" to match "." DNS servers may request a list of root nameservers by forming an NS request for ".". We have received reports that when applying a visibility policy with the DNS matchPattern "*", DNS requests of this kind were being dropped in the proxy. Fix this by extending the visibility match "*" to explicitly match on either "[validdnscharacters].", or ".". If the matchPattern is more complicated than simply "*", do not match on ".". Signed-off-by: Joe Stringer <joe@cilium.io> | 21 May 2020, 20:06:30 UTC |
43ccfc9 | Maciej Kwiek | 18 May 2020, 15:50:54 UTC | ci: fix archiving artifacts in runtime jenkinsfile Signed-off-by: Maciej Kwiek <maciej@isovalent.com> | 21 May 2020, 18:10:25 UTC |
5a8f408 | Michi Mutsuzaki | 21 May 2020, 17:32:55 UTC | doc: Update spelling for Netlify We need these words for Netlify build that happens outside the docker container that we use. Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 21 May 2020, 17:37:28 UTC |
13f8fca | Michi Mutsuzaki | 15 May 2020, 02:04:36 UTC | doc: Enable Netlify Deploy Preview Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 21 May 2020, 17:29:11 UTC |
a89d83c | Jarno Rajahalme | 20 May 2020, 19:52:40 UTC | test: Re-enable Services test with L7 policy Fixes: #11578 Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 21 May 2020, 17:27:14 UTC |
9dc4ed6 | Chris Tarazi | 20 May 2020, 18:57:12 UTC | linux/routing: Clarify debug logs in test This should make it easier to know which messages to pay attention to or not. Signed-off-by: Chris Tarazi <chris@isovalent.com> | 21 May 2020, 17:11:56 UTC |
c4f91e4 | Chris Tarazi | 20 May 2020, 18:36:22 UTC | linux/routing: Centralize netns handling in test Previously, the code set the original root netns back when the entire test suite finishes. This commit changes that to switch back to the root netns when each individual test completes. This simplifies the handling of netns's with regard to the their creation and corresponding destruction. Given that we now are locking the goroutine which executes the test to a OS thread, this makes the execution flow easier to follow. The flow becomes: 1) Grab Golang runtime OS thread lock 2) Save reference to original / root netns 3) Create and switch to new netns 4) Execute test 5) Cleanup resources under new netns 6) Close new netns 7) Switch back to original / root netns 8) Unlock Golang runtime OS thread lock This is an effort to reduce the flakiness of this test suite. Signed-off-by: Chris Tarazi <chris@isovalent.com> | 21 May 2020, 17:11:56 UTC |
fc77166 | Chris Tarazi | 20 May 2020, 16:50:28 UTC | linux/routing: Lock Golang runtime OS thread This locks the runtime from switching threads (read: goroutines) when handling network namespaces. This is required as network namespaces used with the vishvananda/netns library are thread-local variables. Due to this, we must pin and disallow any other goroutine from running on the OS thread by issuing a runtime.LockOSThread. This allows us to safely invoke the OS services for getting a new netns, executing the test under that netns, and cleanup the netns. This is an effort to reduce the flakiness of this test suite. Read here from more info: https://pkg.go.dev/github.com/vishvananda/netns?tab=doc https://tip.golang.org/src/runtime/proc.go?h=LockOSThread#L3762 Signed-off-by: Chris Tarazi <chris@isovalent.com> | 21 May 2020, 17:11:56 UTC |
5821704 | Chris Tarazi | 20 May 2020, 16:46:09 UTC | linux/routing: List devices when adding dummy dev This allows assert if the device already exists before running the tests, and assert that the device truly was created before running the tests. This is an effort to reduce the flakiness of this test suite. Signed-off-by: Chris Tarazi <chris@isovalent.com> | 21 May 2020, 17:11:56 UTC |
b30be85 | Joe Stringer | 20 May 2020, 22:54:31 UTC | docs: Refresh ginkgo CLI flags documentation Signed-off-by: Joe Stringer <joe@cilium.io> | 21 May 2020, 15:57:27 UTC |
6ed1d36 | Joe Stringer | 20 May 2020, 21:28:23 UTC | test: Support running DatapathConfiguration tests on single node Recent refactoring of the manifest deployments has broken the ability to run these tests on a single note (such as microk8s / minikube). Restore this ability by adding a new `-cilium.multinode` flag which can be disabled, and autodisabling it for these two integrations. Signed-off-by: Joe Stringer <joe@cilium.io> | 21 May 2020, 15:57:02 UTC |
9bad3ad | Joe Stringer | 20 May 2020, 21:52:07 UTC | test: Fix DeployRandomNamespace function comment Signed-off-by: Joe Stringer <joe@cilium.io> | 21 May 2020, 15:57:02 UTC |
adfaa33 | Joe Stringer | 20 May 2020, 21:51:37 UTC | test: Add manifest.GetFilename() helper This will be used to select which file to deploy in the following commit. Signed-off-by: Joe Stringer <joe@cilium.io> | 21 May 2020, 15:57:02 UTC |
123d03c | Maciej Kwiek | 21 May 2020, 12:37:31 UTC | ci: skip fqdn restart test Signed-off-by: Maciej Kwiek <maciej@isovalent.com> | 21 May 2020, 14:22:54 UTC |
d7f58e8 | Swaminathan Vasudevan | 14 May 2020, 04:57:24 UTC | Fix up ipcache access in datapath This PR replaces the ipcache_lookup[46]() with lookup_ip[46]_remote_endpoint() where the older kernel does not support it. Fixes: #11351 Signed-off-by: Swaminathan Vasudevan <svasudevan@suse.com> | 21 May 2020, 09:47:05 UTC |
ee55fa5 | André Martins | 18 May 2020, 15:33:15 UTC | config/templates: disable cnp-status update for new installations CNP status updates don't provide any useful information and prevents Cilium from scaling for large clusters as each CNP node update will trigger a k8s event to all remaining nodes. Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
354099a | André Martins | 18 May 2020, 15:27:17 UTC | config/templates: configure ipam mode if neither gke, azure nor eni are enabled This avoids a duplicated entry for the "ipam" field in case the user sets the ipam value manually and picks a GKE mode. Fixes: 787c2763c06f ("gke: Enable native-routing mode on GKE by default") Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
6060045 | André Martins | 18 May 2020, 15:26:13 UTC | config/templates: allow to enable health checks with helm options Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
3604c4c | André Martins | 18 May 2020, 15:24:42 UTC | agent/templates: add K8S_SERVICE_{HOST,PORT} in init container Might be useful to pass the K8S_SERVICE_HOST and K8S_SERVICE_PORT to the Cilium's init container. Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
3123abd | André Martins | 15 May 2020, 18:05:58 UTC | maps/policymap: only dump keys of policy map When the endpoint is synchronizing the desired policy with the enforced policy it only uses the policy map keys. This commit introduces a new function that will only dump the policy map keys, not the values. This will help to decrease the memory consumption from 32 bytes to 8 bytes per Policy entry. Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
10ef261 | André Martins | 15 May 2020, 16:40:32 UTC | k8s/types: do not store full ObjectMeta for CEPs It's not required to store the full ObjectMeta of CEPs. This will help to reduce the memory consumption of CEPs since a none of the ObjectMeta fields are used when processing a CEP k8s event. Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
20458c2 | André Martins | 15 May 2020, 16:39:15 UTC | operator/watchers: also store ResourceVersion If the resource version is not stored, the watcher won't be able to keep up the last resource version it has seen for this object type so it will assume that any event received from kube-apiserver is an event that should be processed. Fixes: 3a1bde594b61 ("types/slim: add slim packages for k8s structures") Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
8dd41ee | André Martins | 15 May 2020, 10:27:08 UTC | pkg/endpoint: optimize GetCiliumEndpointStatus To get a GetCiliumEndpointStatus the function does not need to get an endpoint model has it is expensive in terms of CPU and memory to do it so. Thus, GetCiliumEndpointStatus is now optimized to only generate the api Models for the fields that it actually needs. Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
c4138f7 | André Martins | 15 May 2020, 09:24:43 UTC | install/kubernetes: set the brief header when request for /healthz Similar to what done with cilium status --brief, we should perform the HTTP request by sending the same headers set with `cilium status --brief` to Cilium server. Fixes: d613dea5d524 ("install/kubernetes: use HTTP for agent {liveness,readiness}Probe") Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
76fb7c5 | André Martins | 15 May 2020, 09:23:11 UTC | k8s/watchers: set BlockOwnerDeletion to true in CEP This field should be set to true so that k8s will block the deletion of Pod until the CEP is also removed by k8s. Fixes: 08dc8ca31968 ("pkg/endpoint: set Pod as the endpoint owner of a CiliumEndpoint") Signed-off-by: André Martins <andre@cilium.io> | 21 May 2020, 09:31:35 UTC |
59d1412 | Chris Tarazi | 21 May 2020, 00:19:17 UTC | Makefile: Fix error when specifying RACE Fixes: ``` $ sudo -E make SKIP_VET=true SKIP_KVSTORES=true TESTPKGS=pkg/aws/eni RACE=1 unit-tests make -C tools/maptool/ .. echo "mode: count" > coverage-all-tmp.out echo "mode: count" > coverage.out ... for pkg in github.com/cilium/cilium/pkg/aws/eni; do \ go test -mod=vendor -race -ldflags "-X github.com/cilium/cilium/pkg/kvstore.consulDummyConfigFile=/tmp/cilium-consul-certs/cilium-consul.yaml -X github.com/cilium/cilium/pkg/testutils.CiliumRootDir=/home/chris/code/cilium/cilium -X github.com/cilium/cilium/pkg/datapath.DatapathSHA=1234567890abcdef7890 -X github.com/cilium/cilium/pkg/logging.DefaultLogLevelStr="error"" $pkg -test.v -timeout 360s -coverprofile=coverage.out -covermode=count -coverpkg github.com/cilium/cilium/pkg/aws/eni \ || exit 1; \ tail -n +2 coverage.out >> coverage-all-tmp.out; \ done -covermode must be "atomic", not "count", when -race is enabled make: *** [Makefile:224: unit-tests] Error 1 ``` Signed-off-by: Chris Tarazi <chris@isovalent.com> | 21 May 2020, 07:05:06 UTC |
c6d373c | Chris Tarazi | 21 May 2020, 00:27:19 UTC | Makefile: Build maptool with CGO enabled if RACE Fixes: ``` $ sudo -E make SKIP_VET=true SKIP_KVSTORES=true TESTPKGS=pkg/aws/eni RACE=1 unit-tests dirname: missing operand Try 'dirname --help' for more information. make -C tools/maptool/ make[1]: Entering directory '/home/chris/code/cilium/cilium/tools/maptool' CGO_ENABLED=0 go build -mod=vendor -race -ldflags '-X "github.com/cilium/cilium/pkg/version.Version=1.7.90 2d4cc760b 2020-05-20T12:25:41-07:00 go version go1.14.2 linux/amd64" -s -w -X "github.com/cilium/cilium/pkg/envoy.RequiredEnvoyVersionSHA=a3385205ad620550b35d3b0b651e40898386e6e3" -X "github.com/cilium/cilium/pkg/datapath/loader.DatapathSHA=7359bebb8825a116e3b022e9a3ff35045d0709ce" ' -o maptool go build: -race requires cgo; enable cgo by setting CGO_ENABLED=1 make[1]: *** [Makefile:14: maptool] Error 2 make[1]: Leaving directory '/home/chris/code/cilium/cilium/tools/maptool' make: *** [Makefile:216: unit-tests] Error 2 ``` Signed-off-by: Chris Tarazi <chris@isovalent.com> | 21 May 2020, 07:05:06 UTC |
8b54d2f | Jarno Rajahalme | 19 May 2020, 22:57:25 UTC | test: Add K8sServicesTest with L4-only policy Test flakes with L7 policy seem to be independent of the proxy redirection (e.g., tftp is not redirected, and still flakes). Add a new test with an L4-only policy to see if it also flakes. In local testing there are failures roughly on ~1/100 tests, when running a test in a loop: $ for i in {1..100}; do if kubectl exec -n kube-system log-gatherer-w4kbp \ -- curl --path-as-is -s -D /dev/stderr --fail --connect-timeout 5 \ --max-time 8 http://127.0.0.1:30870 2>/dev/null >/dev/null; \ then printf +; else printf $?; fi ; done && printf "\n" +++++++++++++++++++++++++28+++++++++++++++++++++++++28++++++++++++++++++++++++++++++++++++++++++++++++ Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 21 May 2020, 02:54:55 UTC |
6e36360 | Jaime Caamaño Ruiz | 13 May 2020, 16:38:05 UTC | bpf: don't answer ARP requests for endpoint IP Previously, bpf_lxc was answering to all ARP requests. This causes an issue in an scenario where a duplicate address check is being conducted inside the container by sending an ARP request for the endpoint IP for which no answer is expected. This fixes it by answering to ARP requests for all IPs except the endpoint IP. Fixes: #10574 Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com> | 21 May 2020, 02:46:43 UTC |
2d4cc76 | Jarno Rajahalme | 20 May 2020, 19:25:41 UTC | test: Fix looping tests Tell the shell to exit on first error, otherwise the last curl's success will determine the whole test's success, i.e., any failing curls other than the last will be ignored. Fixes: 58be565cfc4 ("test: Unroll curl requests in K8sService suite") Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 22:44:02 UTC |
f829636 | Joe Stringer | 16 May 2020, 00:20:23 UTC | cilium: Add CLI to introspect IPIdentityCache The flow of IP <-> Identity mappings into the IPIdentityCache follow the path of: 1) K8s watch / local poll / generation of the mapping 2) pkg/ipcache:IPIdentityCache 3) pkg/bpf/map userspace cache of map entries being pushed into BPF map 4) Actual BPF map We can currently introspect some of (1) depending on the source; (3) always; and (4) depending on the kernel version in use. (2) cannot be introspected. This commit adds support for introspecting (2) to assist in troubleshooting issues related to the propagation of IP to Identity mappings. Example output: # cilium ip list IP IDENTITY SOURCE 0.0.0.0/0 2 10.29.2.92/32 51185 k8s 10.29.25.191/32 1 10.29.27.15/32 4 10.29.27.93/32 104 k8s 10.29.74.136/32 30909 k8s 10.29.78.12/32 16083 k8s 10.29.89.252/32 20623 k8s 10.29.136.128/32 3157 k8s 10.29.177.163/32 19933 k8s 10.29.194.215/32 22010 k8s 10.29.209.106/32 59801 k8s 10.29.224.16/32 589 k8s 192.168.1.29/32 1 Signed-off-by: Joe Stringer <joe@cilium.io> | 20 May 2020, 20:44:40 UTC |
cfeaf6e | Jarno Rajahalme | 20 May 2020, 16:16:50 UTC | build: Set buildkit git origin to a relative path Set the path of the git origin for the build context shallow clone to a relativa path so that it also works when build directory was created in a mounted directory (host vs. VM). Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
5a02646 | Jarno Rajahalme | 16 May 2020, 01:02:20 UTC | build: Optionally use git for all docker builds with BUILDKIT Make building with DOCKER_BUILDKIT and using a shallow git clone as the build context opt-in: the developer must define DOCKER_BUILDKIT to use these. When DOCKER_BUILDKIT is defined, the following takes place: 1. A separate docker build directory for all docker image targets is used. This makes sure the build context only contains the files in git and none of the other files that may exist in the working directory. '_build' in the repo is used as the root of the build directory by default (can be overridden by defining BUILD_DIR). A shallow bare git clone of the main repo is created in '_build/.git', which is checked out into '_build/context'. The build context is subsequently synced with git fetch to avoid overwriting all files. This makes docker build context sync much faster and allows docker to use cached build stages. 2. The .git directory is left out of the build context, so that any changes in there will not affect docker build stage caching. During the build context sync a file '_build/context/.git' points to '_build_.git', but that is removed before the context is handed to docker. 3. BUILD_DIR can be passed in to specify an alternate build root (replacing the default '_build'). This is beneficial in keeping the main repo directory cleaner, and also to avoid slow file I/O in a shared file system (e.g, between the host and a CI VM). Testing this on a MacBook Pro yielded the following results: - Clean and build cilium, cilium-docker-plugin, cilium-operator, and hubble-relay Before these changes: $ time make docker-image 8m17.558s After: $ time make docker-image 5m35.515s $ DOCKER_BUILDKIT=1 time make docker-image 2m49.41s Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
d365d35 | Jarno Rajahalme | 18 May 2020, 23:22:02 UTC | build: Fix parallel build dependency on clean Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
c42eb9a | Jarno Rajahalme | 19 May 2020, 04:08:55 UTC | build: Add 'veryclean' make target to gut docker Add new 'veryclean' target that cleans up the docker (desktop) instance, useful if docker's file system becomes full. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
0c80bde | Jarno Rajahalme | 16 May 2020, 00:33:01 UTC | build: Avoid using git if not in a git repo Do not use git if not in a git repo. Only create GIT_VERSION if the existing file is already not the same. This helps docker caching. Store the list bpf files to a temporary file BPF_SRCFILES, which is ignored by git like GIT_VERSION. This allows builds to succeed without git. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
c87770a | Jarno Rajahalme | 15 May 2020, 22:59:15 UTC | .gitignore: Add 'test/*tmp' Add 'test/*tmp' to cover 'test/gke@tmp/' and anything like it in future. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
278f3b4 | Jarno Rajahalme | 15 May 2020, 17:16:10 UTC | contrib: Update check scripts Add exclusion of _build to pass checks, as otherwise '_build/context/vendor/' would cause problems. Exclude also '.git' to speed them up. Unify syntax to use grep's --exclude-dir={dir1,dir2,...} syntax. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 May 2020, 20:33:11 UTC |
4cd69dc | Joe Stringer | 19 May 2020, 21:25:15 UTC | test: Avoid deleting container-registry namespace Commit 31f3b5e5b984 ("test: Delete all non-essential namespaces before initial test") broke CI_INTEGRATION=microk8s by clobbering the namespace used for deploying the container image. Fix it by adding this namespace to the list of sacred namespaces that the CI won't touch. Signed-off-by: Joe Stringer <joe@cilium.io> | 20 May 2020, 19:47:39 UTC |
119f1b3 | Joe Stringer | 19 May 2020, 22:10:06 UTC | test: Disable ipv6 for microk8s integration Commit ced4ad0bcaa8 ("ipam: Add "kubernetes" IPAM mode") autoenabled --k8s-require-ipv6-pod-cidr if --enable-ipv6 is enabled, which causes a Cilium to get stuck waiting for the IPv6 pod CIDR to be populated in the node. Fix it by disabling ipv6 for microk8s CI. Signed-off-by: Joe Stringer <joe@cilium.io> | 20 May 2020, 19:47:39 UTC |
6b90ed7 | Robin Hahling | 20 May 2020, 15:20:42 UTC | contrib/vagrant: enable hubble listener on :4244 (TCP) by default Hubble-relay needs to connect to hubble peers for multi-node support. Enabling hubble server on :4244 makes working on hubble-relay easier as one does not need to perform an extra step to reconfigure every VM on a locally deployed vagrant k8s cluster to start playing with hubble-relay. Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 17:56:03 UTC |
da9a724 | Michi Mutsuzaki | 19 May 2020, 23:41:38 UTC | doc: Use docker.io instead of quay.io There was some confusion among new contributors whether they should use the Cilium image from docker.io or quay.io for running integration tests locally. Technically both are fine, but changing the documentation to use the Cilium image from docker.io to signify that it is considered a bit more official. Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 20 May 2020, 17:26:51 UTC |
60ab759 | Martynas Pumputis | 18 May 2020, 12:25:12 UTC | test: Call GinkgoRecover() from testNodePort() goroutines Otherwise, in a case of a failure, ginkgo will panic leaving a cryptic message, from which it's harder to determine which test case has failed. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 20 May 2020, 17:20:06 UTC |
a0e5078 | Martynas Pumputis | 18 May 2020, 08:18:29 UTC | test: Skip duplicate ClusterIP tests Test ClusterIP from a pod netns and a hostnetns in testNodePort(), so that some ClusterIP test cases can be skipped. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 20 May 2020, 17:20:06 UTC |
a8a4f46 | Martynas Pumputis | 18 May 2020, 08:02:14 UTC | test: Move failBind tests to separate test case It's enough to test it only once, thus the move. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 20 May 2020, 17:20:06 UTC |
58be565 | Martynas Pumputis | 15 May 2020, 14:56:09 UTC | test: Unroll curl requests in K8sService suite To avoid excessive "kubectl exec", do curl requests in batches. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 20 May 2020, 17:20:06 UTC |
2c8f58a | Martynas Pumputis | 15 May 2020, 14:02:13 UTC | test: Parallelize testNodePort Regroup the test cases and run them in parallel. On my machine the invocation of testNodePort() went from ~2:50 min to ~1:15 min. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 20 May 2020, 17:20:06 UTC |
151f816 | Martynas Pumputis | 15 May 2020, 12:13:04 UTC | test: Get node names and ip addrs only once in K8sServices They don't change during test runs. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 20 May 2020, 17:20:06 UTC |
5aee704 | Thomas Graf | 20 May 2020, 06:34:41 UTC | test: Don't delete and redeploy Cilium at end of each test context There is no point in doing this. Each test context will deploy Cilium in BeforeAll() with the required configuration. Signed-off-by: Thomas Graf <thomas@cilium.io> | 20 May 2020, 16:18:26 UTC |
f2b7478 | Robin Hahling | 15 May 2020, 13:03:30 UTC | test: add basic tests for hubble-relay These tests are the same tests for L3/L4 and L7 flows that target the local hubble server but they target hubble-relay instead. Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 15:37:14 UTC |
610b91c | Robin Hahling | 15 May 2020, 12:36:01 UTC | test/k8sT: add assertion helpers for hubble-cli and hubble-relay Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 15:37:14 UTC |
3c156a3 | Robin Hahling | 15 May 2020, 12:15:15 UTC | test: provision hubble-relay image Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 15:37:14 UTC |
813f1b5 | Robin Hahling | 18 May 2020, 11:51:27 UTC | hubble: remove pkg/hubble/logger and use cilium's default logger This commit removes Hubble's custom logger and ensures that all hubble code makes use of Cilium's logger instead. Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 15:11:40 UTC |
93f33bd | André Martins | 19 May 2020, 13:39:23 UTC | .github: check for diff in the agent and preflight clusterrole Add action to check for differences between the agent and preflight's clusterrole. Since helm does not allow to reference files outside of the chart we need and we need to make sure both files contain the same rules, this action will make us sure both files remain equal. Signed-off-by: André Martins <andre@cilium.io> | 20 May 2020, 15:11:10 UTC |
5c950b1 | André Martins | 19 May 2020, 13:20:47 UTC | preflight/templates: add clusterrole for pre-flight The pre-flight deployment and daemonset might have different requirements for the clusterrole deployed in the cluster. Adding a specific clusterrole for the pre-flight allows users to run it successfully. Signed-off-by: André Martins <andre@cilium.io> | 20 May 2020, 15:11:10 UTC |
b8aa5c7 | André Martins | 19 May 2020, 11:11:58 UTC | docs: add missing --namespace in upgrade guide Fixes: f611334d4b7d ("Use helm repository in docs") Signed-off-by: André Martins <andre@cilium.io> | 20 May 2020, 15:11:10 UTC |
2d5333f | André Martins | 19 May 2020, 11:03:07 UTC | preflight/templates: do not set 'env' if unnecessary The 'env' section can be set even if no environments are being set by the user. With this commit we only set the 'env' section if one of the environment variables are set by the user. Fixes: ff863a8f20b2 ("add validation checker for installed CNPs in preflight") Signed-off-by: André Martins <andre@cilium.io> | 20 May 2020, 15:11:10 UTC |
be8b943 | André Martins | 19 May 2020, 10:48:50 UTC | cilium/cmd: do not fail if CCNPs are not found In a cluster being upgraded from < 1.7, it is expected that CCNPs are not available. For this reason, the CNP validation tool should not fail has it is expected for CCNPs to not be available. Fixes: ff863a8f20b2 ("add validation checker for installed CNPs in preflight") Signed-off-by: André Martins <andre@cilium.io> | 20 May 2020, 15:11:10 UTC |
0997d33 | Sebastian Wicki | 18 May 2020, 12:13:55 UTC | helm: Ensure hubble is enabled when hubble-ui is deployed Fixes: #11518 Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 20 May 2020, 15:08:39 UTC |
e6e571c | Sebastian Wicki | 18 May 2020, 12:12:56 UTC | helm: Ensure hubble is enabled when hubble-relay is deployed Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 20 May 2020, 15:08:39 UTC |
34b9a36 | Thomas Graf | 19 May 2020, 14:19:10 UTC | test: Cleanup default namespace before each Context() Many tests still deploy into the default namespace and sometimes leak resources. This makes it difficult to reliably re-use clusters for testing. Clean the default namespace from various deployment resources. This is specifically not using `delete all --all` so it can be used with the default namespace. It also doesn't touch services, serviceaccounts, secrets, clusterroles, ... with the assumption that these can always be safely overwritten. Signed-off-by: Thomas Graf <thomas@cilium.io> | 20 May 2020, 15:01:59 UTC |
157632f | Daniel Borkmann | 19 May 2020, 08:51:15 UTC | bpf: use per-cpu scratch space from xdp context to store meta data Moving to per-CPU scratch space instead avoids cache-misses and allows to keep the meta buffer always hot in cache. Only really adjust the pkt meta data space if we push up the stack to signal tc layer that we handled the service xlation. This improves the performance on my local testing by roughly +1.2Mpps. We don't perform an expensive clearing of the scratch space upon entering XDP as usage here is all self-contained and across tail calls we only read out what we populated beforehand. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 20 May 2020, 14:24:41 UTC |
8abf68d | Tam Mach | 18 May 2020, 11:49:18 UTC | feat(operator): Reuse existing port on Cilium Operator health api Enable custom TPC listener with SO_REUSEADDR and SOL_SOCKET Closes #11573 Signed-off-by: Tam Mach <sayboras@yahoo.com> | 20 May 2020, 14:17:46 UTC |
883b39f | Robin Hahling | 20 May 2020, 12:25:49 UTC | hubble-relay: enable gRPC reflection This feature is useful for discovering the gRPC API without referring to the .proto files. Example: $ grpcurl -plaintext localhost:4245 list grpc.health.v1.Health grpc.reflection.v1alpha.ServerReflection observer.Observer $ grpcurl -plaintext localhost:4245 describe observer.Observer observer.Observer is a service: service Observer { rpc GetFlows ( .observer.GetFlowsRequest ) returns ( stream .observer.GetFlowsResponse ); rpc ServerStatus ( .observer.ServerStatusRequest ) returns ( .observer.ServerStatusResponse ); } $ grpcurl -plaintext localhost:4245 describe observer.GetFlowsRequest observer.GetFlowsRequest is a message: message GetFlowsRequest { uint64 number = 1; bool follow = 3; repeated .flow.FlowFilter blacklist = 5; repeated .flow.FlowFilter whitelist = 6; .google.protobuf.Timestamp since = 7; .google.protobuf.Timestamp until = 8; } Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 14:04:43 UTC |
85c9f56 | Robin Hahling | 19 May 2020, 06:49:22 UTC | hubble: delete unused code from pkg/hubble/api/v1 This commit removes code in pkg/hubble/api/v1 that was unused. It also removes mock implementations in pkg/hubble/testutils/fake.go that were unused as well. For consistency reasons, also alias flow pb to flowpb instead of pb. Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 14:02:36 UTC |
55dbbcb | Robin Hahling | 18 May 2020, 13:04:40 UTC | hubble/observer: use time.Since instead of Time.Now.Sub Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 14:02:36 UTC |
3f34738 | Robin Hahling | 18 May 2020, 13:02:50 UTC | hubble/k8s: remove unused ParseNamespaceNames function Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> | 20 May 2020, 14:02:36 UTC |
859e178 | Daniel Borkmann | 19 May 2020, 10:39:58 UTC | test: disable MetalLB service test until there's a drop-in replacement MetalLB performs ARP announcements which confuses the vbox test env setup since it infers IP addresses of its NAT device by sniffing ARP requests. We need a open-coded dummy LB which triggers creation of LoadBalancer service. Until then, disable it since it's causing too many CI flakes due to this issue. Related: #10763 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 20 May 2020, 10:11:01 UTC |
a1d54e3 | Paul Chaignon | 15 May 2020, 14:04:22 UTC | bpf: Hints to verifier's state pruning Introduce pruning checkpoints to help the verifier's state pruning on older kernels. All program sections now load with less than 128k processed instructions on v4.9.212 and less than 65k on v4.14. Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 16:54:19 UTC |
489dbef | Paul Chaignon | 15 May 2020, 14:04:22 UTC | bpf: Enforce host policies for IPv6 Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 16:54:19 UTC |
88bf291 | Paul Chaignon | 15 May 2020, 14:04:22 UTC | bpf: Enforce host policies for IPv4 Host policies are only enforced when --enable-host-firewall is set. Once enforced, they implement a default deny. Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 16:54:19 UTC |
f9c205d | Paul Chaignon | 15 May 2020, 14:04:22 UTC | pkg/policy: Host network policies This commit adds network policies for nodes. Node (or host) network policies are loaded with a new nodeSelector field. The nodeSelector and endpointSelector fields cannot co-exist for now. Rules with a nodeSelector field apply only to the special endpoint representing the host. Network policies for the host cannot contain L7 policies yet as this isn't supported in the datapath. Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 16:54:19 UTC |
f2e7df4 | Paul Chaignon | 15 May 2020, 14:04:22 UTC | bpf: localID as parameter of policy logic functions bpf_lxc programs have their localID hardcoded as SECLABEL, but that is not the case for the bpf_host program in the case of the host firewall. This commit prepares the policy_can_{egress,access_ingress} functions to take the localID as an argument. Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 16:54:19 UTC |
f74087e | Paul Chaignon | 15 May 2020, 14:04:22 UTC | daemon: Introduce enable-host-firewall option BPF-based egress load balancing isn't supported from the host namespace, so the host policies will fail (due to wrong destination endpoint) if that was enabled. Most users likely use bpf_sock (newer kernels) or kube-proxy for egress load balancing so we just disable BPF-based egress load balancing with a warning if the host firewall is enabled. Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 16:54:19 UTC |
38abe89 | Michi Mutsuzaki | 14 May 2020, 01:31:14 UTC | doc: Add make render-docs-live-preview target - Install dependencies inside a virtualenv using pipenv and run sphinx-autobuild for real-time preview. - Update PyYAML dependency to 5.3.1. Pipenv complains about beta version dependencies by default. - Update the Documentation page. Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 19 May 2020, 15:04:05 UTC |
cc52749 | Michi Mutsuzaki | 14 May 2020, 01:35:30 UTC | doc: Update spelling_wordlist.txt Update spelling_wordlist.txt to include some words that are missing in the OS X English dictionary. Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> | 19 May 2020, 15:04:05 UTC |
8d0211c | Paul Chaignon | 12 May 2020, 15:00:47 UTC | pkg/identity: Watch and update labels for the host This commit adds a k8s watcher for label updates on the host. It allows node network policies to select the nodes based on labels. For now, the same label filters are used for the nodes as for the labels. Whatever the labels it receives, because we know there can be only one host endpoint per node, the host endpoint will always retain its security ID of 1. We therefore don't need to reload the host endpoint's datapaths on label updates. Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 09:58:58 UTC |
ec4b2f5 | Paul Chaignon | 18 May 2020, 14:48:49 UTC | identity: Recognize host and health identities as fixed The health and host identities should be recognized as fixed because endpoints with these identities will never receive new ones. So there's no point waiting on the kvstore for these endpoints. Fixes: #11559 Fixes: a695f53 ("Endpoint for host") Reported-by: André Martins <andre@cilium.io> Signed-off-by: Paul Chaignon <paul@cilium.io> | 19 May 2020, 09:54:07 UTC |
b6f4c70 | Tam Mach | 16 May 2020, 09:15:19 UTC | fix(kvstore): Correct the error messages in kvstore get CLI The info log message `waiting for consul to elect a leader` is misleading. I move it inside retry with backoff loop. Separate two scenarios: error getting the key and key is nil. While checking for this issue, I found out consul version is quite old and not the same version in packer-ci-build (e.g. 1.1.0) https://github.com/cilium/packer-ci-build/blob/master/provision/pull-images.sh#L9 Closes #11567 Signed-off-by: Tam Mach <sayboras@yahoo.com> | 19 May 2020, 08:32:34 UTC |
ed59264 | Martynas Pumputis | 18 May 2020, 07:01:39 UTC | datapath: Fix removal of bpf_netdev The name of a bpf_netdev object file which is attached to a native device has changed its name - from "bpf_netdev.o" to "bpf_netdev_${NATIVE_DEV_IFACE}.o". E.g.: $ sudo tc filter show dev enp0s8 ingress filter protocol all pref 1 bpf chain 0 filter protocol all pref 1 bpf chain 0 handle 0x1 bpf_netdev_enp0s8.o:[from-netdev] direct-action not_in_hw id 982 tag feca2ca7f6f80c7e jited The change of the name broke the removal of bpf_netdev from previously used native devs. Fixes: a695f532d06 ("Endpoint for host") Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
ad7475b | Martynas Pumputis | 14 May 2020, 13:33:13 UTC | datapath: Set ipv4-alloc-range if native-routing-cidr is not available Since we changed the SNAT logic in the previous commit, we need to set IPV4_SNAT_EXCLUSION_DST_CIDR (prev. IPV4_NATIVE_ROUTING_CIDR) in any case, otherwise traffic between pods on different nodes will be SNAT'd. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
2f0d1c3 | Martynas Pumputis | 14 May 2020, 13:12:33 UTC | datapath: Do not SNAT if dst id is WORLD_ID Unfortunately, we cannot SNAT a packet from a local endpoint only if dst sec id is WORLD_ID. The problem with this is that in the case of an FQDN policy, a world destination can get its own sec id, which makes a packet destined to such target to bypass the check, and bypass the SNAT. To fix this, we SNAT a packet from a local endpoint if dst is neither from native-routing-cidr nor REMOTE_HOST_ID. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
9d3ad46 | Martynas Pumputis | 13 May 2020, 15:03:20 UTC | test: Get rid of dedicated BPF masq test cases As BPF masq is enabled by default, we don't need a dedicated deployments (and test cases) to test the feature. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
9b567af | Martynas Pumputis | 13 May 2020, 14:07:39 UTC | test: Set single --device in K8sUpdates test Cilium < v1.8 doesn't support multi-dev, so installing e.g. v1.7 with multiple devices (set by default in overwriteHelmOptions()) will crash cilium-agent. Therefore, in the upgrade test use a single device. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
bd487b6 | Martynas Pumputis | 12 May 2020, 14:01:17 UTC | test: Do not set devices in DatapathConfiguration BPF masq tests As we enabled the BPF masq by default, the correct devices (default and private) are already set by DeployCilium(). Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
bde9037 | Martynas Pumputis | 12 May 2020, 13:52:39 UTC | test: Disable BPF masq for K8sKubeProxyFreeMatrix Disable the BPF masq in the vxlan tests until PublicInterfaceName is decluttered. The communication between pod and remote node has to be SNAT'd in the case of vxlan, which is currently not feasible, as bpf_netdev is loaded only on PublicInterfaceName. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
c620f34 | Martynas Pumputis | 08 May 2020, 15:46:18 UTC | test: Enable BPF masquerading Enable BPF masquerading for the {{4.19,net-next},no-kube-proxy} CI jobs. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 19 May 2020, 07:27:15 UTC |
13bcf96 | Glib Smaga | 18 May 2020, 19:19:47 UTC | docs: Point GKE doc to the cluster name var It's created a few lines above Signed-off-by: Glib Smaga <code@gsmaga.com> | 18 May 2020, 20:32:33 UTC |
7e328b1 | Thomas Graf | 14 May 2020, 08:00:24 UTC | doc: Change machine-type for GKE guide Due to defaulting to a CPU request of 0.1 core for all pods, the number of pods on the single core machine type is limited and insufficient to ru the connectivity-check deployment at times. Switch to a 4 core machine type to achieve a reliable connectivity-check result. Signed-off-by: Thomas Graf <thomas@cilium.io> | 18 May 2020, 15:43:48 UTC |
a2ff935 | Thomas Graf | 18 May 2020, 10:07:05 UTC | test: Remove NodeCleanMetadata This seems useless and only prolongs test duration Signed-off-by: Thomas Graf <thomas@cilium.io> | 18 May 2020, 15:41:21 UTC |
1d618db | Thomas Graf | 18 May 2020, 13:21:47 UTC | test: Disable Tests NodePort with L7 Policy This test has been failing in 7/10 builds in the Ginkgo-CI-Tests-4.19-Pipeline as of May 18. Signed-off-by: Thomas Graf <thomas@cilium.io> | 18 May 2020, 13:34:53 UTC |
3cef02f | Tobias Klauser | 15 May 2020, 09:21:34 UTC | Update Go to 1.14.3 Signed-off-by: Tobias Klauser <tklauser@distanz.ch> | 18 May 2020, 09:02:56 UTC |
668dfca | Tobias Klauser | 07 May 2020, 13:20:22 UTC | datapath/linux: drop dependency on pkg/option With all the preceding commits, pkg/datapath/linux/route is now the only package imported in the cilium-cni and cilium-docker plugins which pulls in pkg/option. This can easily be avoided by changing NodeDeviceWithDefaultRoute to not fetch the EnableIPv{4,6} options itself from pkg/option, but by taking them as arguments. Together with the preceding commits, this reduces the binary size of cilium-cni and cilium-docker by ~1 MiB each: before: -rwxr-xr-x 1 tklauser tklauser 15364096 Mai 4 16:39 plugins/cilium-cni/cilium-cni -rwxr-xr-x 1 tklauser tklauser 17399808 Mai 4 16:39 plugins/cilium-docker/cilium-docker after: -rwxr-xr-x 1 tklauser tklauser 13938688 Mai 4 17:00 plugins/cilium-cni/cilium-cni -rwxr-xr-x 1 tklauser tklauser 16523264 Mai 4 17:00 plugins/cilium-docker/cilium-docker Signed-off-by: Tobias Klauser <tklauser@distanz.ch> | 18 May 2020, 08:38:17 UTC |
a340554 | Tobias Klauser | 07 May 2020, 13:20:18 UTC | datapath/connector: move ipvlan operation mode options from pkg/option The OperationModeL3 and OperationModeL3S consts are only used withing pkg/datapath/connector and daemon/cmd. The former is also imported e.g. in the cilium-cni and cilium-docker plugins. In order to avoid transitive dependencies on pkg/option and its imports through pkg/datapath/connector, move the option definitions there. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> | 18 May 2020, 08:38:17 UTC |
b9ce4cb | Tobias Klauser | 07 May 2020, 13:19:27 UTC | datapath: split datapath mode option values into own package These are used in several places where a full import of pkg/option (and thus all its dependencies) can be avoided because only the DatapathModeVeth and DatapathModeIpvlan constants are used. Together with the following commits, this helps to reduce the binary size of cilium-cni and cilium-docker. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> | 18 May 2020, 08:38:17 UTC |
d335ede | Tobias Klauser | 07 May 2020, 13:19:05 UTC | ipam: split IPAM mode option values into own package These are used in several places where a full import of pkg/option (and thus all its dependencies) can be avoided because only the IPAM mode constants are used. Together with the following commits, this helps to reduce the binary size of cilium-cni and cilium-docker. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> | 18 May 2020, 08:38:17 UTC |
757493c | Tobias Klauser | 29 April 2020, 20:12:07 UTC | plugins/cilium-cni: avoid parsing CNI configuration twice in cmdAdd There's already a call to types.LoadNetConf further up. This was probably added by mistake in commit ff49865d477a ("plugins/cilium-cni: disable CNI debug messages by default"). Signed-off-by: Tobias Klauser <tklauser@distanz.ch> | 18 May 2020, 08:38:17 UTC |