Skip to main content

Browse the archive

https://github.com/cilium/cilium
12 July 2024, 03:14:21 UTC
sort by:
Revision Author Date Message Commit Date
46de47b viktor-kurchenko 18 March 2024, 08:35:04 UTC workflows: IPsec key rotation using CLI Use Cilium CLI encryption status and key rotation commands instead of bash scripts. The workflow IPsec key count logic was replaced with the `cilium-cli encryption status` command that implements the necessary logic. IPsec algorithms were renamed according the CLI `--auth-algo` parameter for the `cilium-cli encryption rotate-key` command: * gcm(aes) -> gcm-aes * cbc(aes) -> hmac-sha256 Signed-off-by: viktor-kurchenko <viktor.kurchenko@isovalent.com> 16 May 2024, 08:09:02 UTC
b339452 Julian Wiedmann 02 May 2024, 14:27:17 UTC images: update cilium-{runtime,builder} Signed-off-by: Julian Wiedmann <jwi@isovalent.com> 02 May 2024, 17:09:08 UTC
9bd92c0 renovate[bot] 02 May 2024, 11:55:27 UTC chore(deps): update docker.io/library/golang:1.22.2 docker digest to d5302d4 Signed-off-by: renovate[bot] <bot@renovateapp.com> 02 May 2024, 17:09:08 UTC
8c9e022 Quentin Monnet 02 May 2024, 14:38:01 UTC Revert "test: Disable hostfw in monitor aggregation test" This reverts commit 7a1a76e3cbda75ed42d874f1127007aedc651bb6. The complexity issue occurred on kernel 4.19, which is no longer supported. We closed https://github.com/cilium/cilium/issues/14552 and we can now have the Host Firewall, monitorAggregation=medium and monitorFlags=syn together. Signed-off-by: Quentin Monnet <qmo@qmon.net> 02 May 2024, 16:37:36 UTC
b71cd07 Tobias Klauser 02 May 2024, 13:01:35 UTC ci: only install llvm/clang and gingko for gingko test suite changes Since commit ade7f22ec5e6 (".github: Build documentation and BPF code in builder images") the ginkgo test suite build is using native builds and needs llvm/clang and ginkgo installed. All other steps are run using in a cilium-builder container which already has all the required tools installed. Signed-off-by: Tobias Klauser <tobias@cilium.io> 02 May 2024, 16:09:44 UTC
dbcdd7d Marcel Zieba 02 May 2024, 10:36:50 UTC ci: Filter supported versions of AKS Whenever AKS stopped supporting a particular version of AKS, we had to manually remove it from all stable branches. Now instead of that, we will dynamically check if it's supported and only then run the test. Signed-off-by: Marcel Zieba <marcel.zieba@isovalent.com> 02 May 2024, 16:09:32 UTC
76d6670 Paul Chaignon 29 April 2024, 16:09:48 UTC ipsec: Log XFRM errors during temporary state removal Context: During IPsec upgrades, we may have to temporarily remove some XFRM states due to conflicts with the new states and because the Linux API doesn't enable us to perform this atomically as we do for XFRM policies. This temporary removal should be very short but can still cause drops under heavy throughput. This commit logs how many such drops happened. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 02 May 2024, 15:59:49 UTC
bba016e Paul Chaignon 29 April 2024, 15:27:34 UTC ipsec: Log duration of temporary XFRM state removal Context: During IPsec upgrades, we may have to temporarily remove some XFRM states due to conflicts with the new states and because the Linux API doesn't enable us to perform this atomically as we do for XFRM policies. This temporary removal should be very short but can still cause drops under heavy throughput. This commit logs the duration of the removal so we can validate that it's actually always short and estimate the impact on packet drops. Note the log message will now be displayed only once the XFRM state is re-added, instead of when it's removed like before. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 02 May 2024, 15:59:49 UTC
e7db879 Paul Chaignon 29 April 2024, 15:50:51 UTC ipsec: Refactor temporary removal of XFRM state Context: During IPsec upgrades, we may have to temporarily remove some XFRM states due to conflicts with the new states and because the Linux API doesn't enable us to perform this atomically as we do for XFRM policies. This commit moves this removal logic to its own function. That logic will grow in subsequent commits as I'll add debugging information to the log message. This commit doesn't make any functional changes. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 02 May 2024, 15:59:49 UTC
c1f370f Quentin Monnet 02 May 2024, 15:17:13 UTC ci: Fix typo on "Ginkgo" Let's fix a typo: "Ginko" -> "Ginkgo". Given that the strings appear in the list of jobs on GitHub Pull Requests, it's easier to search for the specific job without the typo. Signed-off-by: Quentin Monnet <qmo@qmon.net> 02 May 2024, 15:56:46 UTC
962e78d Markus Nilsson 25 March 2024, 20:42:44 UTC Remove CiliumOperatorName constant There are no longer any references to this constant so we should be able to remove it. Signed-off-by: Markus Nilsson <markus.nilsson@yubico.com> 02 May 2024, 14:29:58 UTC
8397e45 Casey Callendrello 31 January 2024, 10:42:51 UTC pkg: don't cache Host identity rule matches Unlike every other identity, the set of labels for the reserved:host identity is mutable. That means that rules should not cache matches for this identity. So, clean up the code around determining matches. Signed-off-by: Casey Callendrello <cdc@isovalent.com> 02 May 2024, 12:22:47 UTC
de55fd8 Julian Wiedmann 02 May 2024, 06:36:29 UTC bpf: hide dynamic/static variant for policy tail-call Whether the tail-call is executed as dynamic or static is an implementation detail. Hide it in a generic tail_call_policy() helper. Suggested-by: Timo Beckers <timo@isovalent.com> Signed-off-by: Julian Wiedmann <jwi@isovalent.com> 02 May 2024, 11:57:14 UTC
92dfbc5 Paul Chaignon 08 April 2024, 20:49:41 UTC workflows: Cover IPsec + KPR in EKS To be able to cover this configuration without removing coverage for others, we need to add one more test case. Fortunately, it will run in parallel to other test case. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 02 May 2024, 11:45:54 UTC
d5bf4ae Paul Chaignon 03 April 2024, 22:03:42 UTC workflows: Cover KPR in end-to-end IPsec tests We can reuse the two configs that had --devices set because KPR will cause devices to be autodetected anyway. We then need to add one other config to cover VXLAN. Upgrade tests are not extended to cover KPR because it isn't supported in the previous stable. We will need to wait for the next minor release to be able to extend those tests. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 02 May 2024, 11:45:54 UTC
c31e2f4 Paul Chaignon 03 April 2024, 21:59:37 UTC daemon: Allow KPR with IPsec With previous fixes, we can now have IPsec enabled together with KPR. IPsec will encrypt traffic between pods as usual. Note that requests to a NodePort that are being forwarded from the receiving node to a node with a backend won't be encrypted. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 02 May 2024, 11:45:54 UTC
077ad27 Julian Wiedmann 17 January 2024, 08:43:40 UTC bpf: nodeport: avoid revalidation in nodeport_rev_dnat_ingress_ipv4() Set up saddr/daddr for the fib_params struct a bit earlier, so that we don't have to revalidate after the ipv4_l3() call. In case of XDP manually pushing tunnel headers, we can just set the selected outer IP addresses. Apply the same logic to the IPv6 path for consistency, and to untangle the goto flow a tiny bit. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> 02 May 2024, 11:35:14 UTC
acf98ff Lucas Rattz 26 April 2024, 18:28:48 UTC Add Syself to USERS.md Signed-off-by: Lucas Rattz <lucas.rattz@syself.com> 02 May 2024, 10:28:42 UTC
3f22794 Daniel Borkmann 30 April 2024, 11:51:52 UTC cilium, docs: Add note to upgrade guide on tcx Add a note on tcx for the 1.16 upgrade guide. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 02 May 2024, 10:13:51 UTC
aa7fb02 Daniel Borkmann 30 April 2024, 08:49:00 UTC cilium, api: Extend API with datapath attach mode Extend the agent API to indicate whether Cilium is actually using tcx or relying on legacy tc so that this can be displayed in `cilium status`. Status when tcx is active: # kubectl exec cilium-4m7nq -- cilium-dbg status [...] BandwidthManager: Disabled Routing: Network: Tunnel [geneve] Host: Legacy Attach Mode: TCX Masquerading: IPTables [IPv4: Enabled, IPv6: Enabled] [...] Status when inactive: # kubectl exec cilium-4m7nq -- cilium-dbg status [...] BandwidthManager: Disabled Routing: Network: Tunnel [geneve] Host: Legacy Attach Mode: Legacy TC Masquerading: IPTables [IPv4: Enabled, IPv6: Enabled] [...] Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 02 May 2024, 10:13:51 UTC
ad8b50e Timo Beckers 29 April 2024, 10:17:22 UTC Helm: add bpf.enableTCX Helm value, enable by default This commit adds the 'bpf.enableTCX' Helm value to allow disabling tcx attachments if external tooling integrating with Cilium hasn't caught up yet, as attaching a tcx program to an interface disables the legacy tc ingress/egress pipelines. The agent upgrades and downgrades interfaces seamlessly based on tcx being enabled or not, so any existing workloads are migrated automatically at runtime if the config flag is changed and the agent restarted. Rebooting the node is not necessary. Signed-off-by: Timo Beckers <timo@isovalent.com> 02 May 2024, 10:13:51 UTC
6b8c995 Timo Beckers 29 April 2024, 10:17:42 UTC loader: wire up tcx attachment logic behind --enable-tcx agent flag This commit puts the tcx logic in the endpoint attachment path and gates it behind a new --enable-tcx agent flag. A follow-up commit will use the flag in the Helm charts' configmap. attachSKBProgram() now takes a bool to indicate if the user has requested tcx attachments and seamlessly migrates programs between tcx and legacy attachment modes in both directions. Of course, this process is contingent on no other tcx programs being attached to the interface, as that disables legacy tc execution. Signed-off-by: Timo Beckers <timo@isovalent.com> 02 May 2024, 10:13:51 UTC
0a25351 Robin Gögge 26 April 2024, 11:24:44 UTC loader: infrastructure for attaching skb programs using the tcx API This commit adds the necessary infrastructure to attach bpf programs operating on sk_buff using the kernel's new tcx hook. Enabling the functionality in the agent's endpoint attachment path happens in a follow-up commit. Signed-off-by: Robin Gögge <r.goegge@isovalent.com> Co-authored-by: Timo Beckers <timo@isovalent.com> 02 May 2024, 10:13:51 UTC
77769ea Daniel Borkmann 26 April 2024, 13:49:10 UTC bpf, tcx: Clear tc_classid field This is needed for tcx given it does not automatically clear the tc_classid cb field and could contain garbage from upper layers of the stack. This later maps to skb->tc_index and given in Cilium code we utilize it, we should explicitly zero the field like we do with other cb buffers. Under tcx and endpoint routes, the test below breaks if the field if not cleared: ./cilium-cli connectivity test --test client-ingress After the fix the test passes. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 02 May 2024, 10:13:51 UTC
6de4e5c renovate[bot] 30 April 2024, 11:14:41 UTC fix(deps): update all go dependencies main Signed-off-by: renovate[bot] <bot@renovateapp.com> 02 May 2024, 09:25:52 UTC
d4ad5bc mvtab 17 April 2024, 16:23:07 UTC Deactivated Grafana reporting in monitoring example yaml. Signed-off-by: mvtab <mvtabilitas@protonmail.com> 02 May 2024, 09:18:00 UTC
579d3b6 Anton Ippolitov 05 April 2024, 13:54:14 UTC docs: Improve CES documentation to prepare graduation to "Stable" Signed-off-by: Anton Ippolitov <anton.ippolitov@datadoghq.com> 02 May 2024, 09:12:58 UTC
d5efd28 Jarno Rajahalme 30 April 2024, 19:25:00 UTC envoy: Update to use source port in connection pool hash Update Envoy image to a version that includes the source port in upstream connection pool hash, so that each unique downstream connection gets a dedicated upstream connection. Fixes: #27762 Signed-off-by: Jarno Rajahalme <jarno@isovalent.com> 02 May 2024, 09:03:19 UTC
b2ff580 Tam Mach 30 April 2024, 12:43:56 UTC pkg/envoy: Replace gocheck with built-in go test One point worth noting is the custom checker is migrated to assert.AssertComparision interface. Signed-off-by: Tam Mach <tam.mach@cilium.io> 02 May 2024, 08:35:54 UTC
f7f6ba6 Cilium Imagebot 29 April 2024, 18:14:15 UTC images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> 02 May 2024, 06:49:17 UTC
230de7c renovate[bot] 29 April 2024, 16:48:07 UTC chore(deps): update all-dependencies Signed-off-by: renovate[bot] <bot@renovateapp.com> Signed-off-by: Julian Wiedmann <jwi@isovalent.com> 02 May 2024, 06:49:17 UTC
fe6c1a9 renovate[bot] 02 May 2024, 05:53:22 UTC chore(deps): update cilium/cilium-cli action to v0.16.6 Signed-off-by: renovate[bot] <bot@renovateapp.com> 02 May 2024, 06:45:28 UTC
3011a9d renovate[bot] 29 April 2024, 15:33:21 UTC chore(deps): update all github action dependencies Signed-off-by: renovate[bot] <bot@renovateapp.com> 02 May 2024, 05:29:29 UTC
a8b21ee Martynas Pumputis 30 April 2024, 19:28:25 UTC gh/actions: Bump CLI to v0.16.6 Signed-off-by: Martynas Pumputis <m@lambda.lt> 02 May 2024, 05:24:57 UTC
1ab24d0 Joe Stringer 25 January 2022, 23:32:15 UTC test/helpers: Skip CiliumUninstall if not installed Various tests will call UninstallCiliumFromManifest() -> DeleteAndWait() during cleanup, including when the test itself gets skipped. When running individual test cases from kind, this can mean that the file that is supposed to contain the Cilium configuration doesn't exist on the local filesystem, and then when attempting to delete that Cilium configuration from the cluster, the tesuite reports: K8sBandwidthTest Checks Bandwidth Rate-Limiting at /home/joe/git/cilium/test/ginkgo-ext/scopes.go:527 [Error removing cilium from installed manifest Expected <*exec.ExitError | 0xc0003f2420>: exit status 1 to be nil] Fix this by looking to see whether the file even exists. If we never properly configured Cilium in the first place, then the file won't exist, and then it's safe to just no-op the uninstall process. Signed-off-by: Joe Stringer <joe@cilium.io> 01 May 2024, 22:59:21 UTC
28747f6 Tam Mach 01 May 2024, 10:11:00 UTC pkg/maglev: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 19:04:44 UTC
40e83de Tam Mach 01 May 2024, 10:02:51 UTC pkg/loadbalancer: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 19:04:44 UTC
67d961e Tam Mach 01 May 2024, 10:01:55 UTC pkg/service: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 19:04:44 UTC
03368ef Tam Mach 01 May 2024, 10:40:14 UTC pkg/source: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 19:01:33 UTC
a3382ab Tam Mach 01 May 2024, 10:40:06 UTC pkg/ipcache: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 19:01:33 UTC
2a154a6 Brandon Ewing 30 April 2024, 12:27:17 UTC install/kubernetes: add extraInitContainers allow additional initContainers to be added to cilium-agent Daemonset via helm values. Signed-off-by: Brandon Ewing <brandon.ewing@imc.com> 01 May 2024, 18:46:39 UTC
7260c5f Chance Zibolski 22 June 2023, 20:27:30 UTC hubble: Support --cel-expression filter in hubble observe Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com> 01 May 2024, 14:44:57 UTC
2949b16 Tam Mach 01 May 2024, 12:27:57 UTC docs: Add annotation for Ingress endpoint Relates: #19764 Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 14:01:29 UTC
1b38beb Alexandre Perrin 07 March 2024, 14:29:08 UTC hubble: add datapath trace reason to hubble flows Before this patch, the datapath trace reason was not exposed in Hubble flows. In Hubble, the trace reason is used to infer the traffic direction and reply status. Before a6bfb7928e74f11211449f16ec778dc3e0721317 all trace reasons were CT related, so the information was "converted" by Hubble into higher level concept / terminology. Since a6bfb7928e74f11211449f16ec778dc3e0721317 there are now non-CT trace reason that don't map with Hubble's traffic direction and/or reply status, and thus it make sense to start exposing the underlying trace reason. Signed-off-by: Alexandre Perrin <alex@isovalent.com> 01 May 2024, 13:08:16 UTC
29a9dea Alexandre Perrin 27 March 2024, 15:30:32 UTC hubble: fix traffic direction for TraceReasonEncryptOverlay flows Before this patch, TraceReasonEncryptOverlay traces would result in flows with ingress traffic direction. Since the flow source is the local host and destination a remote node, egress arguably make more sense to expose at a high level. Thus, this patch set the traffic direction to egress consistently for TraceReasonEncryptOverlay hubble flows. Signed-off-by: Alexandre Perrin <alex@isovalent.com> 01 May 2024, 13:08:16 UTC
bc90fc8 Alexandre Perrin 06 March 2024, 19:45:10 UTC monitor: provide trace reason helpers Before this patch, both the monitor package and Hubble's "threefour" parser would access the TraceNotify.Reason field directly. However, it is easy to miss that the Reason field contains the "encrypted" bit and has to be masked to retrieve the actual trace reason (e.g. TraceReasonCtReply), as shown by 9939fa2b0848ddd056e81f14a548f179f59027f3. This commit introduces several TraceNotify helpers around trace reason and encryption status, so that both the monitor code and Hubble "threefour" parser don't have to access the Reason field anymore. Signed-off-by: Alexandre Perrin <alex@isovalent.com> 01 May 2024, 13:08:16 UTC
e493adb Alexandre Perrin 06 March 2024, 16:49:23 UTC CODEOWNERS: add sig-hubble to review datapath trace changes https://github.com/cilium/cilium/pull/30154 and https://github.com/cilium/cilium/pull/31073 introduced new datapath trace reasons and had an impact on Hubble, but the sig-hubble team doesn't get automatically pulled in for review. This patch adds the sig-hubble team to review datapath_trace.go changes. Signed-off-by: Alexandre Perrin <alex@isovalent.com> 01 May 2024, 13:08:16 UTC
baec8dd Tam Mach 01 May 2024, 00:09:00 UTC dev: Clean-up development setup Main points are as per below: - Remove cfssl and cfssljson as these tools are used for provisioning Vagrant dev cluster, which is un-maintained now. - Update versions in dev-tool for helm, kubectl, clang and gingko Signed-off-by: Tam Mach <tam.mach@cilium.io> 01 May 2024, 09:27:34 UTC
d1b9062 Charles Uneze 27 April 2024, 14:28:11 UTC Update intro.rst Signed-off-by: Charles Uneze <charlesniklaus@gmail.com> 01 May 2024, 03:01:29 UTC
b6dd0f4 Taylor 05 April 2024, 16:11:21 UTC cec: set default route maxstreamduration Signed-off-by: Taylor <tskinn12@gmail.com> 01 May 2024, 03:00:47 UTC
6fca78d Tam Mach 28 April 2024, 11:35:36 UTC pkg/logging: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 23:49:41 UTC
48fe4bf Tam Mach 24 April 2024, 11:31:33 UTC pkg/command: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 23:49:41 UTC
46c3de3 Tam Mach 24 April 2024, 11:31:31 UTC cilium-dbg/cmd: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 23:49:41 UTC
415ca1d Tam Mach 24 April 2024, 11:31:31 UTC bugtool/cmd: Replace gocheck with built-in go test The setup and teardown steps are simplified by t.TempDir function. Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 23:49:41 UTC
c132abb Martynas Pumputis 30 April 2024, 08:14:48 UTC gh/workflows: Test WG w/o KPR Extend the E2E configurations to test for WG w/o KPR. Previously, we did not have any config to test it. Considering, that it can be a widely used configuration, sacrifice the 10th config (egress GW, endpoint routes, multi-netdev all are tested in other configs). Signed-off-by: Martynas Pumputis <m@lambda.lt> 30 April 2024, 21:19:54 UTC
7897ab9 Martynas Pumputis 30 April 2024, 08:00:31 UTC daemon: Do not require NodePort for WG Commit 6481b5bbb88 ("daemon: Detect bpf_host netdevs when WG is enabled") extended the disablement of NodePort. In particular, finishKubeProxyReplacementInit() does not disable NodePort if WG is enabled. This does not make any sense, as WG does not depend on NodePort, and bpf_host attachment (which WG depends on) is controlled via AreDevicesRequired(). Signed-off-by: Martynas Pumputis <m@lambda.lt> 30 April 2024, 21:19:54 UTC
79a8358 Tim Horner 26 April 2024, 22:07:47 UTC operator: fix CES sync in identity-based batching When CiliumEndpointSlice is enabled, any existing CiliumEndpointSlices need to be added to the Cilium Operator's cache on start up. The 'cesManagerIdentity' used for the identity-based slicing mode has 2 additional maps to track which CES map to which identity, and vice-versa. Currently these maps are not populated on the initial sync, causing the operator to believe the identity of a CiliumEndpoint has changed and removing it from the CES on first update. This causes all CiliumEndpointSlices to be recreated whenever the operator restarts. This commit adds an override method to 'cesManagerIdentity' to populate the identity mapping on initial sync, allowing the operator to properly sync the existing CiliumEndpointSlices and avoid recreating them. Fixes: #31564 Signed-off-by: Tim Horner <timothy.horner@isovalent.com> 30 April 2024, 18:34:10 UTC
cfbd7e5 Paul Chaignon 29 April 2024, 15:12:16 UTC docs: Update LLVM requirement to LLVM 17 Trying to compile with LLVM versions before 14 results in the fellowing error: In file included from bpf_lxc.c:53: In file included from /cilium/bpf/lib/nat.h:24: /cilium/bpf/lib/stubs.h:24:1: error: unknown attribute 'btf_decl_tag' ignored [-Werror,-Wunknown-attributes] DEFINE_IPV6(IPV6_MASQUERADE, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /cilium/bpf/lib/static_data.h:102:2: note: expanded from macro 'DEFINE_IPV6' DECLARE_CONFIG(__u64, name##_2, "Second half of ipv6 address " #name) \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /cilium/bpf/lib/static_data.h:26:17: note: expanded from macro 'DECLARE_CONFIG' __attribute__((btf_decl_tag(description))) \ ^~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> 30 April 2024, 16:18:41 UTC
85fcd15 Tam Mach 24 April 2024, 11:31:33 UTC pkg/k8s: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 16:14:48 UTC
a602f97 Tam Mach 24 April 2024, 11:31:30 UTC plugins/cilum-cni: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 16:14:48 UTC
64ee261 Tam Mach 30 April 2024, 12:24:24 UTC pkg/bgp: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:55:43 UTC
dba84b0 Tam Mach 28 April 2024, 14:44:38 UTC pkg/versioncheck: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
65b5e41 Tam Mach 28 April 2024, 14:40:25 UTC pkg/version: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
0f5e3e6 Tam Mach 28 April 2024, 14:38:01 UTC pkg/trigger: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
1fb977e Tam Mach 28 April 2024, 14:35:39 UTC pkg/status: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
295bfc6 Tam Mach 28 April 2024, 14:31:21 UTC pkg/spanstat: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
83aceb0 Tam Mach 28 April 2024, 14:29:21 UTC pkg/safetime: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
5f0cfaf Tam Mach 28 April 2024, 14:27:03 UTC pkg/revert: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
3b55c0f Tam Mach 28 April 2024, 14:23:59 UTC pkg/pidfile: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
26f17c7 Tam Mach 28 April 2024, 14:21:58 UTC pkg/option: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
9932bc6 Tam Mach 28 April 2024, 14:02:13 UTC pkg/node: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
2ef58d0 Tam Mach 28 April 2024, 13:32:28 UTC pkg/math: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
d00bfa8 Tam Mach 28 April 2024, 13:30:49 UTC pkg/ipmasq: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
8195406 Tam Mach 28 April 2024, 12:29:29 UTC pkg/iana: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
1b994dc Tam Mach 28 April 2024, 12:26:58 UTC pkg/health: Replace gocheck with built-in go test One extra change is to use t.Run() for subtests. Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
217cfed Tam Mach 28 April 2024, 12:13:14 UTC pkg/eventqueue: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
cf29e86 Tam Mach 24 April 2024, 13:32:09 UTC pkg/debug: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
360dac0 Tam Mach 24 April 2024, 13:08:32 UTC pkg/controller: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
11e27bf Tam Mach 24 April 2024, 11:31:33 UTC pkg/common: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
87dafaa Tam Mach 24 April 2024, 11:31:33 UTC pkg/cleanup: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
f808f33 Tam Mach 24 April 2024, 11:31:31 UTC pkg/backoff: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
712574c Tam Mach 24 April 2024, 11:31:31 UTC pkg/lock: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 15:02:59 UTC
8748ef9 Tam Mach 29 April 2024, 13:24:49 UTC pkg/endpoint: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 14:40:11 UTC
c573be4 Tam Mach 24 April 2024, 11:31:32 UTC pkg/azure: Replace gocheck with built-in go test One point worth noting is the removal of api_interaction_test.go. This test is not even complied and didn't run for a long time, so better just clean it up. Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 13:59:19 UTC
f79b6ae Tam Mach 24 April 2024, 11:31:31 UTC pkg/alibabacloud: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 13:59:19 UTC
e4a4357 Tam Mach 24 April 2024, 11:31:31 UTC pkg/aws: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 13:59:19 UTC
7e01a7b Tobias Klauser 24 April 2024, 08:51:21 UTC ci: use base and head SHAs from context in lint-build-commits workflow Instead of querying the GitHub API for the parent SHA, use the base and head SHA provided by the github.event.pull_request context. This works fine because the workflow only runs on pull requests. Also use a loop and git checkout instead of git rebase to avoid potential issues with merge conflicts in the presence of merge commits in the PR. Signed-off-by: Tobias Klauser <tobias@cilium.io> 30 April 2024, 12:16:47 UTC
1bc2c75 Marco Hofstetter 25 April 2024, 14:52:53 UTC l7 policy: add possibility to configure Envoy proxy xff-num-trusted-hops Currently, when L7 policies (egress or ingress) are enforced for traffic between Pods, Envoy might change x-forwarded-for related headers because the corresponding Envoy listeners don't trust the downstream headers because `XffNumTrustedHops` is set to `0`. e.g. `x-forwarded-proto` header: > Downstream x-forwarded-proto headers will only be trusted if xff_num_trusted_hops is non-zero. If xff_num_trusted_hops is zero, downstream x-forwarded-proto headers and :scheme headers will be set to http or https based on if the downstream connection is TLS or not. https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-proto This might be problematic if L7 policies are used for egress traffic for Pods from a non-Cilium ingress controller (e.g. nginx). If the Ingress Controller is terminating TLS traffic and forwards the protocol via `x-forwarded-proto=https`, Cilium Envoy Proxy changes this header to `x-forwarded-proto=http` (if no tls termination itself is used in the policy configuration). This breaks applications that depend on the forwarded protocol. Therefore, this commit introduces two new config flags `proxy-xff-num-trusted-hops-ingress` and `proxy-xff-num-trusted-hops-egresss` that configures the property `XffNumTrustedHops` on the respective L7 policy Envoy listeners. For backwards compabitility and security reasons, the values still default to `0`. Note: It's also possible to configure these values via Helm (`envoy.xffNumTrustedHopsL7PolicyIngress` & `envoy.xffNumTrustedHopsL7PolicyEgress`). Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> 30 April 2024, 11:12:01 UTC
6633ca8 Timo Beckers 24 April 2024, 11:10:26 UTC datapath,endpoint: explicitly remove TC filters during endpoint teardown Prior to this commit, we left it up to the kernel to clean up tc attachments when the CNI finally removes the veth when a Pod goes away. This leaves a window of time where an endpoint's tc programs can potentially be invoked after the endpoint's internal tail call maps have already been cleared and the endpoint has been removed from the endpoint map and ipcache, resulting in undefined behaviour. This patch clearly defines the endpoint teardown sequence as follows: - remove (endpoint) routes - set the interface down - detach tc(x) hooks - remove endpoint from endpoint map - remove endpoint policy program(s) - delete conntrack map pins - remove policy prog array map pin - remove internal tail call map pin - remove custom calls map pin This puts the agent more in control of the teardown sequence and will allow us to reason better about failures related to missed tail calls and other flakes. Signed-off-by: Timo Beckers <timo@isovalent.com> 30 April 2024, 10:51:48 UTC
51f10d0 Tam Mach 28 April 2024, 14:56:49 UTC cilium/operator: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 09:50:46 UTC
d7c0bf5 renovate[bot] 29 April 2024, 15:41:22 UTC fix(deps): update all go dependencies main Signed-off-by: renovate[bot] <bot@renovateapp.com> 30 April 2024, 09:17:16 UTC
b5f4efa Tam Mach 29 April 2024, 11:20:41 UTC pkg/ipam: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 30 April 2024, 09:03:27 UTC
cab3648 Ryan Drew 04 April 2024, 19:12:28 UTC docs: Add Pod eviction warning in upgrade notes for Envoy DS This commit expands on the upgrade warning in the documentation for the Envoy DaemonSet, describing a potential case in which pod evictions could occur during upgrade. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com> 30 April 2024, 06:34:01 UTC
6b0d76a Joe Stringer 16 April 2024, 23:54:52 UTC daemon: Run conntrack GC after Endpoint Restore The reverse call tree for RestoreEndpoint, which exposes all restored endpoints in the EndpointManager, is as follows: INCOMING CALLS - f RestoreEndpoint github.com/cilium/cilium/pkg/endpointmanager - f regenerateRestoredEndpoints github.com/cilium/cilium/pkg/endpointmanager - f initRestore github.com/cilium/cilium/daemon/cmd + f startDaemon github.com/cilium/cilium/daemon/cmd Previously, the `CTNATMapGC.Enable()` call, which invokes `gc.endpointsManager.GetEndpoints()`, would be called prior to exposing these endpoints in the EndpointManager. As a result, the step where the initial scan attempts to update each Endpoint's DNSHistory with the latest CT GC timers would fail, leaving the timestamps empty. The potential impact of this is that DNS entries that should expire soon after a cilium-agent restart may not time out for an extra entire conntrack garbage collection interval several minutes later. Signed-off-by: Joe Stringer <joe@cilium.io> 30 April 2024, 01:51:39 UTC
8d28663 Tam Mach 29 April 2024, 10:55:06 UTC pkg/metrics: Replace gocheck with built-in go test Signed-off-by: Tam Mach <tam.mach@cilium.io> 29 April 2024, 22:59:06 UTC
41408a7 Chance Zibolski 27 March 2024, 21:25:34 UTC Support configuring TLS for hubble metrics server Also supports using mTLS to secure access to the metrics endpoint. Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com> 29 April 2024, 20:53:10 UTC
2136418 André Martins 26 April 2024, 08:00:21 UTC install/kubernetes: add AppArmor profile to Cilium Daemonset Starting from k8s 1.30 together with Ubuntu 24.04, Cilium fails to initialize with the error: ``` Error: applying apparmor profile to container 43ed6b4ba299559e8eac46a32f3246d9c54aca71a9b460576828b662147558fa: empty localhost AppArmor profile is forbidden ``` This commit adds the "Unconfined" as default, where users can overwrite it with any of the AppArmor profiles available on their environments, to all the pods that have the "container.apparmor.security.beta.kubernetes.io" annotations. Signed-off-by: André Martins <andre@cilium.io> 29 April 2024, 20:29:00 UTC
93a6d3c Daneyon Hansen 04 March 2024, 20:17:39 UTC IPAM: Updates API Types for IPv6 Allocation Statistics Previously, IPAM API types were specific to managing an IPv4 address pool. This icommit updates the API types to support separate IPAM pool maintainers for IPv4 and IPv6. - `pkg/ipam/node.go`: Updates the `Node` type to support IPv6 allocation statistics. - `pkg/ipam/stats/stats.go`: Updates the `InterfaceStats` type support IPv6 interface statistics. - `pkg/ipam/types/types.go`: Updates `IPAMSpec`, `IPAMStatus`, and `Subnet` type to support IPv6 allocation statistics. - `ciliumnodes.yaml`: Regenerated due to newly added fields of IPAM API types. Supports: #19251 Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> 29 April 2024, 18:49:13 UTC
c29a81a renovate[bot] 15 April 2024, 01:08:29 UTC chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to f41b84c Signed-off-by: renovate[bot] <bot@renovateapp.com> 29 April 2024, 15:30:46 UTC
08d9b14 Ryan Drew 14 March 2024, 20:10:30 UTC ci: Collect cilium-agent pprofs during 100 node scale test This commit adjusts the 100 node scale test to include the cilium-agent pprofs CL2 module. This will trigger the collection of cilium-agent pprofs throughout the duration of the test, assisting in debugging of regressions. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com> 29 April 2024, 14:38:13 UTC
back to top