Skip to main content

Browse the archive

https://github.com/cilium/cilium
09 April 2024, 21:14:05 UTC
sort by:
Revision Author Date Message Commit Date
1bfb630 Thomas Graf 23 May 2017, 18:11:45 UTC Prepare for 0.9.0 release Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 12:05:39 UTC
549c39d Thomas Graf 30 May 2017, 11:51:28 UTC Prepare NEWS for release Signed-off-by: Thomas Graf <thomas@cilium.io> 31 May 2017, 00:15:56 UTC
6cf1469 André Martins 30 May 2017, 22:27:58 UTC policy: adding a merger for l7 rules This commit fixes the order of policies when they are inserted. If a user adds policies with the same selector and a l7 rule, the l7 rule won't be merged causing the policy of the first rule inserted to be enforced. This commit attempts to merge the l7 http rules for all the policies with the same endpoint selector. Thus, all l7 rules will be enforced for the same endpoint selector. Signed-off-by: André Martins <andre@cilium.io> 30 May 2017, 23:33:28 UTC
8537a0e Thomas Graf 30 May 2017, 04:50:06 UTC Documentation: Show cilium endpoint list in getting started guide Also fixes a typo in the example policy shown. Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 20:13:31 UTC
7c50045 Thomas Graf 30 May 2017, 03:38:42 UTC examples/minikube: Link to full Kubernetes guide Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 20:13:31 UTC
cc3ddde Thomas Graf 30 May 2017, 03:30:21 UTC examples/gettingstarted: No need for --cap-add NET_ADMIN This seems to have been a leftover from the times we used ping Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 20:13:31 UTC
6e42cee Thomas Graf 30 May 2017, 03:26:04 UTC Documentation: Provide minimal README for examples/gettingstarted/ Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 20:13:31 UTC
fc30f0a Ian Vernon 30 May 2017, 18:11:41 UTC Documentation/admin.rst: update enable-policy flag Update description for enable-policy flag for daemon to include possible values (default, true, false) as well as default value to 'default'. Signed-off by: Ian Vernon <ian@covalent.io> 30 May 2017, 19:16:31 UTC
edba26e Thomas Graf 30 May 2017, 06:23:31 UTC k8s: Specify serviceAccountName Related-to: #831 Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 19:15:59 UTC
fc4c57c André Martins 30 May 2017, 16:45:28 UTC k8s: omitting k8s namespace for reserved labels If the user specifies any reserved label for the endpoint selector in the k8s cilium TPR, the k8s namespace is not inserted to that same selector. Signed-off-by: André Martins <andre@cilium.io> 30 May 2017, 17:08:31 UTC
80b7b05 Thomas Graf 30 May 2017, 03:44:54 UTC k8s: Ignore annotation.kubernetes.io labels Example: cilium:annotation.kubernetes.io/config.seen=2017-05-30T14:22:17.718886499Z cilium:annotation.kubernetes.io/config.source=api cilium:annotation.kubernetes.io/created-by={"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicaSet","namespace":"default","name":"app3-640085774","uid":"628aadb4-4543-11e7-bdbb-080027f02591","apiVersion":"extensions","resourceVersion":"517"}} Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 16:55:47 UTC
287349b Thomas Graf 30 May 2017, 06:13:31 UTC kubernetes: Add thirdpartyresources create capability to cilium role Resolves the following error: Error while enabling k8s watcher Unable to create third party resource: User \"system:node:niesen\" cannot create thirdpartyresources.extensions at the cluster scope. (post thirdpartyresources.extensions) Related-to: #831 Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 06:13:31 UTC
b0ed34e Thomas Graf 29 May 2017, 21:19:39 UTC Rework of the administration guide Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:56:58 UTC
d8027d8 Thomas Graf 29 May 2017, 21:19:39 UTC examples/docker-compose: Remove outdated README and policy Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:56:58 UTC
ee6c549 Thomas Graf 29 May 2017, 21:19:39 UTC k8s: Remove oudated daemon-set.yaml example The up to date examples are in: examples/kubernetes/ Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:56:58 UTC
86e0625 Thomas Graf 29 May 2017, 21:19:39 UTC examples: Always refer to cilium/cilium:stable Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:56:58 UTC
d8d7af5 Thomas Graf 29 May 2017, 21:19:39 UTC k8s: Provide isolated RBAC related resources Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:56:58 UTC
eeab6bb Alexander Alemayhu 24 May 2017, 07:17:12 UTC tests: add test for documentation link This should hopefully catch newly introduced link syntax errors. The file is intentionally prefixed with 00. This way if any links are changed they should be noticed relatively early. Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 30 May 2017, 11:29:29 UTC
62776b4 André Martins 30 May 2017, 03:16:22 UTC k8s: renamed kubernetes path to kubernetes-ingress Signed-off-by: André Martins <andre@cilium.io> 30 May 2017, 11:28:21 UTC
8938ace André Martins 30 May 2017, 04:10:29 UTC go: upgrade go to 1.8.3 due security fix Signed-off-by: André Martins <andre@cilium.io> 30 May 2017, 11:26:29 UTC
04ac090 André Martins 30 May 2017, 04:09:50 UTC ctmap: fix visualization of bpf ct list utility Signed-off-by: André Martins <andre@cilium.io> 30 May 2017, 11:25:52 UTC
15b6d3a Thomas Graf 29 May 2017, 22:28:37 UTC labels: Consider all labels except "io.kubernetes" by default Instead of whitelisting individual label prefixes by default, consider all labels except "io.kubernetes*" to avoid including pod-name hash, timestamps, grace periods, etc. Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:23:36 UTC
6cb09d9 Thomas Graf 29 May 2017, 22:28:37 UTC labels: Support ignoring label prefix Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:23:36 UTC
29aa335 Thomas Graf 29 May 2017, 22:28:37 UTC labels: Simplify parsing of valid label prefixes - Move into pkg/labels/ - No need to take lock Signed-off-by: Thomas Graf <thomas@cilium.io> 30 May 2017, 11:23:36 UTC
0405476 Daniel Borkmann 30 May 2017, 09:05:59 UTC bpf, doc: minor fixes and couple more entries in further reading List of talks and blog posts should be pretty much complete by now. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 30 May 2017, 10:05:01 UTC
9886f71 Tobias Klauser 30 May 2017, 06:54:00 UTC pkg/bpf: remove #define depending on CI_BUILD The CI_BUILD macro is no longer defined since travis CI integration was removed in commit b7483ba03d59 ("build: Remove travis integration"). Remove the last remaining bit wich depends on CI_BUILD being defined. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> 30 May 2017, 07:29:52 UTC
793b519 Daniel Borkmann 29 May 2017, 15:23:48 UTC docs, readme: fix meeting time Last week we decided to move the meeting by one hour, so that people from the US have a more convenient time to join the Cilium developer meeting. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 29 May 2017, 21:20:25 UTC
a4048ae Daniel Borkmann 29 May 2017, 10:58:51 UTC bpf, doc: various fixes and improvements Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 29 May 2017, 21:20:25 UTC
c59996b Daniel Borkmann 29 May 2017, 13:56:09 UTC cilium: fetch endpoint.OptionConntrackLocal only once It's enough to fetch it only once and then use isLocal for the seenGlobal related test. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 29 May 2017, 21:20:25 UTC
7d68529 Thomas Graf 24 May 2017, 18:54:44 UTC policy: Fix policy deadlock The policy repository is already locked Signed-off-by: Thomas Graf <thomas@cilium.io> 29 May 2017, 20:57:31 UTC
f06ac26 Thomas Graf 24 May 2017, 17:48:20 UTC policy: Simplify locking when selecting endpoint policy selection No need to unlock and relock in this case. owner.UpdatePolicyEnforcement can be called within the section of the locks already being held. Signed-off-by: Thomas Graf <thomas@cilium.io> 29 May 2017, 20:57:31 UTC
8c5f015 André Martins 29 May 2017, 04:15:05 UTC daemon: fixing cilium deadlock When cilium was being used with kubernetes, the endpoint RLock was called while the endpoint's Lock was already held. By calling UpdatePolicyEnforcement with the lock held, it is not necessary use the RLock inside this function. Signed-off-by: André Martins <andre@cilium.io> 29 May 2017, 19:51:06 UTC
3d48be6 André Martins 29 May 2017, 02:26:12 UTC ctmap: fixing switch cases Signed-off-by: André Martins <andre@cilium.io> 29 May 2017, 19:50:13 UTC
1922ddd Ian Vernon 29 May 2017, 03:44:54 UTC daemon: check if policy enforcement is being updated This fixes a bug where if any configuration update was applied to the daemon, the daemon would update the daemon's EnablePolicy configuration value regardless of if there was an update to the Policy Enforcement configuration flag in the daemon or not. Now, the daemon only checks if the option is present in the update, and then if so, updates the EnablePolicy flag if needed. Signed-off by: Ian Vernon <ian@covalent.io> 29 May 2017, 19:27:10 UTC
d6c9771 Alexander Alemayhu 29 May 2017, 07:24:24 UTC Documentation: minor nitpicks o Remove repeated word. o Add missing period. o Remove extra spaces. o s/to a/to as/ o s/appss/apps/ Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 29 May 2017, 10:52:58 UTC
7d8ebb8 Daniel Borkmann 28 May 2017, 22:58:50 UTC bpf, doc: update on further reading section Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 29 May 2017, 10:52:40 UTC
667d7e8 André Martins 28 May 2017, 21:24:51 UTC ct: checking endpoint opts inside lock Signed-off-by: André Martins <andre@cilium.io> 28 May 2017, 22:30:56 UTC
5e44ca9 André Martins 28 May 2017, 18:46:14 UTC ctmap: fixing select cases for multiple cases Signed-off-by: André Martins <andre@cilium.io> 28 May 2017, 22:30:56 UTC
691cfee André Martins 28 May 2017, 18:45:43 UTC ctmap: fixing order of attributes for ct6 keys Signed-off-by: André Martins <andre@cilium.io> 28 May 2017, 22:30:56 UTC
c2f92fe Ian Vernon 24 May 2017, 22:27:57 UTC daemon: enable policy enforcement per endpoint k8s Extend policy flag to daemon to have three modes: default, where policy enforcement is enabled if at least one policy exists if K8s is not enabled, or, if k8s is enabled, policy enforcement is enabled on the pods that are selected by a NetworkPolicy. true: policy enforcement is always enabled false: policy enforcement is always disabled Signed-off-by: Ian Vernon <ian@covalent.io> 28 May 2017, 21:03:18 UTC
6386f67 Ian Vernon 24 May 2017, 22:26:47 UTC api/v1 : regenerate API files Signed-off-by: Ian Vernon <ian@covalent.io> 28 May 2017, 21:03:18 UTC
4582253 Ian Vernon 24 May 2017, 22:25:07 UTC api/v1/openapi.yaml: update Endpoint API models Signed-off-by: Ian Vernon <ian@covalent.io> 28 May 2017, 21:03:18 UTC
d37a793 Thomas Graf 24 May 2017, 12:44:18 UTC k8s: Upgrade consul to 0.8.3 Fixes: #833 Signed-off-by: Thomas Graf <thomas@cilium.io> 28 May 2017, 21:02:36 UTC
82a0c1d Thomas Graf 24 May 2017, 12:09:53 UTC k8s: Add TPR creationand CiliumNetworkPolicy to ClusterRole Fixes: #816 Reported-by: @goloxina on Slack Signed-off-by: Thomas Graf <thomas@cilium.io> 28 May 2017, 18:34:52 UTC
8264845 Alexander Alemayhu 27 May 2017, 07:13:06 UTC cmd: daemon: plugins: use RequireRootPrivilege Reduces some minor duplication. No functional change intended. Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 27 May 2017, 17:09:10 UTC
66cb7dc Daniel Borkmann 27 May 2017, 01:41:40 UTC cilium: bindata update due to changes in bpf Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 27 May 2017, 05:34:25 UTC
d53ffc9 Daniel Borkmann 27 May 2017, 00:48:00 UTC bpf: avoid excessive map updates due to timeout update When we need to use HT, we update timeouts over the entire map for every single entry from user space walk. This is very costly as it involes atomic operations for entry updates, copying value data, etc. Really just interfere from user space when we perform deletions. The kernel side uses ktime_get_ns() BPF helper, which is available in 4.8+ and calls into ktime_get_mono_fast_ns(), which is a fast, nmi safe access to monotonic clock. For LRU, we don't need to perform any update at all right now. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 27 May 2017, 05:34:25 UTC
1e59d06 Daniel Borkmann 26 May 2017, 13:48:56 UTC pkg, bpf: add api to return monotonic clock This adds an API that we can use to compare values against bpf_ktime_get_ns() BPF helper for the timeouts. Looks like golang doesn't offer such an interface, so we need to add a cgo version right here. Probably also better to not rely on go internals should they once change their clock source internally, etc. Related: https://github.com/golang/go/issues/12914 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 27 May 2017, 05:34:25 UTC
256b1f4 Alexander Alemayhu 26 May 2017, 21:36:23 UTC demo: use matchLabels Fixes the following output $ cilium policy import ./policy.json Error: Cannot parse policy ./policy.json: policy.json:1: unable to assign value 'array' to type 'v1.LabelSelector': [{ Also added extra slash to last curl call in sw_demo, without it the rules won't match. Closes: #820 (Broken demos) Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 27 May 2017, 05:29:43 UTC
81b1d30 Daniel Borkmann 26 May 2017, 23:17:41 UTC cilium: fix bindata Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 27 May 2017, 00:27:20 UTC
678aa46 Daniel Borkmann 26 May 2017, 22:37:56 UTC cilium: fix hashtable walk and timeout update Current HT walker is buggy since lookup + update/delete combination doesn't work the way it is supposed to be. E.g. each update/delete with the nextKey places the entry to the beginning of the hash slot in the kernel map resp. deletes the entry and starts from the first map entry since it does not find it anymore. I've seen often that due to the current update logic in cilium, we create loops among entries that we walk until we reduced the timeout enough that they expire and delete such that the walker can move on. Fix it by using the real next key after the current element and use that for the next check. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 27 May 2017, 00:27:20 UTC
6d71b90 Daniel Borkmann 25 May 2017, 14:43:44 UTC cilium: trigger global CT only once per run Right now we trigger timeout reduction on the global maps for each EP participating in the global v4/v6 maps. Thus per run, we reduce the timeout worst case #EPs * 10 units, which is buggy as it should just be reduced by 10 units only. So, once we went through the global CT, skip it for other EPs that use it. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 27 May 2017, 00:27:20 UTC
ca4f1af John Fastabend 26 May 2017, 21:15:01 UTC cilium: bindata Signed-off-by: John Fastabend <john.fastabend@gmail.com> 26 May 2017, 22:21:12 UTC
153a61b John Fastabend 26 May 2017, 04:15:22 UTC cilium: by unifing keys we can simplify local and global CT The keys are the same for both local and glocal case now so we can remove at least a few additional switch statements. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 26 May 2017, 22:21:12 UTC
088ff00 John Fastabend 25 May 2017, 21:15:16 UTC cilium: use same tuple struct for both global and local CT There is a bug in the proxy code when local conntrack is enabled. The issue is the proxy{4,6} map uses the original source IP in the key when configuring the proxy. This allows the key to be matched by the proxy on the 'from-netdev' side by using the 'dip' (which is the client's IP) to lookup the address translation. The result from the lookup is then used to translate the ports and source IP. In the global CT case the ct_lookup{4,6} path reverses the saddr and daddr in the ipv{4,6}_ct_tuple and, assuming no match is found in the table, calls ct_create{4,6} to add a new key/value pair to the proxy{4,6} map. When the key is created for this entry the 'daddr' in the tuple is used which is actually the 'source' IP from the packet (in other words its the clients IP address). However, in the local CT case the tuple only has a single addr and it is not swapped by the tuple reverse logic in ct_lookup{4,6}. The result is ct_create{4,6} creates a key using the only available address, which is the destination IP from the packet which corresponds to the server. Then when the proxy sends packets, using the 'from-netdev' code path, a key is built using the destination IP (the client IP from this direction) but there is no match in the proxy{4,6} map due to the above bug (specifically the key being built with the server IP). To resolve this we came up with two solutions. One is to pass the original source IP and use this in ct_create{4,6} as the source address. But this gets ugly and we already pass by value the orig_dip and orig_was_proxy so adding yet another value is getting a bit awkward. The other option, and the one we implemented, is to convert local CT over to use the same tuple structure as the global CT implementation so that both modes have the same data structures available to build the key from. This solves the above issue and simplifies the code instead of complicating it furher. With the nice benefit of being a patch full of removals and creating one less #define to worry about. The disadvantage is the key size is sizeof('address') larger in the conntrack local case. However, this is not the default case so I believe the trade-off is worth it. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 26 May 2017, 22:21:12 UTC
a8475f7 John Fastabend 25 May 2017, 21:34:53 UTC cilium: add contrack local tests for ingress proxy Proxy tests for conntrack local case. Note, I avoided building a larger unified test function and bash helpers because I like being able to see an entire test in a single file when debugging. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 26 May 2017, 22:21:12 UTC
1f9e55b John Fastabend 25 May 2017, 18:49:45 UTC cilium: add contrack local tests for egress proxy Proxy tests for conntrack local case. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 26 May 2017, 22:21:12 UTC
93e5dc7 Jarno Rajahalme 19 May 2017, 22:10:15 UTC daemon: Add newline before bpf feature warnings. Multiple bpf feature warnings are separated by newlines, so add a newline after the header for the warnings as well. This makes the formatting uniform when more than one warnings are present. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 26 May 2017, 20:42:28 UTC
b2f0d96 Jarno Rajahalme 22 May 2017, 22:25:07 UTC pkg/policy/consumer: Fix comment. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 26 May 2017, 20:42:28 UTC
df89b25 Jarno Rajahalme 22 May 2017, 21:30:37 UTC pkg/policy/l4: Fix DeepCopy. Ingress map length was also used for egress map allocation. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 26 May 2017, 20:42:28 UTC
0591a15 Jarno Rajahalme 25 May 2017, 22:25:02 UTC api: update. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 26 May 2017, 20:42:28 UTC
73c3632 André Martins 24 May 2017, 16:05:21 UTC k8s/types: Improving cilium TPR translation and unit tests Signed-off-by: André Martins <andre@cilium.io> 26 May 2017, 10:42:51 UTC
f6de343 Daniel Borkmann 25 May 2017, 22:40:06 UTC cilium: bindata update due to bpf changes Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 26 May 2017, 06:42:40 UTC
05e7a72 Daniel Borkmann 25 May 2017, 22:39:46 UTC bpf: fix llvm relo issue with router_ip We also need to use the BPF_V6() macro in this case so that LLVM doesn't generate rodata records. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 26 May 2017, 06:42:40 UTC
963e52a John Fastabend 25 May 2017, 18:28:35 UTC cilium: bindata update Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 21:50:42 UTC
8dbea35 John Fastabend 25 May 2017, 18:27:05 UTC cilium: fix build errors with proxy ipv6 and conntrack local Same as in IPv4 when conntrack local is used we need to ensure the proper source address fields are used. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 21:50:42 UTC
4391914 John Fastabend 25 May 2017, 15:08:45 UTC cilium: bindata updates Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
1dff33e John Fastabend 25 May 2017, 15:05:34 UTC cilium: add *.swn to gitignore Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
a22a75f John Fastabend 25 May 2017, 03:40:52 UTC cilium: convert tests to force waiting for endpoint labels IPv6 tests will result in errors if run before the labels have been instantiated, checked via 'cilium endpoint list'. This patch ports proxy tests to wait for labels. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
21e4c51 John Fastabend 24 May 2017, 22:18:23 UTC cilium: IPv6 ingress proxy support Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
1a92c4e John Fastabend 19 May 2017, 22:43:33 UTC cilium: support for IPV6 egress policy Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
6c0c690 John Fastabend 24 May 2017, 20:39:16 UTC cilium: ct_state was not being returned in ipv6 ct lookup case Return the ct state from the ipv6 ct lookup so we can use it to lookup proxy port. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
fe5555e John Fastabend 24 May 2017, 17:54:42 UTC cilium: add proxy6map support Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
fe856e3 John Fastabend 24 May 2017, 18:11:17 UTC cilium: convert IPv6 HOST_IP and LXC_IP over to macros To avoid reloc errors in IPv6 proxy use macros for IPV6 addresses. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
5af1f57 John Fastabend 24 May 2017, 17:38:38 UTC cilium: avoid llvm relocations with macro Until the LLVM issue, "BPF target: relocation records generated for non-map data" is fixed we need to work around for this issue. This patch puts a work around in place for HOST_IP and LXC_IP needed to enable IPv6 proxy. ref: https://bugs.llvm.org/show_bug.cgi?id=26243 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
5e409b5 John Fastabend 19 May 2017, 22:39:50 UTC cilium: IPv6 ingress and egress proxy tests Add IPv6 ingress and egress proxy tests. Signed-off-by: John Fastabend <john.fastabend@gmail.com> 25 May 2017, 17:19:00 UTC
85f1db7 Thomas Graf 23 May 2017, 20:18:24 UTC Documentation: Remove creation of ThirdPartyResource from guide Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 21:16:46 UTC
7e4f642 Thomas Graf 23 May 2017, 20:18:24 UTC k8s: Automatically create ThirdPartyResource for CiliumNetworkPolicy Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 21:16:46 UTC
4acac36 Thomas Graf 23 May 2017, 19:07:17 UTC Documentation: Access /private in 2nd attempt Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 17:11:09 UTC
315bd5a Thomas Graf 23 May 2017, 19:03:42 UTC Documentation: HTTP => http in L7 YAML Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 17:07:40 UTC
3eebfa6 André Martins 24 May 2017, 15:18:49 UTC k8s/types: fixing missing http rules from k8s translation Signed-off-by: André Martins <andre@cilium.io> 24 May 2017, 15:22:18 UTC
ee21ae3 Thomas Graf 23 May 2017, 17:44:34 UTC Documentation: Remove kube-dns workaround Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 15:00:11 UTC
d3a10cb Thomas Graf 23 May 2017, 17:43:35 UTC Documentation: Use service IP instead of pod IP Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 15:00:11 UTC
4cafb45 Thomas Graf 23 May 2017, 17:27:18 UTC Documentation: Fix L7 policy YAML Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 14:53:08 UTC
cdba989 Thomas Graf 23 May 2017, 17:10:09 UTC Documentation: Temporary workaround for kube-dns issue Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 13:24:36 UTC
0d6d879 Thomas Graf 23 May 2017, 16:42:22 UTC examples/minikube: Add ThirdPartyResource YAML Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 12:55:48 UTC
9825804 Thomas Graf 23 May 2017, 15:25:44 UTC examples/minikube: Point to correct demo apps yaml Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 12:55:48 UTC
c894102 Thomas Graf 23 May 2017, 15:11:14 UTC examples/minikube: Properly set --k8s-prefix Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 12:55:48 UTC
b673128 Thomas Graf 23 May 2017, 14:42:16 UTC Point getting-started guide to 0.9.0-rc1 release Also adjusts the examples to the new policy language Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 12:37:35 UTC
b3f5343 Thomas Graf 23 May 2017, 12:30:43 UTC Documentation: Adjust getting started guide to TPR policy Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 07:05:28 UTC
05ff2e0 Thomas Graf 23 May 2017, 12:08:05 UTC Documentation: Kubernetes installation guide using DaemonSet Signed-off-by: Thomas Graf <thomas@cilium.io> 24 May 2017, 07:05:28 UTC
74636e7 André Martins 24 May 2017, 00:49:02 UTC daemon: fix nil pointer when using k8s-prefix When the user specified a k8s-prefix, the ValidK8sLabelPrefixes was not initialized resulting in a nil pointer. Signed-off-by: André Martins <andre@cilium.io> 24 May 2017, 01:10:42 UTC
fc7a184 André Martins 23 May 2017, 21:04:12 UTC start.sh: fixing typo in etcd config Signed-off-by: André Martins <andre@cilium.io> 24 May 2017, 00:52:40 UTC
8585f77 André Martins 23 May 2017, 01:55:41 UTC labels: set default source to "any" for policy labels. When the user imports a policy without any source specified, for example: "foo=bar", the source will be automatically set to "any". In the following policy: "endpointSelector": { "matchLabels": { "any:role": "frontend", } }, "ingress": [ { "fromEndpoints": [ { "matchLabels": { "k8s:foo": "bar" } } ] } ], the following command returns ALLOWED $ cilium policy trace -d cilium:role=frontend -s k8s:foo=bar but the following command returns DENY $ cilium policy trace -d cilium:role=frontend -s any:foo=bar Signed-off-by: André Martins <andre@cilium.io> 23 May 2017, 13:26:19 UTC
271f81e André Martins 19 May 2017, 23:38:43 UTC k8s third party: adding same namespace to CNP rules Signed-off-by: André Martins <andre@cilium.io> 23 May 2017, 13:26:19 UTC
f1ff777 André Martins 19 May 2017, 23:10:02 UTC k8s: changed ExtractNamespace for ObjectMeta Signed-off-by: André Martins <andre@cilium.io> 23 May 2017, 13:26:19 UTC
024879f Thomas Graf 15 May 2017, 07:07:25 UTC k8s: Fix CiliumPolicy ThirdPartyResource parsing Signed-off-by: Thomas Graf <thomas@cilium.io> 23 May 2017, 13:26:19 UTC
61a9518 Thomas Graf 23 May 2017, 11:47:31 UTC examples/kubernetes: Use VXLAN mode by default Signed-off-by: Thomas Graf <thomas@cilium.io> 23 May 2017, 12:04:50 UTC
d6fd4fa Ross Guarino 22 May 2017, 22:15:30 UTC fix(daemon): switch to using --kvstore-opt Remove all of the remaining references to the old options for configuring key-value store and replace them with --kvstore-opt. Fixes: #791 23 May 2017, 06:33:15 UTC
0c49f03 Thomas Graf 21 May 2017, 22:57:18 UTC kubernetes: Provide cilium-consul DaemonSet in kubernetes example Signed-off-by: Thomas Graf <thomas@cilium.io> 23 May 2017, 06:27:50 UTC
back to top