https://github.com/cilium/cilium
- HEAD
- refs/heads/1.2.7-hotfix1-fqdn-regen
- refs/heads/EndpointPolicyEnformcement
- refs/heads/address
- refs/heads/all-scalability-improvements
- refs/heads/beta/service-mesh
- refs/heads/bpf-metrics
- refs/heads/brb/brb-patch-2
- refs/heads/cilium-envoy-crd-pre-beta
- refs/heads/cilium-no-gopath
- refs/heads/cli-upgrade-v1.12-ci-test
- refs/heads/clustermesh511-upgrade-test
- refs/heads/committers-codeowners
- refs/heads/debug
- refs/heads/dev/joe/v1.8-with-hostfw-fixes
- refs/heads/enable_cnp_latency
- refs/heads/encrypt-node-fixes
- refs/heads/ensure-macos-build-succeeds
- refs/heads/envoy-policy-precedence
- refs/heads/envoy-warnings-cleanup
- refs/heads/extension-mysql
- refs/heads/feature/cep-scalability
- refs/heads/feature/devices-and-addresses
- refs/heads/feature/devices-reconciliation-v1.16
- refs/heads/feature/main/svc-icmp-response
- refs/heads/feature/service-refactor
- refs/heads/feature/service-refactor-fresh
- refs/heads/feature/v1.11/beta-test
- refs/heads/feature/v1.11/k8s-ingress
- refs/heads/fix-iphealth
- refs/heads/fqdn-fixl3-wildcard
- refs/heads/fristonio/iptables-manager-fix
- refs/heads/ft/main/chancez/push-dev-charts
- refs/heads/ft/main/push_chart_stable_branches_fix
- refs/heads/ft/main/test_push_chart_updates
- refs/heads/gce-example
- refs/heads/gh-readonly-queue/main/pr-27509-78a5f177693fb443cd946441f45826bf7fa2437a
- refs/heads/ginkgo-better-timeout
- refs/heads/graduation
- refs/heads/hf/main/ipam-pools-build-230605
- refs/heads/hf/master/v1.12-rc2-health-dbg-v1
- refs/heads/hf/master/wg-fix-ipam-k8s-v2
- refs/heads/hf/v1.10/cls-prio2
- refs/heads/hf/v1.10/debug-taint-removal
- refs/heads/hf/v1.10/v1.10.10-with-19452
- refs/heads/hf/v1.10/v1.10.2-fix-ipsec-ep-routes
- refs/heads/hf/v1.10/v1.10.5-with-identity-leak-fix
- refs/heads/hf/v1.10/v1.10.7-additional-logs
- refs/heads/hf/v1.10/v1.10.7-exclude-local
- refs/heads/hf/v1.10/v1.10.7-exclude-loopback
- refs/heads/hf/v1.10/v1.10.7-extra-logs
- refs/heads/hf/v1.10/v1.10.7-more-logs
- refs/heads/hf/v1.10/v1.10.8-deadlock-and-complexity-fix
- refs/heads/hf/v1.10/v1.10.8-deadlock-fix
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v3
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v4
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v5
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v6
- refs/heads/hf/v1.10/xdp-multidev-with-bpf-multihoming-and-egress-gw-fixes-v7
- refs/heads/hf/v1.11/1.11.4-custom-taint
- refs/heads/hf/v1.11/19247-custom-taint-key
- refs/heads/hf/v1.11/dbg-svc-restore
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak-eni-attach-and-logging
- refs/heads/hf/v1.11/v1.11.16-fix-xfrm-leak-eni-attachment
- refs/heads/hf/v1.11/v1.11.3-with-19259
- refs/heads/hf/v1.11/v1.11.4-custom-taint
- refs/heads/hf/v1.11/v1.11.5-and-19247-eed5544
- refs/heads/hf/v1.11/xdp-multidev-v1
- refs/heads/hf/v1.11/xdp-multidev-v2-ipcache-fix
- refs/heads/hf/v1.12/next-net-v1
- refs/heads/hf/v1.12/v1.12.18-994
- refs/heads/hf/v1.12/v1.12.3-debug-k8s-heartbeat
- refs/heads/hf/v1.12/v1.12.3-debug-k8s-heartbeat-v2
- refs/heads/hf/v1.13/bpf-sock-l7-fix
- refs/heads/hf/v1.13/v1.13.12-without-deny-precedence
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence-debug
- refs/heads/hf/v1.13/v1.13.14-without-deny-precedence-with-xfrm-fix
- refs/heads/hf/v1.13/v1.13.2-with-24875
- refs/heads/hf/v1.13/v1.13.3-with-26242
- refs/heads/hf/v1.14/cidr-identity-refcnt-fix
- refs/heads/hf/v1.14/v1.14-with-27327
- refs/heads/hf/v1.7/v1.7.15-with-neighbor-fix
- refs/heads/hf/v1.7/v1.7.15-with-neighbor-fix-2
- refs/heads/hf/v1.8/v1.8.13-with-19452
- refs/heads/hf/v1.8/v1.8.6-eni-cidr-fix-1
- refs/heads/hf/v1.8/v1.8.6-eni-cidr-fix-15303
- refs/heads/hf/v1.8/v1.8.7-with-fqdn-underscore-fix
- refs/heads/hf/v1.8/v1.8.8-eni-cidr-fix-1
- refs/heads/hf/v1.8/v1.8.8-with-encrypt-fixes
- refs/heads/hf/v1.9/v1.9.8-azure-ipam-fix
- refs/heads/hf/v1.9/v1.9.9-azure-pod-egress-fix
- refs/heads/hpabla/bgpv2/deprecate-localport
- refs/heads/images/runtime/20210830
- refs/heads/ipc-demo
- refs/heads/ktls-tx-only
- refs/heads/ktls-tx-only-v2
- refs/heads/ktls-tx-rx
- refs/heads/ktls-tx-rx-v2
- refs/heads/ktls-tx-rx-v3
- refs/heads/ktls-tx-rx-v4
- refs/heads/ktls-tx-rx-v5
- refs/heads/ldelossa/feat/bgp-control-plane
- refs/heads/ldelossa/keep-mark-definitions-consistent
- refs/heads/ldelossa/segment-makefiles
- refs/heads/ldelossa/segment-makefiles-v2
- refs/heads/ldelossa/srv6-encap-fib
- refs/heads/lizrice/pr/cli-confusion
- refs/heads/main
- refs/heads/mio/wireguard-restore-allowed-ips
- refs/heads/multi-stack-dev-vm
- refs/heads/pr/1-9-ci-test
- refs/heads/pr/aanm-update-k8s-conformance
- refs/heads/pr/aanm/bisect
- refs/heads/pr/add-controller-identity
- refs/heads/pr/aditighag/lrp-skip-lb
- refs/heads/pr/asauber/link-local-as-host
- refs/heads/pr/asauber/max-ifindex-metric
- refs/heads/pr/avoid-ct-for-dsr
- refs/heads/pr/backend-state
- refs/heads/pr/bbb-cpy
- refs/heads/pr/bimmlerd/modularize-bandwidth-manager
- refs/heads/pr/bimmlerd/v1.12-backport-quay-org-from-env
- refs/heads/pr/bounded-loops
- refs/heads/pr/bpf-based-masquerading
- refs/heads/pr/bpf-edt-proxy
- refs/heads/pr/brb/arping-nexthop
- refs/heads/pr/brb/arping-via-gw
- refs/heads/pr/brb/auto-multi-dev-v2
- refs/heads/pr/brb/backport-1.8.5-nat-gc
- refs/heads/pr/brb/bpf-host-routing-wg
- refs/heads/pr/brb/bpf-lxc-no-redirect
- refs/heads/pr/brb/bpf-masq-veth
- refs/heads/pr/brb/bpf-multihoming
- refs/heads/pr/brb/cgroup-v2-test
- refs/heads/pr/brb/check-errors-in-logs
- refs/heads/pr/brb/check-wg
- refs/heads/pr/brb/ci
- refs/heads/pr/brb/ci-1111
- refs/heads/pr/brb/ci-2
- refs/heads/pr/brb/ci-4.19
- refs/heads/pr/brb/ci-arping-flake
- refs/heads/pr/brb/ci-bigtcp
- refs/heads/pr/brb/ci-bpf-netdev-without-egress
- refs/heads/pr/brb/ci-cleanup-svc
- refs/heads/pr/brb/ci-dbg-conformance-kind
- refs/heads/pr/brb/ci-dbg-external
- refs/heads/pr/brb/ci-dbg-flake-from-outside
- refs/heads/pr/brb/ci-demo
- refs/heads/pr/brb/ci-disable-ces-for-egress-gw
- refs/heads/pr/brb/ci-dp-disable-bpf-host-routing
- refs/heads/pr/brb/ci-dp-hubble-flows
- refs/heads/pr/brb/ci-dp-more-diversity
- refs/heads/pr/brb/ci-dp-v1.13
- refs/heads/pr/brb/ci-dp-v6
- refs/heads/pr/brb/ci-dp-verifier
- refs/heads/pr/brb/ci-e2e-enable-debug-ipsec
- refs/heads/pr/brb/ci-e2e-geneve-dsr
- refs/heads/pr/brb/ci-e2e-helm-mode-v1.13
- refs/heads/pr/brb/ci-e2e-lvh-retry
- refs/heads/pr/brb/ci-e2e-more-nodes
- refs/heads/pr/brb/ci-e2e-new-cli
- refs/heads/pr/brb/ci-e2e-nft
- refs/heads/pr/brb/ci-e2e-unsafe
- refs/heads/pr/brb/ci-e2e-unsafe-v2
- refs/heads/pr/brb/ci-e2e-upgrade-tests
- refs/heads/pr/brb/ci-e2e-upgrade-tests-ipsec
- refs/heads/pr/brb/ci-early-terminate-conn-disrupt
- refs/heads/pr/brb/ci-eks-ipsec-upgrade
- refs/heads/pr/brb/ci-encrypt-l7
- refs/heads/pr/brb/ci-fix-ip-masq-dry-run
- refs/heads/pr/brb/ci-ipsec-upgrade-fix
- refs/heads/pr/brb/ci-ipsec-upgrade-missed-tail-calls
- refs/heads/pr/brb/ci-ipsec-upgrade-v1.13
- refs/heads/pr/brb/ci-ipsec-upgrade-vol2
- refs/heads/pr/brb/ci-keep-missed-tail-calls
- refs/heads/pr/brb/ci-l7-nodeport
- refs/heads/pr/brb/ci-lvh-4.19
- refs/heads/pr/brb/ci-lvh-5.4
- refs/heads/pr/brb/ci-lvh-5.4-v2
- refs/heads/pr/brb/ci-lvh-bpf-next
- refs/heads/pr/brb/ci-no-self-hosted
- refs/heads/pr/brb/ci-pass-kernel-env
- refs/heads/pr/brb/ci-prepull-l4lb
- refs/heads/pr/brb/ci-refactor-svc-suite
- refs/heads/pr/brb/ci-rm-smoke-tests
- refs/heads/pr/brb/ci-sanity
- refs/heads/pr/brb/ci-test
- refs/heads/pr/brb/ci-test-2
- refs/heads/pr/brb/ci-test-k8s-vsn-swap
- refs/heads/pr/brb/ci-test-large-runners
- refs/heads/pr/brb/ci-uffff
- refs/heads/pr/brb/ci-upgrade-vol-2
- refs/heads/pr/brb/ci-upgrade-vol-3
- refs/heads/pr/brb/ci-wg-mtu
- refs/heads/pr/brb/ci-wg-mtu-vol2
- refs/heads/pr/brb/cilium-host-v6-from-ipam
- refs/heads/pr/brb/cli-bump-test
- refs/heads/pr/brb/datapath-loop-dbg
- refs/heads/pr/brb/dbg-ci
- refs/heads/pr/brb/dbg-conformance-gke
- refs/heads/pr/brb/dbg-master-np-vxlan-ipcache-ci
- refs/heads/pr/brb/debug-nodeport-bpf-flake
- refs/heads/pr/brb/do-not-derive-pod-cidrs-from-dev
- refs/heads/pr/brb/do-not-query-dev-for-arping
- refs/heads/pr/brb/docs-clarify-egress-gw-ip-addr-dp
- refs/heads/pr/brb/drop-notify
- refs/heads/pr/brb/dsr
- refs/heads/pr/brb/dsr-v2
- refs/heads/pr/brb/dualstack-ci
- refs/heads/pr/brb/enable-ipv6-per-endpoint-routes
- refs/heads/pr/brb/enable-route-mtu-cni
- refs/heads/pr/brb/fib-lookup-src
- refs/heads/pr/brb/fix-backend-id-u32
- refs/heads/pr/brb/fix-ci-dp-deprecation-warn
- refs/heads/pr/brb/fix-clang-vsn-regexp
- refs/heads/pr/brb/fix-egress-ip-16147
- refs/heads/pr/brb/fix-external-ip-dp
- refs/heads/pr/brb/fix-maglev-del
- refs/heads/pr/brb/fix-nodeport-hostnetns
- refs/heads/pr/brb/fix-stale-dsr
- refs/heads/pr/brb/fix-svc-backend-selection
- refs/heads/pr/brb/fix-third-host
- refs/heads/pr/brb/gh-action-cgr
- refs/heads/pr/brb/gh-action-lvh
- refs/heads/pr/brb/gh-install-cli-backup
- refs/heads/pr/brb/ginkgo-kpr-strict
- refs/heads/pr/brb/ginkgo-rm-update-tests
- refs/heads/pr/brb/go-crazy
- refs/heads/pr/brb/hubble-tcp-ack-seq-no
- refs/heads/pr/brb/improve-svc-restore
- refs/heads/pr/brb/istio-getsockopt
- refs/heads/pr/brb/it-cannot-be-truth
- refs/heads/pr/brb/kpr-svc-mesh
- refs/heads/pr/brb/kubeproxy-free-ci
- refs/heads/pr/brb/l7-np-bpf
- refs/heads/pr/brb/l7-rerevert
- refs/heads/pr/brb/lets-be-friends-with-ipsec
- refs/heads/pr/brb/lvh-kind-127
- refs/heads/pr/brb/lvh-kind-ipsec-upgrade
- refs/heads/pr/brb/meyskens/auth-ep-gc-locks
- refs/heads/pr/brb/multi-network
- refs/heads/pr/brb/no-cache-snat
- refs/heads/pr/brb/no-rev-nat-bpf-lxc-ingress
- refs/heads/pr/brb/node-id-per-fam
- refs/heads/pr/brb/nodeport-xlr-flag
- refs/heads/pr/brb/perf-wg
- refs/heads/pr/brb/pin-lvh
- refs/heads/pr/brb/push-ci-charts
- refs/heads/pr/brb/pwru
- refs/heads/pr/brb/rm-arping-l2-addr-check
- refs/heads/pr/brb/rm-no-redirect
- refs/heads/pr/brb/rm-np-deadcode
- refs/heads/pr/brb/rm-partial-host-svc
- refs/heads/pr/brb/rm-test-gke
- refs/heads/pr/brb/test-bpf-masq
- refs/heads/pr/brb/test-ci-e2e
- refs/heads/pr/brb/test-ci-e2e-v1.13
- refs/heads/pr/brb/test-kind
- refs/heads/pr/brb/third-host-more-pain
- refs/heads/pr/brb/timing-l4lb-gh-action
- refs/heads/pr/brb/triage-flake-v2
- refs/heads/pr/brb/triage-lb-flake
- refs/heads/pr/brb/unquarantine-svc
- refs/heads/pr/brb/v1.10-istio-snat
- refs/heads/pr/brb/v1.12-ci-e2e
- refs/heads/pr/brb/v1.12-ci-ipsec-upgrade
- refs/heads/pr/brb/v1.12-test-ipsec-upgrade
- refs/heads/pr/brb/v1.13-ci-e2e
- refs/heads/pr/brb/v1.13-remote-np
- refs/heads/pr/brb/v1.13-upgrade-fixes
- refs/heads/pr/brb/v1.14-ci-e2e-upgrade
- refs/heads/pr/brb/v1.14-drop-notify
- refs/heads/pr/brb/v1.15-enable-route-mtu-cni
- refs/heads/pr/brb/v1.6.9-iptables-W
- refs/heads/pr/brb/v1.8-fix-icmp-port-check
- refs/heads/pr/brb/wg-duplicate-node-ip
- refs/heads/pr/brb/wg-encrypt-node-test
- refs/heads/pr/brb/wg-hack
- refs/heads/pr/brb/wg-ipam-fix
- refs/heads/pr/brb/wg-kpr
- refs/heads/pr/brb/wg-test
- refs/heads/pr/brb/wip
- refs/heads/pr/brb/wip-ci
- refs/heads/pr/brb/wip-sync-policy-map
- refs/heads/pr/brb/xdp-egress-gw
- refs/heads/pr/brb/xdp-multidev-with-bpf-multihoming
- refs/heads/pr/brb/xdp-multidev-with-bpf-multihoming-v2
- refs/heads/pr/bruno/sleepy-pawn
- refs/heads/pr/bugtool-systemd
- refs/heads/pr/bwm-base2
- refs/heads/pr/bwm-fq
- refs/heads/pr/bwm-priority
- refs/heads/pr/chancez/add_hubble_l7_dashboard_prometheus_example
- refs/heads/pr/chancez/fix_websocket_l7_policies
- refs/heads/pr/chancez/flow_filter_namespace
- refs/heads/pr/chancez/hubble_plus_plus
- refs/heads/pr/chancez/hubble_tls_validation_troubleshooting
- refs/heads/pr/chancez/static_peers_hubble_relay
- refs/heads/pr/christarazi/controlplane-fqdn
- refs/heads/pr/christarazi/ipcache-async-cep-pods-namedports
- refs/heads/pr/christarazi/prep-from-cidr-tests
- refs/heads/pr/ci-k8s-1.30
- refs/heads/pr/datapath-opt
- refs/heads/pr/dbkm/nodeport-lb
- refs/heads/pr/debug-dns-timeout
- refs/heads/pr/eproutes-redir
- refs/heads/pr/example/neigh-state-manager
- refs/heads/pr/fastdp
- refs/heads/pr/fastdp2
- refs/heads/pr/feroz/allow-sbom-read
- refs/heads/pr/feroz/set-container-scan-failure-flag
- refs/heads/pr/feroz/test-cosign-attest
- refs/heads/pr/fib-consolidation
- refs/heads/pr/fix-aks-workflow
- refs/heads/pr/fix-data-race
- refs/heads/pr/fix-k8s-all-sha1
- refs/heads/pr/fix-pod-pacing
- refs/heads/pr/fix-tail-call-replace
- refs/heads/pr/fristonio/feat-19038
- refs/heads/pr/fristonio/fix-istio-k8sT
- refs/heads/pr/fristonio/ipv6-masquerading
- refs/heads/pr/fristonio/test-dual-stack
- refs/heads/pr/fristonio/test-ipv6-dualstack
- refs/heads/pr/gandro+brb/fix-monitor-aggregation-np-v2
- refs/heads/pr/gandro+brb/mv-trace-point-to-rev-nodeport
- refs/heads/pr/gandro+brb/wg-host-encryption-v3
- refs/heads/pr/gandro+brb/wg-host2host
- refs/heads/pr/gandro+brb/wg-host2host-kind
- refs/heads/pr/gandro/bump-hubble-2020-03-25
- refs/heads/pr/gandro/ci-conformance-multicluster-fix-log-gathering
- refs/heads/pr/gandro/ci-delete-crds-in-cleanupcomponents
- refs/heads/pr/gandro/ci-fix-status-if-workflows-are-skipped
- refs/heads/pr/gandro/ci-wait-for-all-relevant-images-do-not-merge-test
- refs/heads/pr/gandro/enable-hubble-by-default
- refs/heads/pr/gandro/portmap-refcount
- refs/heads/pr/gandro/re-enable-wireguard-in-multicluster-ci
- refs/heads/pr/gandro/svc-healthchecknodeport
- refs/heads/pr/gc-on-svc-update
- refs/heads/pr/getname-hooks
- refs/heads/pr/giorio94/1.14/test-cilium-cli-2184
- refs/heads/pr/giorio94/main/cluster-name-validation-strict
- refs/heads/pr/giorio94/main/gha-cluster-name
- refs/heads/pr/giorio94/main/gha-conformance-clustermesh-lb
- refs/heads/pr/giorio94/main/test-cilium-cli-2184
- refs/heads/pr/giorio94/main/tests-clustermesh-upgrade-interrupted
- refs/heads/pr/giorio94/v1.13/bump-gke-version
- refs/heads/pr/gray/30837-with-pwru
- refs/heads/pr/gray/ipsec-proxy-kpr-revdnat-test
- refs/heads/pr/gray/main/connectivity-wg-proxy-nodeport
- refs/heads/pr/gray/main/decouple-ipsec-gh-actions
- refs/heads/pr/gray/main/egress-proxy-ipsec-fix2
- refs/heads/pr/gray/main/fix-leak-detection-race
- refs/heads/pr/gray/main/xfrm-delete-flake
- refs/heads/pr/gray/main/xfrm-delete-flake2
- refs/heads/pr/gray/new-cli-test-pr-2759
- refs/heads/pr/gray/pwru-action
- refs/heads/pr/gray/v1.15/decouple-ipsec-gh-actions
- refs/heads/pr/health-data-path
- refs/heads/pr/hubble-tls-cert-gen-via-k8s-job
- refs/heads/pr/ianvernon/kvstore-client-type
- refs/heads/pr/ianvernon/kvstore-context
- refs/heads/pr/ianvernon/more-endpoint-cleanup
- refs/heads/pr/ianvernon/resolve-cidr-policy-perf-improvement
- refs/heads/pr/increase-verifier-test-build-timeout
- refs/heads/pr/ipip
- refs/heads/pr/ipip-encap
- refs/heads/pr/ipip-encap2
- refs/heads/pr/ipip2
- refs/heads/pr/ipip4
- refs/heads/pr/ipip6
- refs/heads/pr/jibi/differentiate-udp-tcp-svcs-take-4
- refs/heads/pr/jibi/fix-differentiate-udp-tcp-svc-upgrade
- refs/heads/pr/jibi/ip-list-contains-addr
- refs/heads/pr/jibi/wip
- refs/heads/pr/joamaki/gather-network-info
- refs/heads/pr/joamaki/idless-service-restapi
- refs/heads/pr/joe/ariane-scheduled-cilium-only
- refs/heads/pr/joe/backport-28007-1.11
- refs/heads/pr/joe/bump-ginkgo-seed
- refs/heads/pr/joe/docker-build-log-tracing
- refs/heads/pr/joe/docs-builder-latex
- refs/heads/pr/joe/docs-workflow-repo+test
- refs/heads/pr/joe/initialize-helm-flags
- refs/heads/pr/joe/ipcache-cidr-policy
- refs/heads/pr/joe/lost-identity
- refs/heads/pr/joe/release-codeowners
- refs/heads/pr/joe/sw-quay
- refs/heads/pr/joe/test-labeler
- refs/heads/pr/joe/test-lvh-fix
- refs/heads/pr/joe/v1.13-stability-check
- refs/heads/pr/joe/v1.7-dev-env
- refs/heads/pr/jrajahalme/gh-filter-test-files
- refs/heads/pr/jrfastab/backport-ooo-ipsec-fixes
- refs/heads/pr/jrfastab/backport-v115
- refs/heads/pr/jrfastab/dbgNodeId
- refs/heads/pr/jrfastab/dbgNodeId111
- refs/heads/pr/jrfastab/dbgNodeId111v2
- refs/heads/pr/jrfastab/dbgv114
- refs/heads/pr/jrfastab/eks-encrypt-ipamupdate
- refs/heads/pr/jrfastab/fix-encrypt-subnets
- refs/heads/pr/jrfastab/fix-ixsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/fixes-ipsec-init
- refs/heads/pr/jrfastab/v1.8-fix-ipsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/v1.9-fix-ipsec-vxlan-remoteIP
- refs/heads/pr/jrfastab/v111-debug-ooo
- refs/heads/pr/jrfastab/v111-debug-ooo-v2
- refs/heads/pr/jwi/main/bpf-dsr-geneve
- refs/heads/pr/jwi/main/ci-e2e-upgrade
- refs/heads/pr/jwi/main/ci-geneve-dsr
- refs/heads/pr/jwi/main/ipsec-rhel8
- refs/heads/pr/jwi/main/ipv6-ci
- refs/heads/pr/jwi/v1.14/foo
- refs/heads/pr/jwi/v1.15/bpf-complexity
- refs/heads/pr/jwi/v1.16/tophat
- refs/heads/pr/k8s-nat46x64
- refs/heads/pr/k8s-nat46x64-2
- refs/heads/pr/kaworu/helm-hubble-cli.yaml
- refs/heads/pr/kkourt/azure-ipam-test-race
- refs/heads/pr/kkourt/bpftool-update
- refs/heads/pr/kkourt/ct-rst-timeout-wip
- refs/heads/pr/kkourt/v1.11-backport-2022-01-26
- refs/heads/pr/kkourt/v1.9-lxc-complexity
- refs/heads/pr/l4lb-improvements-tmp
- refs/heads/pr/learnitall/ginkgo-race-workflow
- refs/heads/pr/learnitall/init-egw-scale-test
- refs/heads/pr/learnitall/test-startup-script-changes
- refs/heads/pr/lmb/1.14-cni
- refs/heads/pr/lmb/1.15-cni
- refs/heads/pr/lmb/update-cni-plugin
- refs/heads/pr/marga/v1.11-without-deny-precedence
- refs/heads/pr/marseel/improve_net_perf
- refs/heads/pr/marseel/scale_test_1_15
- refs/heads/pr/max/upgrade-llvm-18-1-6
- refs/heads/pr/mhofstetter/guestbook-registry
- refs/heads/pr/mhofstetter/junit-fetch-nullglob
- refs/heads/pr/mhofstetter/ssh-store-consolelog
- refs/heads/pr/mhofstetter/test-ingress
- refs/heads/pr/michi/circular-struggle
- refs/heads/pr/michi/crdregister
- refs/heads/pr/michi/debug
- refs/heads/pr/michi/description
- refs/heads/pr/michi/dns-refactor12
- refs/heads/pr/michi/faster
- refs/heads/pr/michi/l7drop
- refs/heads/pr/michi/majestic-ketchup
- refs/heads/pr/michi/mega-ketchup
- refs/heads/pr/michi/peerapi
- refs/heads/pr/michi/sleep-on-it
- refs/heads/pr/michi/test
- refs/heads/pr/michi/weekly-bot
- refs/heads/pr/monitor-wait-ci
- refs/heads/pr/move-image-to-one-repo
- refs/heads/pr/nat-gw-tests
- refs/heads/pr/nathanjsweet/add-complex-allow-test-to-policy-map-tests
- refs/heads/pr/nathanjsweet/add-lockdown-mode-for-policy-map-overflows
- refs/heads/pr/nathanjsweet/differentiate-protocol-in-services
- refs/heads/pr/nathanjsweet/node-port-addresses
- refs/heads/pr/nathanjsweet/refactor-has-same-owners
- refs/heads/pr/nathanjsweet/refactor-mapstate
- refs/heads/pr/nathanjsweet/update-k8s-control-plane-tests-to-1-27
- refs/heads/pr/nebril/add-dns-concurrency-limit
- refs/heads/pr/nebril/fix-precheck
- refs/heads/pr/nebril/fqdn-proxy-ha
- refs/heads/pr/nebril/fqdn-proxy-interface
- refs/heads/pr/nebril/gke-workflow-migrate-from-cli
- refs/heads/pr/nebril/quarantine-1.14-nodeport
- refs/heads/pr/nebril/test-bottlerocket
- refs/heads/pr/nebril/test-helm-gke-fix
- refs/heads/pr/nebril/test-our-ghaction-shenanigans
- refs/heads/pr/nebril/test-rebase-helm
- refs/heads/pr/nebril/trololo
- refs/heads/pr/nebril/update-cli-9.1-test
- refs/heads/pr/netkit
- refs/heads/pr/netkit3
- refs/heads/pr/netns-switch
- refs/heads/pr/netns-switch-no-peer
- refs/heads/pr/nodeport-fix
- refs/heads/pr/nodeport-improvements2
- refs/heads/pr/nodeport-nat-improvements
- refs/heads/pr/nodeport-nat-improvements2
- refs/heads/pr/nodeport-retry-sport
- refs/heads/pr/pchaigno/deprecate-bpf_network-f
- refs/heads/pr/pchaigno/fix-4.19-bpf-program-size
- refs/heads/pr/pchaigno/hotfix1-ipsec-fix
- refs/heads/pr/pchaigno/hotfix1-ipsec-fix-brb-v0
- refs/heads/pr/pchaigno/optim-complexity-ipcache-lookup
- refs/heads/pr/pchaigno/rework-config-probes
- refs/heads/pr/pchaigno/tmp-base-branch
- refs/heads/pr/pin-1.10-workflows-k8s-version
- refs/heads/pr/pin-1.11-workflows-k8s-version
- refs/heads/pr/pin-1.12-workflows-k8s-version
- refs/heads/pr/pin-1.13-workflows-k8s-version
- refs/heads/pr/pin-cloud-provider-master-workflows
- refs/heads/pr/pr/fix-ipam-node-manager-semaphore-error-handling
- refs/heads/pr/publish-test-images
- refs/heads/pr/qmonnet/docs-20230224
- refs/heads/pr/qmonnet/docs-bump
- refs/heads/pr/qmonnet/standalone-lb-docs
- refs/heads/pr/ray/late-dns-proxy
- refs/heads/pr/remove-1.13-references
- refs/heads/pr/rgo3/1.12-run-no-unexpected-drops-for-patch
- refs/heads/pr/rgo3/fix-k8s-vm-provisioning-1.13
- refs/heads/pr/rgo3/fix-missing-health-endpoint
- refs/heads/pr/rolinh/better-policy-verdict
- refs/heads/pr/rolinh/hubble-dump-all
- refs/heads/pr/rolinh/hubble-fix-maxflows-rounding
- refs/heads/pr/route-test
- refs/heads/pr/run-tests-in-parallel
- refs/heads/pr/scalability-crd-only
- refs/heads/pr/squeed/make-ccache
- refs/heads/pr/squeed/per-node-config
- refs/heads/pr/squeed/remote-cluster-leak
- refs/heads/pr/stacy/docs-update
- refs/heads/pr/tammach/accesslog-envoy
- refs/heads/pr/tammach/ci-cm
- refs/heads/pr/tammach/cleanup-helm-1.16
- refs/heads/pr/tammach/headless-service-flake
- refs/heads/pr/tammach/ingress-controller-e2e-config6
- refs/heads/pr/tammach/kind-host-dns-again
- refs/heads/pr/tammach/more-ingress-tests
- refs/heads/pr/tammach/rennovate-statedb
- refs/heads/pr/tammach/revert/fib-lookup
- refs/heads/pr/tammach/upgrade-test-ingress
- refs/heads/pr/tc-np-test
- refs/heads/pr/tcx
- refs/heads/pr/tcx-helm
- refs/heads/pr/tcx-misc
- refs/heads/pr/test-419-ci
- refs/heads/pr/test-increase-update-delete-timeout
- refs/heads/pr/test-k8s-all-tests
- refs/heads/pr/test-lb-super-netperf
- refs/heads/pr/test-nightly
- refs/heads/pr/test-upstream-timeout
- refs/heads/pr/tgraf/chaos-testing
- refs/heads/pr/tgraf/clustermesh-stale-state
- refs/heads/pr/tgraf/eni-ipam
- refs/heads/pr/tgraf/new-endpoint-state
- refs/heads/pr/tgraf/new-policy
- refs/heads/pr/tgraf/remove-tunnel-map
- refs/heads/pr/tgraf/scoped-ipam
- refs/heads/pr/tgraf/sctp
- refs/heads/pr/tgraf/split-lxc-prog
- refs/heads/pr/thorn3r/cesBlanketTest
- refs/heads/pr/thorn3r/clustermesh511
- refs/heads/pr/thorn3r/scaleTest5k
- refs/heads/pr/tklauser/build-push-images-env-var
- refs/heads/pr/tklauser/netipx-switch
- refs/heads/pr/tklauser/replace-k8s-strings-slices
- refs/heads/pr/tommyp1ckles/debugging-aks-conformance
- refs/heads/pr/tp/add-logging-for-integration-etcd
- refs/heads/pr/tp/add-logging-for-wait-for-pods-term-condition
- refs/heads/pr/tp/backport-31380
- refs/heads/pr/tp/bump-cilium-cli
- refs/heads/pr/tp/cleanup-ipam-ips-metric-docs
- refs/heads/pr/tp/complexity-issue-verifier-case-main
- refs/heads/pr/tp/dont-terminate-on-node-config-changee
- refs/heads/pr/tp/eps-modular-health
- refs/heads/pr/tp/fix-stuck-ginko-pod-v2
- refs/heads/pr/tp/forward-hubble-for-e2e
- refs/heads/pr/tp/forward-hubble-for-e2e-v2
- refs/heads/pr/tp/make-nat-purge-async
- refs/heads/pr/tp/preload-test-kind-images
- refs/heads/pr/tp/switch-1.24-eks-region
- refs/heads/pr/tp/switch-1.24-eks-region-v1.13
- refs/heads/pr/tp/use-helm-default-vars-for-clustermesh-downgrade-c1
- refs/heads/pr/tweak-github-action-ref
- refs/heads/pr/twpayne/hubble-recent-events-buffer
- refs/heads/pr/twpayne/hubble-ring-buffer-benchmarks
- refs/heads/pr/update-azure
- refs/heads/pr/update-readme-for-releases
- refs/heads/pr/update-tm-network
- refs/heads/pr/v1.10-backport-2022-06-13
- refs/heads/pr/v1.10-backport-2022-10-03
- refs/heads/pr/v1.10-eni-stability-improvements-v1
- refs/heads/pr/v1.10-neigh-clean
- refs/heads/pr/v1.11-backport-2022-10-03
- refs/heads/pr/v1.11-test/issue-692
- refs/heads/pr/v1.12-backport-2023-10-10
- refs/heads/pr/v1.12-test/issue-692
- refs/heads/pr/v1.13-backport-2023-10-31
- refs/heads/pr/v1.13-backport-2024-04-22-03-42
- refs/heads/pr/v1.13-test/issue-692
- refs/heads/pr/v1.14-backport-2024-06-18-02-46
- refs/heads/pr/v1.14.1
- refs/heads/pr/v1.7-stability-test
- refs/heads/pr/v1.7.9-hf-13205
- refs/heads/pr/v3-cpu
- refs/heads/pr/v6-host-addr2
- refs/heads/pr/vk/bpf/csum
- refs/heads/pr/vk/bpf/test/l4/csum
- refs/heads/pr/vk/bpf/tests/csum
- refs/heads/pr/vk/conn/test/hooks
- refs/heads/pr/vk/doc/ipsec
- refs/heads/pr/vk/eks/tests/concurrent/run
- refs/heads/pr/vk/ipsec/key/rotate
- refs/heads/pr/vk/ipsec/tests/concurrency
- refs/heads/pr/wip/bijective-nodemap
- refs/heads/regex_improved
- refs/heads/renovate/main-all-go-deps-main
- refs/heads/renovate/main-go
- refs/heads/renovate/main-golangci-lint
- refs/heads/renovate/main-patch-all-lvh-images-main
- refs/heads/renovate/v1.13-go
- refs/heads/renovate/v1.14-patch-stable-lvh-images
- refs/heads/renovate/v1.15-aanm-test
- refs/heads/renovate/v1.15-patch-stable-lvh-images
- refs/heads/renovate/v1.16-cilium-cli
- refs/heads/renovate/v1.16-go
- refs/heads/renovate/v1.16-patch-stable-lvh-images
- refs/heads/revert-29086-2023-11-09-backport-1.14
- refs/heads/revert-33302-policy-catch-invalid-port-wildcard
- refs/heads/rib
- refs/heads/run-ci-wihout-building-cilium
- refs/heads/service-over-srv6-main3
- refs/heads/sh-dep-test-l4lb
- refs/heads/sidecar-http-proxy
- refs/heads/sockmap-v5
- refs/heads/sockops-build-fix
- refs/heads/tam/integration-tests
- refs/heads/tam/more-ingress-tests
- refs/heads/tb/bpf-remove-bear
- refs/heads/test-branch
- refs/heads/test-ipsec
- refs/heads/test-sig-bgp-notifs
- refs/heads/test/brlbil/upload
- refs/heads/test/skip-workflows
- refs/heads/tgraf/process-policy
- refs/heads/thorn3r/cesScaleTest
- refs/heads/thorn3rCES
- refs/heads/tinker/learnitall/scale-test-1
- refs/heads/tinker/learnitall/scale-test-2
- refs/heads/tklauser+brb/wip/multi-homing
- refs/heads/unit-test-ipsec
- refs/heads/v0.10
- refs/heads/v0.11
- refs/heads/v0.12
- refs/heads/v0.13
- refs/heads/v0.8
- refs/heads/v0.9
- refs/heads/v1.0
- refs/heads/v1.0.0-rc2
- refs/heads/v1.0.0-rc3
- refs/heads/v1.1
- refs/heads/v1.10
- refs/heads/v1.11
- refs/heads/v1.12
- refs/heads/v1.12.11-base
- refs/heads/v1.13
- refs/heads/v1.14
- refs/heads/v1.15
- refs/heads/v1.16
- refs/heads/v1.2
- refs/heads/v1.3
- refs/heads/v1.3.1
- refs/heads/v1.3.1-release
- refs/heads/v1.3.7-release
- refs/heads/v1.4
- refs/heads/v1.4.5-release
- refs/heads/v1.5
- refs/heads/v1.5.2-rc1-with-clusterip-fix
- refs/heads/v1.5.4-release
- refs/heads/v1.6
- refs/heads/v1.7
- refs/heads/v1.7.9-1
- refs/heads/v1.7.9.1
- refs/heads/v1.8
- refs/heads/v1.9
- refs/heads/verify-external-workload-dns-setup-redux
- refs/heads/vladu/identity-type-metrics
- refs/heads/weavescope
- refs/heads/wip-debug-link-not-found
- refs/heads/wip-debug-link-not-found-v2
- refs/heads/wip-ktls-tx-rx
- refs/heads/wip-sockmap
- refs/heads/wip-sockmap-v2
- refs/heads/wip-sockmap-v3
- refs/heads/wip-sockmap-v4
- refs/heads/xfrm-subnet-test
- refs/heads/yutaro/bgp-cplane-etp-local/doc
- refs/heads/yutaro/oss/eni-overlapping-mark
- refs/remotes/bruno/hf/v1.10/v1.10.3-bpf-snat-and-masq-fixes
- refs/remotes/joe/submit/quarantine-etcd
- refs/remotes/origin/1.2-backports-18-09-12
- refs/remotes/origin/ipvlan3
- refs/remotes/origin/pr/add-reserved-health
- refs/remotes/origin/pr/brb/nodeport-lb
- refs/remotes/origin/pr/ianvernon/5859
- refs/remotes/origin/pr/ianvernon/dynamic-ep-cfg
- refs/remotes/origin/pr/tgraf/kube-dns-fixed-identity
- refs/semaphoreci/6384f501b324813e55cfbe818c04a40f2a923765
- refs/semaphoreci/7f69b285bac8a1be414e8769799962ae1408d9e1
- refs/semaphoreci/b5eb6622da121ad36b8f375a084392f7feeec64a
- refs/semaphoreci/d9e7e28f39d34a7050a9c1cad2a26d84f5f4eff1
- refs/semaphoreci/f55ec535d85f387ef981265967fabb3c1b5f1ec6
- refs/tags/0.10.1
- refs/tags/1.1.1
- refs/tags/1.9.0-rc0
- refs/tags/v0.11
- refs/tags/v0.12.0
- refs/tags/v0.13.1
- Branches list truncated to 702 entries, 10 were omitted.
- v0.13.2
- v0.13.19
- v0.13.18
- v0.13.17
- v0.13.16
- v0.13.15
- v0.13.14
- v0.13.13
- v0.13.12
- v0.13.11
- v0.13.10
- v0.10.0
- 1.9.9
- 1.9.8
- 1.9.7
- 1.9.6
- 1.9.5
- 1.9.4
- 1.9.3
- 1.9.2
- 1.9.18
- 1.9.17
- 1.9.16
- 1.9.15
- 1.9.14
- 1.9.13
- 1.9.12
- 1.9.11
- 1.9.10
- 1.9.1
- 1.9.0-rc3
- 1.9.0-rc2
- 1.9.0-rc1
- 1.9.0
- 1.8.9
- 1.8.8
- 1.8.7
- 1.8.6
- 1.8.5
- 1.8.4
- 1.8.3
- 1.8.2
- 1.8.13
- 1.8.12
- 1.8.11
- 1.8.10
- 1.8.1
- 1.8.0-rc4
- 1.8.0-rc3
- 1.8.0-rc2
- 1.8.0-rc1
- 1.8.0
- 1.7.9
- 1.7.8
- 1.7.7
- 1.7.6
- 1.7.5
- 1.7.4
- 1.7.3
- 1.7.2
- 1.7.16
- 1.7.15
- 1.7.14
- 1.7.13
- 1.7.12
- 1.7.11
- 1.7.10
- 1.7.1
- 1.7.0-rc4
- 1.7.0-rc3
- 1.7.0
- 1.6.9
- 1.6.8
- 1.6.7
- 1.6.6
- 1.6.5
- 1.6.4
- 1.6.3
- 1.6.2
- 1.6.12
- 1.6.11
- 1.6.10
- 1.6.1
- 1.6.0
- 1.5.9
- 1.5.8
- 1.5.7
- 1.5.6
- 1.5.5
- 1.5.4
- 1.5.3
- 1.5.2
- 1.5.13
- 1.5.12
- 1.5.11
- 1.5.10
- 1.5.1
- 1.5.0-rc6
- 1.5.0-rc5
- 1.5.0-rc4
- 1.5.0-rc3
- 1.5.0-rc2
- 1.5.0
- 1.4.9
- 1.4.8
- 1.4.7
- 1.4.6
- 1.4.5
- 1.4.4
- 1.4.3
- 1.4.2
- 1.4.10
- 1.4.1
- 1.4.0-rc9
- 1.4.0-rc8
- 1.4.0-rc7
- 1.4.0-rc6
- 1.4.0-rc5
- 1.4.0-rc2
- 1.4.0
- 1.3.8
- 1.3.7
- 1.3.6
- 1.3.5
- 1.3.4
- 1.3.3
- 1.3.2
- 1.3.1
- 1.3.0-rc5
- 1.3.0-rc4
- 1.3.0
- 1.2.8
- 1.2.7
- 1.2.6
- 1.2.5
- 1.2.4
- 1.2.3
- 1.2.2
- 1.2.1
- 1.2.0-rc3
- 1.2.0-rc2
- 1.2.0-rc1
- 1.2.0
- 1.16.1
- 1.16.0-rc.2
- 1.16.0-rc.1
- 1.16.0-rc.0
- 1.16.0-pre.3
- 1.16.0-pre.2
- 1.16.0-pre.1
- 1.16.0-pre.0
- 1.16.0
- 1.15.8
- 1.15.7
- 1.15.6
- 1.15.5
- 1.15.4
- 1.15.3
- 1.15.2
- 1.15.1
- 1.15.0-rc.1
- 1.15.0-rc.0
- 1.15.0-pre.3
- 1.15.0-pre.2
- 1.15.0-pre.1
- 1.15.0-pre.0
- 1.15.0
- 1.14.9
- 1.14.8
- 1.14.7
- 1.14.6
- 1.14.5
- 1.14.4
- 1.14.3
- 1.14.2
- 1.14.14
- 1.14.13
- 1.14.12
- 1.14.11
- 1.14.10
- 1.14.1
- 1.14.0-snapshot.4
- 1.14.0-snapshot.3
- 1.14.0-snapshot.2
- 1.14.0-snapshot.1
- 1.14.0-snapshot.0
- 1.14.0-rc.1
- 1.14.0-rc.0
- 1.14.0-pre.2
- 1.14.0
- 1.13.9
- 1.13.8
- 1.13.7
- 1.13.6
- 1.13.5
- 1.13.4
- 1.13.3
- 1.13.2
- 1.13.18
- 1.13.17
- 1.13.16
- 1.13.15
- 1.13.14
- 1.13.13
- 1.13.12
- 1.13.11
- 1.13.10
- 1.13.1
- 1.13.0-rc5
- 1.13.0-rc4
- 1.13.0-rc3
- 1.13.0-rc2
- 1.13.0-rc1
- 1.13.0-rc0
- 1.13.0
- 1.12.9
- 1.12.8
- 1.12.7
- 1.12.6
- 1.12.5
- 1.12.4
- 1.12.3
- 1.12.2
- 1.12.19
- 1.12.18
- 1.12.17
- 1.12.16
- 1.12.15
- 1.12.14
- 1.12.13
- 1.12.12
- 1.12.11
- 1.12.10
- 1.12.1
- 1.12.0-rc3
- 1.12.0-rc2
- 1.12.0-rc1
- 1.12.0-rc0
- 1.12.0
- 1.11.9
- 1.11.8
- 1.11.7
- 1.11.6
- 1.11.5
- 1.11.4
- 1.11.3
- 1.11.20
- 1.11.2
- 1.11.19
- 1.11.18
- 1.11.17
- 1.11.16
- 1.11.15
- 1.11.14
- 1.11.13
- 1.11.12
- 1.11.11
- 1.11.10
- 1.11.1
- 1.11.0-rc3
- 1.11.0-rc2
- 1.11.0-rc1
- 1.11.0-rc0
- 1.11.0
- 1.10.9
- 1.10.8
- 1.10.7
- 1.10.6
- 1.10.5
- 1.10.4
- 1.10.3
- 1.10.20
- 1.10.2
- 1.10.19
- 1.10.18
- 1.10.17
- 1.10.16
- 1.10.15
- 1.10.14
- 1.10.13
- 1.10.12
- 1.10.11
- 1.10.10
- 1.10.1
- 1.10.0-rc2
- 1.10.0-rc1
- 1.10.0-rc0
- 1.10.0
- 1.1.6
- 1.1.5
- 1.1.4
- 1.1.3
- 1.1.2
- 1.1.0
- 1.0.7
- 1.0.6
- 1.0.5
- 1.0.4
- Releases list truncated to 298 entries, 350 were omitted.
Take a new snapshot of a software origin
If the archived software origin currently browsed is not synchronized with its upstream version (for instance when new commits have been issued), you can explicitly request Software Heritage to take a new snapshot of it.
Use the form below to proceed. Once a request has been submitted and accepted, it will be processed as soon as possible. You can then check its processing state by visiting this dedicated page.![swh spinner](/static/img/swh-spinner.gif)
Processing "take a new snapshot" request ...
Permalinks
To reference or cite the objects present in the Software Heritage archive, permalinks based on SoftWare Hash IDentifiers (SWHIDs) must be used.
Select below a type of object currently browsed in order to display its associated SWHID and permalink.
Revision | Author | Date | Message | Commit Date |
---|---|---|---|---|
19ff6c6 | Cilium Release Bot | 10 July 2024, 20:43:30 UTC | Prepare for release v1.13.18 Signed-off-by: Cilium Release Bot <noreply@cilium.io> | 11 July 2024, 15:36:20 UTC |
f2d1c3c | Julian Wiedmann | 03 July 2024, 07:17:10 UTC | bpf: lxc: fix up reporting of drop reason in drop_for_direction() [ upstream commit 83fa353200d4576fd0fa8a706be70e0af3644f86 ] [ backporter's notes: minor conflict due to different function signature ] DROP_* reasons are negative values. Reported-by: Nikita V. Shirokov <tehnerd@tehnerd.com> Relates: https://github.com/cilium/cilium/issues/32473 Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io> | 10 July 2024, 09:35:03 UTC |
47620cc | Jason Aliyetti | 01 July 2024, 20:15:11 UTC | ipsec: do not nil out EncryptInterface when using IPAM ENI [ upstream commit 9343a62c9e3b0af18ce1fc50983e598a48f20897 ] [ backporter's note: conflicts in imported packages, the use of Cilium's own internal time package has been replaced with the Go's stdlib one ] netlink.LinkList() can return a transient kernel interrupt error. This commit adds a retry when this occurs in loader.reinitializeIPSec() to prevent nilling out or misconfiguring EncryptInterface. Additionally, it will now surface an error instead of swallowing it. Signed-off-by: Jason Aliyetti <jaliyetti@gmail.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io> | 10 July 2024, 09:35:03 UTC |
303e17c | Julian Wiedmann | 01 July 2024, 16:12:24 UTC | gh: ipsec: clarify check for leaked proxy traffic during key rotation [ upstream commit fb55ad6a1bfee262b3f15d9b4319017b05e456d7 ] Add a comment to explain why we need to disable the check for proxy traffic when running the bpftrace leak detection during key rotation. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io> | 10 July 2024, 09:35:03 UTC |
b529f2c | André Martins | 08 July 2024, 15:26:44 UTC | github: fix concurrency groups for push events Due to 32fea9e18f81, the concurrency groups aren't working properly for 'push' events. This commit fixes the concurrency group so that pushes to a branch don't stop runs from other branch pushes. Fixes: 32fea9e18f81 ("run CI automatically for renovate") Signed-off-by: André Martins <andre@cilium.io> | 09 July 2024, 08:42:56 UTC |
75acbcb | André Martins | 05 July 2024, 19:18:58 UTC | renovate: add auto-approve bot for renovate PRs [ upstream commit d65f9afb57fb176b9f073a3a6745c241c9525153 ] Enable the GitHub "auto-merge" feature in the repository settings at https://github.com/<org>/<repo>/settings. If Renovate detects this feature, it allows PRs to be auto-merged by GitHub. GitHub will auto-merge a PR if all required checks pass and CODEOWNERS have reviewed it. If these conditions are unmet, GitHub won't merge the PR. To allow Renovate to auto-approve its own PRs, configure Renovate to request a review from the bot `ciliumbot` for PRs with trusted dependencies. The `reviewers` configuration in Renovate will ensure `ciliumbot` is the sole reviewer of Renovate's PRs. Create a GitHub Action triggered by a review request event, ensuring the PR review was requested by the Renovate bot, the PR was created by Renovate, and the review request is for `ciliumbot`. Ensure `ciliumbot` belongs to some teams of the CODEOWNERS file but is not auto-assigned reviews by GitHub. This setup allows `ciliumbot` to provide the necessary approvals without manual intervention, enabling seamless integration of Renovate to auto-approve PRs. The teams that `ciliumbot` will belong to are the ones that usually are selected to review renovate PRs when a trusted dependency is updated. Signed-off-by: André Martins <andre@cilium.io> | 08 July 2024, 18:12:36 UTC |
b276d32 | gray | 05 July 2024, 09:15:39 UTC | doc: Instruct users to manually clean stale routing after downgrade Signed-off-by: gray <gray.liang@isovalent.com> | 08 July 2024, 17:07:26 UTC |
4b23863 | gray | 05 July 2024, 08:54:33 UTC | ci-ipsec-upgrade: Run manual cleanups only for minor downgrade Recent security fixes require some new ip routing rules like "fwmark 0xb00/0xf00 lookup 2005" in 1.13, which leave a downgrade problem when users want to rollback after an unsuccessful 1.12->1.13 upgrade. Because 1.12 is EOL, there is no way to do graceful downgrade automatically, we should run some commands to delete those stale routing rules in old 1.12 cilium. Those commands are also set in ci-ipsec-upgrade to ensure healthy CI status. As we explained above, this manual step is necessary only for 1.13->1.12 downgrade (minor downgrade). This patch therefore runs manual cleanups only for minor downgrade. Suggested-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: gray <gray.liang@isovalent.com> | 08 July 2024, 17:07:26 UTC |
f69c46c | Julian Wiedmann | 08 April 2024, 03:52:51 UTC | bpf: test: add LB test for terminating backend [ upstream commit 7ece278d42cca541b2e8e862e717f2536935af11 ] [ backporter's notes: open-code all the non-existent helpers ] Once a LB connection has been established, we expect to continue using its CT entry to obtain the backend. Even if the backend is in terminating state, and the service has lost all of its backends. Keeping this separate from the fix, in case we can't easily backport. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> | 08 July 2024, 09:21:42 UTC |
e28aea0 | Julian Wiedmann | 04 April 2024, 14:12:45 UTC | bpf: lb: un-break terminating backends for service without backend [ upstream commit 0de6f0f230be10e084f30fb3128c215edde1611f ] [ backporter's notes: add the ->count checks in slightly different locations, as we're missing a bunch of LB cleanup PRs. ] Continue to forward traffic for established connections, even when a service loses its last active backends. This needs a small adjustment in a BPF test that was relying on this behaviour. Fixes: 183501124869 ("bpf: drop SVC traffic if no backend is available") Signed-off-by: Julian Wiedmann <jwi@isovalent.com> | 08 July 2024, 09:21:42 UTC |
5f46a77 | Julian Wiedmann | 04 July 2024, 08:36:29 UTC | ci: ipsec-e2e: fine-tune L7 proxy check For v1.13 the CLI doesn't test IPv6 connectivity with L7 policies when per-EP routes are enabled [1]. Disable the warning for missing L7 traffic accordingly, instead of disabling it unconditionally. [1] https://github.com/cilium/cilium-cli/blob/5df839f3a77d5c7ce5efa1cff6066438ee0c3206/connectivity/check/test.go#L897-L905 Co-authored-by: Marco Iorio <marco.iorio@isovalent.com> Signed-off-by: Julian Wiedmann <jwi@isovalent.com> | 04 July 2024, 14:40:39 UTC |
0c4a7f5 | Cilium Imagebot | 03 July 2024, 13:15:14 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 04 July 2024, 09:06:06 UTC |
0e78347 | cilium-renovate[bot] | 03 July 2024, 13:10:37 UTC | chore(deps): update go to v1.21.12 Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 04 July 2024, 09:06:06 UTC |
e484dfa | Tam Mach | 03 July 2024, 09:39:33 UTC | envoy: Bump golang version to v1.22.5 Relates: https://github.com/cilium/proxy/pull/827 Signed-off-by: Tam Mach <tam.mach@cilium.io> | 03 July 2024, 15:58:37 UTC |
b8f0a80 | Tam Mach | 26 June 2024, 10:31:46 UTC | envoy: Avoid short circuit BE filtering [ upstream commit 2123732670cc43989fb895df0f7d81c44f96b5f7 ] The same service can be used with multiple port types (e.g number and name), so we should continue matching port values for both. Signed-off-by: Tam Mach <tam.mach@cilium.io> | 03 July 2024, 13:18:57 UTC |
578b99d | André Martins | 02 July 2024, 09:31:36 UTC | renovate: remove concurrency group from renovate's Base Image Release Build [ oss commit 1a33ff0d12653cabc27b95066bba64bf33121e44 ] The "Base Image Release Build - Renovate" workflow doesn't need a concurrency group has it will use the concurrency group of the workflow that it uses, the "./.github/workflows/build-images-base.yaml". Using the concurrency groups on both workflows will result in the following error: Canceling since a deadlock for concurrency group 'Base Image Release Build - Renovate-refs/heads/renovate/main-all-dependencies' was detected between 'top level workflow' and 'build-base-images-from-renovate' Fixes: f054f94b24b9 (".github: add workflow for renovate to build base images") Signed-off-by: André Martins <andre@cilium.io> | 03 July 2024, 12:24:04 UTC |
a4c1199 | André Martins | 07 August 2023, 19:07:52 UTC | renovate: add all dependencies of Makefile.values [ oss commit 99846fd67db870f4d6ff2ae0e9f73df43e2a4e7b ] Now we can let renovate update the dependencies of all images from Makefile.values. Signed-off-by: André Martins <andre@cilium.io> | 03 July 2024, 12:24:04 UTC |
ada10b2 | Julian Wiedmann | 16 January 2024, 13:50:18 UTC | conformance-ipsec-e2e: run leak check before/after key rotation [ upstream commit: 4e2a66d131243bad2daff58dd4e9deab87b776ec ] [ backporter's note: In 1.13 ci-ipsec-e2e disables IPv6, we need to suppress "no IPv6 connections" errors in check-ipsec-leaks.bt ] This is because we saw a racing issue if leak detection covers the whole rotation + conn-disrupt-check: cilium connectivity will remove conn-disrupt pods in the end of connectivity test, leaving some linger packets recognized as leaked traffic. This commit avoids the issue by running leak checks separately for key rotation and after-rotation test. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
31fca8b | gray | 06 June 2024, 06:58:18 UTC | ci: check-ipsec-leaks.bt can tolerate proxy traffic not found [ upstream commit: 230c200353f2c647d9b21774cf177706f919ad23 ] Add an argument to tell check-ipsec-leaks.bt whether to report errors if proxy traffic not found. Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
6de9984 | Marco Iorio | 11 October 2023, 09:49:45 UTC | conformance-ipsec-e2e: add leaked unencrypted packets check [ upstream commit: e3fe4bc5bb8073eb7d52f95b367ce6470d5e3ade ] Extend the conformance-ipsec-e2e GHA workflow to additionally check that we don't leak any unencrypted packets during the connectivity test. This aims to complement the validation already performed as part of the connectivity tests by the Cilium CLI. Specifically, we leverage bpftrace to analyze the packets forwarded by the bridge device (used by kind), and report those that are not encrypted. We flag packets with both the source and the destination belonging to the IPv4/6 PodCIDR, and we consider the inner headers if packets are encapsulated. In this case, we additionally skip packets originating or targeting CiliumInternalIP addresses (as these are used for node-to-pod traffic when running in tunnel mode, which is not encrypted by design). Extra checks are finally added to always include packets originating from the L7 and DNS proxies, as their source IP is not that of a pod. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
3b7c76e | gray | 11 June 2024, 09:41:50 UTC | ci: Delete deprecated conn-disrupt-test action [ upstream commit: ec1b79628d0e9af6ce689505e4b1415537363481 ] Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
9532f0a | gray | 12 June 2024, 05:40:11 UTC | ci: Use conn-disrupt-test-{setup,check} for ci-ipsec-upgrade [ upstream commit: 364ff9e ] Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
6389d1c | gray | 12 June 2024, 05:34:27 UTC | ci: Decouple ipsec-key-rotate action from conn-disrupt-test action [ upstream commit: c430572 ] [ backporter's note: 1.13 doesn't have ipsec-key-rotate action, we just get ride of conn-disrupt-test from ci-ipsec-e2e. ] So in future we can add encryption leak detection right after key rotation to avoid certain issues. ci-ipsec-e2e and ci-eks also has been adjusted to use conn-disrupt-test-* actions before and after ipsec-key-rotate action. Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
2f6ca2d | gray | 30 May 2024, 09:35:24 UTC | ci: Add conn-disrupt-test-{setup,check} actions [ upstream commit: 0f957a7a4644211202465de878dd2bd4c35463d3 ] They are to replace conn-disrupt-test action for better flexibility. Please note the new conn-disrupt-test-check doesn't run full tests by default. Signed-off-by: gray <gray.liang@isovalent.com> | 03 July 2024, 10:47:38 UTC |
f6e8827 | Jason Aliyetti | 30 June 2024, 06:00:23 UTC | Update ipsec to handle larger psk values [ oss commit 866829248fe718776c21f59be9013c24f0f7baea ] [ Backporter's notes: TestLoadKeys changed to use gopkg.in/check ] For psk values <= 32 bytes use SHA256 to compute the node key. Otherwise use SHA512. This is needed to support GCM-256-AES since a PSK for this would require a 36 bytes as per RFC 4106. Fixes: #33457 Fixes: c28e046d4c6 ("ipsec: Compute per-node-pair IPsec keys") Signed-off-by: Jason Aliyetti <jaliyetti@gmail.com> | 03 July 2024, 09:46:37 UTC |
0078828 | Sebastian Wicki | 27 June 2024, 09:08:28 UTC | daemon: Allow DNS transparent mode to be turned off with encryption [ oss commit 6cb07c19ddcef5f8e8d2c24c943a6dd963b540cf ] [ Backporter's notes: Dropped change in config_test.go since TestDaemonConfig_StoreInFile is missing in v1.13 ] DNS transparent mode was introduced to make sure that DNS traffic is always encrypted if the user is running with transparent encryption. If DNS proxy transparent mode is turned off, proxied DNS traffic will be leaked. However, DNS transparent mode is suffering from various bugs, e.g. - https://github.com/cilium/cilium/issues/31535 - https://github.com/cilium/cilium/issues/31197 - https://github.com/cilium/cilium/issues/33144 While we are working on addressing these bugs, some users might be fine with proxied DNS traffic being leaked. Therefore, this commit introduces a hidden and undocumented flag which requires DNS proxy transparent mode to be enabled with IPSec. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 03 July 2024, 09:46:37 UTC |
76d7675 | André Martins | 27 June 2024, 09:09:05 UTC | Documentation: accept ORG and REPO [ oss commit 1267ff92b0831aa24b1286afcf800b996eb537e6 ] By default, the check-crd-compat-table script will get the remote from cilium/cilium. This script won't work if there isn't a remote under these names. As a workaround, and to avoid many refactoring, the script will detect if ORG and / or REPO environment variables are set and use those as inputs to get the remote name. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com> | 03 July 2024, 09:46:37 UTC |
79072c3 | Marcel Zieba | 27 June 2024, 11:23:39 UTC | install/kubernetes: update nodeinit image to latest version [ oss commit ea393843824ef59c1767bb2605206af17e5bd595 ] [ Backporter's notes: trivial conflicts due to different pullPolicy, solved keeping "IfNotPresent". ] Renovate does not pick up new version as tag is in sha format rather than regular semver. Related: #32181 Signed-off-by: Marcel Zieba <marcel.zieba@isovalent.com> | 03 July 2024, 09:46:37 UTC |
8d641ba | Sebastian Wicki | 25 June 2024, 12:18:52 UTC | docs: Improve note on kube-apiserver entity limitations [ oss commit 3a669e931e894c7c7c54d894daaa17bcb243ffe1 ] Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 03 July 2024, 09:46:37 UTC |
6c75589 | cilium-renovate[bot] | 01 July 2024, 13:09:22 UTC | chore(deps): update all github action dependencies Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 02 July 2024, 09:16:21 UTC |
53de6bb | Lorenz Bauer | 19 June 2024, 11:39:11 UTC | pkg/endpoint: make state synchronization atomic (partial backport) [ upstream commit acf3141f35 ] [ backporter's notes: only needed a single line from this patch, the rest was not compatible ] BPF regeneration writes state into a new temporary directory. Once it has succeeded we need to swap the old and new directory. This is currently achieved by "backing up" the current state by renaming the directory. This code has a bunch of corner cases around cleaning up old directories and so on which are necessary since the synchronization isn't truly atomic. Instead, use the RENAME_EXCHANGE flag to atomically exchange the two existing directories. Also use hard links to retain existing state so that killing the agent during a synchronization doesn't lead to corruption. Signed-off-by: Lorenz Bauer <lmb@isovalent.com> Signed-off-by: Timo Beckers <timo@isovalent.com> | 02 July 2024, 08:41:43 UTC |
22f377f | Lorenz Bauer | 09 August 2023, 16:59:28 UTC | health: only launch /hello after host datapath is ready [ upstream commit 916a2ce2c2 ] Delay starting the /hello endpoint until we've loaded the host datapath at least once. This means that the presence of /health can be used to infer not only that the cilium unix socket API is up but also that the datapath can do basic packet processing. Signed-off-by: Lorenz Bauer <lmb@isovalent.com> | 02 July 2024, 08:41:43 UTC |
605fd8f | Lorenz Bauer | 13 May 2024, 17:45:39 UTC | pkg/endpoint: do not rely on bpf_host.o to detect host endpoint [ upstream commit 8c97a2119d ] The code to restore endpoint state checks for the presence of bpf_host.o to determine whether the host endpoint ID needs to be restored. Use ep.IsHost instead to decouple the restore process from what the loader is doing under the covers. Signed-off-by: Lorenz Bauer <lmb@isovalent.com> | 02 July 2024, 08:41:43 UTC |
9d39eeb | Tam Mach | 01 July 2024, 04:17:29 UTC | envoy: Update envoy 1.28.x to v1.28.5 This is mainly to pick up the below CVE fix from the upstream. Related CVE: https://github.com/envoyproxy/envoy/security/advisories/GHSA-fp35-g349-h66f Relates: https://github.com/cilium/proxy/pull/819 Relates: https://github.com/envoyproxy/envoy/releases/tag/v1.28.5 Signed-off-by: Tam Mach <tam.mach@cilium.io> | 01 July 2024, 12:10:57 UTC |
41d2bee | cilium-renovate[bot] | 25 June 2024, 15:06:33 UTC | chore(deps): update docker.io/library/alpine docker tag to v3.17.8 Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 01 July 2024, 07:27:19 UTC |
d86f23b | André Martins | 24 June 2024, 12:54:08 UTC | build-images-base: push to branch if pull request ref doesn't exist [ upstream commit 56494b13a40a768f8069ce85bec404351deaf3bd ] With the introduction of workflow_call by f054f94b24b9, pushing changes to the branch was not possible when the event was type "workflow_call" as the github.event.pull_request.head.ref does not exist. Fixes: f054f94b24b9 (".github: add workflow for renovate to build base images") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com> | 27 June 2024, 15:13:50 UTC |
3ff04ff | Ryan Drew | 20 June 2024, 22:43:40 UTC | cni: Revert "cni: Use correct route MTU for various cloud cidrs" [ upstream commit a31dcbd5d90d6c2507d09e78ae72d1de0b60427d ] The PR #32244, that was merged with commit 29a340e, was intended to fix IP fragmentation with WireGuard deployments, causing poor network throughput and increased network latency. Unfortunately, after this PR was merged, users began reporting issues with Cilium modifying the MTU of the default interface of the node. This commit reverts the blamed commit in an attempt to fix said issues. The surfaced side-effect is tracked in issue #33303. Fixes: #33258 Signed-off-by: Ryan Drew <ryan.drew@isovalent.com> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com> | 27 June 2024, 15:13:50 UTC |
d85268a | André Martins | 24 June 2024, 12:54:08 UTC | build-images-base: cancel github runs based on branch name [ upstream commit de873916584ce98164a869a6a2db714d9fbcaffb ] With the introduction of workflow_call by f054f94b24b9, the concurrency group started to cancel jobs based on the workflow name alone which has caused workflow runs created by this workflow were canceled even if they were opened from different branches. Fixes: f054f94b24b9 (".github: add workflow for renovate to build base images") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com> | 27 June 2024, 15:13:50 UTC |
434913b | Cilium Imagebot | 18 June 2024, 10:22:55 UTC | ci: update docs-builder [ upstream commit 97f4e25b9093ab19aadd2a60f4ee73c5d4e80f22 ] [ backporter's note: Took upstream change. ] Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 27 June 2024, 15:13:50 UTC |
e0cbb06 | dependabot[bot] | 17 June 2024, 22:18:52 UTC | build(deps): bump urllib3 from 2.0.7 to 2.2.2 in /Documentation [ upstream commit 0378d78af1e8c3c1498aa59b1f8181e4410bea8a ] [ backporter's note: Fix minor conflict and only apply urllib change. ] Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.0.7 to 2.2.2. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/2.0.7...2.2.2) --- updated-dependencies: - dependency-name: urllib3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> | 27 June 2024, 15:13:50 UTC |
fe51ac8 | André Martins | 17 June 2024, 20:47:10 UTC | build-images: fetch artifacts with specific pattern [ upstream commit 112a16db227093f490ba07f557261378da331145 ] It seems that docker/build-push-action started to store artifacts on GitHub. This sort of affected the digests of the image build process as it timeout while trying to download these artifacts. To fix this issue we will only download the artifacts with the pattern "*image-digest *" which are the only artifacts relevant for the image digests. Fixes: b86d5fc1aa64 ("chore(deps): update docker/build-push-action action to v6") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com> | 27 June 2024, 15:13:50 UTC |
1a97f3a | Marco Iorio | 06 June 2024, 16:31:24 UTC | cilium-dbg: improve troubleshoot clustermesh output for local cluster [ upstream commit c46e6be716d1c283b0fb908a2bfdd97413cfc00a ] [ backporter's note: Fix minor conflict. ] Users may additionally configure a clustermesh entry for the local cluster as well, to reuse the same configuration in all clusters, as Cilium then automatically ignores it. Let's improve the output of the cilium-dbg troubleshoot clustermesh (and kvstoremesh-dbg troubleshoot) commands in this situation, removing the usage of the term "remote", and displaying a note for the entry matching the local cluster name. The retrieval of the local cluster name is performed in a best effort fashion, and may not always work. Suggested-by: Bruno M. Custódio <bruno@isovalent.com> Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 27 June 2024, 15:13:50 UTC |
fd3f277 | Marco Iorio | 06 June 2024, 14:43:37 UTC | cilium-dbg: minor clarifications to the clustermesh status output [ upstream commit ab579235446ad2f77146f61a85dc2c8201554122 ] [ backporter's note: Fixed minor conflict. ] Add the term remote to clarify that the number of clusters reported by the cilium-dbg and kvstoremesh-dbg status commands do not include the local one, regardless of whether it is included in the clustermesh configuration or not. Similarly, let's replace the term failures with reconnections, as failures has a negative connotation, but they are actually expected to happen when the clustermesh-apiserver in the given remote cluster is restarted. Suggested-by: Bruno M. Custódio <bruno@isovalent.com> Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 27 June 2024, 15:13:50 UTC |
c58abec | Feroz Salam | 12 July 2023, 08:52:01 UTC | ci: use env variable to store branch name [ upstream commit 22e066d7b1825d338cf78bda7a4a5fe8c69e9235 ] Instead of using the branch name directly in the run command. Signed-off-by: Feroz Salam <feroz.salam@isovalent.com> Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com> | 27 June 2024, 15:13:50 UTC |
b91a5e2 | Cilium Imagebot | 17 June 2024, 02:49:04 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> Signed-off-by: André Martins <andre@cilium.io> | 25 June 2024, 14:27:00 UTC |
51cb485 | cilium-renovate[bot] | 24 June 2024, 17:06:08 UTC | chore(deps): update docker.io/library/golang:1.21.11 docker digest to b405b62 Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 25 June 2024, 14:27:00 UTC |
d15bd48 | cilium-renovate[bot] | 24 June 2024, 19:06:28 UTC | chore(deps): update all github action dependencies Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 25 June 2024, 00:01:56 UTC |
2227fa7 | cilium-renovate[bot] | 24 June 2024, 09:46:48 UTC | chore(deps): update stable lvh-images Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 24 June 2024, 14:22:44 UTC |
6a89627 | André Martins | 21 June 2024, 12:26:11 UTC | .github: add workflow for renovate to build base images [ upstream commit f054f94b24b9c242611b956ba3f3698e8394c884 ] As renovate can automate a lot of our dependency updates it will also be possible for it to trigger the workflow to build base images. For this to happen we need to create a new workflow that reuses the existing workflow by using a different environment. This environment is protected to only be executed on the branches that are created by renovate. Signed-off-by: André Martins <andre@cilium.io> | 24 June 2024, 10:50:01 UTC |
9497114 | André Martins | 21 June 2024, 13:02:49 UTC | .github: fix cloud workflows for renovate Ensure consistency by sanitizing the 'OWNER' field in these workflows. This matches the approach used in other workflows. Fixes: 6f461ea592ca ("run CI automatically for renovate") Signed-off-by: André Martins <andre@cilium.io> | 21 June 2024, 15:39:37 UTC |
fe824e0 | André Martins | 21 June 2024, 07:16:12 UTC | .github: fix worfklows used by renovate With the introduction of 6f461ea592ca, some of the workflows were not prepared to handle concurrency for "push" events so we had to add the group for these type of events. Also, some of the workflows were not running the "commit-status-final" as this step was only running for events that were not type "push". As the list of required workflows are based on the name created by this step, we also need to run this step for the "push" events. Some existing workflows already push "commit-status-final" for pushes as well so the introduction for these workflows will be consistent with existing ones. Finally, the push events should only be triggered for pushes done respective to the "main" branch, thus we will be using the prefix "renovate/main-**" instead of "renovate/**" to avoid triggering the GH main workflows from stable branches and vice-versa. Fixes: 6f461ea592ca ("run CI automatically for renovate") Signed-off-by: André Martins <andre@cilium.io> | 21 June 2024, 15:39:37 UTC |
32fea9e | André Martins | 20 June 2024, 11:28:06 UTC | run CI automatically for renovate Renovate is a trusted contributor of Cilium. We can skip the need to run the CI manually by the triager if the CI is automatically ran after a push to renovate's branches. [ upstream commit 6f461ea592ca00115c82b91520d8951b2529d1eb ] Signed-off-by: André Martins <andre@cilium.io> | 21 June 2024, 15:39:37 UTC |
430cbc4 | Cilium Imagebot | 17 June 2024, 11:18:08 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 19 June 2024, 08:17:31 UTC |
01972d5 | cilium-renovate[bot] | 17 June 2024, 08:13:18 UTC | chore(deps): update docker.io/library/golang:1.21.11 docker digest to 2eb85b8 Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 19 June 2024, 08:17:31 UTC |
b71c080 | cilium-renovate[bot] | 17 June 2024, 15:07:09 UTC | chore(deps): update all github action dependencies Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 17 June 2024, 19:04:28 UTC |
ca3823e | cilium-renovate[bot] | 17 June 2024, 09:11:46 UTC | chore(deps): update all github action dependencies Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 17 June 2024, 13:40:08 UTC |
8bb85e2 | cilium-renovate[bot] | 17 June 2024, 09:11:39 UTC | chore(deps): update stable lvh-images Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 17 June 2024, 13:39:30 UTC |
4b726ca | André Martins | 13 June 2024, 12:26:21 UTC | remove tracking of backports with MLH With the sunset of GH projects by GH [1], we will now create organization-projects to track which PR is available on which release after a CHANGELOG of a release is performed. Thus, we can also sunset this feature from MLH. [1] https://github.blog/changelog/2024-05-23-sunset-notice-projects-classic/ Signed-off-by: André Martins <andre@cilium.io> | 15 June 2024, 09:56:49 UTC |
3afc2f8 | Julian Wiedmann | 11 June 2024, 14:28:11 UTC | docs: ipsec: mention dependency on transparent mode for DNS proxy [ upstream commit 26325a8b9c94c731c54111e87b903c2c2f6a189f ] For connections that are established by the DNS proxy, this is required to detect the original source IP and apply IPsec policy accordingly. The agent fatals if IPsec and L7 proxy are enabled, but the DNS proxy is not set to transparent mode. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 13 June 2024, 09:40:28 UTC |
6926b19 | Tam Mach | 12 June 2024, 14:41:21 UTC | gha: Only retrieve IPv4 CIDR from docker network [ upstream commit b49f9128cb8916b56b5b218dabc11820df79d2b3 ] [ backporter's notes: hit conflicts due to the usage of MetalLB rather than Cilium LB. Preserved the main hunk, and adapted the debug output. ] It seems like github runner is enabled with docker dual stack, so the current docker network inspect command might return IPv6 instead of IPv6 CIDR, which breaks LB IPPool configuration. Sample output of `docker network inspect kind` command can be found as per below. This commit is to make sure that we only retrieve IPv4 CIDR in docker network inspect command. Additionally, some echo/cat statement are added to make similar issue more visible in the future. ``` [ { "Name": "kind", "Id": "43e3b3267092150f5f2e6f2053157d912ad6b5a4ce20f700e1e9be547a437f75", "Created": "2024-06-12T14:18:17.733107881Z", "Scope": "local", "Driver": "bridge", "EnableIPv6": true, "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "fc00:f853:ccd:e793::/64" }, { "Subnet": "172.18.0.0/16", "Gateway": "172.18.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": { "748d7161857ca5e610f196299828eacafcbdb069d38c00e4e6c14cdeefada9c5": { "Name": "chart-testing-control-plane", "EndpointID": "0f1a5bbeb14929200ed13cb289afd6bf5f9f455d4ed75bb3a26e167e67bf7784", "MacAddress": "02:42:ac:12:00:02", "IPv4Address": "172.18.0.2/16", "IPv6Address": "fc00:f853:ccd:e793::2/64" }, "c2030425e24a11ea208b87c5d70e194b0f51eee133f09b67404fd2bf97410f13": { "Name": "chart-testing-worker", "EndpointID": "81489bd101e483be7270e2b5dd7e0bf3a0163b89650d7ef69cc4ce43454479e3", "MacAddress": "02:42:ac:12:00:03", "IPv4Address": "172.18.0.3/16", "IPv6Address": "fc00:f853:ccd:e793::3/64" } }, "Options": { "com.docker.network.bridge.enable_ip_masquerade": "true", "com.docker.network.driver.mtu": "1500" }, "Labels": {} } ] ``` Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 13 June 2024, 09:40:01 UTC |
04f12e1 | cilium-renovate[bot] | 10 June 2024, 16:05:37 UTC | chore(deps): update docker/build-push-action action to v5.4.0 Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 12 June 2024, 08:16:04 UTC |
b98da7f | Julian Wiedmann | 05 June 2024, 10:01:21 UTC | docs: ipsec: remove limitation for native-routing with L7 egress policy [ upstream commit: 5f18d88b973c20490e923c5312caf3afc516e5f2 ] This was addressed by https://github.com/cilium/cilium/pull/32683. Signed-off-by: Julian Wiedmann <jwi@isovalent.com> Signed-off-by: gray <gray.liang@isovalent.com> | 11 June 2024, 13:43:58 UTC |
21a4316 | gray | 06 June 2024, 11:43:32 UTC | proxy/routes: Also routes egress proxy's return traffic to 2005 [ upstream commit: 1ce4c7f31844c0577fdd9bff324ba6bead422b91 ] [ backporter's note: v1.14 still uses bpf/init.sh to install routing rules, we have to re-implement the logic in bash. ] This commit installs "0xb00/0xf00 lookup 2005" routing rule when IPsec is enabled with native routing and envoy. This is a necessary step towards fixing encryption leaks, otherwise egress proxy's return traffic gets no chance to be set IPsec mark. The new routing rule ensures these packets are routed to cilium_host, where we have bpf_host to handle encryption datapath. This patch uses a different condition from requireFromProxyRoutes() to determine whether to install the new routing rule, otherwise we will see breakage on IPsec=off + envoy=on. Specially, the new routing rule is isolated to IPsec only. Signed-off-by: gray <gray.liang@isovalent.com> | 11 June 2024, 13:43:58 UTC |
6741ada | gray | 13 May 2024, 09:51:31 UTC | iptables: Ensure iptables masquerading works for proxy traffic [ upstream commit: 3384d73c12ea8bc9e24fc4c30193f95775b23005 ] After https://github.com/cilium/proxy/pull/742, proxy traffic keeps original pod IP as source IP for to-world packets, which must be masqueraded to eth0 IP. There is no issue for now, but the new routing rule (0xb00 lookup 2005) to be added for https://github.com/cilium/cilium/issues/31984 will cause a side effect breaking masquerading. This patch fixes the that side effect as a precaution, otherwise git-bisect breaks. The new routing rule (0xb00 lookup 2005) will cause proxy packets going through POSTROUTING for twice: first time happens when proxy sends packets which are routed to cilium_host, these are hitting OUTPUT + **POSTROUTING**; the second time takes place after packets ingressed from cilium_net, these skbs will traverse PREROUTING + FORWARD + **POSTROUTING**. However, due to kernel's implementation details, an skb won't be processed by nat POSTROUTING for twice: after the first POSTROUTING check, skb's ct `(struct nf_conn*)(skb->_nfct & ~7)` has a status IPS_SRC_NAT_DONE to skip the further traversal at all. [1] To avoid being set the IPS_SRC_NAT_DONE flag, this patch adds an iptables rule `--mark 0xb00 -j CT --notrack` at OUTPUT to skip the first round iptables ct, just for proxy traffic which is characterized by 0xb00 mark. [1] https://elixir.bootlin.com/linux/v6.6.2/source/net/netfilter/nf_nat_core.c#L825 [1] https://elixir.bootlin.com/linux/v6.6.2/source/include/net/netfilter/nf_nat.h#L111 Signed-off-by: gray <gray.liang@isovalent.com> | 11 June 2024, 13:43:58 UTC |
7449728 | gray | 28 May 2024, 07:57:23 UTC | Don't set 0x200 mark for proxy to world traffic in iptables PREROUTING [ upstream commit: f93a40c7283b2b60acbcbad3819dd0ea18204190 ] We have an iptables rule to set 0x200 mark for transparent socket: ``` *mangle -A PREROUTING -m comment --comment "cilium-feeder: CILIUM_PRE_mangle" -j CILIUM_PRE_mangle -A CILIUM_PRE_mangle -m socket --transparent -m mark ! --mark 0xe00/0xf00 -m comment --comment "cilium: any->pod redirect proxied traffic to host proxy" -j MARK --set-xmark 0x200/0xffffffff ``` This rule is in the mangle PREROUTING which checks packets ingressed from a netdev. Let's then focus on the pod to world traffic when IPsec=on + proxy=on + tunnel=off. Currently, a pod-to-world packet will go through the path: 1. from_lxc@lxc: skb->mark is set to 0x200 and returned to stack 2. iptables: skb is hijacked by tproxy (due to 0x200), to be accepted by proxy 3. proxy process: the old skb is consumed by proxy, an new skb is sent to upstream (world) 4. stack routing: the new skb is routed to eth0 5. stack iptables: the new skb is traversing OUTPUT chain and POSTROUTING chain 6. to_netdev@eth0: the new skb is going to world Please note the new skb won't hit PREROUTING chain, where there is a rule setting skb->mark=0x200. To fix https://github.com/cilium/cilium/issues/31984, we are going to change the routing for packets from egress proxy; consequently, on the step 4 above, the new skb will be routed to cilium_host instead: 4. stack routing: the new skb is routed to cilium_host 5. from_host@cilium_host: the new skb is returned to stack 6. to_host@cilium_net: the new skb is returned to stack 7. stack: PREROUTING, routing, FORWARD, POSTROUTING Look at step 7, we are hitting PREROUTING! Because of https://github.com/cilium/proxy/pull/742, this to-world skb is also linked to a transparent socket, matching the "-m socket --transparent" condition, the packet will fortunately have the 0x200 mark. If we do nothing, this to-world skb marked with 0x200 will then hit routiong rule "from all fwmark 0x200/0xf00 lookup 2004" and be routed to local. It should have gone to the world. This patch fixes this future issue as a precaution (otherwise we'll break git-bisect). This patch provides a straightforward solution: at step 5 from_host@cilium_host, we set a specical mark 0x800 (MARK_MAGIC_PROXY_TO_WORLD), then iptables can exclude this mark using "-m mark ! --mark 0x800/0xf00". Signed-off-by: gray <gray.liang@isovalent.com> | 11 June 2024, 13:43:58 UTC |
0e4c523 | gray | 07 June 2024, 09:08:38 UTC | ci: Manually clean stale routing rules for downgrade It's basically https://github.com/cilium/cilium/pull/31930 what we can't merge due to 1.12 EOL. Signed-off-by: gray <gray.liang@isovalent.com> | 11 June 2024, 13:43:58 UTC |
ae30ccb | cilium-renovate[bot] | 10 June 2024, 12:06:28 UTC | chore(deps): update stable lvh-images Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 10 June 2024, 16:06:25 UTC |
7cbb86e | Quentin Monnet | 10 June 2024, 14:58:21 UTC | install: Update image digests for v1.13.17 Generated from https://github.com/cilium/cilium/actions/runs/9449889419. Docker Manifests ================ cilium - docker.io/cilium/cilium:v1.13.17@sha256:db7553ec384eeeb786aa3f7472bb8ecfc1b50d37a64a8309e94e4a82fda4882e - quay.io/cilium/cilium:v1.13.17@sha256:db7553ec384eeeb786aa3f7472bb8ecfc1b50d37a64a8309e94e4a82fda4882e clustermesh-apiserver - docker.io/cilium/clustermesh-apiserver:v1.13.17@sha256:bce520cc4e234a63cf3eb58b51f18fb24c3a7c38365241ba59b395fa4bb07b38 - quay.io/cilium/clustermesh-apiserver:v1.13.17@sha256:bce520cc4e234a63cf3eb58b51f18fb24c3a7c38365241ba59b395fa4bb07b38 docker-plugin - docker.io/cilium/docker-plugin:v1.13.17@sha256:ea64f2abca1271cf03904da37c123c3013926eb8610226c548a251f61343561e - quay.io/cilium/docker-plugin:v1.13.17@sha256:ea64f2abca1271cf03904da37c123c3013926eb8610226c548a251f61343561e hubble-relay - docker.io/cilium/hubble-relay:v1.13.17@sha256:9398e764708197aee93f5ee3d6a42b087b9c777ef13c81b175be7235be1fb478 - quay.io/cilium/hubble-relay:v1.13.17@sha256:9398e764708197aee93f5ee3d6a42b087b9c777ef13c81b175be7235be1fb478 operator-alibabacloud - docker.io/cilium/operator-alibabacloud:v1.13.17@sha256:5d8d5253339f1fba9404730a8f44aa6ea10439b97098e84325051c6877bfc9f7 - quay.io/cilium/operator-alibabacloud:v1.13.17@sha256:5d8d5253339f1fba9404730a8f44aa6ea10439b97098e84325051c6877bfc9f7 operator-aws - docker.io/cilium/operator-aws:v1.13.17@sha256:a99201ecf60265f4a38cb78805023af12c19c9a309b86a73ffcd815a26962279 - quay.io/cilium/operator-aws:v1.13.17@sha256:a99201ecf60265f4a38cb78805023af12c19c9a309b86a73ffcd815a26962279 operator-azure - docker.io/cilium/operator-azure:v1.13.17@sha256:b2f504420114da2f6f8138e9c7e4a8700684f15b9cce4304a8616649ed91aa4c - quay.io/cilium/operator-azure:v1.13.17@sha256:b2f504420114da2f6f8138e9c7e4a8700684f15b9cce4304a8616649ed91aa4c operator-generic - docker.io/cilium/operator-generic:v1.13.17@sha256:caa8e0da2b3946463ed9206ff97a88115522999a8b276e09841f4bbd7974da3a - quay.io/cilium/operator-generic:v1.13.17@sha256:caa8e0da2b3946463ed9206ff97a88115522999a8b276e09841f4bbd7974da3a operator - docker.io/cilium/operator:v1.13.17@sha256:febf6ffa2e44717165e985b6ef65d89f4d3caff6288750084c0a12013d2fdd81 - quay.io/cilium/operator:v1.13.17@sha256:febf6ffa2e44717165e985b6ef65d89f4d3caff6288750084c0a12013d2fdd81 Signed-off-by: Quentin Monnet <qmo@qmon.net> | 10 June 2024, 15:53:02 UTC |
7e88b2e | Michi Mutsuzaki | 08 June 2024, 22:47:53 UTC | Prepare for release v1.13.17 Signed-off-by: Michi Mutsuzaki <michi@isovalent.com> Signed-off-by: Quentin Monnet <qmo@qmon.net> | 10 June 2024, 10:37:56 UTC |
21475ae | Quentin Monnet | 10 June 2024, 10:04:29 UTC | check-crd-compat-table.sh: Fix script following main branch renaming The main branch in Cilium's repository has been renamed from master to main a while ago. Script check-crd-compat-table.sh in branch v1.13 was not updated at the same time, and this led to failures to update the relevant value in the compatibility table for the latest branch. Let's fix the script now. Signed-off-by: Quentin Monnet <qmo@qmon.net> | 10 June 2024, 10:37:56 UTC |
bf9a1ae | Tam Mach | 05 June 2024, 04:11:54 UTC | bugtool: Add post-processing masking function for Envoy [upstream commit 48a9976a09015a0e411997780c8b260d59593071] This commit is to explicitly mask the below fields from Envoy config dump: - api_key (used in kafka L7 policy) - TLSContext (used in Cilium NetworkPolicy) One round of scanning on existing Cilium protobuf was done. Related docs: https://www.envoyproxy.io/docs/envoy/latest/operations/admin#get--config_dump Signed-off-by: Tam Mach <tam.mach@cilium.io> | 08 June 2024, 03:49:49 UTC |
958d7b7 | Tam Mach | 05 June 2024, 05:01:04 UTC | bugtool: Add json masking function [upstream commit 568dbc5ad884e37614992f59ceb89ad89feb9135] This commit is to add a generic json field masking based on the field name. [ Quentin: Replaced the use of slices.Contains(), unsupported with the Go version used with v1.13. ] Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Quentin Monnet <qmo@qmon.net> | 08 June 2024, 03:49:49 UTC |
dc19b3d | Joe Stringer | 07 June 2024, 04:35:06 UTC | ci: l4lb: Don't hang on gathering logs forever [ upstream commit 84013315bdc3167dfb2f33d074403170c8bacebe ] It doesn't make sense to pass `--follow` when the container is still running, this will hang forever and fail to complete the remaining steps in the workflow. Remove the follow flag. Fixes: 93927457779d ("ci: l4lb: gather more infos about docker-in-docker issues") Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: viktor-kurchenko <viktor.kurchenko@isovalent.com> | 07 June 2024, 22:36:07 UTC |
a443aee | André Martins | 06 June 2024, 12:12:31 UTC | remove release scripts [ upstream commit df03e886bcddc4f3f94d31ad443d922b0f9fd2f5 ] [ backporter notes: trivial deletion conflict.] These scripts will only be available under github.com/cilium/release to avoid any confusion when performing releases. Signed-off-by: André Martins <andre@cilium.io> | 07 June 2024, 22:36:07 UTC |
d8dc81f | André Martins | 06 June 2024, 12:03:42 UTC | remove unused files [ upstream commit 129a20004a8ac32b055d97cef5e9c4cc64399cad ] [ backporter notes: trivial deletion conflict. ] Signed-off-by: André Martins <andre@cilium.io> | 07 June 2024, 22:36:07 UTC |
4456760 | cilium-renovate[bot] | 07 June 2024, 06:05:16 UTC | chore(deps): update dependency cilium/hubble to v0.13.5 Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> | 07 June 2024, 09:12:21 UTC |
2ddb190 | Cilium Imagebot | 06 June 2024, 02:34:56 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 06 June 2024, 17:05:02 UTC |
04c5d13 | renovate[bot] | 06 June 2024, 02:28:53 UTC | chore(deps): update docker.io/library/ubuntu:22.04 docker digest to 19478ce Signed-off-by: renovate[bot] <bot@renovateapp.com> | 06 June 2024, 17:05:02 UTC |
bf494e3 | renovate[bot] | 05 June 2024, 21:32:27 UTC | chore(deps): update google/cloud-sdk docker tag to v479 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 06 June 2024, 11:54:25 UTC |
14a7eec | Cilium Imagebot | 05 June 2024, 01:42:45 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 06 June 2024, 02:18:19 UTC |
d5a0f9b | renovate[bot] | 05 June 2024, 00:23:00 UTC | chore(deps): update go to v1.21.11 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 06 June 2024, 02:18:19 UTC |
b39584f | Marcel Zieba | 16 May 2024, 14:46:02 UTC | ipsec: cache xfrm state list [ upstream commit 3a4c57f12b61d336de26c24ac2b9b15dc4fc0368 ] [ Backporter's notes: switch default to false - so not enabled by default. Switch from testing package to checkmate in unit tests. Flags use Vp instead of vp. Minor conflicts with netlink.XfrmState* calls. Switched from pkg/time to time. Switch from checkmate to check.v1 ] Reduces GC CPU usage and memory allocations coming from XfrmStateList. To ensure we have up-to-date cache, wrap all XfrmState related functions inside cache, which is invalidated whenever XfrmState changes. This is follow-up to #32577 While that PR averages out CPU usage over time, in large cluster 100+ nodes amount of allocations coming from netlink.XfrmStateList() is high due to backgroundSync where we usually don't change any Xfrm states. This becomes more and more expensive as number of nodes increases. Added CI test to make sure that we accidentally don't add calls that modify XFRMState without going through cache. Also, added hidden option that allows to turn of caching. Signed-off-by: Marcel Zieba <marcel.zieba@isovalent.com> | 05 June 2024, 21:08:46 UTC |
f995bb0 | Tam Mach | 05 June 2024, 12:27:07 UTC | envoy: Bump envoy version to v1.28.4 This commit is to bump envoy version to v1.28.4 for below CVEs: - [CVE-2024-34362: Crash (use-after-free) in EnvoyQuicServerStream](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv) - [CVE-2024-34363: Crash due to uncaught nlohmann JSON exception](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-g979-ph9j-5gg4) - [CVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-xcj3-h7vf-fw26) - [CVE-2024-32974: Crash in EnvoyQuicServerStream::OnInitialHeadersComplete()](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299) - [CVE-2024-32975: Crash in QuicheDataReader::PeekVarInt62Length()](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-g9mq-6v96-cpqc) - [CVE-2024-32976: Endless loop while decompressing Brotli data with extra input](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-7wp5-c2vq-4f8m) - [CVE-2024-23326: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode](https://togithub.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c) Additionally, this build also includes a couple of Cilium fixes, more details can be found in #786. Upstream release: https://github.com/envoyproxy/envoy/releases/tag/v1.28.4 Relates: https://github.com/cilium/proxy/pull/786 Signed-off-by: Tam Mach <tam.mach@cilium.io> | 05 June 2024, 21:08:27 UTC |
decca29 | André Martins | 03 June 2024, 22:37:41 UTC | .github/workflows: fix digests file creation [ upstream commit deee47cac2f7c56d376e1877d1fb4bd9f3c9fd84 ] With the introduction of 57db22b2029c, Syft creates the sbom files under the same directory the image digest files are created. This resulted on image-digest-output.txt file to contain all the SBOMs unexpectedly. Thus, using find, we will make sure that only the files that start with the "image-digests" are used to by copied into the image-digest-output.txt file. Tested in https://github.com/aanm/cilium/actions/runs/9358191181 Fixes: 57db22b2029c ("Generate SBOMs using Syft instead of bom") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: viktor-kurchenko <viktor.kurchenko@isovalent.com> | 05 June 2024, 20:15:13 UTC |
5b4badc | Lukas Stehlik | 03 May 2024, 07:56:25 UTC | Remove `hubble.ui.securityContext.enabled` from hubble-ui helm template [ upstream commit 4b81d22f4c2ba2dcad3068d25e15ef74bff8e36d ] Signed-off-by: Lukas Stehlik <stehlik.lukas@gmail.com> Signed-off-by: viktor-kurchenko <viktor.kurchenko@isovalent.com> | 05 June 2024, 20:15:13 UTC |
742626c | Marcel Zieba | 02 May 2024, 11:13:28 UTC | ci: Filter supported versions of EKS [ upstream commit 720927534b26477002d7fe320b389a19d6dd5664 ] Whenever EKS stopped supporting a particular version of EKS, we had to manually remove it from all stable branches. Now instead of that, we will dynamically check if it's supported and only then run the test. This implementation is not great as supported versions are hard-coded in eksctl until EKS fixes it: https://github.com/aws/containers-roadmap/issues/982#issuecomment-2050635472 Because of that, we always fetch newest eksctl version. Signed-off-by: Marcel Zieba <marcel.zieba@isovalent.com> Signed-off-by: viktor-kurchenko <viktor.kurchenko@isovalent.com> | 05 June 2024, 20:15:13 UTC |
4c64c45 | Marcel Zieba | 21 May 2024, 09:32:09 UTC | background-sync: fix bootstrap issue and edge-case with 1 node [ upstream commit 2019ebebc816a0b095b6afcdbd5e30bb081a3e64 ] [ Backporter's notes: minor conflicts due to lack of context and closeChan instead. ] During bootrstrap, we don't know number of nodes and new implementation essentially was hot looping till fetched nodes. Also, in case of cluster with single node, rate-limiter was not rate-limiting. Fixes #32577 Signed-off-by: Marcel Zieba <marcel.zieba@isovalent.com> | 05 June 2024, 09:35:23 UTC |
e500fac | Marcel Zieba | 16 May 2024, 12:03:30 UTC | background-sync: spread node updates over time. [ upstream commit 3e12e02d04a33aa8ea36f463d26c2ffa3804a01a ] [ Backporter's notes: no error handling in v1.14, different m.Iter part, no health module. closeChan instead of context. ] Before, depending on cluster-size we were triggering node update for each node at fixed intervals depending on cluster-size. This resulted in high cpu usage spike in agent. While the intent is to fix state that got stale and shouldn't be the primary source of updates, it makes sense to spread these updates over time to average out cpu usage. Also, reenable backgroundSync test. Signed-off-by: Marcel Zieba <marcel.zieba@isovalent.com> | 05 June 2024, 09:35:23 UTC |
ee79c38 | Maciej Kwiek | 15 May 2024, 10:20:40 UTC | install: Update image digests for v1.13.16 Generated from https://github.com/cilium/cilium/actions/runs/9093775032. `docker.io/cilium/cilium:v1.13.16@sha256:f1f26a973419ba449a47a08e8c4c8e280d8941bb4fd77d1e992e2721425c0629` `quay.io/cilium/cilium:v1.13.16@sha256:f1f26a973419ba449a47a08e8c4c8e280d8941bb4fd77d1e992e2721425c0629` `docker.io/cilium/clustermesh-apiserver:v1.13.16@sha256:5fe762a36b260b400458bb1381e3e8b9453969bb9f4225926645baf4f8abf5ec` `quay.io/cilium/clustermesh-apiserver:v1.13.16@sha256:5fe762a36b260b400458bb1381e3e8b9453969bb9f4225926645baf4f8abf5ec` `docker.io/cilium/docker-plugin:v1.13.16@sha256:e4263bf37acccb2256d164cc443afd4fdd43d41c247a0c634abdd51f8df4d917` `quay.io/cilium/docker-plugin:v1.13.16@sha256:e4263bf37acccb2256d164cc443afd4fdd43d41c247a0c634abdd51f8df4d917` `docker.io/cilium/hubble-relay:v1.13.16@sha256:bd54f5ebd81e2b911f3453fda344280510d1695abbe24d097ed2f784e5a82840` `quay.io/cilium/hubble-relay:v1.13.16@sha256:bd54f5ebd81e2b911f3453fda344280510d1695abbe24d097ed2f784e5a82840` `docker.io/cilium/operator-alibabacloud:v1.13.16@sha256:cd3cf713a9f6658ae62ebf073134f7286228aae36e5946d543a0c8c00eb7fa60` `quay.io/cilium/operator-alibabacloud:v1.13.16@sha256:cd3cf713a9f6658ae62ebf073134f7286228aae36e5946d543a0c8c00eb7fa60` `docker.io/cilium/operator-aws:v1.13.16@sha256:e068622352cd2929f98367cd59203b403ab5cc766957f12ac0663c0f4c0b6cdf` `quay.io/cilium/operator-aws:v1.13.16@sha256:e068622352cd2929f98367cd59203b403ab5cc766957f12ac0663c0f4c0b6cdf` `docker.io/cilium/operator-azure:v1.13.16@sha256:60d814726d9b9b27e7b2bbbf27d8e44dfdef6271c2d69bd69b1194b11202ea29` `quay.io/cilium/operator-azure:v1.13.16@sha256:60d814726d9b9b27e7b2bbbf27d8e44dfdef6271c2d69bd69b1194b11202ea29` `docker.io/cilium/operator-generic:v1.13.16@sha256:a2711d5b891da9fd66c2116b77782b58a1a428eb4abdab2dd3ac1221937d846b` `quay.io/cilium/operator-generic:v1.13.16@sha256:a2711d5b891da9fd66c2116b77782b58a1a428eb4abdab2dd3ac1221937d846b` `docker.io/cilium/operator:v1.13.16@sha256:e161e6f883f17b136799abb3e5b910cf1a98da8828f05f1a42f3b6ecf109e45d` `quay.io/cilium/operator:v1.13.16@sha256:e161e6f883f17b136799abb3e5b910cf1a98da8828f05f1a42f3b6ecf109e45d` Signed-off-by: Maciej Kwiek <maciej@isovalent.com> | 04 June 2024, 16:20:47 UTC |
3d21438 | renovate[bot] | 03 June 2024, 08:01:08 UTC | chore(deps): update all github action dependencies Signed-off-by: renovate[bot] <bot@renovateapp.com> | 03 June 2024, 18:30:20 UTC |
c855d49 | renovate[bot] | 03 June 2024, 08:00:57 UTC | chore(deps): update stable lvh-images Signed-off-by: renovate[bot] <bot@renovateapp.com> | 03 June 2024, 18:30:11 UTC |
51bda14 | renovate[bot] | 03 June 2024, 03:19:40 UTC | chore(deps): update hubble cli to v0.13.4 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 03 June 2024, 18:29:59 UTC |
2c6c18d | Marco Iorio | 03 June 2024, 07:12:58 UTC | gha: correctly trigger integration tests via ariane commands The blamed commit backported the GHA-based integration tests to v1.13. However, it missed registering them into the Ariane configuration, which means that tests are not executed upon /test-backport-1.13, nor by means of the scheduled trigger. Let's fix it. Fixes: 7531e097d2c2 ("introduce ARM github workflows") Signed-off-by: Marco Iorio <marco.iorio@isovalent.com> | 03 June 2024, 11:00:06 UTC |
90cc38a | Feroz Salam | 30 May 2024, 09:33:20 UTC | (v1.13) Bump golang.org/x/net Resolves some CVEs showing up in scanners Signed-off-by: Feroz Salam <feroz.salam@isovalent.com> | 31 May 2024, 07:29:13 UTC |
d2765bb | Cilium Imagebot | 30 May 2024, 01:43:17 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 30 May 2024, 18:42:50 UTC |
db20655 | renovate[bot] | 30 May 2024, 00:46:00 UTC | chore(deps): update docker.io/library/ubuntu:22.04 docker digest to a6d2b38 Signed-off-by: renovate[bot] <bot@renovateapp.com> | 30 May 2024, 18:42:50 UTC |
11ff4b8 | Yutaro Hayakawa | 28 May 2024, 04:22:58 UTC | Bump timeout of lint-build-commits.yaml [ upstream commit 4cda262008ae8124ac57dfcfae2cb47beceedc5a ] In the latest state, lint-build-commits takes over 90min. While it is not desirable to take many time, bump it to 180min as a workaround. Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com> Signed-off-by: Jussi Maki <jussi@isovalent.com> | 30 May 2024, 17:15:08 UTC |
5a15936 | Sebastian Wicki | 27 May 2024, 08:22:09 UTC | cni: Reserve local ports for DNS proxy even if IPv6 is disabled [ upstream commit 76ecb4bc4c157d4943b4cc96ec96ee89151de010 ] This fixes a bug where the port reservation of ports which can conflict with transparent DNS proxy where only reserved if IPv6 was enabled. The call to `reserveLocalIPPorts` was accidentally added in the "IPv6-only" branch. This commit fixes that by unconditionally reserving local ports. Fixes: 11fe7cc144aa ("cilium-cni: Reserve ports that can conflict with transparent DNS proxy") Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 30 May 2024, 17:15:08 UTC |
5bd5dc3 | Sebastian Wicki | 27 May 2024, 08:21:09 UTC | daemon: Log set of auto-detected reserved ports [ upstream commit 6a014ff313773fd940670dc771c250abe04d5efc ] This aids in troubleshooting, as the list of ports is not visible anywhere else in the sysdump. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> Signed-off-by: Jussi Maki <jussi@isovalent.com> | 30 May 2024, 17:15:08 UTC |
97aa7d3 | Cilium Imagebot | 28 May 2024, 04:42:59 UTC | images: update cilium-{runtime,builder} Signed-off-by: Cilium Imagebot <noreply@cilium.io> | 29 May 2024, 21:57:21 UTC |