Skip to main content

Browse the archive

https://github.com/cilium/cilium
12 July 2024, 03:14:21 UTC
sort by:
Revision Author Date Message Commit Date
270ed8f Thomas Graf 14 July 2017, 04:57:59 UTC 0.10 release \o/ See NEWS.rst Signed-off-by: Thomas Graf <thomas@cilium.io> 21 July 2017, 17:01:25 UTC
fe6211d Thomas Graf 14 July 2017, 04:02:52 UTC NEWS: Prepare for 0.10 release Signed-off-by: Thomas Graf <thomas@cilium.io> 21 July 2017, 15:39:48 UTC
22e5bdc André Martins 21 July 2017, 14:26:35 UTC k8s: removed kubernetes specific code from daemon Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 15:31:50 UTC
ad13a5a André Martins 21 July 2017, 12:19:24 UTC k8s: use k8s node addresses in ipv4-node and ipv6-node Since kubernetes provides each node addresses in the node's spec it might be useful to leverage them as cilium IPv4 and IPv6 addresses. Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 15:31:50 UTC
e85bdc2 André Martins 21 July 2017, 12:07:20 UTC daemon: fixed missing Labels' RefCount update Since RefCount is based on endpoint's timeout, this commit reintroduces again that endpoint's keep-alive in the kvstore. Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 15:31:50 UTC
3e1e02b André Martins 18 July 2017, 20:38:11 UTC tests: removed L7 workaround Since L7 works on a multinode environment we can remove the workaround created. Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 15:31:50 UTC
f9645cd Ian Vernon 20 July 2017, 20:26:33 UTC tests: refactor functions to copy files from VMs The scripts that copy files off of the VMs for k8s and runtime tests were using VM names that were out-of-date. This commit refactors the file copying code to work with each build in a more generic way. Signed-off by: Ian Vernon <ian@covalent.io> 21 July 2017, 13:02:09 UTC
6c7d963 André Martins 20 July 2017, 14:56:00 UTC k8s: move K8s NP from extensions/v1beta1 to networking/v1 Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 03:12:00 UTC
cf49cfa André Martins 20 July 2017, 14:52:20 UTC k8s: removed v1.NodeLegacyHostIP deprecated field Due k8s client update in 4596e20dd1, v1.NodeLegacyHostIP had to be removed from cilium. Changed the unit tests accordingly the update made to the k8s lib. Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 03:12:00 UTC
26edf16 André Martins 20 July 2017, 14:51:19 UTC vendor: updated k8s client and dependencies Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 03:12:00 UTC
27f1fd3 André Martins 20 July 2017, 12:54:53 UTC k8s: removed deprecated k8s methods Signed-off-by: André Martins <andre@cilium.io> 21 July 2017, 03:12:00 UTC
f316d4a Thomas Graf 13 July 2017, 19:43:32 UTC agent: Prefix endpoint IDs with node address to make them unique Signed-off-by: Thomas Graf <thomas@cilium.io> 20 July 2017, 16:19:21 UTC
2f9a7db Thomas Graf 13 July 2017, 19:03:05 UTC endpointmanager: Lock auxEndpoints for writing Signed-off-by: Thomas Graf <thomas@cilium.io> 20 July 2017, 15:41:11 UTC
a8349ee Ian Vernon 20 July 2017, 04:43:42 UTC daemon: remove log msg in /GET endpoint w/ labels Signed-off by: Ian Vernon <ian@covalent.io> 20 July 2017, 12:51:03 UTC
9061f46 Ian Vernon 20 July 2017, 03:22:47 UTC Documentation: coreos.rst contents --> admin.rst Move the CoreOS Guide to part of the administration guide. Signed-off by: Ian Vernon <ian@covalent.io> 20 July 2017, 09:14:30 UTC
d9a265e Ian Vernon 20 July 2017, 00:56:50 UTC cmd: get ep with labels, pod / container name, ID * daemon: add handlers for new /endpoints API, update endpoint structures with container ID / pod name * pkg/endpoint: support new API models * pkg/endpointmanager: add pod name, container name entries as keys mapping to endpoints * pkg/labels: change Orchestration labels -> OrchestrationIdentity labels (labels used in computing a security identity) and OrchrestationInfo labels (labels not used in computing a security identity) `cilium endpoint get` now supports the following: * `cilium endpoint get -l <set of labels>` * `cilium endpoint get <eID, pod name, container name, etc.>` Signed-off by: Ian Vernon <ian@covalent.io> 20 July 2017, 03:53:00 UTC
48abb62 Ian Vernon 20 July 2017, 00:54:36 UTC api: add pod / container name, labels for GET ep * add new fields to Endpoint (pod-name, container-name) * GET /endpoint now takes an optional array of labels to return a list of endpoints whose labels match the provided array. Signed-off by: Ian Vernon <ian@covalent.io> 20 July 2017, 03:53:00 UTC
2a7fcb7 André Martins 19 July 2017, 13:24:47 UTC tests: removed k8s single node test - Remove k8s single node test - Move multi-node tests to previous single node test directory - Changed relative paths to accommodate the new directory. - Disabled the gsg runtime test on a single node environment. Signed-off-by: André Martins <andre@cilium.io> 19 July 2017, 17:02:54 UTC
0aa70aa André Martins 18 July 2017, 18:14:40 UTC tests: add more files to 00-no-sleep.sh Since commit 82976101cf introduced a diff file containing a "sleep" command, for the pod specification, it was necessary to add `.yaml` and `.diff` extensions to the list of ignored extensions in 00-no-sleep.sh. Signed-off-by: André Martins <andre@cilium.io> 19 July 2017, 17:02:54 UTC
dd719d7 André Martins 17 July 2017, 20:17:41 UTC tests: fixed wait_for_healthy_k8s_cluster Fixed helper function to wait until N nodes were ready on the k8s cluster. Signed-off-by: André Martins <andre@cilium.io> 19 July 2017, 17:02:54 UTC
707617b André Martins 17 July 2017, 18:55:15 UTC tests: adding k8s GSG to multi node test Signed-off-by: André Martins <andre@cilium.io> 19 July 2017, 17:02:54 UTC
bd15bc9 André Martins 19 July 2017, 12:00:12 UTC docs: removing consul from the administration guide Signed-off-by: André Martins <andre@cilium.io> 19 July 2017, 13:35:27 UTC
454837e Amre Shakimov 19 July 2017, 02:40:10 UTC remove tmp debug file 19 July 2017, 03:26:31 UTC
57d8902 Ian Vernon 06 July 2017, 18:40:46 UTC tests: only change permissions of created logs dir Signed-off by: Ian Vernon <ian@covalent.io> 18 July 2017, 19:05:40 UTC
96cc0e4 André Martins 12 July 2017, 15:14:25 UTC tests: add k8s multi node to stress the L7 proxy Unfortunately it is not possible to run ab 1000000 requests with 200 connections in the L7 proxy for unknown reasons, but most likely to memory constrains. Signed-off-by: André Martins <andre@cilium.io> 18 July 2017, 12:55:15 UTC
6f7011a Amre Shakimov 18 July 2017, 06:33:40 UTC fix kvstore arg for docker-compose example Signed-off-by: Amre Shakimov <amre@covalent.io> 18 July 2017, 09:50:56 UTC
47cb2db André Martins 17 July 2017, 18:52:12 UTC Updating list of AUTHORS Signed-off-by: André Martins <andre@cilium.io> 17 July 2017, 22:01:04 UTC
357e5f8 Daniel Borkmann 17 July 2017, 20:15:05 UTC cilium: also remove cilium_calls maps When we check for stale maps to be removed, we currently ignore the cilium_calls prefix and therefore cilium_calls_* maps are still leftover as pinned. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 17 July 2017, 21:15:18 UTC
8cbe395 Daniel Borkmann 17 July 2017, 17:30:26 UTC cilium: remove stale id also from policy map Commit 37776f088422 ("cilium: on ep destruction also remove id from cilium_policy tail call map") initiated removal of eps from global policy map, but we should also do so when we check and remove stale maps in case on non-graceful exit. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 17 July 2017, 21:15:18 UTC
52462cc André Martins 14 July 2017, 11:50:48 UTC daemon: cleaning up leftover veths On a development environment some veths can be left uncleaned leading to a pile up of unused veths. This commit tries to clean all veths created by cilium (veths with name starting with "lxc") that are non longer being used by a moby container. Signed-off-by: André Martins <andre@cilium.io> 17 July 2017, 16:20:38 UTC
b7f374c Daniel Dao 17 July 2017, 11:57:02 UTC fix overflow of arguments array length of the array should be initArgMax since const starts from 0. Set it to initArgMax -1 makes setting initArgDevice overflow (test with --device some-device) Signed-off-by: Daniel Dao <dqminh89@gmail.com> 17 July 2017, 12:30:30 UTC
cb7d7a4 Thomas Graf 11 July 2017, 23:06:20 UTC labels: Include source in sortedList() Not including the source will cause identical labels from different sources to clash. Signed-off-by: Thomas Graf <thomas@cilium.io> 17 July 2017, 12:22:57 UTC
df3e52f Thomas Graf 11 July 2017, 21:06:27 UTC monitor: Fix message separator output Signed-off-by: Thomas Graf <thomas@cilium.io> 17 July 2017, 08:33:28 UTC
840e9d2 Alexander Alemayhu 17 July 2017, 07:03:03 UTC tests: fix typo s/14/13 Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 17 July 2017, 07:43:40 UTC
d2ad3a8 Alexander Alemayhu 11 July 2017, 22:26:44 UTC pkg/byteorder: use Swap{16,32} in NetworkToHost It's shorter and should produce the same results. Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 17 July 2017, 07:43:40 UTC
46ce3c9 Alexander Alemayhu 11 July 2017, 22:13:29 UTC daemon: remove dead monitor code The monitor code is handled by the CLI and the daemon is not really involved there. Reading the code it might be perceived as in use, but it's actually not really doing anything useful. Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 17 July 2017, 07:43:40 UTC
73ea3c3 Alexander Alemayhu 06 July 2017, 17:35:03 UTC cmd: replace some of the placeholders with short descriptions Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 17 July 2017, 07:43:40 UTC
470a3b0 Alexander Alemayhu 06 July 2017, 17:26:00 UTC git: ignore more files o bash completion o vim temproary files o email directory Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 17 July 2017, 07:43:40 UTC
7c64b3d Amre Shakimov 27 June 2017, 05:53:03 UTC cni-plugin: pass through labels during ep creation This happens when CNI plugin receives a CREATE event with labels, e.g., from mesos/marathon. https://github.com/cilium/cilium/issues/1028 16 July 2017, 19:34:58 UTC
7f42c9d Amre Shakimov 28 June 2017, 17:18:11 UTC cilium-cni: move labels to ep - change api to allow passing labels while creating an endpoint - decouple labels from containers - use endpoint labels 16 July 2017, 19:34:58 UTC
df51939 Ian Vernon 16 July 2017, 17:57:22 UTC pkg/bpfdebug: fix errant c/p in DumpInfo func desc Replace typo with comment that describes what DumpInfo function does. Signed-off by: Ian Vernon <ian@covalent.io> 16 July 2017, 19:33:28 UTC
d8adef7 Thomas Graf 11 July 2017, 04:54:33 UTC bpf: Make tracing capture len configurable Add --trace-payloadlen option to set length of captured payload Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 21:28:10 UTC
75af4e7 Thomas Graf 11 July 2017, 04:54:33 UTC bpf: Do not require DEBUG flag to emit basic tracing messages Allow to disable basic tracing with --disable-trace agent flag Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 21:28:10 UTC
71b0522 Thomas Graf 11 July 2017, 04:54:33 UTC monitor: Print separator between messages in non-info mode Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 21:28:10 UTC
24e2cf4 Thomas Graf 11 July 2017, 04:54:33 UTC monitor: Decode layers unless disabled Require user to provide --hex flag to disabled decoding and printing in hexadecimal format. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 21:28:10 UTC
d013686 Thomas Graf 11 July 2017, 04:54:33 UTC bpfdebug: Improve DumpInfo() output TCP forwarding: <- endpoint 64189, identity 258: 10.15.220.6:51198 -> 10.15.242.54:80 tcp SYN -> ifindex 586: 10.15.220.6:51198 -> 10.15.242.54:80 tcp SYN <- endpoint 33115, identity 257: 10.15.242.54:80 -> 10.15.220.6:51198 tcp ACK, RST -> endpoint 64189, identity 258: 10.15.242.54:80 -> 10.15.220.6:51198 tcp ACK, RST ARP: <- endpoint 33115, identity 257: ea:e1:ad:23:9e:ac -> 1e:19:55:1b:27:a0 ARP -> endpoint 33115, identity 257: 1e:19:55:1b:27:a0 -> ea:e1:ad:23:9e:ac ARP <- endpoint 64189, identity 258: 62:28:3d:b9:16:71 -> ba:15:0d:5c:cb:90 ARP -> endpoint 64189, identity 258: ba:15:0d:5c:cb:90 -> 62:28:3d:b9:16:71 ARP ICMP forwarding: <- endpoint 50098: 10.15.189.46 -> 10.15.222.137 EchoReply -> endpoint 42392: 10.15.189.46 -> 10.15.222.137 EchoReply <- endpoint 42392: 10.15.222.137 -> 10.15.189.46 EchoRequest -> endpoint 50098: 10.15.222.137 -> 10.15.189.46 EchoRequest <- endpoint 50098: 10.15.189.46 -> 10.15.222.137 EchoReply -> endpoint 42392: 10.15.189.46 -> 10.15.222.137 EchoReply Drops: <- endpoint 64189, identity 257: 10.15.220.6 -> 10.15.247.232 EchoRequest xx drop (Policy denied) to endpoint 29898, identity 257->256: 10.15.220.6 -> 10.15.247.232 EchoRequest <- endpoint 64189, identity 257: 10.15.220.6 -> 10.15.247.232 EchoRequest xx drop (Policy denied) to endpoint 29898, identity 257->256: 10.15.220.6 -> 10.15.247.232 EchoRequest Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 21:28:10 UTC
c1bb719 Thomas Graf 11 July 2017, 04:54:33 UTC bpf: Provide identity in capture messages Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 21:28:10 UTC
258af93 Ian Vernon 11 July 2017, 05:05:15 UTC cmd: add output options for cilium monitor By default, when `cilium monitor` is ran, a one-line summary will be output, only for drop and capture messages. A new flag, -v for verbose, is added which will output more detailed information about each packet for debug, drop, and capture messages, which was before the default behavior for `cilium monitor`. Signed-off by: Ian Vernon <ian@covalent.io> 15 July 2017, 21:28:10 UTC
77a05ce Thomas Graf 10 July 2017, 22:01:03 UTC tests: Remove multinode L7 tests workaround Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
3cb4ae9 Thomas Graf 10 July 2017, 22:01:03 UTC bpf: Redirect to HOST_IFINDEX when doing proxy redirect When packet originally comes from bpf_netdev or bpf_overlay and we pass to stack, Linux will evaluate the source - dest pair in the context of the overlay device and drop it as invalid due to martian source. Do a proper redirect ot the HOST_IFINDEX. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
511083e Thomas Graf 10 July 2017, 22:01:03 UTC tests: Fix 06-lb.sh Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
1c951ee Thomas Graf 10 July 2017, 22:01:03 UTC bpf: Attach bpf_host.o at egress of cilium_host We have attached bpf_host.o at ingress of the cilium_host peer so far. The side effect of this is that skbs are scrubbed and we lose access to skb->mark. Move bpf_host.o to egress of cilium_host. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
2f6ede4 Thomas Graf 10 July 2017, 22:01:03 UTC proxy: Inherit endpoint source identity from proxy map - When forwarding, inherit identity from proxy map and and pass it on to the BPF program using skb->mark. This allows bpf_netdev to inherit the identity and pass it on to the wire - When serving as ingress proxy, all replies must have the identity of the endpoint we are serving. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
e06e0db Thomas Graf 10 July 2017, 22:01:03 UTC bpf: Store source identity in proxy map Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
d4d9158 Thomas Graf 10 July 2017, 22:01:03 UTC bpf: Support reaching the local node from the overlay Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
51ced7f Thomas Graf 10 July 2017, 22:01:03 UTC agent: Masquerade traffic from host into cilium cluster Traffic from the host with a source IP outside of the cilium cluster must be masquerade with a cluster IP. Allocate an internal IP for this, add it to the cilium_host interface and masquerade all traffic which flows into cilium_host which does not have a proper source address. Signed-off-b: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
e6d9967 Thomas Graf 10 July 2017, 22:01:03 UTC bpf: Compile bpf_host.o after ENCAP_IFINDEX has been derived Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
18c4474 Thomas Graf 10 July 2017, 22:01:03 UTC bpf: Add additional debugging for bpf_netdev Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
5501df5 Thomas Graf 10 July 2017, 22:01:03 UTC proxy: Provide original identity as SO_MARK Make the proxy provide the source identity as SO_MARK when sending packets. This allows the security identity to be preserved while passing through the proxy. Fixes: #1110 Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
008b3a9 Thomas Graf 10 July 2017, 22:01:03 UTC daemon: Automatically reserve conflicting local IPv4 routes in alloc prefix This resolves the case where the VM is using some IPs which reside inside the allocation prefix. This allows a node to use the ip range 10.1.1.0/24 while the node allocates to containers out of the prefix 10.1.0.0/16. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
d228524 Thomas Graf 10 July 2017, 22:01:03 UTC daemon: Point cluster CIDR to cilium_host in encapsulation mode In encapsulation mode, make use of the new encapsulation feature of bpf_netdev and point the entire cluster prefix to cilium_host. This makes endpoint IPs on other nodes available to local processes. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
6679c97 Thomas Graf 10 July 2017, 22:01:02 UTC daemon: Add options to specify service CIDR The service CIDR (e.g. k8s service-cidr) can live outside of the cilium cluster prefix. This is fine as service IPs are immediately translated to endpoint IPs and are never seen on the wire. The exception to this is if the host attempts to talk to service IPs, in this case, we need to add a route in the host to pass such packets to the cilium_host interface so they can be properly loadbalanced. Provide new options to allow the user to specify the service ranges if the reside outside of the clsuter prefix. Fixes: #1013 Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
b5bd9ce Thomas Graf 10 July 2017, 22:01:02 UTC bpf: Support encapsulation for packets received from a netdev This extends bpf_netdev to perform encapsulation if the destination is within the cluster prefix but not a local endpoint. This allows for a local process to reach endpoints which reside on other nodes. If the packet is being received from the wire, the identity is inherited as normal. If the packet is coming from the host, the skb->mark can be used to define the source identity of the packet. It also compiles bpf_netdev.c to bpf_host.o for use on the cilium_host interface so we can pass in a special define FROM_HOST which indicates that bpf_netdev is being run in the context for packets from the host. Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
845a82a Thomas Graf 10 July 2017, 22:01:02 UTC find-llvm.sh: Add fast track for common location Signed-off-by: Thomas Graf <thomas@cilium.io> 15 July 2017, 18:23:04 UTC
afd893a Thomas Bachman 14 July 2017, 20:41:35 UTC Fix typo in demo1.sh This patch fixes a typo in the demo1.sh script. 14 July 2017, 21:30:42 UTC
2271e36 Thomas Graf 10 July 2017, 06:50:39 UTC vagrant: Fail if cilium.service fails and print log Signed-off-by: Thomas Graf <thomas@cilium.io> 14 July 2017, 08:27:19 UTC
66b7eb0 Thomas Graf 10 July 2017, 06:50:28 UTC Makefile: run etcd 3.1.0 for unit tests Signed-off-by: Thomas Graf <thomas@cilium.io> 14 July 2017, 00:20:12 UTC
a52c9de Thomas Graf 10 July 2017, 07:39:08 UTC tests: Add helpers to wait for all endpoints to run a policy revision Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
743d77b Thomas Graf 10 July 2017, 07:39:08 UTC cilium: New 'cilium policy wait <revison>` command Allows to wait for all local endpoints to run a particular revision of the policy. Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
538d9ba Thomas Graf 10 July 2017, 07:39:08 UTC agent: Report repository revision as endpoint policy build Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
092943c Thomas Graf 10 July 2017, 07:39:08 UTC agent/client: Report policy revision via API and print in CLI Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
966f137 Thomas Graf 10 July 2017, 07:39:08 UTC api: Regenerate API code Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
5df2381 Thomas Graf 10 July 2017, 07:39:08 UTC api: Return policy revision via API Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
6097a3d Thomas Graf 10 July 2017, 07:39:08 UTC policy: Introduce policy repository revision - Adds a revision number to the repository which is bumped on every change of policy - Verify the revision in the unit tests - Adjust high level policy change functions to return the revision after a change has been applied Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 23:37:09 UTC
27592df Thomas Graf 10 July 2017, 05:54:50 UTC tests: Disable CT cleanup tests for now Signed-off-by: Thomas Graf <thomas@cilium.io> 13 July 2017, 21:46:10 UTC
c1249e4 Ian Vernon 10 July 2017, 23:50:27 UTC Documentation: add CoreOS getting-started-guide Add a guide with steps to configure Kubernetes and Cilium to get Cilium up-and-running on CoreOS. Signed-off by: Ian Vernon <ian@covalent.io> 13 July 2017, 20:52:40 UTC
0c9ccf7 André Martins 12 July 2017, 11:44:12 UTC tests: adding nodeselector for bookinfo spec Since we have a bug limiting the usage of L7 proxy on multinode this commit adds a NodeSelector into the yaml spec files to the pods are scheduled into the same node. This commit is a workaround and should be removed once the L7 proxy works on a multi works on a multinode environment. Signed-off-by: André Martins <andre@cilium.io> 13 July 2017, 19:58:09 UTC
39b8b0a André Martins 10 July 2017, 11:53:32 UTC tests: add one more example to tests multi CNP enforcement Add a runtime test to test the Cilium Network Policy with multiple policies enforcement on a multi node environment. Signed-off-by: André Martins <andre@cilium.io> 13 July 2017, 19:58:09 UTC
46739d8 André Martins 07 July 2017, 22:34:46 UTC k8s: implemented CiliumNetworkPolicy multi rule Extended CiliumNetworkPolicy to allow setting up multi rules on a single specification file with the keyword `specs` (instead of `spec` on a single policy file. Example: apiVersion: "cilium.io/v1" kind: CiliumNetworkPolicy description: "Policy to test multiple rules in a single file" metadata: name: "multi-rules" specs: - endpointSelector: matchLabels: app: ratings ingress: - fromEndpoints: - matchLabels: app: reviews - endpointSelector: matchLabels: app: details ingress: - fromEndpoints: - matchLabels: app: productpage Signed-off-by: André Martins <andre@cilium.io> 13 July 2017, 19:58:09 UTC
44751c7 Eloy Coto 03 July 2017, 21:36:44 UTC [BPF/probes]: Added kernel checks Fixes: #891 Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 July 2017, 12:50:54 UTC
b99931a André Martins 13 July 2017, 00:03:49 UTC endpointmanager: fixed remove locked for DockerEndpointID The endpointsAux stores the same EP value with different keys. When removing the endpoint, all of those keys where removed from the map except the ep.DockerEndpointID since it was wrongly set with ep.DockerID Signed-off-by: André Martins <andre@cilium.io> 13 July 2017, 00:40:00 UTC
8fab4c7 André Martins 12 July 2017, 20:58:21 UTC Jenkinsfile: add timestamps to builds Signed-off-by: André Martins <andre@cilium.io> 12 July 2017, 22:37:48 UTC
25201c6 André Martins 11 July 2017, 20:33:35 UTC tests: ignoring .json files in 00-no-sleep.sh Since 00-no-sleep.sh was checking for all files, the commit b7bec4bfd7 add a sleep in the pod's command file causing the script to give a false positive. This commit ignores all files with the name ".json" to prevent this false positive. Fixes: b7bec4bfd7 ("tests: adding l7 stresstest on different namespaces") Signed-off-by: André Martins <andre@cilium.io> 12 July 2017, 12:52:54 UTC
95ae985 André Martins 11 July 2017, 16:37:32 UTC tests: adding l7 stresstest on different namespaces Add L7 stress test on a single node for the L7 proxy. Signed-off-by: André Martins <andre@cilium.io> 12 July 2017, 12:52:54 UTC
ff5466b André Martins 11 July 2017, 19:35:25 UTC K8s: keeping namespace label set in cilium NP Cilium Network Policy only enforces policies on the namespace where it's stored. This is achieved by adding a special label on the EndpointSelector, on the FromEndpoints and on the FromRequires with the k8s namespace where the policy is stored. Since users are allowed to specify that special label on the FromEndpoints and / or FromRequires, we should keep the value's label unchanged. The special label in the EndpointSelector is only possible to be overwritten with the metadata's namespace. If the user specifies it manually, by inserting the special label, a warning is printed in cilium logs and the label is replaced with the namespace where the policy is stored. For example, the following CNP ``` metadata: name: "l7-stresstest" namespace: "development" spec: endpointSelector: matchLabels: id: server ingress: - fromEndpoints: - matchLabels: id: client "k8s:io.kubernetes.pod.namespace": qa ``` Will be translated into: ``` "endpointSelector": { "matchLabels": { "any:id": "server", "k8s:io.kubernetes.pod.namespace": "development" } }, "ingress": [ { "fromEndpoints": [ { "matchLabels": { "any:id": "client", "k8s:io.kubernetes.pod.namespace": "qa" } } ], ``` Signed-off-by: André Martins <andre@cilium.io> 12 July 2017, 12:52:54 UTC
ad53848 Tobias Klauser 12 July 2017, 07:58:26 UTC pkg/bpf: add new sock ops prog type Add prog type ProgTypeSockOps to match BPF_PROG_TYPE_SOCK_OPS, introduced in the net-next tree in commit 40304b2a1567 ("bpf: BPF support for sock_ops"). Signed-off-by: Tobias Klauser <tklauser@distanz.ch> 12 July 2017, 09:09:21 UTC
20d6e2f Alexander Alemayhu 17 May 2017, 12:45:43 UTC byteorder: add documentation file for byteorder package this should show a synopsis on godoc[0]. [0]: https://godoc.org/github.com/cilium/cilium Closes: #285 (Micro: Fix common.Swab16 with proper encoding/binary usage) Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 11 July 2017, 19:04:58 UTC
4925039 Alexander Alemayhu 28 May 2017, 13:28:18 UTC bpf: don't call bpf_htonl for LXC_IPV4 It's should already be in network byte order from Go side. Related-to: #285 (Micro: Fix `common.Swab16` with proper `encoding/binary` usage) Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 11 July 2017, 19:04:58 UTC
0dfe617 Alexander Alemayhu 14 June 2017, 19:35:06 UTC pkg: introduce new package for handling byteorder netlink is used for the byte order detection, which is already a dependency available in the vendor directory. The package provides the native byte order in the variable Native and wraps all byte order specific reads and write call sites. Related-to: #285 (Micro: Fix `common.Swab16` with proper `encoding/binary` usage) Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 11 July 2017, 19:04:58 UTC
e0bce32 Alexander Alemayhu 26 May 2017, 19:45:43 UTC tests: check printed container ids Related-to: #746 (container id in BPF debug message is wrong) Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> 11 July 2017, 19:04:58 UTC
12cc2ea Thomas Graf 08 July 2017, 17:29:34 UTC examples/demo: Clean up star wars demo Signed-off-by: Thomas Graf <thomas@cilium.io> 11 July 2017, 14:52:35 UTC
ca481ff Daniel Dao 10 July 2017, 11:39:03 UTC remove Godeps manifest since we moved to vndr Commit 71fefcaf moves the dependencies management to vndr, but forgot to remove existing Godeps manifest. Signed-off-by: Daniel Dao <dqminh89@gmail.com> 10 July 2017, 18:39:15 UTC
2e58110 Daniel Dao 10 July 2017, 11:34:47 UTC remove unused dependencies detected by vndr Looks like we dont use any of the current prometheus dependencies. vndr detects those are unused and remove them. `make` still works after the purge. The original change adds prometheus together with the bump to etcd v3.1, but we dont actually exposes the prometheus metrics anywhere. I think we should just remove this now and re-integrate prometheus separately when working on https://github.com/cilium/cilium/issues/165 maybe. Signed-off-by: Daniel Dao <dqminh89@gmail.com> 10 July 2017, 18:39:15 UTC
2064589 Daniel Dao 10 July 2017, 11:23:30 UTC vendor.conf: update etcd to 3.2.1 The move to vendor.conf missed a separate bump for etcd in another change. This readds the bump. Signed-off-by: Daniel Dao <dqminh89@gmail.com> 10 July 2017, 18:39:15 UTC
a8fddc6 Thomas Graf 07 July 2017, 22:43:16 UTC k8s: Correctly implement ClusterIP for type NodePort and LoadBalancer NodePort and LoadBalancer are supersets of ClusterIP. Implement ClusterIP for these types as well. Also: Silently ingore external name services instead of printing a warning. Signed-off-by: Thomas Graf <thomas@cilium.io> 10 July 2017, 12:50:01 UTC
71fefca Daniel Dao 03 July 2017, 12:36:29 UTC move from godeps to https://github.com/LK4D4/vndr Godeps make it very difficult to update only a few dependencies. We uses vndr in a couple of projects and it works well so far in terms of ease of dependencies' update. One more plus is vndr also removes more files that are unnecessary for the build process. Signed-off-by: Daniel Dao <dqminh89@gmail.com> 10 July 2017, 10:06:23 UTC
4052fc5 André Martins 06 July 2017, 11:24:44 UTC k8s: add node IP CIDR in the annotations node When the user uses the cluster-cidr in the controller manager, kubernetes controller automatically sets up a dedicated pod CIDR for each node. This CIDR is used by cilium both locally and on the cluster so that cilium knows on which node IP is the pod CIDR assigned. Unfortunately, kubernetes only assigns one IP version CIDR per node, in consequence, the cilium node derives the other IP version CIDR and stores this value in the node's attributes map, where the other nodes receive a notification regarding both IPv4 and IPv6 CIDRs allocated to that node. Signed-off-by: André Martins <andre@cilium.io> 08 July 2017, 00:51:32 UTC
37b3ac1 André Martins 06 July 2017, 11:24:44 UTC k8s: change daemon's k8s clientSet to Interface Changed the daemon's k8s client to use the k8s client interface to facilitate the use of an interface in future k8s unit tests. Signed-off-by: André Martins <andre@cilium.io> 08 July 2017, 00:51:32 UTC
902b999 Michi Mutsuzaki 07 July 2017, 00:52:27 UTC Refactor k8s.Client This patch exposes k8s.CreateConfig, and changes k8s.CreateClient() and k8s.CreateTPRClient() to accept rest.Config as an input instead of endpoint and kubeconfig file path. This allows the caller to pass rest.Config that has been created some other way, for example using rest.InClusterConfig(). Signed-off-by: Michi Mutsuzaki <michi@covalent.io> 07 July 2017, 23:24:15 UTC
b24d8cb Ian Vernon 28 June 2017, 23:04:12 UTC tests: pick up k8s test logs, other enhancements * tests/k8s: copy contents of /var/lib/cilium, /var/run/cilium, as well as logs from kube-apiserver, kube-controller-manager, kubelet into tar.gz that is archived after each build. * tests: shut down VMs even if gathering of logs / archiving of artifacts fails. Signed-off by: Ian Vernon <ian@covalent.io> 07 July 2017, 21:17:13 UTC
back to top