Skip to main content

Browse the archive

https://github.com/cilium/cilium
12 July 2024, 03:14:21 UTC
sort by:
Revision Author Date Message Commit Date
0392ea9 Thomas Graf 15 February 2018, 01:36:12 UTC kafka: Use policy identity cache to lookup identity for L3 dependant rules Fixes Issue: #2824 [ upstream commit 4566a558d62cd0329be45a74896cc0cbccef8f70 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Manali Bhutiyani <manali@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 15 February 2018, 14:31:22 UTC
6875004 Romain Lenglet 13 February 2018, 02:15:03 UTC endpoint: Move deletion of obsolete proxy redirects until after BPF regeneration [ upstream commit afd1d5b9cddb074f1412bb226cbf8a82a74b0e08 ] To avoid traffic loss, wait for the new policy to be computed and compiled into BPF before deleting obsolete redirects, to make sure no packets are redirected to those ports. Replace the tracking of redirects to delete with a tracking of the redirects that have been realized, to simplify the logic. Fixes: #2796 Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 15 February 2018, 14:31:22 UTC
5ab2870 Romain Lenglet 12 February 2018, 23:18:27 UTC endpoint: Limit proxy completion timeout to proxy updates [ upstream commit 6a8b48951470e765e9ad84081f5eb0ba448f39d1 ] Wait for proxy redirect completion before generating policies that redirect traffic to proxy redirect ports, to prevent traffic loss. Reduce the proxy completion timeout to 10 seconds again, since policy regeneration is now excluded from the timeout. Fixes: #2788 Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 15 February 2018, 14:31:22 UTC
7e9cb17 Ray Bejjani 14 February 2018, 15:25:04 UTC k8s: k8s 1.9 compatible version parsing [ upstream commit 4f6acaab4e7ab68ee7157f2b523da005328e0f81 ] On minikube 0.25.0, at least, cilium-agent cannot parse the k8s version because ServerVersion.major and .minor are not populated. gitVersion is and we fall back to parsing that instead. Signed-off-by: Ray Bejjani <ray@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 15 February 2018, 14:31:22 UTC
576dabc Thomas Graf 15 February 2018, 01:01:06 UTC allocator/proxy: Avoid concurrent access of rand.Rand [ upstream commit b46592ad8c7bab8bcf73367167a4f1281a4b0147 ] Fixes: #2808 Signed-off-by: Thomas Graf <thomas@cilium.io> 15 February 2018, 14:31:22 UTC
798293d Jarno Rajahalme 13 February 2018, 19:40:28 UTC envoy: Set source identity correctly in access log. Since 22cfad197 the source identity is in the upper 16 bits of the mark. Fixes: 22cfad197 ("bpf: Use upper 16 bits for identity") Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 13 February 2018, 21:40:00 UTC
64b3f53 André Martins 08 February 2018, 21:20:57 UTC examples/polices: fixed default-deny examples Signed-off-by: André Martins <andre@cilium.io> 13 February 2018, 20:56:19 UTC
ea78a26 André Martins 08 February 2018, 18:50:35 UTC k8s: implemented kubernetes network policy default deny Signed-off-by: André Martins <andre@cilium.io> 13 February 2018, 20:56:19 UTC
15138cf André Martins 13 February 2018, 12:05:15 UTC pkg/endpoint: return WaitForProxyCompletion errors Signed-off-by: André Martins <andre@cilium.io> 13 February 2018, 19:26:10 UTC
b5f3183 Nirmoy Das 13 February 2018, 09:20:49 UTC Makefile: enable backslash escapes for echo Signed-off-by: Nirmoy Das <ndas@suse.de> 13 February 2018, 15:37:09 UTC
6a6ced4 André Martins 11 February 2018, 16:53:00 UTC common/plugins: replaced sysctl invocation with echo redirect Signed-off-by: André Martins <andre@cilium.io> 13 February 2018, 11:47:11 UTC
2da54a4 Romain Lenglet 12 February 2018, 18:39:36 UTC endpoint: Increase the proxy completion timeout to 1 minute Fixes: #2788 Signed-off-by: Romain Lenglet <romain@covalent.io> 12 February 2018, 21:19:14 UTC
3523143 Michal Rostecki 30 January 2018, 16:03:18 UTC pkg/envoy: Move all operations on the cmd to StartEnvoy The Envoy struct contains the attribute for managing the Envoy process. Different operations (like starting, waiting and killing) shouldn't happen at the same time, so we need to ensure that only one method is doing them. That's why supervising of the Envoy process is moved to a goroutine inside StartEnvoy method. And StopEnvoy method only closes the "stop channel" and gets an error, through the another channel. Fixes: #2631 Signed-off-by: Michal Rostecki <mrostecki@suse.com> 12 February 2018, 18:17:32 UTC
2a07843 Eloy Coto 08 February 2018, 15:11:32 UTC Jenkins: Adjust timeouts With the new behaviour of Jenkins some builds died over timeout. The global timeout counts from start of the build (Including time in the queue) with this patch the timeouts are set in the stage part. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 12 February 2018, 16:07:36 UTC
97fedbb Ian Vernon 11 February 2018, 18:50:29 UTC test/runtime: address misc. review comments * Fix indentation * Make test name in log field consistent with actual test name * Add message to Ginkgo assertion in case of failure Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
3a24b69 Ian Vernon 11 February 2018, 18:48:22 UTC test/helpers: add missing single quotation mark in log message Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
8b92531 Ian Vernon 11 February 2018, 04:39:43 UTC tests: deprecate 20-cidr-limit.sh Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
22215b7 Ian Vernon 11 February 2018, 04:38:11 UTC test/runtime: migrate 20-cidr-limit test to Ginkgo Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
452bf7b Ian Vernon 11 February 2018, 04:34:23 UTC test/helpers: add log to ContainerRm function Add log which says that container is being deleted. Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
4f55c02 Ian Vernon 11 February 2018, 04:33:56 UTC test/helpers: misc. enhancements * Rename PolicyImport function to PolicyImportAndWait, as it waits until the policy revision number is incremented before returning. * Add PolicyImport function, which does not wait after a policy is imported. Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
4c8abbe Ian Vernon 11 February 2018, 00:10:52 UTC test/runtime: factor out policy import tests into separate Describe Factor out these tests into a separate Describe, as no containers are needed to be launched in these tests. Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
53840fc Ian Vernon 10 February 2018, 20:11:54 UTC test/runtime: change variable names to reflect types of invalid policy Signed-off by: Ian Vernon <ian@cilium.io> 12 February 2018, 16:02:17 UTC
035605f André Martins 11 February 2018, 22:12:18 UTC tests: deprecating 18-kvstore.sh test Signed-off-by: André Martins <andre@cilium.io> 12 February 2018, 01:43:16 UTC
46c08b7 Ian Vernon 10 February 2018, 07:12:08 UTC tests: deprecate 17-cilium_policy-id-remove.sh Signed-off by: Ian Vernon <ian@cilium.io> 11 February 2018, 18:43:09 UTC
7b072e5 Ian Vernon 10 February 2018, 07:11:00 UTC test/runtime: migrate 17-cilium_policy-id-remove.sh test Migrate bash test to Ginkgo framework Signed-off by: Ian Vernon <ian@cilium.io> 11 February 2018, 18:43:09 UTC
040fc5c Ian Vernon 10 February 2018, 07:10:28 UTC test/helpers: add WaitEndpointsDeleted function This waits until all endpoints except for cilium-health are deleted. Signed-off by: Ian Vernon <ian@cilium.io> 11 February 2018, 18:43:09 UTC
4ec32af Daniel Borkmann 11 February 2018, 00:27:36 UTC bpf, init: don't use sysctl, just write setting directly Martin reported that sysctl binary is not available in CoreOS hyperkube image and thus Cilium fails in init. Lets just not use the binary and write the setting directly instead. Reported-by: Martin Mailand <martin@tuxadero.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 11 February 2018, 08:25:14 UTC
6bf5e4e Daniel Borkmann 09 February 2018, 21:35:43 UTC bpf: fix complexity issues around recent CT changes on 4.9 kernels The single heavy hitter in complexity in our BPF progs right now is the slave selection based on weights in the LB. Reason is that in the verifier pruning, a couple of assumptions cannot be made once the kernel sees that there's one or multiple usages with dynamic map access and thus we bump from ~30k to ~90k closely hitting limits and for older 4.9 kernels that don't have the 98k complexity limit we easily overrun the 68k. Now with this change the heavy hitter in section '2/10' (IPv6 handling) reduces down to ~30k and loads fine on my side. It also allows us to remove the relax_verifier() pseudo helper again. Thus for the LB fall back to just use hash-based which afaik is the default anyway in our case. We can enable this for more recent kernels that have a smarter verifier if we want to. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> 11 February 2018, 08:25:14 UTC
78aa0aa Ian Vernon 11 February 2018, 00:13:02 UTC ginkgo.Jenkinsfile: bump timeout to 90 minutes 60 minute limit kept getting hit, which caused Jenkins to forcibly abort PRs. Signed-off by: Ian Vernon <ian@cilium.io> 11 February 2018, 01:34:07 UTC
e5f4443 Ian Vernon 09 February 2018, 23:52:10 UTC tests: deprecate 14-policy-enforcement-docker.sh Corresponding Ginkgo test has been marked as validated already. Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:32:02 UTC
08fee04 Ian Vernon 09 February 2018, 21:48:00 UTC test/runtime: validate connectivity.go Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:31:37 UTC
db49090 Ian Vernon 09 February 2018, 21:57:04 UTC tests: deprecate 03-docker.sh Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:31:37 UTC
b2c724e Ian Vernon 09 February 2018, 21:53:19 UTC tests: deprecate 08-nat46.sh Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:31:37 UTC
8bc9a6d Ian Vernon 09 February 2018, 21:47:29 UTC tests: deprecate 01-ct.sh Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:31:37 UTC
484bdc5 Ian Vernon 09 February 2018, 23:36:08 UTC test/runtime: mark lb.go as Validated Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:30:54 UTC
dc45449 Ian Vernon 09 February 2018, 23:35:46 UTC tests: deprecate 06-lb.sh Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:30:54 UTC
56e2625 Ian Vernon 10 February 2018, 00:00:31 UTC tests: deprecate 13-fd-open.sh Corresponding Ginkgo test has already been marked as validated. Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:30:18 UTC
18857b4 Ian Vernon 10 February 2018, 00:11:31 UTC test/runtime: mark Kafka test as validated Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:29:42 UTC
04a6939 Ian Vernon 10 February 2018, 00:10:20 UTC tests: deprecate 07-kafka.sh Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:29:42 UTC
ffbc64a Ian Vernon 10 February 2018, 00:23:24 UTC tests: deprecate Bash monitor tests Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:29:09 UTC
ac87f11 Ian Vernon 10 February 2018, 02:00:55 UTC test/runtime: mark RuntimePolicies as validated Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:28:33 UTC
0411dac Ian Vernon 10 February 2018, 02:00:30 UTC tests: deprecate 11-getting-started.sh Signed-off by: Ian Vernon <ian@cilium.io> 10 February 2018, 10:28:33 UTC
deb2de2 Romain Lenglet 06 February 2018, 21:51:38 UTC completion: Refactor proxy completion logic in a new package Move the completion into its own package: github.com/cilium/cilium/pkg/completion. Rename CompletionContainer into WaitGroup to reflect the similarity with sync.WaitGroup. Refactor Completion and WaitGroup to take a Context and handle context cancellation. Rename Completion.Completed into Complete to make it a verb. Added Completion.Completed method to return a channel, to make it easier to use in unit tests. Revert the (de)serialization of the ProxyCompletions field to/from JSON within the Endpoint struct, and rename ProxyCompletions into ProxyWaitGroup. Signed-off-by: Romain Lenglet <romain@covalent.io> 10 February 2018, 01:00:39 UTC
81e68c1 Joe Stringer 31 January 2018, 22:26:01 UTC docs: Add endpoint to glossary Signed-off-by: Joe Stringer <joe@covalent.io> 09 February 2018, 20:43:52 UTC
4e562c7 Joe Stringer 31 January 2018, 22:25:41 UTC docs: Sort glossary Signed-off-by: Joe Stringer <joe@covalent.io> 09 February 2018, 20:43:52 UTC
ac40ff4 André Martins 09 February 2018, 17:17:53 UTC Revert "bpf: Relax the verifier in CT slow paths" This reverts commit e96c42ce4c733ecd665a7831d676d58dbd817f26. 09 February 2018, 18:04:07 UTC
e96c42c Thomas Graf 09 February 2018, 10:52:16 UTC bpf: Relax the verifier in CT slow paths Signed-off-by: Thomas Graf <thomas@cilium.io> 09 February 2018, 15:06:56 UTC
4903142 Eloy Coto 09 February 2018, 08:42:14 UTC Ginkgo: Fix issues with DNS Stopped and deleted the systemctl-resolved to avoid issues with kubedns Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 09 February 2018, 14:05:51 UTC
4802cf4 Ray Bejjani 26 January 2018, 13:56:21 UTC containerd: Remove synchronous syncWithRuntime init We synchronously ran syncWithRuntime before spawning the containerd listener and periodic sync. This could, at times, block waiting for docker and so block agent initialisation. This happens before the API socket is openened and resulted in the API not being served. This change removes the init call, relying on the timestamp passed to docker and the periodic sync running as soon as the goroutine is scheduled. Signed-off-by: Ray Bejjani <ray@covalent.io> 09 February 2018, 08:22:32 UTC
fafca54 Ray Bejjani 26 January 2018, 13:13:49 UTC containerd: Add timeout to containerd syncToRuntime This call would sometimes block indefinitely. We now allow 10s to complete the ContainerList call, allowing the periodic sync to try again later. Signed-off-by: Ray Bejjani <ray@covalent.io> 09 February 2018, 08:22:32 UTC
78c7cd0 Ian Vernon 09 February 2018, 05:12:35 UTC Jenkinsfile / tests: remove bash K8s stage All Bash-script based K8s tests have been migrated / validated to have equivalent coverage in the Ginkgo framework. Thus, there is no need to provision the Kubernetes VMs for the bash-script based build anymore. Signed-off by: Ian Vernon <ian@cilium.io> 09 February 2018, 08:18:11 UTC
cdd5e9e Ian Vernon 09 February 2018, 05:07:23 UTC test: validate runtime policy tests Better now than never. Signed-off by: Ian Vernon <ian@cilium.io> 09 February 2018, 08:18:11 UTC
d369b8c Ian Vernon 09 February 2018, 05:05:08 UTC tests: deprecate 04-bad-cnp-import.sh Signed-off by: Ian Vernon <ian@cilium.io> 09 February 2018, 08:18:11 UTC
bf255e7 Ian Vernon 09 February 2018, 05:01:37 UTC tests: deprecate 99-restore-state.sh Ginkgo test/runtime/chaos.go covers restore functionality. Signed-off by: Ian Vernon <ian@cilium.io> 09 February 2018, 08:18:11 UTC
bc9df7b Ian Vernon 09 February 2018, 04:58:27 UTC tests/k8s: deprecate 04-toservices-test.sh This was migrated by #2380, so we can deprecate it now. Signed-off by: Ian Vernon <ian@cilium.io> 09 February 2018, 08:18:11 UTC
a93aa77 Jarno Rajahalme 09 February 2018, 00:44:33 UTC endpoint: Take read lock while accessing Consumable Parallel policy recomputations can update Consumable, so the reader has to protect against that. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 09 February 2018, 08:16:30 UTC
658e01a Jarno Rajahalme 09 February 2018, 00:46:43 UTC envoy: Lock stream server while adding remove completion. Internal slice manipulations must be protected, and one of the calls to addCompletions() missed this. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 09 February 2018, 04:46:27 UTC
ca6e1cb Thomas Graf 08 February 2018, 19:44:18 UTC bpf: Relax verifier in conntrack code Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:43:46 UTC
4dee158 Thomas Graf 08 February 2018, 13:49:17 UTC bpf: Reduce the number of supported IPv6 extension headers This greatly reduces the complexity of the program Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:43:46 UTC
444aa65 Thomas Graf 07 February 2018, 23:18:17 UTC bpf: Split IPv6 handling into separate tail call Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:43:46 UTC
79ae248 Thomas Graf 07 February 2018, 19:45:45 UTC policy: Document what connections FromCIDR and ToCIDR and apply to Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:43:46 UTC
e778731 Thomas Graf 05 February 2018, 13:19:43 UTC bpf: Enforce to-world access via CIDR map Remove ALLOW_TO_WORLD define from the program and enforce all access to external services via the CIDR map. This simplifies the code and makes policy updates more atomic. Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:43:46 UTC
e4c58da Thomas Graf 02 February 2018, 00:47:10 UTC bpf: Simplify connection tracking logic Connection tracking entries get created for non-SYN packets. This allows a persistent connection to be temporarily be removed and then get re-added. RST no longer triggers immediate deletion of the entry. Instead, directional closure is triggered. This will result in the entry getting evicted if the other direction confirms the RST/FIN or the entry gets reset on the next non RST packet in the direction of the initial RST. Presence of the connection tracking entry is only used for REPLY and RELATED, otherwise the policy table is always considered for policy purposes. This will guarantee that connections get dropped as soon as policy no longer allows the connection. Fixes: #2697 Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:43:46 UTC
676f395 Thomas Graf 08 February 2018, 19:22:59 UTC Documentation: Add diagram to explain Kubernetes iptables rules integration Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 21:05:41 UTC
2f76eb2 Ray Bejjani 05 February 2018, 13:05:14 UTC controller: Add StopFunc on controller exit When a controller exits it might need to cleanup or indicate that it exited. StopFunc is called as the controller shuts down. Signed-off-by: Ray Bejjani <ray@covalent.io> 08 February 2018, 18:57:22 UTC
b6d894a Ray Bejjani 08 February 2018, 15:33:25 UTC controller: Do not reuse controller struct & stats When updating a controller we reusued the existing struct. The docs state that we reset the statistics but this usage does not. It also allows for a race where the running controller will lookup c.params but this has now changed as part of the update. Signed-off-by: Ray Bejjani <ray@covalent.io> 08 February 2018, 18:57:22 UTC
2570f3d Ray Bejjani 05 February 2018, 12:06:41 UTC controller: Simplify DoFunc init handling Signed-off-by: Ray Bejjani <ray@covalent.io> 08 February 2018, 18:57:22 UTC
222b83f Ray Bejjani 06 February 2018, 18:22:34 UTC k8s: extract reusable CRD registration logic The current code is specific to the only CRD we register, CiliumNetworkPolicy. We will need to register more CRDs in the future but ensure that they are all managed the same way. Signed-off-by: Ray Bejjani <ray@covalent.io> 08 February 2018, 18:56:57 UTC
075b06d Ray Bejjani 06 February 2018, 18:16:01 UTC k8s: Stop setting CRD validation gratuitously on startup The order of operations we used while setting up the CiliumNetworkPolicy CRD meant that we always saw the cluster CRD lacking validation. This fetches a correct copy when we fail to create the CRD on startup. Signed-off-by: Ray Bejjani <ray@covalent.io> 08 February 2018, 18:56:57 UTC
5343e86 Thomas Graf 08 February 2018, 15:31:01 UTC tests: Wait for Cilium to start up in CIDR limit test The 20-cidr-limit.sh test will start Cilium again in the cleanup function but does not wait for it to come up properly so when the next test is being run, Cilium is not ready yet which will result in test failures. Fixes: #2744 Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 16:35:47 UTC
bf75a81 Eloy Coto 08 February 2018, 14:36:48 UTC Ginkgo: Added a new helper to ensure pods are terminated. Added a `WaitCleanAllTerminatingPods` to be sure that all pods are deleted and not in Terminating state when other test start. This commit fixes some issues in the latest Jenkins builds: https://jenkins.cilium.io/job/Ginkgo-CI-Tests-Pipeline/1291/ Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 08 February 2018, 16:35:27 UTC
a324e6e André Martins 07 February 2018, 15:30:58 UTC replace jteeuwen/go-bindata with cilium/go-bindata Signed-off-by: André Martins <andre@cilium.io> 08 February 2018, 15:58:22 UTC
1fd8e48 Thomas Graf 08 February 2018, 14:40:14 UTC agent: Relax FORWARD accept rule from/to cluster The -i cilium_host restriction on the FORWARD rule was not working properly, relax the restriction on the rule and allow forwarding all traffic from the known cluster prefix. Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 15:56:28 UTC
119ffc3 Thomas Graf 08 February 2018, 12:15:14 UTC agent: Move iptables rules to clear KUBE-MARK-MASQ to mangle table Kubernetes 1.9 has introduced new iptables rules a part of the FORWARD chain in the filter table: -m mark --mark 0x4000/0x4000 -j ACCEPT -s 10.233.64.0/18 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -d 10.233.64.0/18 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT Because it is impossible to guarantee the order of iptables rules with multiple writers, the following rule required by Cilium did no longer take any effect -o cilium_host -j MARK --set-xmark 0x0/0x4000 The rule is required to ensure that Cilium can choose the source IP to masquerade to. By moving the above Cilium rule to the mangle table in POSTROUTING, it is guaranteed to run before the kube-proxy rules residing in the filter table. This also makes NodePort services available from local processes. Fixes: #2505 Fixes: #2495 Signed-off-by: Thomas Graf <thomas@cilium.io> 08 February 2018, 15:56:28 UTC
05d53f2 Ray Bejjani 08 February 2018, 11:26:51 UTC proxy: Refactor goto in CreateOrUpdateRedirect We introduce a loop constructed with a goto. This is an uncommon go construct and, in this case, isn't necessary for the function to work. The loop is now clearly a loop and it's continue/exit decision point is more explicit. Signed-off-by: Ray Bejjani <ray@covalent.io> 08 February 2018, 15:09:47 UTC
411e5c5 Romain Lenglet 08 February 2018, 00:18:26 UTC api: Remove PortRule.RedirectPort field The redirectPort field in the policy API's PortRule was not tested, not officially documented, and doesn't work in some cases, notably whenever any L7 rule applies to the same port. Moreover, K8s's NetworkPolicy doesn't have any such field. Such port redirection can be implemented by K8s services, so it's redundant. Fixes #2743 Signed-off-by: Romain Lenglet <romain@covalent.io> 08 February 2018, 04:50:24 UTC
953f7c6 Thomas Graf 07 February 2018, 22:30:15 UTC proxy: Retry redirect creation a couple of times Combined with the random port allocation, this can work around ports within the proxy range which cannot be used. Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 23:37:11 UTC
cefa4a6 Thomas Graf 07 February 2018, 22:05:15 UTC proxy: Use random port number allocation Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 23:37:11 UTC
ba2d8bf Thomas Graf 07 February 2018, 21:56:58 UTC proxy: Delay release of redirect ports after use Immediate reuse can lead to errors on the listen() system call. Delay the release of the port from the map of used ports so the port can be properly released in the kernel and is ready for re-consumption. Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 23:37:11 UTC
60fadda Thomas Graf 07 February 2018, 21:45:38 UTC proxy: Use kvstore backed identity cache for label resolution The policy package maintains a cache of all identities synchronized via kvstore events. Use this cache to translate security identities to labels. Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 23:16:25 UTC
05eb2d1 Eloy Coto 07 February 2018, 18:53:04 UTC Ginkgo: Added --all-controllers on ReportDump Added the full output of `cilium status` with the option --all-controllers Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 07 February 2018, 20:45:39 UTC
24f254a André Martins 06 February 2018, 23:31:37 UTC pkg/k8s: mirror parseNetworkPolicy for kubernetes NP v1beta1 Signed-off-by: André Martins <andre@cilium.io> 07 February 2018, 17:02:15 UTC
86fd7c4 André Martins 06 February 2018, 23:22:12 UTC k8s: set up informers / controllers based on api-server version Since kubernetes automatically adds a v1 network policy to both v1 and v1beta1 resources and a v1beta1 network policy also to both v1 and v1beta1 resources, it will be useless to watch for both resource types at the same time. For that reason it was added a kube-apiserver version detection to set up the necessary informers / controllers based on the kube-apiserver version detected. For example, if kube-apiserver is running with version 1.6. only the Cilium TPR (v1) and the kubernetes network policy v1beta1 controllers will be started. If kube-apiserver is running with version 1.8 only the Cilium CRD (v2) and the kubernetes network policy v1 controllers will be started. Signed-off-by: André Martins <andre@cilium.io> 07 February 2018, 17:02:15 UTC
ed527e7 Thomas Graf 06 February 2018, 16:18:57 UTC tests: Fix up identity-list tests * The test was assuming that the kvstore still knew about an identity from a previous test * Do not depend on the exact formatting of the CLI Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 16:41:18 UTC
d9a7403 Thomas Graf 05 February 2018, 22:09:42 UTC ginkgo: Double time for monitor to pick up relevant messages Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 16:41:18 UTC
dc2780b Thomas Graf 31 January 2018, 23:51:22 UTC cli: Add "cilium kvstore (get|set|delete)" tooling Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 16:41:18 UTC
7ccf877 Thomas Graf 31 January 2018, 23:51:22 UTC kvstore: New kvstore abstraction API - Basic lockless operations: - Get, GetPrefix, ListPrefix, Set, Delete, DeletePrefix, CreateOnly - ListAndWatch, CreateLease, KeepAlive - Advanced operations (etcd: lockless, consul: locking required) - CreateIfExists - Unit tests automatically test etcd and consul backends in single run, no need for special make targets anymore - Abstracted encoding of keys to allow for binary keys - New generic allocator: - Maps keys to identifiers using lockless operations in the fast path - Uses TTLs to protect reference counting keys in case the node disappears - Utilizes garbage collector which uses distribtued locks to release unused identities - Local cache of all identities and keys for fast allocation and retrieval - Local reference counting if key->id mapping is used multiple times from a single node - Prepared to support lockless operations with etcd 3.3 Fixes: #915 Fixes: #916 Fixes: #2629 Signed-off-by: Thomas Graf <thomas@cilium.io> 07 February 2018, 16:41:18 UTC
e9e57cc Romain Lenglet 30 January 2018, 06:42:55 UTC envoy: Implement an Envoy xDS protocol server Signed-off-by: Romain Lenglet <romain@covalent.io> 07 February 2018, 15:36:03 UTC
0a244ba Eloy Coto 07 February 2018, 10:28:16 UTC Ginkgo: Updated Kube-dns version Fixes #2732 Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 07 February 2018, 13:25:09 UTC
ce77645 Joe Stringer 07 February 2018, 11:29:34 UTC Miscellaneous makefile fixes (#2736) * test: Fix 'go vet' issues Fix unreachable code and improper usage of logging functions identified by running 'go vet' against test/. Signed-off-by: Joe Stringer <joe@covalent.io> * Makefile: build tags for test/ test/ was previously excluded from GOFILES to avoid running go test inside that directory. However, it's useful to have tags files for symbols used in ginkgo tests. Add the test/ directory to GOFILES, then add a new variable that contains all of the packages we intend to test (and use those in the various testing targets). Signed-off-by: Joe Stringer <joe@covalent.io> * Makefile: Fix GIT_VERSION build and clean GIT_VERSION was relying on '.git', which is not guaranteed to change when git commands are executed. This allowed it to retain an outdated SHA in the file. The 'clean' target previously wouldn't clean this file, so as a result when building docker images, all of the cilium binaries would include the wrong git SHA in their version information. Ultimately when deploying such a docker image, cilium would crash on startup with the following message: level=info msg="Cilium w.x.y-z <outdated-sha> ... level=info msg="cilium-envoy version: <correct-sha> ..." level=fatal msg="Envoy version mismatch, aborting." Modify the 'clean' target to clear out this file to ensure that docker builds get the correct git commit SHA. Signed-off-by: Joe Stringer <joe@covalent.io> 07 February 2018, 11:29:34 UTC
19cbd1c Thomas Graf 06 February 2018, 15:42:55 UTC cilium-health: Reduce verbosity under normal operation * Avoid empty warning message in log * Remove useless namespace deletion message * Degrade command being invoked to debug level * Remove info message that permission was modified on unix domain socket Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
eea076d Thomas Graf 06 February 2018, 15:38:08 UTC agent: Reword logging message for endpoint restoration Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
58d936f Thomas Graf 06 February 2018, 15:29:34 UTC workloads: Reword log message when not managing container Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
a87538f Thomas Graf 06 February 2018, 14:45:21 UTC agent: Reword message when removing obsolete BPF maps Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
c7b68a7 Thomas Graf 06 February 2018, 14:27:40 UTC policymap: Provide debugging while validating maps msg="Unified diff:" subsys=policy-map msg="--- b" subsys=policy-map msg="+++ a" subsys=policy-map msg="@@ -1,9 +1,9 @@" subsys=policy-map msg=" &bpf.Map{" subsys=policy-map msg=" MapInfo: bpf.MapInfo{MapType:1, KeySize:0x8, ValueSize:0x18, MaxEntries:0x400, Flags:0x0, OwnerProgType:0}," subsys=policy-map msg="- fd: 0," subsys=policy-map msg="+ fd: 14," subsys=policy-map msg=" name: \"cilium_policy_reserved_4\"," subsys=policy-map msg=" path: \"/sys/fs/bpf/tc/globals/cilium_policy_reserved_4\"," subsys=policy-map msg=" once: sync.Once{}," subsys=policy-map msg=" lock: lock.RWMutex{}," subsys=policy-map msg=" NonPersistent: false," subsys=policy-map msg=" }" subsys=policy-map Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
ca48bb7 Thomas Graf 06 February 2018, 13:43:17 UTC node: Reword allocation prefix generation log mesage Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
72036e3 Thomas Graf 06 February 2018, 13:42:19 UTC agent: Indent bootstrap addressing information: msg="Addressing information:" msg=" Local node-name: cilium-master" msg=" Node-IPv6: fdff::ff" msg=" External-Node IPv4: 10.0.2.15" msg=" Internal-Node IPv4: 10.11.28.238" msg=" Cluster IPv6 prefix: f00d::/64" msg=" Cluster IPv4 prefix: 10.0.0.0/8" msg=" IPv6 node prefix: f00d::a0f:0:0:0/96" msg=" IPv6 allocation prefix: f00d::a0f:0:0:0/112" msg=" IPv4 allocation prefix: 10.11.0.0/16" msg=" IPv6 router address: f00d::a0f:0:0:8ad6" Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
e02faa3 Thomas Graf 06 February 2018, 11:04:04 UTC endpoint: Improve policy calculation logs * Shorten containerID strings * Degrade "Forced rebuild" message from info to debug * Reword language Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
190a39c Thomas Graf 06 February 2018, 13:34:37 UTC policy: Print policy revision in log on policy import "Policy imported via API, recalculating..." policyRevision=2 Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
bec6842 Thomas Graf 06 February 2018, 10:47:03 UTC k8s: Improve logging on CRD/TPR installation * Degrade "CRD validation is different, updating it..." to debug * Degrade "Creating CiliumNetworkPolicy/v1 ThirdPartyResource" to debug * Consistent "Installed CustomResourceDefinition CiliumNetworkPolicy/v2" for CRD and TPR Signed-off-by: Thomas Graf <thomas@cilium.io> 06 February 2018, 18:44:11 UTC
back to top