Skip to main content

Browse the archive

https://github.com/cilium/cilium
09 April 2024, 21:14:05 UTC
sort by:
Revision Author Date Message Commit Date
e6befe1 Thomas Graf 22 April 2018, 17:23:54 UTC Prepare for 1.0.0-rc14 release Signed-off-by: Thomas Graf <thomas@cilium.io> 22 April 2018, 17:59:58 UTC
b4cb0ca Jarno Rajahalme 20 April 2018, 23:07:28 UTC envoy: Use distinct Stats stores for each instance of a xDS client. [ upstream commit 2110a64e4b51d1baef6efa21557621b11968cf21 ] Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
2270bfe Jarno Rajahalme 20 April 2018, 23:07:28 UTC envoy: Minor cleanup. [ upstream commit 181fada8bbe3de78c40ce160b81c61c67cc47d92 ] Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
2662716 Jarno Rajahalme 20 April 2018, 23:07:27 UTC envoy: Initialize thread local host map with an empty map. [ upstream commit 94be14c72260cde45d1b7a981bb3629e7d54d3f5 ] Initialize with an empty map instead of a nullptr to make it less likely that a null pointer is found when resolving. Due to worker threads possibly initializing later than the main thread it is still possible (at least in theory) that a worker thread resolves before initializing so we still check the value of the thread local pointer. Perform the null pointer check before dereferencing it, as libc++ assertions fail otherwise. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
6b3f8cb Romain Lenglet 20 April 2018, 21:44:01 UTC npds: Don't wait for ACK from sidecar proxy with no L7 rules [ upstream commit 0118ac2c39df0070743107f89dc4e1f2e78678f5 ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
21742ba Romain Lenglet 20 April 2018, 20:32:46 UTC npds: Don't update NetworkPolicy if none has been calculated [ upstream commit 553ba7163c96e4af595e21af7119c7866168f473 ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
7d571e7 Joe Stringer 20 April 2018, 17:57:13 UTC xds: Validate NPHDS updates before upserting [ upstream commit c2adbfe63c7058ffad74dfb8e4ff6006a4fd6386 ] This should catch recent errors such as the one reported in #3825. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
cf8c68e Ian Vernon 20 April 2018, 17:05:32 UTC ginkgo-kubernetes-all.Jenkinsfile: increase timeouts [ upstream commit 803bd5437ad4d2a991b472035686f0f46ae32c86 ] Use a more generous timeout to allow for variability in build times. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
2172cd1 Thomas Graf 20 April 2018, 15:29:05 UTC workloads: Silence noisy harmless warning [ upstream commit 53065cc51a7ac148571e7bafa160c354d99d3fa7 ] The following warning is repeated up to 20 times when a container create event is being handled but the container has already exited again: level=warning msg="Unable to inspect container, retrying..." containerID=ad5fd3ea00 error="unable to inspect container 'ad5fd3ea0031e00f5d0dbaac16b69bfb6c3b9d2894cbcf326be86ae2dd67df5f': Error: No such container: ad5fd3ea0031e00f5d0dbaac16b69bfb6c3b9d2894cbcf326be86ae2dd67df5f" maxRetry=20 retry=8 subsys=containerd-watcher The warning is absolutely harmless, move it to a debug message. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
92faf3d André Martins 20 April 2018, 15:05:00 UTC k8s: only watch for ingress changes if LB is enabled [ upstream commit 94f9a2cd4c2d24acc5f1159c507a2dc04a36c37f ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
b746224 Joe Stringer 19 April 2018, 19:00:58 UTC ipcache: Avoid issuing delete for identity=0 [ upstream commit 3a7ceb132e0b3db1ec4bc7e367dbfdc09087ba70 ] Fixes: b6c5cb0f1bf5 ("ipcache: Shift NPHDS logic to envoy") Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
f0dfa85 André Martins 19 April 2018, 00:00:19 UTC start.sh: add routes based on VM name [ upstream commit 4923337104969f95825013f1b162ee935dc0d969 ] Add routes without hardcoded VM prefix name Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
ce6b79e André Martins 18 April 2018, 23:59:33 UTC Vagrantfile: re-add workaround for kube-proxy in node-2 [ upstream commit d5795a3405b44cbf2610e1096d397f79f64325c2 ] Since kube-proxy doesn't redirect traffic to the proper interface when translating from service IP to backend IP we need to re-add this workaround. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
8183260 Jarno Rajahalme 19 April 2018, 01:27:06 UTC envoy: Manage life-cycles of singleton maps properly. [ upstream commit 3179a2c326762d5c3b3e90a992a75a09b2183940 ] Both policy and host maps are managed as singletons, which are initialized when first required, and destructed when the last listener referring to them via Cilium filter instances is removed. Internally, the maps "post" configuration changes to Envoy worker threads via thread dispatch queues. These changes are packaged as C++ lambda closures. The problem with this is that while the "posts" are queued, it is possible for all the listeners to be removed, and thus the associated singleton maps being freed. If the posted closure refers to the (now stale) map, bad things can happen. Fix this by capturing either a weak or shared pointer to the lambda closure. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 22 April 2018, 04:45:20 UTC
e63acd9 Eloy Coto 19 April 2018, 16:33:15 UTC Backport: Don't failfast on branch V1.0 Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 20 April 2018, 18:39:16 UTC
7f322b0 André Martins 19 April 2018, 21:56:50 UTC k8s/specs: update image tag to v1.0.0-rc13 Signed-off-by: André Martins <andre@cilium.io> 20 April 2018, 16:57:27 UTC
a8a85ed André Martins 19 April 2018, 21:54:59 UTC k8s/specs: change imagePullPolicy to IfNotPresent Since we never change the image of docker image releases we can change the imagePullPolicy to IfNotPresent to avoid wasting resources. Signed-off-by: André Martins <andre@cilium.io> 20 April 2018, 16:57:27 UTC
0361f2b André Martins 18 April 2018, 15:23:53 UTC k8s: add some fixes to the kubernetes spec file This fixes the previous commit which had the RestartAlways set in the wrong place. Restart always will guarantee that kubelet will restart cilium in case of failure. Fixes: (e200aaffc1) k8s: add some fixes to the kubernetes spec file Signed-off-by: André Martins <andre@cilium.io> 20 April 2018, 16:57:27 UTC
d873a25 Manali Bhutiyani 18 April 2018, 19:48:26 UTC Kafka : remove noise from logging EOF messages in Kafka parser We keep seeing a lot of these on normal client (produce/consume) connection close. We should not be logging valid EOF as errors. [ upstream commit d9143000325e61a9ed63817b453f7cffbf76de89 ] level=error msg="Unable to parse Kafka request; closing Kafka request connection" error=EOF id="rx:10.15.161.35:57590->10.15.28.238:10551<->tx:closed" Fixes: #3792 Signed-Off-By: Manali Bhutiyani <manali@covalent.io> Signed-off-by: Ray Bejjani <ray@covalent.io> 19 April 2018, 18:43:27 UTC
cf50c76 Romain Lenglet 14 April 2018, 09:26:01 UTC doc: Fix spelling [ upstream commit e89d35c2a21319b3f5ec2e19405aa6646652b1c4 ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Ray Bejjani <ray@covalent.io> 19 April 2018, 18:43:27 UTC
c745392 Romain Lenglet 12 April 2018, 19:05:14 UTC doc: Replace cilium-sidecar.yaml with a config map setting [ upstream commit 95d04e633f2e97244c5bc78c4fa0c6052466971d ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Ray Bejjani <ray@covalent.io> 19 April 2018, 18:43:27 UTC
e200aaf André Martins 18 April 2018, 15:23:53 UTC k8s: add some fixes to the kubernetes spec file Restart always will guarantee that kubelet will restart cilium in case of failure. Signed-off-by: André Martins <andre@cilium.io> 19 April 2018, 04:15:01 UTC
87aa854 Jarno Rajahalme 16 April 2018, 23:06:15 UTC docs: Refine backporting instructions. [ upstream commit 9f25a9058963800edf3b368aa9d617856f121f1c ] Refine backporting instructions by explicitly specifying how to use GitHub labels. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
64c03f0 Joe Stringer 17 April 2018, 22:13:47 UTC policy: Support reserved:cluster entity [ upstream commit 45038629e6e7a881bf6f8a3f91ed34f8a6e61828 ] The support for this entity was already plumbed through most of Cilium, it just wasn't exposed in the API. Expose it there. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
8a9a6a5 Joe Stringer 17 April 2018, 16:55:39 UTC monitor: Fix CT entry dst port printing [ upstream commit 1355c81a101fc489eaa083b9946874d0d186b2e2 ] Ports were not being printed correctly for ports in CT entry monitoring output. Fix it. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
aadca0d Joe Stringer 17 April 2018, 06:51:57 UTC xds: Add tests for cache.Lookup [ upstream commit c6612a9c6a69bc5e3cffe91d74afd5f4c53267f1 ] Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
7ae3ba6 Joe Stringer 13 April 2018, 18:34:32 UTC daemon: Push reserved IP->Identity mappings to XDS [ upstream commit 11c8f3923fb538a583a3e45c9cf1530e9f6312b1 ] Previously we were only handling the BPF case and missing these IPs in XDS, so presumably we would not apply L3/L4 policies correctly for the XDS (eg Envoy sidecar) case. CC: Ian Vernon <ian@cilium.io> Fixes: 7448e41aa047 ("endpoint: sync endpoint IP-SecID map to kvstore") Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
9ea1c96 Joe Stringer 16 April 2018, 21:35:20 UTC envoy: Handle IP->ID deletes inside cache [ upstream commit e24b30d6dc2dce7cd5866f7cdb78958f4fe94296 ] Don't reach back up to the ipcache to handle deletes like this, rather look through the cache and update the entries in place. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
36bbfe5 Joe Stringer 13 April 2018, 07:26:37 UTC ipcache: Shift NPHDS logic to envoy [ upstream commit b6c5cb0f1bf5b8496c89c89ffaff4c2740fe3ba5 ] There was a bunch of Network Policy Hosts Discovery Service logic littering the ipcache logic, shift it into envoy. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
7a4b94e Ian Vernon 17 April 2018, 19:55:04 UTC pkg/envoy: always use dport in proxy statistics [ upstream commit a1e7a25405a8a65285af4a1dd00b8c93d478ec17 ] Even on egress, rules are always defined with 'ToPorts'; thus, in proxy statistics, only use the port to which traffic is flowing (destination port). Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
860c19f Joe Stringer 16 April 2018, 22:42:17 UTC bpf: Fix log message about not supporting CIDR [ upstream commit f3ca26e764ce25d9c8f946ec8088cd295e4d0815 ] Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
8989880 Ian Vernon 05 April 2018, 21:12:51 UTC bpf/lib: unconditionally create ipcache bpf map in datapath [ upstream commit b2e94027ec0f901a189380f1b22740a960cd760c ] In case the opening and creating of the map in userspace fails, it now will be unconditionally created in the datapath. This will not affect the datapath because the lookup into the map is only performed when egress policy is enabled in the datapath for a specific endpoint. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
4155c14 Ian Vernon 04 April 2018, 20:37:05 UTC pkg/bpf: add additional logging and error handling [ upstream commit 5df8397ee957021550e21997e4c1e3f8ac4a06a7 ] * Add logs for when we append to list of maps to open after bpffs is mounted. * Log errors that occur when opening / creating maps which are stored in list of maps to open after bpffs is mounted. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
f612888 Ian Vernon 06 April 2018, 07:58:01 UTC pkg/logging/logfields: add log field for BPF map name [ upstream commit 09f1936d39f21704036385286e5d72a90c3eb393 ] Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
030f253 Ian Vernon 04 April 2018, 19:20:33 UTC pkg/maps/ipcache: log if map unable to be opened [ upstream commit 11091ed6611867a8274d55e798f1973777b6d79f ] Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 19 April 2018, 03:41:11 UTC
cf4887c Thomas Graf 18 April 2018, 21:25:45 UTC Disable code owners reviews in 1.0 branch Signed-off-by: Thomas Graf <thomas@cilium.io> 18 April 2018, 22:22:03 UTC
02bea38 Ray Bejjani 17 April 2018, 12:08:21 UTC scripts: contrib/backports/check_stable prints PR link [ upstream commit 63b39052f349da7c87c5f4a8d1a7c02e823fe5e2 ] Signed-off-by: Ray Bejjani <ray@covalent.io> 17 April 2018, 18:49:49 UTC
ecdc2d2 Ray Bejjani 17 April 2018, 12:05:26 UTC scripts: contrib/backports/check_stable handles backports-done label [ upstream commit 29cab3a38109a5349fc37e0dfa55b64ae291fd9f ] We sometimes leave the "stable/backport-done" label on PRs. Instead of confusing ourselves, we now filter these out. Signed-off-by: Ray Bejjani <ray@covalent.io> 17 April 2018, 18:49:49 UTC
ff19397 Eloy Coto 16 April 2018, 14:13:14 UTC Test: Increase logs for Kube-dns issues [ upstream commit 25c80eb7b366977f6d2696d0bc19bd110d1e0647 ] - Added kubedns logs in reportFailed. - Added a new fallback option in `WaitForKubeDNSEntry` to know in case of fail if the issue is that the DNS entry does not exits, or cannot connect to kube-dns service. - Use service IP instead of the kube-dns pod IP. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: Ray Bejjani <ray@covalent.io> 17 April 2018, 18:49:49 UTC
62c48d7 Thomas Graf 15 April 2018, 16:50:03 UTC Prepare for 1.0.0-rc13 Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:29:04 UTC
2e0c7fa Thomas Graf 15 April 2018, 02:02:09 UTC policy: Add TestWildcardL4RulesIngress and TestWildcardL4RulesEgress [ upstream commit 82950581c84eec44bfbc3209db0f8de80344a8aa ] Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
5f4e908 Ian Vernon 13 April 2018, 04:08:19 UTC pkg/policy: change parser type logic for merging L4Filter [ upstream commit 3ebcca016553f7e9bd80b512f9e9471f5df9d0c6 ] If any L4Filters being merged together have rules on L7, even if one of the rules allows all on L7, allow all on L7, but set the parser type of the be the L7Parser type of the L4Filter which contains L7-related rules. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
4d664df Ian Vernon 12 April 2018, 17:37:54 UTC pkg/policy: do not use length checks on L4Filter.Endpoints [ upstream commit 030fea128ec7636fcc374f608842b5e25803287a ] Length of this slice is not a reliable indicator of what information is encoded in the slice anymore because we now use the WildcardEndpointSelector within this slice to represent that the L4Filter selects all endpoints. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
7ca251e Ian Vernon 12 April 2018, 17:24:10 UTC pkg/policy: remove redundant length check in AllowsAllAtL3 [ upstream commit 62db3530301bd6f93e803a5a20da19ecfbb0fb7d ] This length check is performed within EndpointSelectorSlice.SelectsAllEndpoints, so just remove it from AllowsAllAtL3. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
9474fd5 Romain Lenglet 14 April 2018, 11:26:25 UTC test: Force using IPv4 for egress connections to google.com [ upstream commit 232274b5a25fc847644a8aefed88b85a6b4ec91f ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
7e8491d Romain Lenglet 14 April 2018, 08:18:40 UTC test: Always execute "cilium endpoint get" with -o json [ upstream commit 5dc1865b7527e324d8cc142446441742c447ff8a ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
0b2517e Romain Lenglet 14 April 2018, 07:12:55 UTC policy: Replace adding L3-only rules into L4PolicyMap with extra loop [ upstream commit 6b0115c81e38f06feac767f4a1f656c2518742d7 ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
e5938c4 Romain Lenglet 13 April 2018, 22:37:56 UTC policy: Synthesize wildcard L7 rules for L3-only rules [ upstream commit 8c0ba61abf47844e27252b64f3a912fbc1fc23c8 ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
aef393c Romain Lenglet 12 April 2018, 18:44:27 UTC test: Fix Star Wars demo test [ upstream commit 9da6d710df4a286dc35c2aee61264b85ebceb3fc ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
10724e7 André Martins 14 April 2018, 00:04:33 UTC test: fix star wars demo [ upstream commit 645afa10741355d6fcd09c316ac01def0024a928 ] Once a new endpoint is created, it can trigger regeneration for all the remaining endpoints. By not checking if all of them were in ready state before testing the connection all the traffic could potentially be dropped until the security labels are assigned to that particular endpoint. Since the communication was always denied, before the endpoint had its security ID assigned, the tests would always fail as it was expecting the connection to be successfull. For this reason we should wait for all endpoints to be in ready state before testing out any connection tests. As an example for endpoint 36125 the monitor would show the following: ``` <- endpoint 36125 flow 0xfd750d60 identity 0->0 state new ifindex 0: 9a:1a:e4:12:33:29 -> ff:ff:ff:ff:ff:ff ARP -> lxc8d11b: ca:f4:2e:75:46:11 -> 9a:1a:e4:12:33:29 ARP <- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp xx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp <- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp xx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp <- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp xx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp <- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp xx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp >> Endpoint regenerated: 36125 (k8s:class=spaceship,k8s:org=alliance,k8s:io.kubernetes.pod.namespace=default) <- endpoint 56687 flow 0xb1f87f1 identity 21577->0 state new ifindex 0: fe80::c41d:a6ff:fef1:7998 -> ff02::2 RouterSolicitation ``` Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
34846e9 Jarno Rajahalme 13 April 2018, 23:30:38 UTC bpf: Make all funtions in lib/policy.h conditional on DROP_ALL [ upstream commit 786376ee9c1489505f722f20e5b20e35f7b7e9ad ] Make all policy decision functions conditional on DROP_ALL to avoid regressions in future. Suggested-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
a068821 Jarno Rajahalme 13 April 2018, 23:02:04 UTC bpf: Honor DROP_ALL also in ingress to a container. [ upstream commit ce741afa31adcc7fb39939112f64fc2e3c757d0d ] Even if DROP_ALL is defined, the bpf program can be compiled so that the actual ingress policy check returns OK (e.g., POLICY_INGRESS not defined). Check for DROP_ALL in higher level code that is not conditional to any other compile time definitions. Fixes: https://github.com/cilium/cilium/issues/3731 Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
6a127e9 Jarno Rajahalme 13 April 2018, 20:13:56 UTC envoy: Remove assert, reduce logging. [ upstream commit 1e1fbbd899c625f809ab12d794e8c5c2b32f46e7 ] Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
9ea7a10 Thomas Graf 13 April 2018, 06:44:46 UTC policy: Do not wildcard CIDR 0/0 for world and all entity [ upstream commit 118ad8232628214938e3955cb14bf43cce55b482 ] With the introduction of label based egress including the world and all identity, it is no longer required to whitelist CIDR 0/0 for the world and all entity as it is covered by the identity based policy map which also supports L4. This allows to define rules such as: [{ "endpointSelector": {"matchLabels": {}}, "egress": [{ "toEntities": ["world"], "toPorts": [ {"ports":[ {"port": "80", "protocol": "TCP"}, {"port": "53", "protocol": "UDP"} ]} ] }] }] Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
e1a49d9 Jarno Rajahalme 12 April 2018, 22:32:21 UTC daemon: Regenerate endpoint in PATCH handler also when endpoint is in waiting-for-identity state. [ upstream commit 3ba379a817e50a1b79192ff5cae48a647a832545 ] commit 41c08396ce ("daemon: Only regenerate in PATCH from valid state") intended to limit endpoint regeneration calls from the API PATCH endpoint handler to valid endpoint states, but inadvertently limited the allowed states only to waiting-to-regenerate, while the endpoint should also be built while in the waiting-for-identity state. The symptom was that endpoints created via docker never built the initial drop-all bpf program while waiting for identity. This commit allows endpoint regeneration via the PATCH endpoint API also when the endpoint is in wairing-for-identity state. Fixes: 41c08396ce ("daemon: Only regenerate in PATCH from valid state") Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
1384437 Joe Stringer 12 April 2018, 18:05:30 UTC tunnel: Remove old tunnel map upon upgrade. [ upstream commit b1955077d001b7570ac26d0131cb535a780bb795 ] This fixes up #3681 to ensure we don't end up with extraneous map entries on the filesystem after upgrade. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
36deff3 André Martins 11 April 2018, 12:45:23 UTC test: update kubedns to 1.14.9 [ upstream commit d0b8fe7be293f0c2c4e6253a7859a1aa507d33e9 ] Since kubedns 1.14.9 contains bug fixes it might help in kube-dns issues the CI is having Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
d93418d Joe Stringer 12 April 2018, 04:26:20 UTC bpf: Rename tunnel_endpoint_map -> cilium_tunnel_map [ upstream commit f117836ffaeb381b7db5d05f44843fc82a2586f5 ] Rename the tunnel endpoint map so it has the same prefix as all of the other cilium maps. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
94f2e03 Jarno Rajahalme 11 April 2018, 22:59:46 UTC envoy: Pass 'non-redirect' http traffic through. [ upstream commit 768fbdfc3163eea0289f6564ee8bf6db8f376ab1 ] Cilium only creates a host proxy redirect when the relevant policy has http rules. A sidecar proxy gets also traffic that would not have been redirected with a host proxy. To emulate the host proxy behavior we pass (allow) traffic through a sidecar if it is passed through by the bpf datapath and would not have been redirected to a host proxy. There are two cases in cilium network policy enforcement where we can detect that the given packet would not have been forwarded to a host proxy: 1. There is no port policy that covers this connection. Cilium always configures a port policy for a redirect, and hence if we find that there is no applicable port policy, the connection must have been passed by the bpf datapath to a sidecar and the sidecar proxy should pass it through, i.e., consider the decision made by the bpf datapath final. 2. There is a port policy, but it does not have any http rules. Again, in this case this request would not have been redirected to a host proxy, and we must consider bpf datapath policy decision as final by passing the request through the sidecar proxy. There changes are marked with TODOs as they will need to be reconsidered when a non-bpf datapaths are supported. Suggested-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
0df6e7b Jarno Rajahalme 12 April 2018, 17:44:03 UTC endpoint: Fix label replacement. [ upstream commit 8515b21011f2969f85c29f41957f2def6513f590 ] Fix bugs in label updates: - Information labels were never deleted - Information label assignments were logged even when nothing changed - Identity label updates never updated the Source or Value of an existing label Add unit test for label updates. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 16 April 2018, 03:13:58 UTC
0c78c4a Ian Vernon 11 April 2018, 18:28:51 UTC test/k8sT: do not access redis-master via hostname, only service IP [ upstream commit 99297d4143ac5717e6c172f2be41350ae2c33763 ] In K8s 1.7 tests, there are issues accessing redis-master via hostname. Disable accessing redis-master via its hostname until K8s 1.7 is updated in CI to a newer version. See GH-3462 for more information. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 April 2018, 07:38:24 UTC
4dcac3d Eloy Coto 11 April 2018, 10:27:31 UTC Test: Add separate logs per each cilium pod [ upstream commit b97c14d3fc13f1435fe0c510fee36b037dd5138d ] Fix 3636 Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 April 2018, 07:38:24 UTC
72942f6 Ian Vernon 10 April 2018, 18:24:00 UTC pkg/endpoint: log what caused policy changes [ upstream commit 1df6acc7e545ae8a2be4c9cb9af008dbfb72d493 ] Before this commit, we only logged whether policy was changed or not for a given endpoint or consumable, not what caused the policy change itself. To get more visibility into what might trigger regenerations, log at debug level what causes policy changes. Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 April 2018, 07:38:24 UTC
e29063f Romain Lenglet 11 April 2018, 19:13:38 UTC doc: Use K8s-version-specific YAML files in Istio GSG [ upstream commit 323973b644944944fa1b98a6e6abccbd2f148d2a ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 April 2018, 07:38:24 UTC
cd684ef Romain Lenglet 10 April 2018, 09:46:26 UTC examples/kubernetes: Generate daemon sets defs for sidecar mode [ upstream commit b542e40b54331f131c9c013274642555ac0869da ] Clean up examples/kubernetes/Makefile. Add support for V=0 quiet option. Add support for multiple daemon set definitions for each Kubernetes version. Generate */cilium-sidecar*.yaml daemon set files for running Cilium along with Istio. Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 April 2018, 07:38:24 UTC
00c2154 Romain Lenglet 04 April 2018, 15:48:16 UTC doc: Update Istio GSG for Istio 0.7.0 [ upstream commit a04087ac01560b6cb0070049e029ced2710d3ece ] Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 13 April 2018, 07:38:24 UTC
f5715e8 André Martins 10 April 2018, 23:58:42 UTC examples/k8s: fix 1.8 spec files Signed-off-by: André Martins <andre@cilium.io> 11 April 2018, 22:56:08 UTC
3a20bad André Martins 10 April 2018, 17:06:04 UTC examples/k8s: change image to point to 1.0 Signed-off-by: André Martins <andre@cilium.io> 11 April 2018, 22:56:08 UTC
3e2f87a Eloy Coto 03 April 2018, 10:29:14 UTC Test: trigger AfterFailed before AfterEach when is in Context [ upstream commit cb9020a3996555ab7444d44c1434f863dea1340b ] When a context is defined with a AfterEach the AfterEach function will be called before `JustAfterEach` and `AfterFailed` and some info cannot be retrieved correctly because no longer exits. With this commit all the `JustAfterEach` and `AfterFailed` will be called just before the AfterEach. Fix #3481 Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 11 April 2018, 21:50:19 UTC
446c56e Thomas Graf 10 April 2018, 22:30:15 UTC health: Do sanity checking on health response [ upstream commit c9b0328ba5aeff9cf201972a78c3791c41978045 ] Check all fields for potential nil pointers. Some of the fields can be omitted if the health API is triggered while the agent is still bootstrapping. Fixes: #3628 Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 11 April 2018, 21:50:19 UTC
cb8c413 André Martins 11 April 2018, 11:40:18 UTC pkg/node: fix nil pointer dereference [ upstream commit 7a733601f25665637e5a6d760d33bfcda0ae1dad ] If a node doesn't have any IPv6 address cilium can panic while trying to delete the IPv6 routes of that node. Signed-off-by: André Martins <andre@cilium.io> Reported-by: Markus Padourek <markus.padourek@gmail.com> Signed-off-by: Eloy Coto <eloy.coto@gmail.com> 11 April 2018, 21:50:19 UTC
d602827 Romain Lenglet 09 April 2018, 20:53:32 UTC proxy: Create access log file and setup notifier at startup [ upstream commit 1024913b09ee4a76511e9f7028fdd5528b6df649 ] Move the access log file and notifier and metadata configuration at daemon startup instead of when creating the first redirect, so access logging is usable with sidecar proxies, for which Cilium doesn't create redirects. Signed-off-by: Romain Lenglet <romain@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
ab265e9 Eloy Coto 10 April 2018, 11:09:54 UTC Bugtool: Add gops output [ upstream commit 4fa2bcad0d1c92e12dffdf89513fb59aff915003 ] - Add gops output for cilium agent to know what happens to the agent in case of something wrong. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
999dfc4 Thomas Graf 10 April 2018, 07:41:48 UTC agent: Provide non-blocking agent status [ upstream commit 56d43d548e721d1fed50fb55ed2c00e8b4f789b9 ] Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
f2144f4 Thomas Graf 10 April 2018, 01:26:38 UTC bpf: Remove connection tracking entries on policy deny [ upstream commit 9095ef8918e38645be1e8a94342d84ea1978306f ] Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
9017181 Thomas Graf 10 April 2018, 01:48:13 UTC policy: Remove connection tracking cleanup on policy change [ upstream commit 4d8b510195807cf5a4c5e1f81c3b182a4a3c58f6 ] Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
d6bead6 Joe Stringer 09 April 2018, 21:46:03 UTC policy: Log errors inserting CIDR entries [ upstream commit 51fdcf01048a439b335c671a25db4954d7e20557 ] Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
e10e079 Joe Stringer 09 April 2018, 22:19:37 UTC cidrmap: Allow insert of any length of CIDR [ upstream commit 3ce8067d1b0fa810d3b2690efb2bde2e20cff78c ] Previously, when attempting to insert CIDRs that differ in length from the maximum prefix length of the protocol type (32 for IPv4, 128 for IPv6), we could end up rejecting the CIDR. Tweak it so that it will accept different CIDR lengths unless the CIDRMap is created without dynamic prefix length (The special XDP prefilter case). Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
c1be0f8 Thomas Graf 09 April 2018, 22:39:00 UTC policy: Do not make initial endpoint DROP_ALL mode dependent on policy option [ upstream commit b35644e0d05c74b0cc6697f3b5680b666aab4991 ] The current code only puts a DROP_ALL in place if the endpoint has ingress or egress policy enforcement enabled. This option is derived based on policies which select the endpoint so the option is likely still disabled at the time we determine this for the first time. This leaves the endpoint unprotected until the labels have been derived and thus policy could have been inspected to affect the ingress/egress policy enforcement bits. Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
71a537f Thomas Graf 09 April 2018, 21:26:05 UTC bpf: Remove proxy_port from conntrack table [ upstream commit 8152d64a1bdf49b3476cc141f1895cf87e3f0c11 ] It is no longer required as the policy map is used to derived the proxy port and the reverse translation occurs via proxymap. Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
b2e7426 Thomas Graf 09 April 2018, 21:36:05 UTC policy: Remove logic to reset proxy port [ upstream commit ca1f1fe757f03e5f3791cd0553fd65196fd635ce ] Since commit 52a948c40 ("bpf: Derive proxy_port from policy rather than CT"), the proxy port is always derived from the policy table. This makes it unnecessary to clean up the proxy_port in the connection tracking table and all of the logic can be removed. Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
78648e6 Michal Rostecki 09 April 2018, 09:36:44 UTC daemon/endpoint: Handle DeleteElement error properly [ upstream commit 0b19157050c95049bc23e9ca55936002d064b615 ] Error from lxcmap.DeleteElement should be added to the slice of errors, not override it. Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
e69cc64 Michal Rostecki 09 April 2018, 09:42:57 UTC pkg/endpoint: Don't declare errs variable in function scope [ upstream commit 5937a3262f482b1bf96bf71ad24f0f53510fdad1 ] errs variables are used only to get the result of applyNewFilter method and it should be declred in the smallest scope possible. Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
bca8c4e Michal Rostecki 09 April 2018, 10:01:21 UTC pkg/envoy/xds: Assign value to ip variable only if it's used [ upstream commit c9e509b0193dbc91b264d94fc8bbe0560b3b8049 ] `ip` variable is used only once, so there is no need of assigning the value of IstioNodeToIP everytime. Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
8dee87c Michal Rostecki 09 April 2018, 10:18:11 UTC pkg/ip: Assign value to allowedCIDRs variable only if it's used [ upstream commit e0e78841e2cfb90babd3c452b622235ef3f73658 ] The first value returned by RemoveCIDRs is not always used and it can be skipped once. Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
5ab6ad6 Michal Rostecki 09 April 2018, 10:35:11 UTC pkg/policy: Don't assingn unused variables [ upstream commit 816f2cfaea5171f350fe6d1bbbc32704e5f9fd84 ] Before this change, this package assigned `err` or any other vabiables regardless of whether they are actually used. In some cases, `err` variables were assigned properly, but they weren't checked. Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
01053b2 Michal Rostecki 09 April 2018, 10:38:38 UTC pkg/k8s: Remove unused `node` variable assignment [ upstream commit 9b1a40384bb2f718b760dcf720ea3876b31c4f4a ] Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
6335188 Michal Rostecki 09 April 2018, 10:49:07 UTC pkg/k8s: Assign value to `rules` variable only if it's used [ upstream commit c98584bdc55c59191c4b7d1a60d60076cc5177cf ] Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
b9edd95 Michal Rostecki 09 April 2018, 11:21:49 UTC pkg/kvstore: Handler error from Get method properly [ upstream commit 5316859b64e9ec9fe89d40968493eb5651892bc2 ] Signed-off-by: Michal Rostecki <mrostecki@suse.com> Signed-off-by: Thomas Graf <thomas@cilium.io> 11 April 2018, 02:12:46 UTC
85b39ad Thomas Graf 10 April 2018, 00:54:15 UTC Prepare for 1.0.0-rc11 release Signed-off-by: Thomas Graf <thomas@cilium.io> 10 April 2018, 01:03:34 UTC
1245007 Thomas Graf 06 April 2018, 21:03:18 UTC policy: Apply wildcarded source L7 rules to all sources [ upstream commit 7803dfab1e49eb99ff50ed64244deb799a02655c ] GetRelevantRules() encoded the following logic so for: 1. Find L3 source dependent L7 rules, if found, return 2. Otherwise fall back to wildcard section This is incorrect and not as permissive as needed. Wildcarded rules should apply regardless of the L3 source. Hence append the list of L7 rules regardless of the source Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
aeafb99 Jarno Rajahalme 04 April 2018, 00:51:36 UTC envoy: Update generated go-files for Cilium HTTP filter. [ upstream commit 7a2a21a0861136b8d8632f8a701383bba628f912 ] cilium_l7policy.proto was missing from Makefile.api, causing the HTTP filter configuration .pb.go files not being regenerated after recent changes. This has no functional impact due to Envoy APIs encoding filter configurations as embedded json structs, in order to allow a degress of extensibility without "changing the API". Hence we open-code the go structures needed for the filter configurations rather than relying on the generated .pb.go files. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
7e16062 Manali Bhutiyani 04 April 2018, 20:12:14 UTC docs: Correct spelling mistakes in the docs Fixes: #3523 Signed-Off-By: Manali Bhutiyani <manali@covalent.io> [ upstream commit 6142443cc87146cc66e0abe302f140a3d40f53e7 ] Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
784406f Thomas Graf 05 April 2018, 06:49:35 UTC cilium: Make cilium endpoint list resilient [ upstream commit a996c8ae21fbe47a66b412fa14422c4ee73f5370 ] ``` [signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x1715922] goroutine 1 [running]: github.com/cilium/cilium/cilium/cmd.listEndpoint(0xc4200fba00, 0xc421670b20, 0x1b96abb, 0xd, 0x1b8dc8d, 0x9) /go/src/github.com/cilium/cilium/cilium/cmd/endpoint_list.go:56 +0x42 github.com/cilium/cilium/cilium/cmd.printEndpointList(0xc4200fba00, 0xc42043f920, 0x5, 0x6) /go/src/github.com/cilium/cilium/cilium/cmd/endpoint_list.go:117 +0x131 github.com/cilium/cilium/cilium/cmd.listEndpoints() /go/src/github.com/cilium/cilium/cilium/cmd/endpoint_list.go:79 +0x126 github.com/cilium/cilium/cilium/cmd.glob..func23(0x2a62ba0, 0x30654a8, 0x0, 0x0) /go/src/github.com/cilium/cilium/cilium/cmd/endpoint_list.go:43 +0x20 github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).execute(0x2a62ba0, 0x30654a8, 0x0, 0x0, 0x2a62ba0, 0x30654a8) /go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:648 +0x234 github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).ExecuteC(0x2a66940, 0x0, 0xc420000260, 0xc4207cdf40) /go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:735 +0x2fe github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).Execute(0x2a66940, 0x0, 0x172df96) /go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:693 +0x2b github.com/cilium/cilium/cilium/cmd.Execute() /go/src/github.com/cilium/cilium/cilium/cmd/root.go:46 +0x31 main.main() ``` Fixes: #3543 Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
b2a7818 André Martins 05 April 2018, 13:52:24 UTC docs: update k8s dependencies to 1.10.0 [ upstream commit 9d6f7ac0ad6541878ac5513dbb031107fc38da86 ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
03beddb André Martins 05 April 2018, 13:26:36 UTC vendor: update k8s dependencies to 1.10.0 [ upstream commit e856b95bc73e212f31b4d79510c160e0a0ff821a ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
78400a3 Joe Stringer 04 April 2018, 23:19:14 UTC daemon: Sync loadbalancer BPF maps from goroutine [ upstream commit 0ed89f975883b8c20b519d817df8156860a291c8 ] In setups with several cilium nodes, we have observed cilium startup blocking for significant periods (eg, one minute or more). One of the few points that blocks during startup for potentially long times is the synchronization of existing BPF loadbalancer maps with the KVStore on restart. If this takes too long, then in kubernetes environments cilium may end up being killed because it's not serving the Cilium API while this is happening. To work around such issues, run this logic in a separate goroutine in the background. In future, we can improve the logic to speed it up (see #3533). Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
0e264b2 Ray Bejjani 04 April 2018, 10:14:22 UTC api: Switch API version from v1beta to v1 [ upstream commit f3376543097590d6cbb1b1488e486ce10fe5de41 ] Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
8367094 Eloy Coto 06 April 2018, 16:21:12 UTC Test: Do not gather envoy.log [ upstream commit fad2e59d6b72b04ee8e2f1aedddafa760bca4f55 ] Due adeacc11586b2529385924a72702d102fa8fe20b gather envoy log is not longer needed. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
9e82119 Joe Stringer 06 April 2018, 00:22:17 UTC docs: Document consistent CIDR policy [ upstream commit bdbccc5e142d0955a3769794880fb7aaf6a9ad5b ] See github issue #3565 for an extended discussion on the motivation of this change. Signed-off-by: Joe Stringer <joe@covalent.io> Signed-off-by: Jarno Rajahalme <jarno@covalent.io> 07 April 2018, 00:49:04 UTC
back to top