7dabf20 | Martynas Pumputis | 10 January 2020, 16:56:06 UTC | test: Fix DatapathConfiguration tests when running on >2 nodes Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
f97f004 | Martynas Pumputis | 10 January 2020, 16:31:46 UTC | test: Improve indentation of kubeproxy-free tests Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
c44de7d | Martynas Pumputis | 10 January 2020, 16:06:14 UTC | test: Run curl from k8s3 instead of client-from-outside container Previously, we ran curl from the "client-from-outside" container in the tests which required sending requests from a third host. We simulated the third host by running a container ("client-from-outside") in a Docker network which was not managed by Cilium. Unfortunately, requests sent to a NodePort service from the container were handled by bpf_sock.c which prevented from testing the NodePort implementation in bpf_netdev.c. Fix it by introducing a "real" host, and run curl from it. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
a477137 | Martynas Pumputis | 10 January 2020, 15:56:54 UTC | test: Run k8s1-1.11 net-next on 3 VMs This is going to be needed by some k8sT/Services.go tests. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
9005229 | Martynas Pumputis | 09 January 2020, 11:40:15 UTC | test: Allow provisioning arbitrary number of VMs Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
6feb6f0 | Martynas Pumputis | 08 January 2020, 10:55:07 UTC | nat: GC NAT entries created by DSR In the case of DSR, the following CT and NAT entries are created on a host which runs a service endpoint and to which a client request is forwarded: * NAT: endpoint -> client (XLATE_SRC aka TUPLE_F_OUT) * CT: client -> endpoint (TUPLE_F_IN) Previously, the CT GC ignored NAT entries when a corresponding CT entry was of the TUPLE_F_IN type. Therefore, the DSR NAT entries could not have been collected. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
fc0b605 | Martynas Pumputis | 23 December 2019, 17:36:11 UTC | test: Schedule test-nodeport-local pod on k8s2 For the DSR test case, we need to schedule the test-k8s2 (prev. test-k8s1) pod on k8s2. Otherwise, a request from the client-from-outside Docker container running on k8s1 to the pod via k8s2 (sending via k8s1 does not test the DSR) would be dropped by the kernel due to a routing loop detection mechanism: 1) k8s2 recv: client-from-outside (192.168.10.10) @ k8s1 -> k8s2:NodePort 2) k8s2 fwd to k8s1: client-from-outside (192.168.10.10) @ k8s1 -> Pod @ k8s1 3) k8s1 recv the packet on enp0s8, and has a route "192.168.10.0/24 dev $DOCKER_BRIDGE" <- kernel detects a potential loop. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
cce66ac | Martynas Pumputis | 19 December 2019, 17:16:57 UTC | test: Add DSR IPv4 integration tests Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:35 UTC |
83c850d | Martynas Pumputis | 22 October 2019, 12:51:04 UTC | datapath: Add DSR for NodePort BPF IPv4 This commit adds a direct server return (DSR) support for the NodePort BPF for IPv4 and in the direct routing mode. The main idea of DSR is to avoid SNAT'ing an original request sent to an LB, so that a backend could directly reply to a client (the originator of the request) and the original source IP could be preserved. To achieve this, we introduce a new IPv4 option which stores a NodePort service IP and port number. The option is set by bpf_netdev running on a public iface of an intermediate node which received the original request. Once the option has been set, the request (the dst IP addr of the request is DNAT'd to the backend IP addr) is forwarded to a node running the backend. After receiving the fwd'd request, bpf_lxc of the backend parses the option, stores the svc addr:port in the NAT table and sets the "dsr" bit in a CT entry. When sending a reply to the client, bpf_lxc finds out that the "dsr" bit was set, does a lookup in the NAT table to find the mapping, and finally rewrites the source addr and port to the svc addr and port. The current approach has a shortcoming that if the request size is > (MTU - 8bytes), the request will be dropped after we append the IPv4 option. To partially solve this, in the case of TCP we set the option only for SYN packets which should have an empty payload. However, the problem still exists for TCP with SYN cookies and UDP packets. For those cases, a client needs to decrease its MTU by 8bytes. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 10:33:31 UTC |
805cf28 | Martynas Pumputis | 22 October 2019, 12:41:46 UTC | helm: Add global.nodePort.dsr Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 09:51:51 UTC |
619020d | Martynas Pumputis | 22 October 2019, 12:41:13 UTC | daemon: Add --enable-dsr param The param is used to enable direct server return (DSR) for the NodePort BPF. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 13 January 2020, 09:51:51 UTC |
4f6184b | Eric Bailey | 10 January 2020, 18:54:35 UTC | USERS.md: add Sportradar Signed-off-by: Eric Bailey <e.bailey@sportradar.com> | 11 January 2020, 14:41:15 UTC |
6426c86 | Daniel Borkmann | 10 January 2020, 19:03:29 UTC | bpf, external ip: fix service xlation for containers We need to compile the service lookup back in for bpf_lxc when in the config ENABLE_EXTERNAL_IP is set. Reason is that for !local IPs we correctly bypass the xlation in the host ns, but given BPF cgroups hook is not ns aware, it's also bypassed for containers which is not the behavior of iptables based kube-proxy. Therefore, the only way to fix it is to rely in this case on the veth ingress hook and finalize the external IP xlation there. Spotted by Andre's amazing kube-proxy test suite. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 23:02:13 UTC |
4ac28ce | Daniel Borkmann | 10 January 2020, 18:58:59 UTC | bpf: make bpf_sock REMOTE_NODE_ID aware Retain the same behavior when remote node IDs are enabled in order to retain xlation of i) NodePort services at the node as well as ii) external IP entries. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 23:02:13 UTC |
6ac70c8 | Daniel Borkmann | 10 January 2020, 17:26:46 UTC | bpf: fix sock6_xlate when not all host service protocols are enabled We have the case in v4, and the v6 one got accidentally removed in commit 2bf35ed2f2a0 ("add correct implementation of k8s externalIPs in datapath"). Restore it back. Fixes: 2bf35ed2f2a0 ("add correct implementation of k8s externalIPs in datapath") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 23:02:13 UTC |
19b18f2 | Daniel Borkmann | 10 January 2020, 16:07:12 UTC | bpf, misc, trivial: cleanup external service naming The BPF datapath is not and should not be aware of any k8s details, thus drop the k8s from external IP name. Also, we'll add nodeport bit next, which would otherwise need to have a k8s_nodeport name. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 23:02:13 UTC |
33f32a0 | Jarno Rajahalme | 09 January 2020, 23:06:25 UTC | policy: Do not merge rules for reserved:none toFQDN currently translates to "reserved:none" as an endpoint selector. Apparently this is needed due to logic requiring that the list of endpoint selectors be not empty. This has the side-effect that we currently create also populate and merge rules for the cached selector for "reserved:none". This merging currently fails if any of the TLS details for the to-be-merged rules are different, as in the case of terminating TLS for two different domain names. As the first level fix, skip merging rules for a cached selector represtation of "reserved:none". Longer term we should seek solutions where "reserved:none" would not be used in the first place. Change the TLS CI test to use two different domain names. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
718637f | Jarno Rajahalme | 09 January 2020, 23:06:24 UTC | test: TLS test with swapi.co Change the TLS toFQDN test us use 'swapi.co' instead of 'www.lyft.com' Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
d97c95b | Jarno Rajahalme | 09 January 2020, 23:06:24 UTC | test: Use more TLS client CA certs Use a newly generated 'testCA' for signing TLS interception certificates. Passphrase for the 'testCA' key is 'cilium'. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
cabf83c | Jarno Rajahalme | 09 January 2020, 23:06:23 UTC | crypto: Add local GetSecrets(). Factor out code reading secrets from the local file system or k8s to GetSecrets(). This cleans up the code and allows the same semantics to be used to getting secret strings as for TLS contexts. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
998c07a | Jarno Rajahalme | 09 January 2020, 23:06:24 UTC | envoy: Increase max log token length to 1MB Long log lines may stop the Envoy log scanner within cilium-agent. Increase the max token size from the default 64kB to 1MB to be safe, but note that such long logs should normally not happen. Signed-off-by: Jarno Rajahalme <jarno@colalent.io> | 10 January 2020, 22:09:27 UTC |
abc1e9b | Jarno Rajahalme | 10 January 2020, 00:13:42 UTC | daemon: Increase default max DNS policy update wait time from 50 to 100ms CI tests fail due to policy updates to Envoy taking longer than 50 ms. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
f8ea5cf | Jarno Rajahalme | 09 January 2020, 23:06:25 UTC | envoy: Avoid logging policy Policy can contain sensitive information, so avoid logging it. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
f081e20 | Jarno Rajahalme | 09 January 2020, 23:06:23 UTC | Dockerfile: Use fixed Envoy image Use Envoy image with fixed upstream SNI support for the original destination cluster & reduced logging. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 10 January 2020, 22:09:27 UTC |
88b012a | Daniel Borkmann | 10 January 2020, 15:18:16 UTC | cilium: use %v for dumping frontend struct on error Lets not pretend we try to make users happy with small Haikus on service update errors. ;-) The U+7532 is dumped due to the service port: # ./cilium/cilium service update --frontend "8.8.8.8:30002" --backends "10.12.164.240:80" --id 3 Updating existing service with id '3' Error: Cannot add/update service: [PUT /service/{id}][500] putServiceIdFailure Unable to allocate service ID 3 for {{"8.8.8.8" {"TCP" '甲'}} '\x03'}: Service ID 3 is already registered to "192.168.178.29:30002" Use %v instead of %q format string to fix it: # ./cilium/cilium service update --frontend "8.8.8.8:30002" --backends "10.12.164.240:80" --id 3 Updating existing service with id '3' Error: Cannot add/update service: [PUT /service/{id}][500] putServiceIdFailure Unable to allocate service ID 3 for {{8.8.8.8 {TCP 30002}} 3}: Service ID 3 is already registered to "192.168.178.29:30002" Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 19:25:18 UTC |
63297f3 | Daniel Borkmann | 10 January 2020, 14:17:11 UTC | cilium, daemon: fix device detection for default route I noticed on one of my test machines that the agent refuses to start up when IPv6 and NodePort gets enabled: [...] level=info msg=" - !:pod-template-generation" subsys=labels-filter level=info msg=" - !:pod-template-hash" subsys=labels-filter level=info msg=" - !:controller-revision-hash" subsys=labels-filter level=info msg=" - !:annotation.*" subsys=labels-filter level=info msg=" - !:etcd_node" subsys=labels-filter level=info msg="Auto-enabling host reachable services for UDP and TCP as required by BPF NodePort." subsys=daemon level=fatal msg="BPF NodePort's external facing device could not be determined. Use --device to specify." error="Found (2) default routes" subsys=daemon # Turns out in case of IPv6 the machine had the same route but different MTU metric: # ip -6 r | grep default default via fe80::9a9b:cbff:fe05:1eae dev eno1 proto ra metric 100 mtu 1492 pref medium default via fe80::9a9b:cbff:fe05:1eae dev eno1 proto ra metric 1024 pref medium # ip -4 r | grep default default via 192.168.178.1 dev eno1 proto dhcp src 192.168.178.28 metric 100 Fix the detection to walk and check all ifindices wrt whether they are equal, and if that is the case then proceed normally. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 18:53:09 UTC |
e45140c | Daniel Borkmann | 10 January 2020, 13:49:31 UTC | bpf: simplify error codes for connect/sndmsg/rcvmsg progs Noticed that the v6 UDP sendmsg prog had CONNECT_PROCEED instead of SENDMSG_PROCEED. In the end they end up with the same code, but lets get rid of the different defines and have a single SYS_PROCEED and SYS_REJECT. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 17:19:00 UTC |
f0de246 | Daniel Borkmann | 10 January 2020, 10:56:57 UTC | bpf: fix regular service lookup in nodeport range for host services Rework and simplify the externalIP handling code in BPF cgroup progs in order to also handle the case of a regular ClusterIP service where its exposed port sits in the NodePort range. Right now, connectivity fails for such corner case since we always assume NodePort in this range. Therefore, i) do the regular non-wildcarded lookup always in the first step to cover externalIP, ClusterIP and a part of the NodePort lookup on public/private interface and only if nothing is found there, perform the wildcarded lookup for covering the rest of the NodePort cases (other, local IPs and loopback IP). Reported-by: Andre Martins <andre@cilium.io> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 10 January 2020, 17:19:00 UTC |
2b8e26c | Vlad Ungureanu | 09 January 2020, 22:14:16 UTC | Add Palantir Technologies to USERS.md Signed-off-by: Vlad Ungureanu <vladu@palantir.com> | 09 January 2020, 22:21:54 UTC |
f45ca16 | ap4y | 07 January 2020, 00:52:58 UTC | Add cilium-monitor sidecar container for agent pods Cilium debugging across a cluster involves running cilium monitor manually on every node of the cluster. This MR introduces optional monitor sidecar container for agent's daemon set. This will simplify monitor startup across a cluster and will expose monitor event to the 'kubectl logs'. Monitor container is disabled by default (monitor.enabled), event types can be adjusted via monitor.eventTypes. Signed-off-by: Arthur Evstifeev <aevstifeev@gitlab.com> | 08 January 2020, 22:47:38 UTC |
3382082 | André Martins | 08 January 2020, 15:39:27 UTC | docs: fix kubernetes configmap The ConfigMap is not correctly formated. This commit fixes it so that users won't have problems using this configuration as an example for their setups. Signed-off-by: André Martins <andre@cilium.io> | 08 January 2020, 20:00:04 UTC |
ad6fed8 | Daniel Borkmann | 08 January 2020, 13:47:42 UTC | bpf, nat: clamp original source port into dest nat range If a source port has been selected by the remote which is not in our destination NAT range, we need to clamp it. Spotted by Martynas. Also add v6 support for 0d5062e99cfb ("bpf, nat: initially try snat by preserving source port"). Fixes: 0d5062e99cfb ("bpf, nat: initially try snat by preserving source port") Reported-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 08 January 2020, 17:55:18 UTC |
89aee18 | Daniel Borkmann | 08 January 2020, 12:11:23 UTC | identity: require global identity for empty labels On recent master, I noticed that there's a lack of connectivity when going over vxlan tunnel. Git bisection pointed me to commit 28dc941544f1 ("bpf: Map HOST_ID to REMOTE_NODE_ID when encapsulating"). After a closer look, it turns out however that 28dc941544f1 itself does nothing wrong, and for tunnel ID the reserved REMOTE_NODE_ID was properly set for traffic going out of the node via curl from hostns. However, the packets got dropped due to the identity == HOST_ID check on replies even though they are originating from a remote container. Turns out those containers had identity of 16777217 which is 0b100000000000000000000001 and therefore get truncated in case of vxlan tunnel id since it's 24 bits width. Moreover, packets with such 0dab1b63b87c ("identity: Introduce local scope for numeric identity") identity are only for local scope and not destined to leave the node. Turns out for empty labels f3bbcd8e886d ("identity: Use local identities to represent CIDR") RequiresGlobalIdentity() returns false which is not correct; fix gets connectivity working again. Fixes: f3bbcd8e886d ("identity: Use local identities to represent CIDR") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 08 January 2020, 17:38:59 UTC |
6c23f97 | Jarno Rajahalme | 03 January 2020, 22:30:16 UTC | policy/api: Factor out Secret.Equal() Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 08 January 2020, 15:47:34 UTC |
78dcf61 | Jarno Rajahalme | 03 January 2020, 22:29:23 UTC | tls: Fix comments and logging Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 08 January 2020, 15:47:34 UTC |
9a6c605 | Jarno Rajahalme | 03 January 2020, 22:27:44 UTC | k8s: Make secret name and TLS context secret required policy fields. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 08 January 2020, 15:47:34 UTC |
fa34e8f | Jarno Rajahalme | 03 January 2020, 22:26:13 UTC | crypto: Simplify error handling in certificatesmanager. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 08 January 2020, 15:47:34 UTC |
aab7482 | Ray Bejjani | 09 December 2019, 14:50:26 UTC | CI: On EKS, skip K8sServicesTest Bookinfo Demo Ingress proxying doesn't work when chaining, and so won't work on EKS. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
51af00c | Ray Bejjani | 09 December 2019, 14:18:53 UTC | CI: On EKS, skip K8sServicesTest Checks service across nodes with L7 policy Ingress proxying doesn't work when chaining, and so won't work on EKS. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
22ee8bb | Ray Bejjani | 30 November 2019, 21:36:46 UTC | CI: On EKS, skip cilium-health --probe endpoint-endpoint checks fail, and the healthcheck --probe will do that. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
2409974 | Ray Bejjani | 26 November 2019, 14:00:41 UTC | CI: On EKS, skip cilium-health test cilium-health probe doesn't work when chaining, such as on flannel & EKS. The health test cannot pass in this case, and should be skipped. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
ba531da | Ray Bejjani | 29 November 2019, 11:06:55 UTC | CI: Refactor SkipIfFlannel to handle any integration We need to skip tests for various reasons, often predicated on the integration chosen. For the common case of "skip if we're running with integration X" the `SkipIf` function is a simple and clean way to indicate this. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
6604570 | Ray Bejjani | 26 November 2019, 17:25:12 UTC | CI: Add GetNodeIPByLabel helper Some tests need the node's IP but this can change based on the test environment. We can derive these easily instead of hard-coding them. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
11bb75d | Ray Bejjani | 29 November 2019, 12:58:07 UTC | CI: Add GetNodeNameByLabel helpers We switched to labelling nodes instead of using fixed names to facilitate varied testing environments. These functions help with lookups when trying to run on a specific node. Signed-off-by: Ray Bejjani <ray@isovalent.com> | 08 January 2020, 13:20:03 UTC |
0d5062e | Daniel Borkmann | 06 January 2020, 17:15:31 UTC | bpf, nat: initially try snat by preserving source port Originally we moved the prandom call out of the unrolled port collision loop in order to reduce verifier complexity but it seems better if we first try to preserve as much as possible before doing any rewrites. For latter we need to reduce the retry loop on older kernels when v4 + v6 is enabled as a trade-off between 4.19.57 and 5.3. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | 07 January 2020, 10:51:16 UTC |
0c01497 | Michal Rostecki | 24 December 2019, 12:59:38 UTC | bpf: Remove unused BPF feature probes/macros The following macros were used in the old implementation of load balancer, but are not used anymore: - HAVE_MAP_VAL_ADJ - HAVE_MARK_MAP_VALS Also, those feature are available in kernel 4.9+, which is already required for running Cilium. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> | 06 January 2020, 16:20:50 UTC |
e270c23 | Thomas Graf | 06 January 2020, 14:06:10 UTC | Adding USERS directory to create a list of Cilium users Sharing experiences and learning from other users is important. We are frequently asked who is using a particular feature of Cilium in order to get in contact with other users of a particular features to share experiences and best-practices. While the Slack community allows users to get in touch, it can be challenging to quickly find users of a particular feature. Signed-off-by: Thomas Graf <thomas@cilium.io> | 06 January 2020, 15:40:57 UTC |
353a20c | Joe Stringer | 23 December 2019, 18:00:50 UTC | test: Make helm fetch more quiet Recent CI builds have consumed as many as 4300 lines of CLI output per attempt to download the helm client, over the course of about 6 seconds. Use the `-nv` (no verbose) option to quieten this output to only info/error/warnings; converts into about one line of output: $ wget -nv https://get.helm.sh/helm-v2.14.2-linux-amd64.tar.gz 2019-12-23 10:00:32 URL:https://get.helm.sh/helm-v2.14.2-linux-amd64.tar.gz [26534215/26534215] -> "helm-v2.14.2-linux-amd64.tar.gz" [1] Signed-off-by: Joe Stringer <joe@cilium.io> | 02 January 2020, 21:37:28 UTC |
d7ff1c8 | Thomas Graf | 27 December 2019, 15:21:15 UTC | operator: Only start kvstore GC if kvstore is enabled The log line indicating the kvstore GC has been started is confusing if kvstore mode is not enabled. Signed-off-by: Thomas Graf <thomas@cilium.io> | 27 December 2019, 17:59:48 UTC |
8c2247d | Thomas Graf | 27 December 2019, 15:14:34 UTC | operator: Improve identity GC logging No log line indicated whether the CRD identity GC has been started or not. Signed-off-by: Thomas Graf <thomas@cilium.io> | 27 December 2019, 17:59:48 UTC |
0b27e79 | Thomas Graf | 18 December 2019, 16:29:32 UTC | helm: Enable remote-node identity for all new deployments by default Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
87eeaa2 | Thomas Graf | 20 December 2019, 13:20:32 UTC | bpf: Prohibit the IPv6 flowlabel transport to represent HOST_ID The existing codepath was already never presenting HOST_ID as the source identity and with the introduction of REMOTE_NODE_ID, this is guarnateed to be impossible. Drop such packets with an appropriate error code. Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
28dc941 | Thomas Graf | 18 December 2019, 16:29:32 UTC | bpf: Map HOST_ID to REMOTE_NODE_ID when encapsulating When encapsulating to other nodes, any traffic originating from the local host must be presented as remote node traffic as it is being received. Therefore, map any use of HOST_ID to REMOTE_NODE_ID. Consequently, drop any traffic received as HOST_ID in bpf_overlay. Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
bbfabcf | Thomas Graf | 18 December 2019, 16:29:32 UTC | node: Assign remote node identity to all node IPs Node IPs other than the Cilium internal IPs where only added to the ipcache so far when encryption was enabled. This commit adds all node IPs to the ipcache and assign the correct node identity. The code is cleaned up while doing so. `n.GetNodeIP(false)` always returns the IPv4 node address and is not dependant on the current address while iterating over all node addresses. Calling it inside the loop is therefore unnecessary as the result is always the same. Similarly, the `nodeIP4` variable is redundant as the nodeIP is always an IPv4 address anyway. Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
becf7dd | Thomas Graf | 18 December 2019, 16:29:32 UTC | policy: Add remote-node entity This allows matching remote nodes with a policy entity. Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
975f7b7 | Thomas Graf | 18 December 2019, 16:29:32 UTC | node: Use remote-node identity when enabled Assign the new remote-node identity to all remote hosts if the option is enabled. The option is disabled by default as it has the potential to change existing policy rules where users are relying on the behavior that allowing from the host will allow traffic from all hosts in the cluster. Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
702913d | Thomas Graf | 18 December 2019, 16:29:32 UTC | policy: Introduce reserved identity for remote cluster nodes Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 December 2019, 14:10:06 UTC |
70c2eae | dhsathiya | 24 December 2019, 10:23:59 UTC | Fix table markdown spacing issue Columns on row 3 of the table were not getting seperated due to it. Signed-off-by: dhsathiya <devarshisathiya5@gmail.com> | 24 December 2019, 11:53:43 UTC |
6b784d8 | Ray Bejjani | 20 December 2019, 14:02:35 UTC | daemon: Upgrade spf13/viper We began using .IsSet to handle --tofqdns-min-ttl=0 invocations but older viper versions always returned true from this function. This then caused the default value to never be used, instead using the 0 default used when initializing the variable. fixes 078f19d6b52ebc099edc2ed2a48a25818b6e4a56 Signed-off-by: Ray Bejjani <ray@isovalent.com> | 23 December 2019, 17:20:39 UTC |
da34687 | Jarno Rajahalme | 12 December 2019, 17:21:22 UTC | k8s: TLS testing Add simple TLS test to access an external resource via the proxy. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 December 2019, 15:46:59 UTC |
32b3025 | Jarno Rajahalme | 12 December 2019, 17:21:22 UTC | test: Add runtime test for imposing an HTTP header Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 December 2019, 15:46:59 UTC |
13db448 | Jarno Rajahalme | 12 December 2019, 17:24:26 UTC | policy: Add API for actions on header mismatches Allow replacing logging, deleting, adding, and replacing mismatching headers. Now that we can have rules with side-effect, we must track if HTTP rules can be short circuited. If no rules have side-effects, then the policy evaluationn can be stopped as soon as a decision to pass traffic has been found. If rules include side-effects, we must evaluate all applicable rules. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 December 2019, 15:46:59 UTC |
c8f4b5b | Jarno Rajahalme | 12 December 2019, 17:21:21 UTC | policy: Map Envoy HTTP rules when translating policy Supporting secrets is easier if we translate HTTP policies while in the policy computation context. Translating HTTP policies erlier also reduces unnecessary work of re-translating them when policy remains but IDs change. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 December 2019, 15:46:59 UTC |
7393662 | Jarno Rajahalme | 12 December 2019, 17:21:21 UTC | policy: Translate TLS contexts into PerEpData Resolve TLS contexts earlier in the process. Get the default namespace from the security identity rather than the rule. This allows for a default namespace to be well defined even if none of the rules have a namespace label. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 December 2019, 15:46:59 UTC |
c17f5c2 | Jarno Rajahalme | 12 December 2019, 17:21:20 UTC | policy: Add PolicyContext Add PolicyContext, a collection of references to resources needed during policy computation. Initially this holds just a SelectorCache, but later commits will add more items without then needing to update and bloat all the function prototypes. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> | 20 December 2019, 15:46:59 UTC |
8610686 | Jarno Rajahalme | 12 December 2019, 17:21:20 UTC | api: Add API support for k8s secrets Add API definitions for k8s secrets and plumb them into Envoy policy updates. Add certificate manager to find certificates either locally or in k8s Map keys "tls.key" and "tls.crt" are used for the private key and the certificate, respectively, when creating a TLS secret like so: $ kubectl create secret tls test-tls --key="file1" --cert="file2" Support explicit overrides for the default item names. If given, these must be found. Signed-off-by: Jarno Rajahalme <jarno@covalent.io> Signed-off-by: André Martins <andre@cilium.io> | 20 December 2019, 15:46:59 UTC |
1371911 | André Martins | 12 December 2019, 17:21:19 UTC | pkg/k8s: add wrapper to get k8s secrets Signed-off-by: André Martins <andre@cilium.io> | 20 December 2019, 15:46:59 UTC |
60a846b | Jarno Rajahalme | 12 December 2019, 17:21:19 UTC | option: add 'certificates-directory' option to look for TLS certificates This option will set the root certificate used to search for TLS certificates defined in a CNP for L7 TLS policy enforcement. Signed-off-by: André Martins <andre@cilium.io> | 20 December 2019, 15:46:59 UTC |
7721c8a | Joe Stringer | 16 December 2019, 14:00:59 UTC | docs: Describe cluster restriction to CIDR policy Describe the restrictions of which traffic CIDR- and DNS-based policies apply in a bit more detail. Signed-off-by: Joe Stringer <joe@cilium.io> | 20 December 2019, 10:21:56 UTC |
b78e761 | Joe Stringer | 16 December 2019, 10:07:59 UTC | docs: Fix reference to init id with k8s With the kubernetes Cilium CNI, the labels are typically fetched during endpoint creation, so the lifecycle text here was a bit out-of-date. Fix it up to be more clear in which cases the init identity is used, and reference it from the relevant code. Signed-off-by: Joe Stringer <joe@cilium.io> | 20 December 2019, 10:21:56 UTC |
5430481 | Sebastian Wicki | 19 December 2019, 22:46:48 UTC | test: Extend externalTrafficPolicy=Local tests Adds an additional check for NodePort services with externalTrafficPolicy=Local where only a single node is running a service endpoint. Therefore, we test that only direct connections to that node will succeed, while any requests to a node without a local backend are dropped. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 20 December 2019, 10:16:00 UTC |
78e3c9b | Sebastian Wicki | 19 December 2019, 22:46:48 UTC | lbmap: Include services without backends in DumpServiceMaps This changes the behavior of DumpServiceMaps to include services without any backends. This is required when DumpServiceMaps is used to restore services in the service cache. Without this change, services without any backends (e.g. NodePort services with externalTrafficPolicy=Local) will not be restored from the datapath and are consequently not garbage collected once cilium-agent recognizes that these services have been removed from Kubernetes. This commit therefore fixes a case where the Cilium CI status preflight check fails to pass, as the lbmap contains such leftover entries. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 20 December 2019, 10:16:00 UTC |
51a1f21 | Joe Stringer | 18 December 2019, 17:03:45 UTC | release: Add guardrails for mixing releases As a sanity check, make sure that the cilium source directory that is being used to generate the release specifies the same version as the one being specified on the uploadrev commandline. Signed-off-by: Joe Stringer <joe@cilium.io> | 20 December 2019, 06:08:42 UTC |
3cc2e51 | Joe Stringer | 18 December 2019, 16:45:10 UTC | release: Fix helm chart paths Store the helm chart artifacts in a release-specific directory so we don't have to upload all resources each time if a particular maintainer reuses the same directory; and ensure that the helm template files are pulled from $CILIUM_SOURCE rather than the current directory. Signed-off-by: Joe Stringer <joe@cilium.io> | 20 December 2019, 06:08:42 UTC |
07b9cba | Joe Stringer | 18 December 2019, 16:46:19 UTC | release: Print SHAs for helm chart artifacts Signed-off-by: Joe Stringer <joe@cilium.io> | 20 December 2019, 06:08:42 UTC |
2e6e8d1 | Michal Rostecki | 18 December 2019, 23:14:20 UTC | datapath: Use the new probes module Use the new `probes` module for checking BPF features in the kernel configuraation. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> | 20 December 2019, 06:06:09 UTC |
6c98e94 | Michal Rostecki | 18 December 2019, 22:29:54 UTC | datapath: New package `probes` with BPF checks based on bpftool This change introduces the new package `pkg/datapath/linux/probes` which uses BPF feature probes from bpftool in JSON format. In the current shape, it handles kernel feature probes with the public function `SystemConfigProbes`. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> | 20 December 2019, 06:06:09 UTC |
512d948 | Michal Rostecki | 18 December 2019, 22:21:22 UTC | bpf: Remove old kernel probes This change removes old kernel probes from run_probes.sh. Kernel probes are going to be implemented in Go and are going to use bpftool. Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> | 20 December 2019, 06:06:09 UTC |
2854434 | Maciej Kwiek | 05 December 2019, 15:52:31 UTC | [CI] parallel image build and cluster setup for eks Signed-off-by: Maciej Kwiek <maciej@isovalent.com> | 19 December 2019, 16:15:54 UTC |
ba85129 | Valas Valancius | 15 December 2019, 22:13:21 UTC | test: Add conntrack entry timeout validation tests. Partially fixes #9303. Signed-off-by: Valas Valancius <valas@google.com> | 19 December 2019, 12:40:42 UTC |
7acf046 | ap4y | 16 December 2019, 01:45:28 UTC | Improve nodeinit uninstalls by reverting nodeinit changes Uninstalls are not well supported by the nodeinit and requires manual operations on each node of a cluster. This patch introduces optional preStop hook to the nodeinit containers that will revert changes made on start. Changes to the nodeinit's helm chart: - Add new variable 'nodeinit.revertReconfigureKubelet', defaults to false - If enabled preStop hook will be installed to revert changes made by nodeinit Signed-off-by: Arthur Evstifeev <aevstifeev@gitlab.com> | 18 December 2019, 16:28:21 UTC |
999ba19 | Sebastian Wicki | 16 December 2019, 16:36:18 UTC | docs: externalTrafficPolicy is now supported by BPF NodePort Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 18 December 2019, 15:24:24 UTC |
5922546 | Sebastian Wicki | 16 December 2019, 16:34:49 UTC | test: Add BPF NodePort externalTrafficPolicy=Local tests This tests externalTrafficPolicy=Local in BPF NodePort with both vxlan and direct routing mode. A new context is added to share the setup of the Cilium deployment in either modes. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 18 December 2019, 15:24:24 UTC |
b46078c | Sebastian Wicki | 16 December 2019, 16:26:03 UTC | service: Add support for externalTrafficPolicy=Local This adds a new TrafficPolicy field to Cilium's service representation and implements the "Local" traffic policy. When externalTrafficPolicy is set to Local, only backends where the node name matches the current node are selected and added to the BPF lbmap. This check of the node name to determine local backends is the same mechanism that is also used by kube-proxy. When a service has TrafficPolicy=Local, the Cilium API only shows and accepts local backends for that service. Fixes: #8698 Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 18 December 2019, 15:24:24 UTC |
e9d5079 | Sebastian Wicki | 16 December 2019, 15:40:43 UTC | k8s: Add NodeName field to backend IPs The Kubernetes EndpointAddress object contains the node name of each backend. This can be used to determine if an endpoint is local to a node. This commit adds an equivalent NodeName field to Cilium's internal representation of a service backend and populates it in the K8s watcher. The node name is not added to the ClusterService object, as a ClusterService will never be node-local. Signed-off-by: Sebastian Wicki <sebastian@isovalent.com> | 18 December 2019, 15:24:24 UTC |
36af58d | Martynas Pumputis | 18 December 2019, 10:00:37 UTC | node: IPv6NodePrefixLen Remove the "IPv6NodePrefixLen" const (=96), as from now we can allocate IPv6 addrs from any size CIDR. The const is only used by a case when an IPv6 allocation range is derived from "ipv6-cluster-alloc-cidr" and "ipv4-range" Signed-off-by: Martynas Pumputis <m@lambda.lt> | 18 December 2019, 15:20:17 UTC |
2d2a3e6 | Martynas Pumputis | 17 December 2019, 16:18:49 UTC | common: Remove misleading comment of NewCiliumIPv6 Neither Node or Endpoint IDs are stored in an IPv6 address. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 18 December 2019, 15:20:17 UTC |
c09596b | Martynas Pumputis | 17 December 2019, 12:21:58 UTC | node: Remove IPv6 /96 prefix constraint Previously, the DSR for IPv6 (aka the "--lb" feature) required the "--ipv6-range" to be /96. This was because the 113-128 bits of an IPv6 addr were used to store a global reverse NAT ID. As the "--lb" feature was removed, the constraint is no longer needed, thus it can be removed. Signed-off-by: Martynas Pumputis <m@lambda.lt> | 18 December 2019, 15:20:17 UTC |
b1aae12 | Martynas Pumputis | 16 December 2019, 10:26:11 UTC | service: Enable NodePort BPF for dual-stack This commit enables provisioning of NodePort BPF services when running in a dual-stack (both ipv{4,6} is enabled). Signed-off-by: Martynas Pumputis <m@lambda.lt> | 17 December 2019, 21:08:15 UTC |
5ccc3db | Fredrik Lönnegren | 12 December 2019, 10:48:46 UTC | Running install/kubernetes/make produces a different version than checked in file Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@gmail.com> | 17 December 2019, 21:04:21 UTC |
b37274a | Vlad Ungureanu | 11 December 2019, 15:49:41 UTC | Make FirstInterfaceIndex a pointer on ENI spec Signed-off-by: Vlad Ungureanu <vladu@palantir.com> | 17 December 2019, 21:02:31 UTC |
18b0bb5 | ChristineTChen | 09 December 2019, 21:10:51 UTC | Add Prometheus version metric The version metric is labelled by the Cilium version. Signed-off by: Christine Chen <christine.chen@datadoghq.com> | 17 December 2019, 20:58:31 UTC |
b552609 | André Martins | 17 December 2019, 19:37:07 UTC | .github: rename github-actions file Signed-off-by: André Martins <andre@cilium.io> | 17 December 2019, 19:56:54 UTC |
131fb89 | ap4y | 17 December 2019, 02:22:32 UTC | Add helm charts packaging steps to the release script This patch adds helm chart packaging and versioning steps to support chart distribution via helm repository. Repository index is merged with existing index (can be initially empty) to support single version uploads. helm and curl binaries are required to execute these steps. Signed-off-by: Arthur Evstifeev <aevstifeev@gitlab.com> | 17 December 2019, 15:53:06 UTC |
1d8c819 | Joe Stringer | 11 December 2019, 23:24:46 UTC | node: Remove unused PublicAttrEquals func This function hasn't been used since v1.5, we can delete it. Signed-off-by: Joe Stringer <joe@cilium.io> | 17 December 2019, 15:05:24 UTC |
48831c4 | Joe Stringer | 17 December 2019, 09:34:33 UTC | Update references to latest releases and projects Signed-off-by: Joe Stringer <joe@cilium.io> | 17 December 2019, 15:04:50 UTC |
0a298c3 | Vlad Ungureanu | 16 December 2019, 21:06:48 UTC | Swap update-ec2-apdater-limit-via-api to use github.com/aws/aws-sdk-go-v2 Signed-off-by: Vlad Ungureanu <vladu@palantir.com> | 17 December 2019, 12:37:05 UTC |
5edd4fd | Vlad Ungureanu | 16 December 2019, 21:05:47 UTC | Remove github.com/aws/aws-sdk-go dependency Signed-off-by: Vlad Ungureanu <vladu@palantir.com> | 17 December 2019, 12:37:05 UTC |
33e3799 | André Martins | 16 December 2019, 13:29:48 UTC | GO_VERSION: set golang version to 1.13.5 Fixes: 81121deaf911 ("update golang to 1.13.5") Signed-off-by: André Martins <andre@cilium.io> | 16 December 2019, 17:15:26 UTC |
27ca260 | Martynas Pumputis | 16 December 2019, 10:07:24 UTC | helm: Add deps for quick-install.yaml target Previously, the "quick-install.yaml" target didn't have any dependency. So, if the target was present and there was any update to a file from the cilium/ dir, the target was not re-generated when running "make". Signed-off-by: Martynas Pumputis <m@lambda.lt> | 16 December 2019, 13:57:41 UTC |