ea14baf | André Martins | 26 January 2019, 20:07:47 UTC | pkg/endpoint: restore endpoints that were being regenerated [ upstream commit bb099df4c32ae454ce1e70db1ab4d1f5b4930d04 ] If cilium-agent got terminated while an endpoint was being created for the first time, Cilium could not restore that endpoint from previous life as the endpoint was never considered "alive" in the first place. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
45e2227 | Thomas Graf | 26 January 2019, 20:38:21 UTC | datapath/linux: Explode node handling datapath unit tests to IPv4/IPv6 only [ upstream commit a227a0298b8a421c75770534c77e44cf2053ede7 ] Run all unit tests and benchmarks with the following three addressing configurations: * IPv4 only * IPv6 only * IPv4 & IPv6 Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
cc042f2 | Thomas Graf | 26 January 2019, 20:36:10 UTC | datapath/linux: Fix node route creation when allocation CIDR is nil [ upstream commit 5d20ca7e8322268320ee37096e19b8c7563e6a6f ] Ensure that the allocation CIDR is non-nil and verify that the required nodeAddressing requirements are fulfilled. Fixes the following panic: ``` [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x259ebf1] goroutine 1 [running]: github.com/cilium/cilium/pkg/datapath/linux.(*linuxNodeHandler).createNodeRoute(0xc00017d650, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /go/src/github.com/cilium/cilium/pkg/datapath/linux/node.go:292 +0x71 github.com/cilium/cilium/pkg/datapath/linux.(*linuxNodeHandler).lookupNodeRoute(0xc00017d650, 0x0, 0xc0004804e0, 0x10, 0x10) /go/src/github.com/cilium/cilium/pkg/datapath/linux/node.go:309 +0x50 github.com/cilium/cilium/pkg/datapath/linux.(*linuxNodeHandler).nodeUpdate(0xc00017d650, 0x0, 0xc000e94c60, 0x0, 0x4adf920) /go/src/github.com/cilium/cilium/pkg/datapath/linux/node.go:456 +0x4b8 github.com/cilium/cilium/pkg/datapath/linux.(*linuxNodeHandler).NodeConfigurationChanged(0xc00017d650, 0x5dc, 0x5aa, 0x0, 0x4adf920, 0x0, 0x0, 0x10000000100, 0x0, 0x0) /go/src/github.com/cilium/cilium/pkg/datapath/linux/node.go:622 +0x1e1 main.(*Daemon).compileBase(0xc0007be700, 0x0, 0x0) /go/src/github.com/cilium/cilium/daemon/daemon.go:533 +0x7a9 main.(*Daemon).init(0xc0007be700, 0xc000e332b8, 0x1) /go/src/github.com/cilium/cilium/daemon/daemon.go:675 +0x126 main.NewDaemon(0x2f49b80, 0xc0004c8de0, 0x1, 0x1, 0xc00088f928, 0x113d542) /go/src/github.com/cilium/cilium/daemon/daemon.go:1191 +0x1177 main.runDaemon() /go/src/github.com/cilium/cilium/daemon/daemon_main.go:1062 +0x214 main.glob..func1(0x44ee920, 0xc0007e67d0, 0x0, 0x5) /go/src/github.com/cilium/cilium/daemon/daemon_main.go:108 +0x30 github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).execute(0x44ee920, 0xc00004c1f0, 0x5, 0x5, 0x44ee920, 0xc00004c1f0) /go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:766 +0x2cc github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).ExecuteC(0x44ee920, 0x2f2caf0, 0x2f543c0, 0x2f2cb10) /go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:852 +0x2fd github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).Execute(0x44ee920, 0x0, 0x0) /go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:800 +0x2b main.daemonMain() /go/src/github.com/cilium/cilium/daemon/daemon_main.go:126 +0x14c main.main() /go/src/github.com/cilium/cilium/daemon/main.go:30 +0xc9 ``` Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
25a1a91 | André Martins | 27 January 2019, 12:33:56 UTC | cilium-cni: build endpoint synchronously in flannel mode [ upstream commit bfd55185173cb5e363fad05fcf02a7c33f0b7185 ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
c1126c1 | André Martins | 26 January 2019, 17:44:29 UTC | flannel.Jenkinsfile: test against k8s 1.9 as k8s 1.8 is not supported [ upstream commit 79a05b50f56d2c019e7378621dd1df742fe6929f ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
69bbe58 | André Martins | 26 January 2019, 17:31:05 UTC | Revert "pkg/datapath: ignore iptables MASQUERADE rules in flannel mode" [ upstream commit e7c587b1df4a0780590c1f6bfa2eb701bd181fc5 ] This reverts commit 7740e3914ebf2bb36860369aeda585a94b2c17c1. Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
0d32552 | André Martins | 26 January 2019, 14:01:37 UTC | daemon: syncLBMapsWithK8s - delete k8s service once if not found [ upstream commit 853fec659702b724295b83e0df8b282c033933f6 ] As lbmap.DumpServiceMapsToUserspace returns a list of backend services, this list of backend services can contain duplicated entries as BPF lb map can contain multiple entries for the same service as showned from the following log messages: ``` level=debug msg="parsing service mapping" bpfMapKey="10.98.234.114:9125" bpfMapValue="0.0.0.0:0 (0)" subsys=map-lb level=debug msg="converting ServiceKey and ServiceValue to frontend and backend" obj="0.0.0.0:0 (0)" serviceID="10.98.234.114:9125" subsys=map-lb level=debug msg="creating L3n4Addr for ServiceKey" serviceID="10.98.234.114:9125" subsys=map-lb level=debug msg="adding frontend and backend to SVCMap" backend="0.0.0.0:0, weight: 0" backendIndex=0 frontend="10.98.234.114:9125" subsys=loadbalancer level=debug msg="parsing service mapping" bpfMapKey="10.98.234.114:9125" bpfMapValue="10.10.1.222:9125 (29)" subsys=map-lb level=debug msg="converting ServiceKey and ServiceValue to frontend and backend" obj="10.10.1.222:9125 (29)" serviceID="10.98.234.114:9125" subsys=map-lb ``` In order to correctly remove this list of services that are no longer being managed by k8s one should use a Set to avoid trying to delete multiple times the same LB service which results in controller errors such as: ``` msg="Controller run failed" consecutiveErrors=2 error="Errors deleting BPF map entries: key 10.98.234.114:42275 is not in lbmap... ``` Fixes: cc4be8e37107 ("daemon: sync BPF maps with in-memory K8s service maps") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
1576284 | Joe Stringer | 26 January 2019, 20:52:50 UTC | bpf: Remove GetLRUMapType() [ upstream commit bc911162fb7bc62dd718350caa06049f7b85e5fe ] Previously the ctmap used a dedicated additional helper, GetLRUMapType(), to determine the map type of the conntrack maps whenever the objects were created, however a recent patch has introduced such logic into the main OpenOrCreate() function, so this is no longer necessary. Rely on the automatic fallback to MapTypeHash provided by OpenOrCreate() instead. Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
0586c44 | Joe Stringer | 25 January 2019, 23:47:02 UTC | bpf: Autodetect map type support on open [ upstream commit ab721bc6d5eaad40a9377064b853758aa8dd0d3c ] Use the BPF probes of the LPM support in the kernel to set the map type during OpenOrCreate of the map before attempting to create the map. This should avoid situations on older kernels where a previous Cilium instance creates the ipcache map as a hash map, then Cilium is re-run and on startup it first sees the wrong map type and attempts to delete it because the type is wrong (hash, not LPM), then attempts to create the LPM map, fails, and falls back to hash map. This would create unnecessary churn and recreation of IPCache maps, potentially leading to some amount of network connectivity downtime. Fixes: #6775 Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
0c9c673 | Joe Stringer | 25 January 2019, 02:46:37 UTC | endpoint: Properly cache ipvlan option [ upstream commit 4bf03dbb438e301e7d99e7d91285581ee10f5e8f ] This option was being dereferenced while the endpoint was unlocked and could (in theory) disappear. Cache it instead. Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
d07ce86 | Thomas Graf | 25 January 2019, 21:21:49 UTC | agent: Announce both IPv4 and IPv6 node address via node discovery [ upstream commit 3ff455e1ced5836790155beaedc2b3493f2861ce ] No real functional differences as the IPv6 node address is not used in the datapath but it ensures that the IPv6 node address is listed in `cilium node list`. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
42d8348 | Thomas Graf | 25 January 2019, 20:29:02 UTC | cli: Only print address range in cilium status when enabled [ upstream commit 9e0aca07c657fdb75a11c49221ee9c234c779bfa ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
7dfa8e5 | Thomas Graf | 25 January 2019, 19:02:34 UTC | node: Only require external IPv4 node address when IPv4 or encapsulation is enabled [ upstream commit 0c22956df3f1ab873a2763e4d3fb7d464b612309 ] The external IPv4 node address is not required in pure IPv6 direct routing mode. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
3ff1569 | Thomas Graf | 25 January 2019, 18:47:01 UTC | cni: Check if NodeAddressing.IPv* is nil [ upstream commit 9c70fee985d76595a4e9d0216de4929c27c2f534 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
7ec6835 | Thomas Graf | 25 January 2019, 18:43:59 UTC | node: Only return node addressing for address families that are enabled [ upstream commit f3ede032ed7df8a781e37d47968608d959acdc16 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
6afbffd | Thomas Graf | 25 January 2019, 18:37:52 UTC | node: Only auto-generate allocation prefix when address family is enabled [ upstream commit d858c9cf75823086431d4ece6a6931ca8e60cff9 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
8a22743 | Thomas Graf | 25 January 2019, 21:24:10 UTC | fqdn: Prepare DNS proxy for node IPs to be nil [ upstream commit dd09d30ead3225682015516a6bd1cb77e8678370 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
3818f6f | Thomas Graf | 25 January 2019, 21:22:45 UTC | proxy: Prepare proxy layer for node IPs to be nil [ upstream commit 91d7a7be8ab0d65f90c2c363f7ebf0dc9946760e ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
f654289 | Thomas Graf | 25 January 2019, 18:55:30 UTC | bpf: Only define IPV4_MASK when IPv4 is enabled [ upstream commit 889fd1d0c40a18873227776e883c85315c89866f ] Prepare for GetIPv4AllocRange() to potentially return nil and only use it when IPv4 is enabled. The BPF datapath has also become capable of not requiring IPv4 so the workaround can be removed. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
708b219 | Thomas Graf | 25 January 2019, 18:30:06 UTC | agent: Support IPv6 NodeSuffix() [ upstream commit 845ba0311d2fc68afcdcc6fb7f7aab28d1c8a094 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
2a66b2b | Thomas Graf | 25 January 2019, 17:14:35 UTC | node: Do not restore NodeIP from node_config.h for disabled address family [ upstream commit 2abbfa8b40a440fa8318d8c8c89ed1570df93866 ] This is required to stop using a NodeIP for an address family that has been disabled. This can happen if a user is switch on/off address families on a node. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
9f86014 | Thomas Graf | 25 January 2019, 17:10:44 UTC | k8s: Do not inherit PodCIDR for disabled address family from k8s node [ upstream commit be469fea38f3601c1e729cd5c4374d695a87718c ] The node IPs should be derived. The IPv4 external IP can be used for encapsulation of an IPv6 only PodCIDR environment. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
7e6cfee | Joe Stringer | 25 January 2019, 17:45:54 UTC | daemon: Fix failure on first health EP start [ upstream commit 6d55daca69e16a63c284a37ccd6d3945afb00345 ] Previously, due to a static global definition of the client object in the health launch package, the daemon had no way to determine whether the client is already initialized, and would always fail to start the endpoint the first time the controller runs, then succeed afterwards. Fix this by pushing the client out to the daemon package, where we can then switch on whether the client exists to create it the first time without treating that case as an error, then only if the client already exists, attempt to ping it and treat failure to ping as an error worthy of failing the controller and restarting the endpoint. Fixes: #6754 Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
46ea68e | Joe Stringer | 25 January 2019, 17:38:54 UTC | launch: Use node type for addressing information [ upstream commit 8f64280aa652bd9834eb98903af03769075ce210 ] Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
2cba452 | Joe Stringer | 25 January 2019, 17:36:33 UTC | launch: Remove unused Annotator interface [ upstream commit 2a67816298ffebf1e9716754ab5587a07f3e27b9 ] Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
f217850 | Joe Stringer | 25 January 2019, 17:34:47 UTC | node: Simplify GetModel() api [ upstream commit 8badece869b67102fcb0a432ec4eb0510fbc6aea ] The IPv4 bool passed in here was confusing and unnecessary, remove it in favour of the global options setting. Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
9f21398 | Thomas Graf | 25 January 2019, 15:36:14 UTC | kvstore: Fix panic in `cilium kvstore` CLI [ upstream commit 60db32bc98a03b07e3dade50ca2c11dcb3e51241 ] Fix the following panic when the kvstore client cannot be created via the CLI: ``` panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0x1a306d0] goroutine 1 [running]: github.com/cilium/cilium/pkg/kvstore.Get(0x0, 0x0, 0x8, 0x8, 0x8, 0x7, 0x7) /home/vagrant/go/src/github.com/cilium/cilium/pkg/kvstore/kvstore.go:40 +0x40 github.com/cilium/cilium/cilium/cmd.glob..func32(0x44e3c80, 0x4ada920, 0x0, 0x0) /home/vagrant/go/src/github.com/cilium/cilium/cilium/cmd/kvstore_get.go:55 +0x2e7 github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).execute(0x44e3c80, 0x4ada920, 0x0, 0x0, 0x44e3c80, 0x4ada920) /home/vagrant/go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:766 +0x2cc github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).ExecuteC(0x44e7f00, 0x2f, 0xffffffffffffffff, 0xc0004c2f30) /home/vagrant/go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:852 +0x2fd github.com/cilium/cilium/vendor/github.com/spf13/cobra.(*Command).Execute(0x44e7f00, 0xc0007a7f58, 0x1164e30) /home/vagrant/go/src/github.com/cilium/cilium/vendor/github.com/spf13/cobra/command.go:800 +0x2b github.com/cilium/cilium/cilium/cmd.Execute() /home/vagrant/go/src/github.com/cilium/cilium/cilium/cmd/root.go:46 +0x2d main.main() /home/vagrant/go/src/github.com/cilium/cilium/daemon/main.go:32 +0xd0 ``` Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
882c1fb | Thomas Graf | 27 January 2019, 19:33:41 UTC | test: Add IPv4 only test [ upstream commit b17aeb9980b5937b992f0fe9972524417f9304e7 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
454b014 | Thomas Graf | 27 January 2019, 19:33:41 UTC | cilium: Fix cilium lb list when IPv4 or IPv6 are disabled [ upstream commit 2922601a41edc78af27f071e418f7e3813218664 ] Fixes: #6800 Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
6ef1809 | Maciej Kwiek | 24 January 2019, 13:52:49 UTC | CLI for clearing FQDN proxy cache [ upstream commit 691079d92128c90050cc9adc9214e7639ee06b26 ] Signed-off-by: Maciej Kwiek <maciej@covalent.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
7c2eef7 | André Martins | 24 January 2019, 21:15:06 UTC | plugins/cilium-cni: uninstall cilium-flannel CNI configuration if user opt-in [ upstream commit 306b6b31c56847bb43ce5b2ea9ce9eaaf74b9d3c ] This avoids containers to accidentally be created and starting being managed only by Flannel if Cilium is in the process of being upgraded where the CNI configuration is always removed during the upgrade. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
272713c | André Martins | 24 January 2019, 15:22:48 UTC | addons/flannel: add more flannel documentation [ upstream commit 923e054e6d55469d3b1dffa49c5ed0fd7a0ff490 ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
be15ec4 | André Martins | 24 January 2019, 14:33:38 UTC | pkg/client: wait until the client has connectivity with daemon [ upstream commit d48af6ab5c286fd91b751eed90a7d1b715a55231 ] Fixes: c6518190de30 ("client: Add NewDefaultClientWithTimeout function") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
30f0bb4 | André Martins | 24 January 2019, 12:10:58 UTC | daemon: stop waiting for flannel device to be ready if process is terminated [ upstream commit 2262a7aa0a4d50d94f5da9bd6e719a0f435e0fce ] When running in flannel mode, cilium-agent would ignore the sigterms as it would be infinitely waiting for the flannel interface to be ready. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
9bb831a | André Martins | 23 January 2019, 12:22:04 UTC | plugins/cilium-cni: change CNI channing name to cbr0 [ upstream commit 80ea41a1701450f57f052ad64865af5e0149dd71 ] As flannel runs with the name "cbr0" by default in its cni configuration, in order for Cilium to be able to run on top of flannel with existing containers, the flannel-cilium CNI configuration file needs to have the same name. By having the same name it prevents the flannel IPAM assigning existing addresses as they are stored on each node under the directory `/var/lib/cni/networks/cbr0/`. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
35b554c | André Martins | 23 January 2019, 10:43:27 UTC | pkg/datapath: ignore iptables MASQUERADE rules in flannel mode [ upstream commit 7740e3914ebf2bb36860369aeda585a94b2c17c1 ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
b9eb92e | André Martins | 21 January 2019, 15:27:25 UTC | daemon: append bpf programs to existing flannel running containers [ upstream commit ad5ae3843b4497bea72c09c111d5f89f058b906c ] [ Backporter's notes: Re-ran "make -C examples/kubernetes" to handle conflicts ] As Cilium has the ability to install BPF programs in already running interfaces we can enable this option by default environments where Cilium is deployed on top of Kubernetes. This requires Cilium DaemonSet to run with `hostPID: true` so that cilium-agent process can access already running network namespaces. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
8bcb935 | André Martins | 21 January 2019, 14:42:21 UTC | plugins/cilium-cni: rely on flannel response [ upstream commit a67df9f6ff07df999a6f98dd48f18bc8f1ddaf68 ] With CNI chaining, the response from the previous CNI plugin, flannel, is sent to the previous CNI plugin, Cilium, we can rely on the flannel response to create a Cilium endpoint instead of entering the network namespace of the container. Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Joe Stringer <joe@cilium.io> | 29 January 2019, 16:49:19 UTC |
e5f5c6f | Thomas Graf | 26 January 2019, 01:29:27 UTC | Prepare for 1.4.0-rc5 release Signed-off-by: Thomas Graf <thomas@cilium.io> | 26 January 2019, 01:33:09 UTC |
374c483 | Ray Bejjani | 20 January 2019, 13:34:42 UTC | fqdn/rulegen: per-name regeneration via ForceGenerateDNS [ upstream commit c8375f8dbbd75c8d617709fb61b8a3454c75ad27 ] There are circumstances to trigger a rule regeneration without new IP information (such as a cache clear or TTL expiration without a new DNS event). ForceGenerateDNS allows running logic similar to UpdateGenerateDNS, where DNS names are matched against rules and new versions generated. Signed-off-by: Ray Bejjani <ray@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
365c907 | Ray Bejjani | 18 January 2019, 17:57:47 UTC | api: Add DELETE /fqdn/cache API [ upstream commit 274d782c32f4d04e16809b2a3171226d705f4f38 ] Signed-off-by: Ray Bejjani <ray@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
91a062f | Ray Bejjani | 18 January 2019, 16:02:03 UTC | daemon: Implement DELETE /fqdn/cache API [ upstream commit 770ebd596fcde6a175933dd98d7c337b6bc808a3 ] This removes entries that match the matchName or CIDR, removing lookups that occurred before the time the API call was issued. No-parameter invocations will clear the entire cache. Signed-off-by: Ray Bejjani <ray@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
0ec824c | Ray Bejjani | 20 January 2019, 13:34:54 UTC | fqdn/cache: Implement .ForceExpire to delete entries [ upstream commit 8f1f949abc1cd719a8ee5bba360c7ba24d6c91f1 ] In normal operation, the cache will only expire entries after the TTL. In some circumstances, we will need to forcibly clear part of the cache without removing all the data within it. ForceExpire and the updated removeExpired allow doing this per-name and by LookupTime. Signed-off-by: Ray Bejjani <ray@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
5c29ff7 | Thomas Graf | 25 January 2019, 03:13:22 UTC | k8s: Don't list identities in CEP for default-allow [ upstream commit c8846bc1a1e4ec9fed88e591d33f0ec7f336769c ] This lowers the size of the CEP and reduces the number of updates required for pods that are running in default-allow policy enforcement mode. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
3ce41ce | Martynas Pumputis | 25 January 2019, 17:36:43 UTC | node: Do not require ipv6AllocRange in ipv4-only mode [ upstream commit d52f6ed0378a314138a724ac6142a9a0ddcb39cc ] Otherwise, cilium-agent cannot start when only ipv4 is enabled. Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
a0a34f5 | Martynas Pumputis | 25 January 2019, 18:38:37 UTC | daemon: Set ROUTER_IP only if IPv6 is enabled [ upstream commit 59d6eddbf0e538c0f3aa5d55f612754aa88a6566 ] Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
e9e5c29 | Martynas Pumputis | 25 January 2019, 16:41:52 UTC | bpf: Enable some IPv6 code only if ENABLE_IPV6 is set [ upstream commit b1ce2bc831c3d25b02403ff5456a27b8b02f26e4 ] 75028e4bcb14 ("ipam: Only allocate IPs if address family is enabled") made setting of `ROUTER_IP` conditional, i.e. it is non-empty only if IPv6 is enabled. In the case of ipv4-only mode, `ROUTER_IP` in node_config.h is empty which leads to compilation errors of BPF functions which calls `BPF_V6(<..>, ROUTER_IP)`. Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
1b26f11 | Eloy Coto | 25 January 2019, 15:31:07 UTC | Jenkins: delete docker-compose networks [ upstream commit c1b0e3d91b4fd8c395be8f5678c3ca163a4870c2 ] On commit `eb3b298849bc72b283034e13ab32e57130260758` target clean-ginkgo-test was deleted, but the jenkins-precheck is still using the docker-compose, so the docker networks never got deleted and Jenkins failed after a while With this change, after each build a delete will happens. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
a23ab40 | Ray Bejjani | 25 January 2019, 14:04:48 UTC | daemon: Sanitize fqdn/cache API matchpattern parameter [ upstream commit a964e923541dc21333334ce96909503f873e6ef1 ] When parsing policy .Sanitize ensures a name or pattern is a FQDN. The FQDN API code now also does this, allow the same patterns in policies to match in-cache names. Signed-off-by: Ray Bejjani <ray@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
00180ce | Eloy Coto | 22 January 2019, 09:00:32 UTC | Jenkins: Add Flannel job [ upstream commit 39f6982aeaf742da13099feb3ae65208810d11c6 ] Add a new flannel job with the new trigger test-flannel in the PR and with the new jenkinsfile. It'll run once a day in the CI. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
c9295a0 | Nirmoy Das | 25 January 2019, 10:56:40 UTC | daemon: sockops: delay sockops init till node_config.h gets generated [ upstream commit fc25dbe2454815456cefab4f34807ab3ec270b47 ] SockmapEnable and SkmsgEnable require node_config.h which generated in Daemon.init(). level=error msg="Failed to compile bpf_sockops.o: exit status 1" compiler-pid=23550 linker-pid=23551 subsys=datapath-loader level=warning msg="/var/lib/cilium/bpf/sockops/bpf_sockops.c:21:10: fatal error: 'node_config.h' file not found" subsys=datapath-loader level=warning msg="#include <node_config.h>" subsys=datapath-loader level=warning msg=" ^~~~~~~~~~~~~~~" subsys=datapath-loader level=warning msg="1 error generated." subsys=datapath-loader level=error msg="failed compile sockops/bpf_sockops.c: Failed to compile bpf_sockops.o: exit status 1" subsys=sockops level=error msg="Failed to compile bpf_redir.o: exit status 1" compiler-pid=23553 linker-pid=23554 subsys=datapath-loader level=warning msg="/var/lib/cilium/bpf/sockops/bpf_redir.c:21:10: fatal error: 'node_config.h' file not found" subsys=datapath-loader level=warning msg="#include <node_config.h>" subsys=datapath-loader level=warning msg=" ^~~~~~~~~~~~~~~" subsys=datapath-loader Fixes: ac55c6a (daemon: Create BPF maps before restoring service IDs) Signed-off-by: Nirmoy Das <ndas@suse.de> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
ec183bd | Michal Rostecki | 23 January 2019, 13:52:40 UTC | proxylib: Add SONAME, create .so* files and symlinks [ upstream commit 6b785067216e64b4b08bb6bf8fc4ea312a4cebb7 ] The common pattern in the most of Linux distributions is to have SONAME field in shared object files and to keep the library version as its suffix. The name of shared object file should be the same as SONAME and .so file without suffix should be a symlink to the versioned file. In this case, SONAME contains only the major version as a suffix, which is acceptable by the most of projects and Linux distributions. After this change, executing `make` and `make install` produces the following results: ``` $ make [...] $ ls -la proxylib/ | grep libcilium.so lrwxrwxrwx 1 mrostecki users 14 Jan 23 14:04 libcilium.so -> libcilium.so.1 -rw-r--r-- 1 mrostecki users 21362336 Jan 23 14:04 libcilium.so.1 $ readelf -a proxylib/libcilium.so | grep SONAME 0x000000000000000e (SONAME) Library soname: [libcilium.so.1] $ make install PREFIX=~/.local LIBDIR=~/.local/lib64 [...] $ ls -la ~/.local/lib64/ total 20988 drwxr-xr-x 3 mrostecki users 188 Jan 23 14:57 . drwx------ 9 mrostecki users 91 Jan 23 14:40 .. lrwxrwxrwx 1 mrostecki users 14 Jan 23 14:57 libcilium.so -> libcilium.so.1 -rwxr-xr-x 1 mrostecki users 21362336 Jan 23 14:57 libcilium.so.1 ``` Signed-off-by: Michal Rostecki <mrostecki@suse.de> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
0f9fb59 | Martynas Pumputis | 25 January 2019, 13:04:51 UTC | workloads: Set options per runtime [ upstream commit 0035477ca593f1855ad77a0b61a86b39b38546af ] Previously, all workloads runtime options passed to `workloads.Setup/2` were passed to each individual runtime implementation. This led to some runtimes returning an error during the setup step, because not all options were supported by them (e.g. "datapath-mode" is not supported by the containerd workloads runtime). This commit changes the runtime options in a way that they are defined per runtime. Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
68e5fe7 | Martynas Pumputis | 25 January 2019, 10:58:28 UTC | workloads: Export WorkloadRuntimeType type [ upstream commit f9174de1a6896833237202c21b470a7b8a3a4268 ] Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
4c8ec20 | Eloy Coto | 25 January 2019, 12:14:43 UTC | Kubernetes: CEP fixes. [ upstream commit 9c744603631024b7484a0718d066ee92ae187667 ] Due the changes on commit `c5e50eb57be837b6b90c601c990fb6834d96d33b` the get cep list is not reporting correctly. With this change the list is reporting correctly: ``` NAME ENDPOINT ID IDENTITY ID INGRESS ENFORCEMENT EGRESS ENFORCEMENT ENDPOINT STATE IPV4 IPV6 testclient-m894b 3216 4397 false false ready 10.10.0.218 f00d::a0a:0:0:f testds-2p4hq 3644 645 false false ready 10.10.0.120 f00d::a0a:0:0:f521 ``` Also, make ingress/egress enforcement value in the json as non-empty, due is good to report that the value is false for jsonpath utilities. Due the changes, I also changed the CI report to make it easy to understand if the test failed, the new behaviour looks like this: ``` <Checks> Number of 'context deadline exceeded' in logs: 0 Number of 'level=error' in logs: 0 Number of 'level=warning' in logs: 0 Number of 'Cilium API handler panicked' in logs: 0 Number of 'Goroutine took lock for more than' in logs: 0 Cilium pods: [cilium-rmcw9] Netpols loaded: CiliumNetworkPolicies loaded: Endpoint Policy Enforcement: Pod Ingress Egress coredns-fff89c9b9-cfkvb false false etcd-operator-5cf67779fd-hmkcv false false testclient-m894b false false testds-2p4hq false false cilium-etcd-8nwlbq9cvq false false cilium-etcd-wgptgl2gt5 false false cilium-etcd-xxh29gps5m false false ``` Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 26 January 2019, 01:11:22 UTC |
10c96b6 | Eloy Coto | 21 January 2019, 16:34:14 UTC | Contrib: Add prometheus and grafana dashboards. [ upstream commit 8308b07dce9fb14341e904868c7b59d31e742865 ] Added a new prometheus manifest that includes a fully functional Prometheus, grafana and kube-metrics to deploy in a single command. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
4d2452d | Ian Vernon | 23 January 2019, 19:31:40 UTC | endpoint: fix logic to finalize proxy state in dry mode [ upstream commit fa240b46ae3e14a12afed369702f49d13de90b59 ] The logic was inverted for checking whether proxy state should be finalized or not. Fixes: 4045887122c11827977956abda8c7c28684538f8 Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
f2d32fa | Thomas Graf | 24 January 2019, 19:22:38 UTC | health: Annotate k8s node with health IPs in intial annotation call [ upstream commit 45b4a5c3d20b6c476a1592585f23550a48f9f7d9 ] Related: #6728 Fixes: be7d5cb4b919 ("node: Use new routing datapath for node events") Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
58183c8 | Thomas Graf | 24 January 2019, 19:23:28 UTC | vendor: Remove now unused dependency code [ upstream commit 4d533b3c2d2ed7f3ad61bd848625d82abf75b3ae ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
0a6b5d5 | Thomas Graf | 24 January 2019, 19:23:28 UTC | node: Remove unused ipv4HealthAddress and ipv6HealthAddress [ upstream commit a26b64b7319f0a6ebc2bf589e257a0f878ded82b ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
8be972e | Thomas Graf | 24 January 2019, 19:23:28 UTC | ipam: Only allocate IPs if address family is enabled [ upstream commit 75028e4bcb1491042e94f30490857ba75d842d38 ] Only initialize the IP allocator for a particular address family if that address family is actually enabled. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
e06d846 | Thomas Graf | 24 January 2019, 19:23:28 UTC | agent: Fail if loopback IPv4 address cannot be allocated [ upstream commit f0653858bd73f6d97529710d6bebeb929d6d0e18 ] Make sure that allocation fails if the allocator is not available Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
e609b0a | Thomas Graf | 24 January 2019, 19:23:28 UTC | health: Support running IPv6 only health endpoints [ upstream commit d92a362c13c58e15d0e9768bfdec9db1c05cf35a ] The cleanup was limited to IPv4 only so far Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
d33e9e9 | Thomas Graf | 24 January 2019, 19:23:28 UTC | health: Only allocate health IP if address family is enabled [ upstream commit 35bf51763c96196d22d9b3458a3c8988d9f34aec ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
a99acb7 | Thomas Graf | 24 January 2019, 19:23:28 UTC | ipam: Remove unused IPAMConfig [ upstream commit dec2dbada2b417862f74ebf0712a3fcf5194ab25 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
f4cf7ab | Thomas Graf | 24 January 2019, 19:23:28 UTC | ipam: Add AllocateNextFamily() to allocate IPs of individual families [ upstream commit 2581cab845d6d3c898dc33262a2fc703e259ae06 ] AllocateNext() allows to allocate for a specific family but the allocation does not fail if the allocator is unavailable. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
c4d0ff2 | Thomas Graf | 24 January 2019, 19:23:28 UTC | ipam: Stop using global ipamConfig variable [ upstream commit 4a1701a183383b6620a3bbf2a351b1ba507bd153 ] Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
2608259 | Thomas Graf | 24 January 2019, 19:23:28 UTC | workloads: Fix init race condition between workloads and IPAM init [ upstream commit f3932a1a69b729530b83debcd42f840f26fd5afa ] The workloads system requires IP allocation. Initialize the workloads system after initializing IPAM. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
142e371 | Ian Vernon | 24 January 2019, 18:32:46 UTC | endpoint: do not return error if endpoint RLock fails due to endpoint being removed [ upstream commit 73aafb818b564b673116af008497c28121d1794e ] The Cilium CI has failed recently on multiple occasions due to errors appearing for controllers for endpoints which resolve the identity for said endpoints. The errors were "rlock failed: endpoint is in the process of being removed". Handle this case specially in both cases where \`identityLabelsChanged\` is called for endpoints by adding a new error variable which is returned if \`RLockAlive\` fails, and handle this error being returned in callers to \`identityLabelsChanged\`. In the case where \`identityLabelsChanged\` is called within the \`resolve-identity\` controller for an endpoint, do not return an error in the controller if \`RLockAlive\` fails because the endpoint is being deleted, so there is no purpose in allocating a new identity for it. Fixes: #6721 Signed-off by: Ian Vernon <ian@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
e2553f5 | John Fastabend | 18 January 2019, 16:50:00 UTC | cilium: ipsec, bpf add receive side ipsec [ upstream commit 6fd8f36a6eb5a5b05107a83f15f34f70b543b23d ] If we did nothing here cilium_vxlan will pop the vxlan header then the outer header will route to cilium_host (assuming tunnel mode) this route would hit the ipsec decrypt path so cilium host would get decrypted packet. These would process using normal host logic and be locally redirected to lxc endpoint via BPF program. However, when mixed with non-ipsec traffic some flows were getting encrypted/decrypted unexpectedly. So instead of hopping through multiple BPF programs this changes the flow as follows. Set the mark decrypt bit and pass to stack. The routing stack decrypts the packet and routes it back to cilium vxlan after decryption is complete. After this cilium_vxlan "sees" the decrypted bit is set and does redirect to lxc. We keep the ipsec traffic localized this way. IMO its easier to trace the flow. We had to pull in a portion of if_packet to get magic numbers for PACKET_* values. Only pulled in required defines for now. Finally, in the next set of patches we drop the tunnel mode flag and this becomes even more relavent to avoid (re)routing. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
8077110 | John Fastabend | 23 January 2019, 01:41:03 UTC | cilium: Add IPv4GW to node discovery [ upstream commit e1438518b192cbf56bb46ce2b3977d4f2d19293f ] This adds the IPv4 gateway address to the localNode so that on node events we can use the gateway address to populate the IPSec context. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
6ea2cdb | John Fastabend | 22 January 2019, 19:32:36 UTC | cilium: ipsec, bind nodeUpdate to ipsec upsert to install ipsec state [ upstream commit 29536aeef82948a9aa720b4b8f6716230991206b ] This hooks into nodeUpdate events using it to add/remote IPSec policies and states when new endpoints come online/offline. For node based ipsec this is sufficient, if we want finer grained IPSe policies. Possibly per identity we will need to hook into ipache most likely. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
a6e3a83 | John Fastabend | 17 January 2019, 20:34:57 UTC | cilium: ipsec, add BPF datapath encryption direction [ upstream commit 3b6245843aeff0509bf0781ef88658ae7a69b9f8 ] This enables encryption on TX path for traffic that is sent over a vxlan tunnel. Currently, we use tunneled IPSec but the datapath should work regardless. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
1fae864 | John Fastabend | 18 January 2019, 18:58:08 UTC | cilium: ipsec, import keys via certs file [ upstream commit a7beef597de252fdc008b3e34612410857c9c7dd ] Initially, we will support a pre-shared key model where all endpoints have a pre-shared keys loaded from a file. The file layout is as follows with a key per line. authname authkey encname enckey [scope] This allows keys to be scoped so that it is possible to have a key per node if desired. If scope is omitted the key is considered a default key used if a more specific key is not found. My three node testing file reads as follows, hmac(sha256) abcdefghijklmnopqrstuvwzyzABCDEF cbc(aes) abcdefghijklmnopqrstuvwzyzABCDEF ubuntu-kvm1 hmac(sha256) abcdefghijklmnopqrstuvwzyzABCDEF cbc(aes) abcdefghijklmnopqrstuvwzyzABCDEF ubuntu-kvm2 hmac(sha256) abcdefghijklmnopqrstuvwzyzABCDEF cbc(aes) abcdefghijklmnopqrstuvwzyzABCDEF The file is loaded at init time so any changes will have to be consumed by a restart. In the future we can add watchers for the file and allow using etcd secrets (files). Also note the logic is built so that other methods of key exchanges can be added later if folks want a different model. Looking forward we can more specific scope types to do per identity keys if needed. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
8cafbc6 | John Fastabend | 17 January 2019, 21:29:53 UTC | cilium: ipsec, add option and #define for ENABLE_IPSEC enablement [ upstream commit 7593ee5f1e9634ff2d2314509fd0847291753f97 ] Add a command line option to enable inter-cilium-node IPSec encryption. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
12ce33a | John Fastabend | 17 January 2019, 21:18:23 UTC | cilium: ipsec, bpf fix mark comments and func names to reflect current usage [ upstream commit 7a597cf8326ac2b528b852771de4566479fd9738 ] The current skb->mark comment is out of date and no longer reflects the actual usage of the 32bit mark field. Fix this and generalize get_identity_via_proxy to simply get_identity it will be used in IPSec case now as well. The cluster ID was removed here, 661062fec8a1 ("bpf: Remove cluster identity"). Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
2a911ac | John Fastabend | 17 January 2019, 20:16:01 UTC | cilium: ipsec, qualify iptables rules to avoid colliding with ipsec [ upstream commit 05a48aced3283313343f2a2cd0660960cae563e4 ] Cilium uses a handful of IPTable rules to mark local packets to/from the proxy along with a few other cases. We need to ensure that these rules do not interfere with packets that need to be encrypted or decrypted. This patch adds qualifiers to the iptables rules added to ensure the encrypt/decrypt mark bits are not set before taking any actions. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
94a491e | John Fastabend | 17 January 2019, 20:00:48 UTC | cilium: ipsec, add ip route needed to decrypt/encrypt traffic [ upstream commit 99a6e33d3ddd99606ad858350779593aa6d3e3f3 ] IPSec datapath pushes packets into IP stack for encryption and decryption. This adds the routing rules used to enforce this. These are inserted once per node so overhead should not be concerning. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
6122654 | John Fastabend | 17 January 2019, 19:39:50 UTC | cilium: ipsec, insert 'ip rules' for ipsec [ upstream commit 48961ade2cc88b79ae9c90e7cd742225bb4ea1bf ] IPSec will be isolated from the "normal" routing tables via a set of marks to direct traffic to an IPSec table. When an endpoint has IPSec enabled the datapath will first set the mark bit to endicate MARK_ENCRYPTED or MARK_DECRYPTED to depending on expected direction. Once the encryption or decryption has occured the mark fields will be cleared and normal processing will happen. In this patch add the mark based 'ip rules' to segregate the IPSec traffic. Also decided on adding default const to ./pkg/datapath/linux/datapath.go becaause (a) as defaults they only make sense on linux datapath it seems and (b) originally I pushed them in via ./pkg/option/ and ./pkg/defaults but this got a bit ugly IMO to translate through to lower datapath after latest changes to separate fake/linux dp. Sure we can push them through NewDaemon but do Daemon creators really want this control? Anyways its easy to go back to pushing at Daemon create time if anyone cares. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
3b84929 | John Fastabend | 17 January 2019, 18:59:44 UTC | cilium: ipsec, add go API to configure xfrm (IPSec) [ upstream commit b2b901fb191634fe971bdec4f24f1a145f62b923 ] This adds a new datapath directory ipsec to configure ipsec for Cilium. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
a98836b | John Fastabend | 17 January 2019, 18:56:31 UTC | cilium: ipsec, add support for inserting rules via golang API [ upstream commit b97804ea33051ef0ace1c1d0c577c3e850a694c9 ] Currently, existing route rules are inserted via init script. Because we are going to start adding more rules for IPSec this patch adds a proper route API that we can call directly. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
e5a3dfd | John Fastabend | 17 January 2019, 18:44:09 UTC | cilium: ipsec, extend datapath route pkg to support more specifiers [ upstream commit fdf560711c549e64b113ceda034d1340dddb9aa7 ] In order to support IPSec we use specific routes inserted into a table designated for IPSec. To further isolate these entries we also constrain the routes using the proto (proto=50 for ESP) field and insert as a "local" route to ensure traffic is processed by the IPSec in kernel code on the correct device. Details on IPSec implementation in documentation and subsequent patches. To facilitate this add support in route pkg to program these from the API. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
313b189 | John Fastabend | 17 January 2019, 18:33:19 UTC | cilium: ipsec, report flags with endpoint maps [ upstream commit bfb4bf304a56179c54c7f603781dbc2f0a06291f ] Reporting flags with endpoint maps helps debugging by allocwing us to ensure the datapath and control path are in sync. Useful when ipsec becomes enabled and host/endpoint flags determine IPSec flows. Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
13a4d0e | Moritz Johner | 24 January 2019, 00:39:44 UTC | cleanup: proper integration test for stdout/err [ upstream commit de302a07906a05ce72737253aa3091314077af31 ] shell scripts in tests/ are deprecated (#6709) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
2dd4504 | Moritz Johner | 20 January 2019, 22:01:01 UTC | fix: redirect help text to stderr [ upstream commit a98fa8ee7dd2e97e5943d84198ba8f64025adeef ] The help text should be printed to stderr to avoid confusion when piping the stdout to another program. e.g. cilium endpoint confi 173 | grep Conntrack Fixes: #2498 Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
7e529f3 | Thomas Graf | 24 January 2019, 19:20:09 UTC | node/manager: Disable unstable unit test [ upstream commit 2b3494efea8f7878c3ee4857dfe44d9df7741ffd ] Related: #6751 Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
9727344 | Michal Rostecki | 21 January 2019, 15:12:02 UTC | kvstore: Add Hint function for extending error messages [ upstream commit 3eedf38256636e90bd0d90da44dbf051995e70af ] Error message `context deadline exceeded` is not descriptive and does not show what component has a connectivity issue. This change introduces the Hint function which should be used in etcdClient methods to extend DeadlineExceeded error with information that it comes from etcd. Fixes: #6458 Signed-off-by: Michal Rostecki <mrostecki@suse.de> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
111dafb | Michal Rostecki | 21 January 2019, 15:07:34 UTC | client: Extend DeadlineExceeded error [ upstream commit 005f3fd3d4049ac3951210d3a424f45c84873918 ] Error message `context deadline exceeded` is not descriptive and does not show what component has a connectivity issue. This change extends DeadlineExceeded errors with information that it comes from Cilium API client. Fixes: #6458 Signed-off-by: Michal Rostecki <mrostecki@suse.de> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
83f97ff | Martynas Pumputis | 24 January 2019, 12:27:58 UTC | daemon: Skip existence check for ipvlan slave when restoring [ upstream commit 06b55eee4fe652bad44c0f8239d087443c8398e2 ] We cannot check from a host network namespace whether an ipvlan slave exists, and in some cases we cannot enter container's netns, as it requires bind mounting /proc to cilium-agent container (e.g. when running with k8s). Instead, check whether ipvlan datapath tail call map exists. Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
3182af3 | Martynas Pumputis | 24 January 2019, 11:19:08 UTC | endpoint: Make endpoint.DataPathMapID public [ upstream commit 585fafcba65cf59de786d3afd354371827b49f73 ] Otherwise, the field is not written into `/var/run/cilium/state/${EP_ID}/lxc_config.h` due to the JSON encoder skipping private fields. The missing field led cilium-agent to treat an ipvlan-based endpoint as a veth-based one (`ep.MustGraft()` returned false) which made the restoration of the endpoint to fail. Signed-off-by: Martynas Pumputis <martynas@covalent.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
ee5b4a7 | Thomas Graf | 23 January 2019, 23:42:57 UTC | test: Adjust CI for new CEP structure [ upstream commit bb7d7a812ebd9b5e8b8d1eac06683c16b9864925 ] The policy revision is no longer provided in the CEP as updating the CEP that often does not scale to a large number of pods. Rely on the CNP status instead which is already verified. One validation of the status.policy.{ingress|egress}.enforcing is kept to test the functionality. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
4cbe5a9 | Thomas Graf | 23 January 2019, 23:42:57 UTC | k8s: Restructure and optimize CEP [ upstream commit 99f0136e65cb02360a76cc0dfba5d40ebcb141d1 ] This commit creates a native type for the CiliumEndpoint CRD. It still uses a couple of structures from api/v1/models but the majority of the types are native. * CiliumEndpoint.Status.Spec is deprecated and no longer populated. The labe configuration is typically available in the pod. The endpoint configuration is almost never changed and if performed, it is done via CLI which means the CLI can also be used to query it. * CiliumEndpoint.Status.Status is deprecated but some fields which we know have users are preserved. All fields are mirrored to CiliumEndpoint.Status and new fields should only be added there. * The endpoint log is limited to the last 5 errors or warnings. Successful transitions are no longer included. * The list of controllers is limited to failing controllers and the list is sorted by controller name. * The endpoint networking field is reduced and the list of addressess is sorted. * The policy field is completely restructured and now contains a list of identities + L4 port + protocol for ingress and egress. Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
29d430f | Thomas Graf | 24 January 2019, 01:54:33 UTC | health: Fix health check to local health agent [ upstream commit 65e5d07f044a2e88e755f759888e3f6de2c04cb7 ] Fixes: #6728 Fixes: be7d5cb4b919 ("node: Use new routing datapath for node events") Signed-off-by: Thomas Graf <thomas@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
25f7db3 | Eloy Coto | 24 January 2019, 12:17:26 UTC | Test: Increase curl timeout [ upstream commit c6218d74f4d9e60f6f8bda53cb711c61e3f23161 ] Due DNS proxy each time that a DNS request happens creates a new regeneration happens, so conenct timeout of 3 seconds was not enough in the CI because of the CI load. Fix #6727 Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
1e6b3eb | Eloy Coto | 23 January 2019, 17:56:30 UTC | Test: Kubectl wait until CNP has status. [ upstream commit 8dbe9b5219e3414b20d98f80805ccf162844bb76 ] Change jq filter to wait until status is present to make sure that no race conditions happens. Signed-off-by: Eloy Coto <eloy.coto@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
0bfb4a8 | André Martins | 23 January 2019, 22:56:05 UTC | test: test upgrades against v1.3 instead of v1.3.0 [ upstream commit 31b2dc975fc939fe5fca2bd5d83e3ba1b2298d7e ] Fixes: 2ddf05339621 ("Test: Bump stable image to 1.3") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
727a355 | André Martins | 23 January 2019, 21:28:16 UTC | docs: cleaning up leftover in minikube gsg [ upstream commit a696c28d18209a83aea0fc9f75f6a277216bba4c ] Fixes: e331e92613a1 ("docs: update minikube gsg") Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
a1bd3ad | Daniel Borkmann | 21 January 2019, 22:05:03 UTC | cilium, ipvlan: implement base host connectivity [ upstream commit 7fbfe1cd92de1f1c0a573b56e5cfd70b9a4e26de ] This patch creates a ipvlan slave device named cilium_host in the init network namespace such that container/pods are enabled to talk to the host. Going through cilium monitor, I can see ping working with correct identities for the packet flow. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 20:35:12 UTC |
7f24c38 | Joe Stringer | 08 January 2019, 23:36:19 UTC | helpers: Limit ep gathering to 5m for all cilium pods [ upstream commit 1c62070f1523137d7d6a46957813559ad914cf0c ] Rather than allowing a limit of 5 minutes per cilium pod for gathering the endpoints list, restrict it to 5 minutes for all cilium pods. Existing test cases only ever use up to 2 cilium instances so this still leaves a reasonable amount of time. This doesn't have much impact with the current implementation which terminates at the first error while fetching endpoint status from cilium instances, but an upcoming commit will change this so we change it here. Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 05:46:05 UTC |
07989a4 | Joe Stringer | 08 January 2019, 23:20:40 UTC | helpers: Collect errors when EndpointWaitReady fails [ upstream commit 66ec8d6a7843478d78b8099e9be13bd44bd4c242 ] Previously only one cilium instance would be attempted to be contacted, and if unavailable, an error would be returned. In case the other Cilium instance is actually available, collect the error from the first instance then attempt to continue and print the state for the endpoints in the other instance. Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: John Fastabend <john.fastabend@gmail.com> | 25 January 2019, 05:46:05 UTC |