Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

v1.13 backports 2023-05-10 #25368

Merged
merged 2 commits into from
May 16, 2023
Merged

v1.13 backports 2023-05-10 #25368

merged 2 commits into from
May 16, 2023

Conversation

thorn3r
Copy link
Contributor

@thorn3r thorn3r commented May 10, 2023 •
edited

Once this PR is merged, you can update the PR labels via:

$ for pr in 25307 25298; do contrib/backporting/set-labels.py $pr done 1.13; done

@thorn3r thorn3r requested a review from a team as a code owner May 10, 2023 19:28
@thorn3r thorn3r added kind/backports This PR provides functionality previously merged into master. backport/1.13 This PR represents a backport for Cilium 1.13.x of a PR that was merged to main. labels May 10, 2023
@thorn3r thorn3r requested review from asauber and meyskens May 10, 2023 19:28
@thorn3r
Copy link
Contributor Author

thorn3r commented May 10, 2023

/test-backport-1.13

@asauber
Copy link
Member

asauber commented May 11, 2023

These look like legitimate build failures https://github.com/cilium/cilium/actions/runs/4940616411/jobs/8832419274?pr=25368

@thorn3r
Copy link
Contributor Author

thorn3r commented May 12, 2023

@asauber it is, it depends on commits in yutaro's backport PR: #25346
i'll rerun tests after thats merged

meyskens
meyskens approved these changes May 15, 2023
View reviewed changes
Copy link
Member

@meyskens meyskens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apart from the build failure and 1 GHA comment on the import my part is LGTM

@thorn3r thorn3r mentioned this pull request May 15, 2023
Closed
43 tasks
meyskens and others added 2 commits May 15, 2023 18:48
@meyskens @thorn3r
Fix copy of annotations into CiliumNode
d75793e 
[ upstream commit a1c949c ]

[ Backporter's notes: Dropped conflict in pkg/node/types/node.go ]

This fixes the adding of relevant annotations to the created CiliumNode
object. This was caused by the local node not containing this info.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
Signed-off-by: Tim Horner <timothy.horner@isovalent.com>
@asauber @thorn3r
datapath: link-local unicast addresses are "host"
0b1a79f 
[ upstream commit 05b6d82 ]

This is a fix for a regression in the local addresses logic, introduced
in 080857b as part of the
implementation for AddressScopeMax. Addresses with the form of
link-local unicast addresses began to be filtered out of the local
address aggregation, causing them to labeled with the "world" identity
for the sake of policy enforcement. Examples of such addresses include:

169.254.10.10
fe80::1234

This caused issues for a variety of users, whose policies allowing
"host" traffic would no longer allow traffic to these addresses, forcing
the use of workarounds involving CIDR policies, which is not the
intended behavior for this type of address. This was a regression as of
Cilium 1.12.0-rc2. One reason for this regression was that logic prior
to the change looked at the address scope, whereas logic after the
change looked at the address bytes, and it was found that many users had
assigned addresses of the forms above but with scope global, causing
them to again be filtered unconditionally.

This patch factors out the local address filtering logic into a
function, removes the skip over IsLinkLocalUnicast(), and adds a variety
of unit tests for that function.

fixes: cilium#25242
fixes: cilium#23910
fixes: cilium#16308
fixes: cilium#20055

Signed-off-by: Andrew Sauber <andrew.sauber@isovalent.com>
Signed-off-by: Tim Horner <timothy.horner@isovalent.com>
@thorn3r thorn3r force-pushed the pr/v1.13-backport-2023-05-10 branch from e9a5349 to 0b1a79f Compare May 15, 2023 22:50
@thorn3r
Copy link
Contributor Author

thorn3r commented May 15, 2023

/test-backport-1.13

@jibi
Copy link
Member

jibi commented May 16, 2023 •
edited by maintainer-s-little-helper bot

/test-backport-1.13

Job 'Cilium-PR-K8s-1.25-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks E/W loadbalancing (ClusterIP, NodePort from inside cluster, etc) Tests NodePort inside cluster (kube-proxy)

Failure Output

FAIL: Request from testclient-trkbr pod to service tftp://[fd04::12]:32364/hello failed

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.25-kernel-4.19/2217/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.25-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathConfig MonitorAggregation Checks that monitor aggregation flags send notifications

Failure Output

FAIL: Error deleting resource /home/jenkins/workspace/Cilium-PR-K8s-1.26-kernel-net-next/src/github.com/cilium/cilium/test/k8s/manifests/l3-policy-demo.yaml: Cannot retrieve cilium pod cilium-t8z74 policy revision: cannot get the revision

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/2317/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks N/S loadbalancing With host policy Tests NodePort

Failure Output

FAIL: Can not connect to service "http://192.168.56.11:31766" from outside cluster (1/10)

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/2332/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

@thorn3r
Copy link
Contributor Author

thorn3r commented May 16, 2023

/ci-e2e-1.13

@thorn3r
Copy link
Contributor Author

thorn3r commented May 16, 2023

/ci-external-workloads-v1.13

@thorn3r
Copy link
Contributor Author

thorn3r commented May 16, 2023

/test-1.25-4.19

@thorn3r
Copy link
Contributor Author

thorn3r commented May 16, 2023

/test-1.26-net-next

@thorn3r
Copy link
Contributor Author

thorn3r commented May 16, 2023

Cilium Conformance E2E tracking this flake here: #25483

@thorn3r
Copy link
Contributor Author

thorn3r commented May 16, 2023

k8s-1.26-kernel-net-next - failing due to #15455

@aditighag aditighag merged commit 5c7ee47 into cilium:v1.13 May 16, 2023
60 of 62 checks passed
@thorn3r thorn3r mentioned this pull request May 17, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@meyskens meyskens meyskens approved these changes

@asauber asauber asauber approved these changes

@michi-covalent michi-covalent michi-covalent approved these changes

Assignees
No one assigned
Labels
backport/1.13 This PR represents a backport for Cilium 1.13.x of a PR that was merged to main. kind/backports This PR provides functionality previously merged into master.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@thorn3r @asauber @jibi @meyskens @michi-covalent @aditighag