Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

v1.13 Backports 2023-07-17 #26861

Merged
merged 6 commits into from
Jul 18, 2023
Merged

v1.13 Backports 2023-07-17 #26861

merged 6 commits into from
Jul 18, 2023

Conversation

gandro
Copy link
Member

@gandro gandro commented Jul 17, 2023 •
edited

PRs skipped due to conflicts:

Once this PR is merged, you can update the PR labels via:

for pr in 23616 26660 26502 26800 26791 26810; do contrib/backporting/set-labels.py $pr done 1.13; done

or with

make add-labels BRANCH=v1.13 ISSUES=23616,26660,26502,26800,26791,26810

deepeshaburse and others added 6 commits July 17, 2023 11:38
@deepeshaburse @gandro
docs: update that egressGateway.installRoutes Helm value is only for …
83ab495 
…EKS ENI mode

[ upstream commit ff59a03 ]

Signed-off-by: Deepesha Burse <deepesha.3007@gmail.com>
Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
@squeed @gandro
docs: remove no-longer-valid known policy issue
a38aef6 
[ upstream commit d242b88 ]

This issue was resolved and the fix shipped in v1.13.3.

Signed-off-by: Casey Callendrello <cdc@isovalent.com>
Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
@sayboras @gandro
helm: Allow nodeport allocation for Ingress LB svc
72308af 
[ upstream commit bbdad5d ]

This commit is to make sure that users can have option to disable node
port allocation for LB service used by Ingress.

https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
@tklauser @gandro
client, health/client: set dummy host header on unix:// local communi…
0c392ed 
…cation

[ upstream commit b9ec2aa ]

Go 1.20.6 added a security fix [1] which leads to stricter sanitization
of the HTTP host header in the net/http client. Cilium's pkg/client
currently sets the Host header to the UDS path (e.g.
/var/run/cilium/cilium.sock), however the slashes in that Host header
now lead net/http to reject it.

RFC 7230, Section 5.4 states [2]:

> If the authority component is missing or undefined for the target URI,
> then a client MUST send a Host header field with an empty field-value.

The authority component is undefined for the unix:// scheme. Thus, the
correct value to use would be the empty string. However, this does not
work due to OpenAPI runtime using the same value for the URL's host and
the http client's host header. Thus, use a dummy value "localhost".

[1] https://go.dev/issue/60374
[2] https://datatracker.ietf.org/doc/html/rfc7230#section-5.4

Signed-off-by: Tobias Klauser <tobias@cilium.io>
Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
@aanm @gandro
.github: add 'name' field for the conformance-e2e job
4e2bd67 
[ upstream commit ce9d4b9 ]

jobs.<job>.env.job_name should be the same as the job name. Thus, adding
the field 'name' to the job will make sure that connectivity tests junit
test results are stored in bigquery for lookerstudio visualization.

Fixes: 12d7643 ("ci/workflows: add junit reports upload")
Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
@pchaigno @gandro
docs/ipsec: Clarify limitation on number of nodes
093a27c 
[ upstream commit 39a9def ]

The limitation on the number of nodes in the cluster when using IPsec
applies to clustermeshes as well and is the total number of nodes. This
limitation arises from the use of the node IDs, which are encoded on
16-bits.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
@gandro gandro added kind/backports This PR provides functionality previously merged into master. backport/1.13 This PR represents a backport for Cilium 1.13.x of a PR that was merged to main. labels Jul 17, 2023
@gandro gandro marked this pull request as ready for review July 17, 2023 12:15
@gandro gandro requested review from a team as code owners July 17, 2023 12:15
pchaigno
pchaigno approved these changes Jul 17, 2023
View reviewed changes
Copy link
Member

@pchaigno pchaigno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My PR looks good. Thanks!

tklauser
tklauser approved these changes Jul 17, 2023
View reviewed changes
Copy link
Member

@tklauser tklauser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My change looks good, thanks Sebastian.

sayboras
sayboras approved these changes Jul 17, 2023
View reviewed changes
Copy link
Member

@sayboras sayboras left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot and lgtm 🥇

@gandro
Copy link
Member Author

gandro commented Jul 17, 2023 •
edited by maintainer-s-little-helper bot

/test-backport-1.13

Job 'Cilium-PR-K8s-1.24-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks E/W loadbalancing (ClusterIP, NodePort from inside cluster, etc) Tests NodePort inside cluster (kube-proxy)

Failure Output

FAIL: Request from testclient-68q29 pod to service tftp://[fd04::11]:31082/hello failed

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.24-kernel-4.19/85/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.24-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

@gandro
Copy link
Member Author

gandro commented Jul 17, 2023

Travis timed out. Restarting. https://app.travis-ci.com/github/cilium/cilium/jobs/606163249

@gandro gandro mentioned this pull request Jul 17, 2023
Closed
@gandro
Copy link
Member Author

gandro commented Jul 17, 2023 •
edited

Travis hit #26873

Edit: This requires an additional upstream commit to be pulled in to fix.

@gandro gandro mentioned this pull request Jul 18, 2023
Closed
@gandro
Copy link
Member Author

gandro commented Jul 18, 2023

@gandro
Copy link
Member Author

gandro commented Jul 18, 2023

/test-1.24-4.19

@gandro gandro removed the request for review from squeed July 18, 2023 09:01
@gandro
Copy link
Member Author

gandro commented Jul 18, 2023

All required tests besides Travis have passed. Travis will not become green on this branch, as it needs follow-up fixes. Only missing review is for a 3 line docs change form Casey who is out today. Marking ready to merge.

@gandro gandro added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jul 18, 2023
@aditighag aditighag merged commit 617f0f3 into cilium:v1.13 Jul 18, 2023
60 of 62 checks passed
@gentoo-root gentoo-root mentioned this pull request Jul 26, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tklauser tklauser tklauser approved these changes

@pchaigno pchaigno pchaigno approved these changes

@aanm aanm aanm approved these changes

@sayboras sayboras sayboras approved these changes

Assignees
No one assigned
Labels
backport/1.13 This PR represents a backport for Cilium 1.13.x of a PR that was merged to main. kind/backports This PR provides functionality previously merged into master. ready-to-merge This PR has passed all tests and received consensus from code owners to merge.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@gandro @tklauser @pchaigno @aanm @sayboras @aditighag @deepeshaburse @squeed