bpf: Inline assembly for packet context access #15397
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ConformanceIngress | |
| # Any change in triggers needs to be reflected in the concurrency group. | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - 'Documentation/**' | |
| - 'test/**' | |
| push: | |
| branches: | |
| - main | |
| - ft/main/** | |
| paths-ignore: | |
| - 'Documentation/**' | |
| - 'test/**' | |
| permissions: read-all | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }} | |
| cancel-in-progress: true | |
| env: | |
| # renovate: datasource=github-releases depName=cilium/cilium-cli | |
| cilium_cli_version: v0.13.2 | |
| cilium_cli_ci_version: | |
| kind_version: v0.17.0 | |
| kind_config: .github/kind-config.yaml | |
| metallb_version: 0.12.1 | |
| timeout: 5m | |
| jobs: | |
| ingress-conformance-test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: Without XDP | |
| bpf-lb-acceleration: disabled | |
| loadbalancer-mode: dedicated | |
| default-ingress-controller: false | |
| - name: With XDP | |
| bpf-lb-acceleration: native | |
| loadbalancer-mode: dedicated | |
| default-ingress-controller: false | |
| - name: With Shared LB | |
| bpf-lb-acceleration: disabled | |
| loadbalancer-mode: shared | |
| default-ingress-controller: false | |
| - name: With Default Ingress Controller | |
| bpf-lb-acceleration: disabled | |
| loadbalancer-mode: dedicated | |
| default-ingress-controller: true | |
| steps: | |
| - name: Checkout main branch to access local actions | |
| uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| persist-credentials: false | |
| - name: Set Environment Variables | |
| uses: ./.github/actions/set-env-variables | |
| - name: Install Cilium CLI | |
| uses: cilium/cilium-cli@b5af8b2ce225699954dd5204e6e65e500711973e | |
| with: | |
| release-version: ${{ env.cilium_cli_version }} | |
| ci-version: ${{ env.cilium_cli_ci_version }} | |
| - name: Set image tag | |
| id: vars | |
| run: | | |
| if [ ${{ github.event.pull_request }} ]; then | |
| SHA=${{ github.event.pull_request.head.sha }} | |
| else | |
| SHA=${{ github.sha }} | |
| fi | |
| echo sha=${SHA} >> $GITHUB_OUTPUT | |
| CILIUM_INSTALL_DEFAULTS="--chart-directory=install/kubernetes/cilium \ | |
| --helm-set=debug.enabled=true \ | |
| --helm-set=debug.verbose=envoy \ | |
| --helm-set=image.repository=quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-ci \ | |
| --helm-set=image.useDigest=false \ | |
| --helm-set=image.tag=${SHA} \ | |
| --helm-set=operator.image.repository=quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/operator \ | |
| --helm-set=operator.image.suffix=-ci \ | |
| --helm-set=operator.image.tag=${SHA} \ | |
| --helm-set=operator.image.useDigest=false \ | |
| --helm-set=securityContext.privileged=true \ | |
| --helm-set kubeProxyReplacement=strict \ | |
| --helm-set=ingressController.enabled=true \ | |
| --helm-set=ingressController.loadbalancerMode=${{ matrix.loadbalancer-mode }} \ | |
| --helm-set=ingressController.default=${{ matrix.default-ingress-controller }} \ | |
| --helm-set=extraConfig.bpf-lb-acceleration=${{ matrix.bpf-lb-acceleration }} \ | |
| --rollback=false \ | |
| --version=" | |
| echo cilium_install_defaults=${CILIUM_INSTALL_DEFAULTS} >> $GITHUB_OUTPUT | |
| - name: Checkout | |
| uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 | |
| with: | |
| ref: ${{ steps.vars.outputs.sha }} | |
| persist-credentials: false | |
| - name: Create kind cluster | |
| uses: helm/kind-action@d8ccf8fb623ce1bb360ae2f45f323d9d5c5e9f00 # v1.5.0 | |
| with: | |
| version: ${{ env.kind_version }} | |
| config: ${{ env.kind_config }} | |
| - name: Checkout ingress-controller-conformance | |
| uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 | |
| with: | |
| # Use the forked repo with retry mechanism | |
| # Please refer to https://github.com/kubernetes-sigs/ingress-controller-conformance/pull/101 for more details. | |
| repository: cilium/ingress-controller-conformance | |
| path: ingress-controller-conformance | |
| ref: 010bbae21b71d9785660b87908dfe2ba8cd2f25d | |
| persist-credentials: false | |
| - name: Install Ingress conformance test tool | |
| timeout-minutes: 10 | |
| run: | | |
| cd ingress-controller-conformance | |
| make build | |
| - name: Wait for images to be available | |
| timeout-minutes: 30 | |
| shell: bash | |
| run: | | |
| for image in cilium-ci operator-generic-ci ; do | |
| until docker manifest inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/$image:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done | |
| done | |
| - name: Install Cilium | |
| run: | | |
| cilium install ${{ steps.vars.outputs.cilium_install_defaults }} | |
| - name: Install metallb for LB service | |
| timeout-minutes: 10 | |
| run: | | |
| KIND_NET_CIDR=$(docker network inspect kind -f '{{(index .IPAM.Config 0).Subnet}}') | |
| METALLB_IP_START=$(echo ${KIND_NET_CIDR} | sed "s@0.0/16@255.200@") | |
| METALLB_IP_END=$(echo ${KIND_NET_CIDR} | sed "s@0.0/16@255.250@") | |
| METALLB_IP_RANGE="${METALLB_IP_START}-${METALLB_IP_END}" | |
| cat << EOF > metallb_values.yaml | |
| configInline: | |
| address-pools: | |
| - name: default | |
| protocol: layer2 | |
| addresses: | |
| - ${METALLB_IP_RANGE} | |
| psp: | |
| create: false | |
| EOF | |
| helm install --namespace metallb-system \ | |
| --create-namespace \ | |
| --repo https://metallb.github.io/metallb metallb metallb \ | |
| --version ${{ env.metallb_version }} \ | |
| --values metallb_values.yaml \ | |
| --wait | |
| # Remove this step once https://github.com/cilium/cilium-cli/pull/1432 is merged. | |
| - name: Create Ingress Endpoint | |
| if: ${{ matrix.loadbalancer-mode == 'shared' }} | |
| timeout-minutes: 5 | |
| run: | | |
| cat << EOF | kubectl apply -f - | |
| apiVersion: v1 | |
| kind: Endpoints | |
| metadata: | |
| name: cilium-ingress | |
| namespace: kube-system | |
| subsets: | |
| - addresses: | |
| - ip: "192.192.192.192" | |
| ports: | |
| - port: 9999 | |
| EOF | |
| - name: Create sample workload | |
| timeout-minutes: 5 | |
| run: | | |
| kubectl apply -n default -f https://raw.githubusercontent.com/istio/istio/release-1.11/samples/bookinfo/platform/kube/bookinfo.yaml | |
| if [ ${{ matrix.default-ingress-controller }} = "true" ]; then | |
| # remove ingressClassName line from basic-ingress.yaml | |
| sed -i '/ingressClassName/d' examples/kubernetes/servicemesh/basic-ingress.yaml | |
| kubectl apply -n default -f examples/kubernetes/servicemesh/basic-ingress.yaml | |
| kubectl wait -n default --for=condition=Ready --all pod --timeout=${{ env.timeout }} | |
| fi | |
| kubectl apply -n default -f examples/kubernetes/servicemesh/basic-ingress.yaml | |
| kubectl wait -n default --for=condition=Ready --all pod --timeout=${{ env.timeout }} | |
| - name: Run Sanity check (external) | |
| timeout-minutes: 5 | |
| run: | | |
| lb=$(kubectl get ingress basic-ingress -o jsonpath='{.status.loadBalancer.ingress[0].ip}') | |
| curl -s -v --connect-timeout 5 --max-time 20 --retry 3 --fail -- http://"$lb" | |
| curl -s -v --connect-timeout 5 --max-time 20 --retry 3 --fail -- http://"$lb"/details/1 | |
| - name: Run Sanity check (internal to NodePort) | |
| timeout-minutes: 5 | |
| run: | | |
| if [ ${{ matrix.loadbalancer-mode }} = "dedicated" ]; then | |
| node_port=$(kubectl get svc cilium-ingress-basic-ingress -o jsonpath='{.spec.ports[?(@.port==80)].nodePort}') | |
| else | |
| node_port=$(kubectl get -n kube-system svc cilium-ingress -o jsonpath='{.spec.ports[?(@.port==80)].nodePort}') | |
| fi | |
| docker exec -i chart-testing-control-plane curl -s -v --connect-timeout 5 --max-time 20 --retry 3 --fail http://localhost:$node_port/details/1 | |
| - name: Cleanup Sanity check | |
| timeout-minutes: 5 | |
| run: | | |
| # Clean up after sanity check to avoid any conflicts with the conformance test | |
| kubectl delete -n default -f examples/kubernetes/servicemesh/basic-ingress.yaml | |
| kubectl delete -n default -f https://raw.githubusercontent.com/istio/istio/release-1.11/samples/bookinfo/platform/kube/bookinfo.yaml | |
| kubectl wait ingress basic-ingress --for=delete | |
| - name: Run Ingress conformance test | |
| timeout-minutes: 30 | |
| run: | | |
| cd ingress-controller-conformance | |
| ./ingress-controller-conformance -ingress-class cilium -wait-time-for-ingress-status 10s -wait-time-for-ready 60s | |
| - name: Post-test information gathering | |
| if: ${{ !success() }} | |
| run: | | |
| kubectl get pods --all-namespaces -o wide | |
| cilium status | |
| cilium sysdump --output-filename cilium-sysdump-out | |
| shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently | |
| - name: Upload artifacts | |
| if: ${{ !success() }} | |
| uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 | |
| with: | |
| name: cilium-sysdump-out.zip | |
| path: cilium-sysdump-out.zip | |
| retention-days: 5 |