Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: Disable wireguard in v1.13 conformance datapath #24804

Conversation

pippolo84
Copy link
Member

@pippolo84 pippolo84 commented Apr 11, 2023

ci-datapath-1.13 workflow is failing in the configs with wireguard enable due to an incompatibility with the L7 proxy:

level=fatal msg="Wireguard (--enable-wireguard) is not compatible with L7 proxy (--enable-l7-proxy)" subsys=daemon

An example of that failure can be found here: https://github.com/cilium/cilium/actions/runs/4620306511/jobs/8170228050

All the workflow configs with wireguard enabled are changed to disable encryption.

@pippolo84 pippolo84 added area/CI Continuous Integration testing issue or flake release-note/ci This PR makes changes to the CI. labels Apr 11, 2023
@pippolo84 pippolo84 force-pushed the pr/pippolo84/fix-conformance-datapath-v1.13 branch from d6e4778 to 790faaf Compare April 11, 2023 09:10
@pippolo84 pippolo84 marked this pull request as ready for review April 11, 2023 09:15
@pippolo84 pippolo84 requested review from a team as code owners April 11, 2023 09:15
Copy link
Member

@pchaigno pchaigno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That won't work. All those configs have KPR=strict which isn't compatible with IPsec.

I think we need to disable Transparent Encryption instead.

.github/workflows/conformance-datapath-v1.13.yaml Outdated Show resolved Hide resolved
ci-datapath-1.13 workflow is failing in the configs with wireguard
enable due to an incompatibility with the L7 proxy:

`level=fatal msg="Wireguard (--enable-wireguard) is not compatible with
L7 proxy (--enable-l7-proxy)" subsys=daemon`

An example of that failure can be found here:
https://github.com/cilium/cilium/actions/runs/4620306511/jobs/8170228050

All the workflow configs with wireguard enabled are changed to disable
encryption.

Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
@pippolo84 pippolo84 force-pushed the pr/pippolo84/fix-conformance-datapath-v1.13 branch from 790faaf to 67f59ea Compare April 11, 2023 10:07
@pippolo84
Copy link
Member Author

That won't work. All those configs have KPR=strict which isn't compatible with IPsec.

I think we need to disable Transparent Encryption instead.

Thanks for the suggestion, I've changed it to disable encryption.

@pippolo84 pippolo84 requested a review from pchaigno April 11, 2023 10:08
@pchaigno pchaigno added area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. labels Apr 11, 2023
@gandro
Copy link
Member

gandro commented Apr 11, 2023

I'm confused, why are we only hitting this now? Do the datapath tests make use of L7 proxy? If not, then I think it might be the better option to disable L7 instead (which is what the Cilium CLI was supposed to do for v1.13 and older).

(Having said that, I'm fine with merging this as is, to unblock the v1.13 branch.)

@dylandreimerink dylandreimerink merged commit bb7d150 into cilium:master Apr 11, 2023
43 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/CI Continuous Integration testing issue or flake area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/ci This PR makes changes to the CI.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants