Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cannot install or upgrade to new versions of Cilium with ipsec enabled #27119

Open
joestringer opened this issue Jul 27, 2023 · 5 comments
Open

Cannot install or upgrade to new versions of Cilium with ipsec enabled #27119

joestringer opened this issue Jul 27, 2023 · 5 comments
Labels
affects/v1.11 This issue affects v1.11 branch affects/v1.12 This issue affects v1.12 branch affects/v1.13 This issue affects v1.13 branch affects/v1.14 This issue affects v1.14 branch area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. feature/ipsec Relates to Cilium's IPsec feature kind/meta Meta-task for co-ordination. kind/regression This functionality worked fine before, but was broken in a newer release of Cilium. pinned These issues are not marked stale by our issue bot. sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages.

Comments

@joestringer
Copy link
Member

Recent releases of Cilium have included a warning message at the top of the release notes to recommend not to upgrade if users are using ipsec:

Example from v1.13.4 release notes:

Do NOT upgrade to this release if you are using IPsec.

Example v1.13.4 Upgrade documentation:
https://docs.cilium.io/en/v1.13/operations/upgrade/#id2

These recommendations are made due to known bugs in the ipsec implementation which can cause connection disruption with the combination of particular Cilium versions and ipsec feature enablement.

We can use this meta issue to track known issues and dev/testing efforts to resolve.
@joestringer joestringer added the kind/meta Meta-task for co-ordination. label Jul 27, 2023
@julianwiedmann julianwiedmann added the area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. label Jul 27, 2023
@aanm aanm added affects/v1.11 This issue affects v1.11 branch affects/v1.12 This issue affects v1.12 branch affects/v1.13 This issue affects v1.13 branch affects/v1.14 This issue affects v1.14 branch labels Jul 27, 2023
@youngnick youngnick added the sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. label Jul 28, 2023
@pchaigno
Copy link
Member

Versions that are known to have bugs are v1.12.8+, v1.11.15+, v1.13.1+, and v1.14.0+. Those bugs typically manifest as packet drops (sometimes entirely preventing two nodes from communicating) with various XFRM counters increasing.

@joestringer
Copy link
Member Author

I believe these are now addressed in v1.11.20, v1.12.13, v1.13.6 and v1.14.1. Is that accurate?

@pchaigno
Copy link
Member

No, unfortunately we still have issues around key rotation (the fix didn't make it into those releases) and for some upgrades when tunneling is enabled.

@github-actions
Copy link

This issue has been automatically marked as stale because it has not
had recent activity. It will be closed if no further activity occurs.

@github-actions github-actions bot added the stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. label Oct 24, 2023
@julianwiedmann julianwiedmann added kind/regression This functionality worked fine before, but was broken in a newer release of Cilium. pinned These issues are not marked stale by our issue bot. and removed stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. labels Oct 24, 2023
@julianwiedmann
Copy link
Member

No, unfortunately we still have issues around key rotation (the fix didn't make it into those releases)

For those keeping score at home, I believe this is handled by #28258 and #28485 in the latest patch releases.

@julianwiedmann julianwiedmann added the feature/ipsec Relates to Cilium's IPsec feature label Nov 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
affects/v1.11 This issue affects v1.11 branch affects/v1.12 This issue affects v1.12 branch affects/v1.13 This issue affects v1.13 branch affects/v1.14 This issue affects v1.14 branch area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. feature/ipsec Relates to Cilium's IPsec feature kind/meta Meta-task for co-ordination. kind/regression This functionality worked fine before, but was broken in a newer release of Cilium. pinned These issues are not marked stale by our issue bot. sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@joestringer @pchaigno @aanm @youngnick @julianwiedmann