v1.13 backports 2023-07-31

[sayboras]

• Documentation: fix the broken links/dead links #26880 -- Documentation: fix the broken links/dead links (@vipul-21)
• bpf: l4lb: fix IPIP health-check path #27015 -- bpf: l4lb: fix IPIP health-check path (@julianwiedmann)
  • ⚠️ small conflict with GHA job
• operator: Adjust CiliumEndpoint GC to only run once in kvstore mode #25324 -- operator: Adjust CiliumEndpoint GC to only run once in kvstore mode (@learnitall)
  • ⚠️ small conflict root.go

Once this PR is merged, you can update the PR labels via:

$ for pr in 26880 27015 25324; do contrib/backporting/set-labels.py $pr done 1.13; done

[sayboras]

/test-backport-1.13

Job 'Cilium-PR-K8s-1.24-kernel-4.19' failed:

Click to show.

Test Name

K8sAgentPolicyTest Multi-node policy test with L7 policy using connectivity-check to check datapath

Failure Output

FAIL: connectivity-check pods are not ready after timeout

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.24-kernel-4.19/102/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.24-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.21-kernel-4.19' failed:

Click to show.

Test Name

K8sAgentPolicyTest Multi-node policy test with L7 policy using connectivity-check to check datapath

Failure Output

FAIL: cannot install connectivity-check

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-4.19/102/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.21-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

[learnitall]

Looks good! Thanks!

[sayboras]

@julianwiedmann there is bpf unit test failure due to the below error, seems like v1.13 didn't have the new attribute local_ivp4 in bpf.h (added as part of #25438). Any suggestion on how to move forward ?

https://github.com/cilium/cilium/actions/runs/5714021888/job/15480514433?pr=27154

l4lb_ipip_health_check_host.c:70:12: error: no member named 'local_ipv4' in 'struct bpf_tunnel_key'
        if (from->local_ipv4 != 0)

[julianwiedmann]

@julianwiedmann there is bpf unit test failure due to the below error, seems like v1.13 didn't have the new attribute local_ivp4 in bpf.h (added as part of #25438). Any suggestion on how to move forward ?

Oh of course 🤦.

It's fine to just drop that specific condition check from the test - thanks for digging it up @sayboras ! Should be straight-forward enough, but let me know if you want me to provide a custom backport.

[sayboras]

Seems like the below patch helps

diff --git a/bpf/tests/l4lb_ipip_health_check_host.c b/bpf/tests/l4lb_ipip_health_check_host.c
index ce9bd98fcd..e2f55e9dc7 100644
--- a/bpf/tests/l4lb_ipip_health_check_host.c
+++ b/bpf/tests/l4lb_ipip_health_check_host.c
@@ -67,10 +67,8 @@ int mock_skb_set_tunnel_key(__maybe_unused struct __sk_buff *skb,
 {
 	if (from->tunnel_id != 0)
 		return -1;
-	if (from->local_ipv4 != 0)
-		return -2;
 	if (from->remote_ipv4 != bpf_ntohl(BACKEND_IP))
-		return -3;
+		return -2;
 	return 0;
 }

[sayboras]

/test-backport-1.13

Job 'Cilium-PR-K8s-1.23-kernel-4.19' failed:

Click to show.

Test Name

K8sAgentPolicyTest Multi-node policy test with L7 policy using connectivity-check to check datapath

Failure Output

FAIL: cannot install connectivity-check

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.23-kernel-4.19/159/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.23-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.25-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks E/W loadbalancing (ClusterIP, NodePort from inside cluster, etc) Tests NodePort inside cluster (kube-proxy) with IPSec and externalTrafficPolicy=Local

Failure Output

FAIL: Request from k8s1 to service tftp://[fd04::11]:31289/hello failed

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.25-kernel-4.19/812/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.25-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

[sayboras]

CI hits below flakes:

• test-1.23-4.19 hits CI: K8sPolicyTest Multi-node policy test with L7 policy using connectivity-check to check datapath: provided port is already allocated #13071
• test-1.25-4.19 hits CI: K8sDatapathServicesTest Checks E/W loadbalancing (ClusterIP, NodePort from inside cluster, etc) Tests NodePort inside cluster (kube-proxy) with IPSec and externalTrafficPolicy=Local #25785

[sayboras]

/test-1.23-4.19

[sayboras]

/test-1.25-4.19