ipsec: fixes for key rotation #27319
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
jrfastab
added
needs-backport/1.11
needs-backport/1.13
joestringer
reviewed
Aug 8, 2023
joestringer
added
the
release-note/bug
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
|
/test |
jrfastab
force-pushed
the
pr/jrfastab/rollkeys
branch
from
d03d566
to
a67ec3e
Compare
|
/test |
rolinh
approved these changes
Aug 17, 2023
maintainer-s-little-helper
bot
added
the
ready-to-merge
margamanterola
added
backport-pending/1.11
backport/author
|
Marking as backport/author to avoid this getting in the backporter bucket, as it's expected to have conflicts. @jschwinger233 will take care of the backports. |
This was referenced Aug 18, 2023
jrfastab
added
backport-done/1.11
|
I've added a release note. |
joestringer
moved this from Needs backport from main
to Backport done to v1.12
in 1.12.14
joestringer
moved this from Needs backport from main
to Backport done to v1.13
in 1.13.7
joestringer
moved this from Needs backport from main
to Backport done to v1.14
in 1.14.2
This was referenced Sep 9, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixups to ensure keys are correctly in place before deleting the old key.
Instantiate all xfrm rules when new key shows up instead of waiting for nodeUpdate events through validator to happen. Its not always the case on larger clusters that the nodeUpdate logic will trigger before the key retention logic triggers to delete old keys. In this case we may be missing xfrm rules for new keys for some nodes.
Ensure rules are in place before key is updated. Current logic updates datapath key before updating the BPF maps creating smallish window where pkts can be marked for the new key but the BPF maps and datapath wont have the mapping to do this yet resulting in dropped pkts.
Both of these intend to address an increased policy block counter in recent versions.