New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Backport v1.13: ipsec: fixes for key rotation #27587
Conversation
/test-backport-1.13 |
/test-1.24-4.19 |
[ upstream commit bba3dfc ] From: John Fastabend <john.fastabend@gmail.com> On key update we only update the policy for our local node. But with latest round of changes we need to update for all nodes in the node cache. With out this we would rely on the validation interval timer to sync the nodes policy before we remove the old policy. This may or may not happen depending on how large the cluster is. Further I've seen us miss it even on relatively small clusters say around 30 nodes so seems its not entirely reliable to count on. Rather than rely on some external to ipsec timer to fire and sync the policies and to do it hopefully in our time window lets just force the nodeUpdate() call on all nodes in the cache when we get the key rotate event. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
[ upstream commit 4f3bc9f ] From: John Fastabend <john.fastabend@gmail.com> The cilium_encrypt_map is used to determine what key the datapath should use. This is done by setting the mark value of the skb and then in the XFRM policy the mark value is matched to designate what encryption policy/state to use. However, on key rotation we have an issue where the map entry with the key is updated before the xfrm policy is plumbed. The result is its possible to mark the skb with a value that will have no matching xfrm policy and result in a policy block error and drop the skb. To resolve ensure we do setup in the correct order and only set the min key in the cilium_encrypt_map after the policy has been updated. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
422dc09
to
49df953
Compare
/test-backport-1.13 Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed: Click to show.Test Name
Failure Output
Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/926/ If it is a flake and a GitHub issue doesn't already exist to track it, comment Then please upload the Jenkins artifacts to that issue. |
/test-1.26-net-next |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ack for tophat, I presume @jrfastab already took a closer look.
Manual backport of #27319
Signed-off-by: Zhichuan Liang gray.liang@isovalent.com