v1.7 backports 2020-07-08 #12458
Merged
v1.7 backports 2020-07-08 #12458
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
backport/1.7
kind/backports
|
test-backport-1.7 |
|
The failures look legit: |
vadorovsky
force-pushed
the
pr/v1.7-backport-2020-07-08
branch
from
113f926
to
7d336a1
Compare
|
test-backport-1.7 |
christarazi
approved these changes
Jul 8, 2020
[ upstream commit 1cc79c1 ] The skb->mark field may not reliable in chaining modes because the host stack may have conflicting users of the mark field. For example in one case we observe a set mark rule 'MARK and 0xfff1ffff' which mangles the identity stored in skb->mark. If Cilium user also has ingress policy logic the identity is no longer correct. This likely will result in policy denied hits, -> stack flow 0xa0688256 identity 54898->7179 state established ifindex 0 orig-ip 0.0.0.0: 192.168.187.136:50344 -> 192.168.187.139:80 tcp SYN xx drop (Policy denied) flow 0xa0688256 to endpoint 149, identity 54897->7179: 192.168.187.136:50344 -> 192.168.187.139:80 tcp SYN To fix this create a flag EnableIdentityMark to allow setting the identity. In cases that have conflicting mark values this can then be disabled. The trace on ingress will no longer have a listed identity but because when 'identity < UNMANAGED' we do the lookup using the src ip and policy will work correctly. Fixes: f25d8b9 ("bpf: Preserve source identity for hairpin via stack") Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
[ upstream commit c7acec0 ] Fix the helm usage of enableIdentityMap so that it uses the correct cilium-agent variable enableIdentityMark. Additionally add text in Calico guide for CNI chaining to use the field. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
[ upstream commit 8f624a7 ] Signed-off-by: André Martins <andre@cilium.io> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
[ upstream commit ecac73d ] This is useful in cases where a backport PR is started on the same day that another backport PR was created, for the same branch (e.g. v1.6). In this case, the developer would have to manually modify the script to create a non-conflicting branch name. This commit allows the developer instead to pass a suffix to disambiguate the branch name, without need to modify the script. Example usage: ``` $ ./contrib/backporting/start-backport 1.6 "-2" ``` This creates a backport branch name pr/v1.6-backport-2020-06-30-2. Signed-off-by: Chris Tarazi <chris@isovalent.com> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
[ upstream commit 5cfa8a8 ] Signed-off-by: Chris Tarazi <chris@isovalent.com> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
[ upstream commit 5968d5a ] The `if` condition is actually inverted which makes it impossible to create a backport branch. This commit fixes this issue. Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
[ upstream commit edff374 ] This PR adds in an option 'enable-health-check-nodeport' to the cilium-agent for disabling 'HealthCheckNodePort' based on the KubeProxyReplacement configuration. It also adds in an opton 'enableHealthCheckNodePort' to the helm charts and documents the new config options with impacts when kubeProxyReplacement is set to 'partial'. Fixes: #11168 Signed-off-by: Swaminathan Vasudevan <svasudevan@suse.com> Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
vadorovsky
force-pushed
the
pr/v1.7-backport-2020-07-08
branch
from
7d336a1
to
32212cf
Compare
|
@christarazi Sorry for that, I totally forgot about running the set-labels script. |
|
test-backport-1.7 |
|
Failure: |
|
Looks like known flake #10442 , not a regression so can be bypassed to merge. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
start-backportscript #12361 -- contrib: fix branch check instart-backportscript (@rolinh)Once this PR is merged, you can update the PR labels via: