v1.11 backports 2021-12-03

Documentation/gettingstarted/k8s-install-default.rst

@@ -164,8 +164,8 @@ to create a Kubernetes cluster locally or using a managed Kubernetes service:
            - name: ng-1
              desiredCapacity: 2
              privateNetworking: true
-             # taint nodes so that application pods are
-             # not scheduled until Cilium is deployed.
+             ## taint nodes so that application pods are
+             ## not scheduled until Cilium is deployed.
              taints:
               - key: "node.cilium.io/agent-not-ready"
                 value: "true"

Documentation/gettingstarted/kubeproxy-free.rst

@@ -658,8 +658,8 @@ As an instance example, ``m5n.xlarge`` is used in the config ``nodegroup-config.
       desiredCapacity: 2
       ssh:
         allow: true
-      # taint nodes so that application pods are
-      # not scheduled until Cilium is deployed.
+      ## taint nodes so that application pods are
+      ## not scheduled until Cilium is deployed.
       taints:
         - key: "node.cilium.io/agent-not-ready"
           value: "true"

Documentation/gettingstarted/requirements-eks.rst

@@ -37,8 +37,8 @@ install ``eksctl`` and prepare your account.
    - name: ng-1
      desiredCapacity: 2
      privateNetworking: true
-     # taint nodes so that application pods are
-     # not scheduled until Cilium is deployed.
+     ## taint nodes so that application pods are
+     ## not scheduled until Cilium is deployed.
      taints:
       - key: "node.cilium.io/agent-not-ready"
         value: "true"

examples/hubble/hubble-cli.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: hubble-cli
-        image: quay.io/cilium/hubble:v0.8.2
+        image: quay.io/cilium/hubble:v0.9.0
         imagePullPolicy: IfNotPresent
         command:
           - tail

images/cilium/hubble-version.sh

@@ -1,5 +1,5 @@
 # Code generated by images/scripts/update-hubble-version.sh; DO NOT EDIT.
-hubble_version="v0.8.2"
+hubble_version="v0.9.0"
 declare -A hubble_sha256
-hubble_sha256[amd64]="e45c85b34d022b17ddb48621583c52b6d86e2e47e6fe71691ee46ff9f89edc27"
-hubble_sha256[arm64]="b9ace3a77e606ad871577fff79fdf0a068c5c9275ce53ee4d85f218be3cad734"
+hubble_sha256[amd64]="63d62f6ea4b2daedaa08f95fbb95e457b4ee5d00167f4a84af0ba7ca3225924d"
+hubble_sha256[arm64]="26aa4c0b5455e76a5dfb47504227552dad750a4fd62f5764c00c26dcc9547f7b"

install/kubernetes/cilium/templates/cilium-operator/_helpers.tpl

@@ -13,11 +13,11 @@
 {{- define "cilium.operator.imageDigestName" -}}
 {{- $imageDigest := (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.genericDigest) "" -}}
 {{- if .Values.eni.enabled -}}
-  {{- $imageDigest := (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.awsDigest) "" -}}
+  {{- $imageDigest = (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.awsDigest) "" -}}
 {{- else if .Values.azure.enabled -}}
-  {{- $imageDigest := (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.azureDigest) "" -}}
+  {{- $imageDigest = (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.azureDigest) "" -}}
 {{- else if .Values.alibabacloud.enabled -}}
-  {{- $imageDigest := (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.alibabacloudDigest) "" -}}
+  {{- $imageDigest = (.Values.operator.image.useDigest | default false) | ternary (printf "@%s" .Values.operator.image.alibabacloudDigest) "" -}}
 {{- end -}}
 {{- $imageDigest -}}
 {{- end -}}

pkg/service/id_local.go

@@ -72,6 +72,12 @@ func (alloc *IDAllocator) acquireLocalID(svc loadbalancer.L3n4Addr, desiredID ui
 	if desiredID != 0 {
 		foundSVC, ok := alloc.entitiesID[desiredID]
 		if !ok {
+			if desiredID >= alloc.nextID {
+				// We don't set nextID to desiredID+1 here, as we don't want to
+				// duplicate the logic which deals with the rollover. Next
+				// invocation of acquireLocalID(..., 0) will fix the nextID.
+				alloc.nextID = desiredID
+			}
 			return alloc.addID(svc, desiredID), nil
 		}
 		return nil, fmt.Errorf("Service ID %d is already registered to %q",

pkg/service/id_test.go

@@ -27,10 +27,12 @@ var _ = Suite(&IDAllocTestSuite{})
 
 func (e *IDAllocTestSuite) SetUpTest(c *C) {
 	serviceIDAlloc.resetLocalID()
+	backendIDAlloc.resetLocalID()
 }
 
 func (e *IDAllocTestSuite) TearDownTest(c *C) {
 	serviceIDAlloc.resetLocalID()
+	backendIDAlloc.resetLocalID()
 }
 
 var (
@@ -50,6 +52,14 @@ var (
 		IP:     net.IPv6loopback,
 		L4Addr: loadbalancer.L4Addr{Port: 2, Protocol: "UDP"},
 	}
+	l3n4Addr5 = loadbalancer.L3n4Addr{
+		IP:     net.ParseIP("::2"),
+		L4Addr: loadbalancer.L4Addr{Port: 2, Protocol: "UDP"},
+	}
+	l3n4Addr6 = loadbalancer.L3n4Addr{
+		IP:     net.ParseIP("::3"),
+		L4Addr: loadbalancer.L4Addr{Port: 2, Protocol: "UDP"},
+	}
 	wantL3n4AddrID = &loadbalancer.L3n4AddrID{
 		ID:       123,
 		L3n4Addr: l3n4Addr2,
@@ -178,6 +188,14 @@ func (s *IDAllocTestSuite) TestBackendID(c *C) {
 	existingID1, err := LookupBackendID(l3n4Addr1)
 	c.Assert(err, Equals, nil)
 	c.Assert(existingID1, Equals, id1)
+
+	// Check that the backend ID restoration advances the nextID
+	err = RestoreBackendID(l3n4Addr5, firstBackendID+10)
+	c.Assert(err, Equals, nil)
+	id3, err := AcquireBackendID(l3n4Addr6)
+	c.Assert(err, Equals, nil)
+	c.Assert(id3, Equals, firstBackendID+11)
+
 }
 
 func (s *IDAllocTestSuite) BenchmarkAllocation(c *C) {