Commits on Oct 5, 2023

1. ipcache: aggregate labels from all IPs with local host identity …

   The `reserved:host` identity is special: the numeric identity is fixed and the
   set of labels is mutable. (The datapath requires this.) So, we need to
   determine all prefixes that have the `reserved:host` label and capture their
   labels. Then, we must aggregate *all* labels from all IPs and insert them as
   the `reserved:host` identity labels.
   
   However, the code as written has a race condition whenever the local node has
   more than one IP address. This can happen when, for example vxlan or ipv6 is
   enabled. The basic sequence is this:
   
   1. Insert IP A as `reserved:host` in to the ipcache. ID 1 now has labels
     `reserved:host`
   2. Insert IP A as `reserved:kube-apiserver` in to the ipcache. ID 1 is updated
     with labels `reserved:host, reserved:kube-apsierver`
   3. Insert IP B as `reserved:host` in to the ipcache. ID 1 is updated with
     labels `reserved:host`. And now policies that select
     `reserved:kube-apiserver` are broken
   
   Likewise, we need to always update the SelectorCache; we cannot short-circuit
   if the ipcache already has that identity. Again, this is needed because the
   identity is mutable. So this bug can take another form:
   
   1. Insert IP A as `reserved:host` in to the ipcache. Because IP A is not known
   to the ipcache, treat ID 1 as a new identity and update the selector cache
   2. Insert IP A as `reserved:kube-apiserver`. Mutate the labels of ID 1. But,
   because IP A already has ID 1, short-circuit the update to the selector cache
   (if the Source is the same, which it _may_ be).
   3. Now the selector cache has incorrect labels for ID 1.
   
   Without this, when there are multiple IPs with the host label, the identity may
   flap and the SelectorCache may be missing updates.
   
   Fixes: cilium#28259
   Fixes: e0d403a
   Fixes: 308c142
   
   Signed-off-by: Casey Callendrello <cdc@isovalent.com>

   

   squeed committed Oct 5, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 3887bc5
   • Browse repository at this point

   Copy the full SHA

   3887bc5 View commit details

   Browse the repository at this point in the history