[v1.14] Bump envoy to v1.27.x

images/cilium/Dockerfile

@@ -6,7 +6,7 @@ ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:f384debcdc15d46ae82b8a87f
 
 # cilium-envoy from github.com/cilium/proxy
 #
-FROM quay.io/cilium/cilium-envoy:v1.26.7-bbde4095997ea57ead209f56158790d47224a0f5@sha256:39b75548447978230dedcf25da8940e4d3540c741045ef391a8e74dbb9661a86 as cilium-envoy
+FROM quay.io/cilium/cilium-envoy:v1.27.3-99c1c8f42c8de70fc8f6dd594f4a425cd38b6688@sha256:877ead12d08d4c04a9f67f86d3c6e542aeb7bf97e1e401aee74de456f496ac30 as cilium-envoy
 
 #
 # Hubble CLI
@@ -80,7 +80,7 @@ ARG TARGETARCH
 LABEL maintainer="maintainer@cilium.io"
 RUN echo ". /etc/profile.d/bash_completion.sh" >> /etc/bash.bashrc
 COPY --from=cilium-envoy /usr/lib/libcilium.so /usr/lib/libcilium.so
-COPY --from=cilium-envoy /usr/bin/cilium-envoy /usr/bin/
+COPY --from=cilium-envoy /usr/bin/cilium-envoy /usr/bin/cilium-envoy-starter /usr/bin/
 # When used within the Cilium container, Hubble CLI should target the
 # local unix domain socket instead of Hubble Relay.
 ENV HUBBLE_SERVER=unix:///var/run/cilium/hubble.sock

install/kubernetes/cilium/templates/cilium-envoy/daemonset.yaml

@@ -61,7 +61,7 @@ spec:
         image: {{ include "cilium.image" .Values.envoy.image | quote }}
         imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
         command:
-        - /usr/bin/cilium-envoy
+        - /usr/bin/cilium-envoy-starter
         args:
         - '-c /var/run/cilium/envoy/bootstrap-config.json'
         - '--base-id 0'

install/kubernetes/cilium/values.yaml.tmpl

@@ -1854,9 +1854,9 @@ envoy:
   image:
     override: ~
     repository: "quay.io/cilium/cilium-envoy"
-    tag: "v1.26.7-bbde4095997ea57ead209f56158790d47224a0f5"
+    tag: "v1.27.3-99c1c8f42c8de70fc8f6dd594f4a425cd38b6688"
     pullPolicy: "${PULL_POLICY}"
-    digest: "sha256:39b75548447978230dedcf25da8940e4d3540c741045ef391a8e74dbb9661a86"
+    digest: "sha256:877ead12d08d4c04a9f67f86d3c6e542aeb7bf97e1e401aee74de456f496ac30"
     useDigest: true
 
   # -- Additional containers added to the cilium Envoy DaemonSet.

pkg/envoy/ciliumenvoyconfig.go

@@ -190,8 +190,6 @@ func ParseResources(cecNamespace string, cecName string, anySlice []cilium_v2.XD
 			if !found {
 				listener.ListenerFilters = append(listener.ListenerFilters, getListenerFilter(false /* egress */, useOriginalSourceAddr, isL7LB))
 			}
-			// Inject listener socket option for Cilium datapath
-			listener.SocketOptions = append(listener.SocketOptions, getListenerSocketMarkOption(false /* egress */))
 
 			// Fill in SDS & RDS config source if unset
 			for _, fc := range listener.FilterChains {
@@ -448,9 +446,6 @@ func ParseResources(cecNamespace string, cecName string, anySlice []cilium_v2.XD
 				resources.portAllocations = make(map[string]uint16)
 			}
 			resources.portAllocations[listener.Name] = port
-
-			// Inject Transparent to work with TPROXY
-			listener.Transparent = &wrapperspb.BoolValue{Value: true}
 		}
 		if validate {
 			if err := listener.Validate(); err != nil {

pkg/envoy/embedded_envoy.go

@@ -53,7 +53,7 @@ var (
 )
 
 const (
-	ciliumEnvoy = "cilium-envoy"
+	ciliumEnvoy = "cilium-envoy-starter"
 )
 
 // EnableTracing changes Envoy log level to "trace", producing the most logs.

pkg/envoy/server.go

@@ -29,7 +29,6 @@ import (
 	envoy_type_matcher "github.com/cilium/proxy/go/envoy/type/matcher/v3"
 	"github.com/cilium/proxy/pkg/policy/api/kafka"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
@@ -782,20 +781,6 @@ func getListenerFilter(isIngress bool, useOriginalSourceAddr bool, l7lb bool) *e
 	}
 }
 
-func getListenerSocketMarkOption(isIngress bool) *envoy_config_core.SocketOption {
-	socketMark := int64(0xB00)
-	if isIngress {
-		socketMark = 0xA00
-	}
-	return &envoy_config_core.SocketOption{
-		Description: "Listener socket mark",
-		Level:       unix.SOL_SOCKET,
-		Name:        unix.SO_MARK,
-		Value:       &envoy_config_core.SocketOption_IntValue{IntValue: socketMark},
-		State:       envoy_config_core.SocketOption_STATE_PREBIND,
-	}
-}
-
 func (s *XDSServer) getListenerConf(name string, kind policy.L7ParserType, port uint16, isIngress bool, mayUseOriginalSourceAddr bool) *envoy_config_listener.Listener {
 	clusterName := egressClusterName
 	tlsClusterName := egressTLSClusterName
@@ -810,10 +795,6 @@ func (s *XDSServer) getListenerConf(name string, kind policy.L7ParserType, port
 		Name:                name,
 		Address:             addr,
 		AdditionalAddresses: additionalAddr,
-		Transparent:         &wrapperspb.BoolValue{Value: true},
-		SocketOptions: []*envoy_config_core.SocketOption{
-			getListenerSocketMarkOption(isIngress),
-		},
 		// FilterChains: []*envoy_config_listener.FilterChain
 		ListenerFilters: []*envoy_config_listener.ListenerFilter{
 			// Always insert tls_inspector as the first filter