Introduce fromEgressProxyRule #31923
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
Because we are introducing fromEgressProxyRule soon, it's better to make clear that the fromProxyRule is for ingress proxy only. This commit also changes its mark from MagicMarkIsProxy to MagicMarkIngress. They hold the same value 0xA00 while have the different semantics. Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
4d6a051
to
a160dd2
Compare
1 task
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
a160dd2
to
9d880aa
Compare
|
/test |
This was referenced Apr 12, 2024
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
db86543
to
46b16c2
Compare
|
/test |
jschwinger233
added
the
release-note/bug
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
jschwinger233
added
area/encryption
rgo3
reviewed
Apr 18, 2024
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
46b16c2
to
b2083cf
Compare
No logic changes, just rename it to "RulePriorityFromProxy" without "Ingress" suffix, because egress rule is using the same priority. Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
b2083cf
to
2f14f06
Compare
|
/test |
rgo3
approved these changes
Apr 19, 2024
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
2f14f06
to
30685df
Compare
Although we don't install fromEgressProxyRule for now, this commit
insists on removing it to make sure further downgrade can go smoothly.
Soon We'll have another PR to install fromEgressProxyRule, and cilium
downgrade from that PR to branch tip (patch downgrade, 1.X.Y ->
1.X.{Y-1}) will be broken if we don't handle the new ip rule carefullly.
Without this patch, downgrade from higher version will leave
fromEgressProxyRule on the lower version cilium, cluster will be in a
wrong status of "having stale ip rule + not having other necessary
settings (iptables)", breaking the connectivity.
Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/main/proxy-route-fix
branch
from
30685df
to
38645da
Compare
|
/test |
tommyp1ckles
approved these changes
Apr 24, 2024
maintainer-s-little-helper
bot
added
ready-to-merge
jschwinger233
added
backport-done/1.13
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This simple PR introduces a new ip rule without installing it, mainly meant to take care of cilium downgrade for the new ip rule. Please see the commit messages for details.
This PR (along with its backport PRs) is the stage one of #31984 to address the remaining IPsec leak issues. Please see that issue for the the context.
Signed-off-by: Zhichuan Liang gray.liang@isovalent.com