Update linux_aarch64_defconfig to add BPF support

[mattrobinsonsre]

BPF support is missing from the arm64 kernel, which breaks for example cilium on that platform

Fixes #17205

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mattrobinsonsre (7de3be6, 6ecb12b)
• ✅ login: minikube-bot (f478b3e)

[k8s-ci-robot]

Welcome @mattrobinsonsre!

It looks like this is your first PR to kubernetes/minikube 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/minikube has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @mattrobinsonsre. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[minikube-bot]

Can one of the admins verify this patch?

[spowelljr]

I have a list of ISO PRs I'm getting merged, I'll ensure this is included

[spowelljr]

ok-to-build-iso

[minikube-bot]

Hi @mattrobinsonsre, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

[spowelljr]

/ok-to-test

[luna-duclos]

I took this for a spin trying to run cilium with this iso. Unfortunately, I still get the following error from cilium-agent:

daemon creation failed: unable to setup device manager: protocol not supported

[mattrobinsonsre]

I took this for a spin trying to run cilium with this iso. Unfortunately, I still get the following error from cilium-agent:

daemon creation failed: unable to setup device manager: protocol not supported

Can you advise how I might test this myself. I know BPF drivers are required for cilium, but I wonder if
a. They've been loaded
b. Some other driver is missing.

[luna-duclos]

I took this for a spin trying to run cilium with this iso. Unfortunately, I still get the following error from cilium-agent:

daemon creation failed: unable to setup device manager: protocol not supported

Can you advise how I might test this myself. I know BPF drivers are required for cilium, but I wonder if a. They've been loaded b. Some other driver is missing.

This is the minimal repro:

minikube start '--cni=cilium' '--driver=qemu' --iso-url https://storage.googleapis.com/minikube-builds/iso/17206/minikube-v1.31.0-1696534967-17206-arm64.iso

[luna-duclos]

Looking at https://docs.cilium.io/en/stable/operations/system_requirements/ and crosschecking this list with whats in the minikube iso, theres a bunch more missing.

[luna-duclos]

Update: I am building the minikube iso locally atm and going to investigate what other flags might be missing

[luna-duclos]

I got everything running, here's a full list of what I added:

# Cilium: flags from docs at https://docs.cilium.io/en/stable/operations/system_requirements/
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_NET_CLS_BPF=y
CONFIG_BPF_JIT=y
CONFIG_NET_CLS_ACT=y
CONFIG_NET_SCH_INGRESS=y
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_USER_API_HASH=y
CONFIG_CGROUPS=y
CONFIG_CGROUP_BPF=y
CONFIG_PERF_EVENTS=y
CONFIG_SCHEDSTATS=y
# CONFIG_NETFILTER_XT_SET=m # Already set elsewhere
# CONFIG_IP_SET=m # Already set elsewhere
# CONFIG_IP_SET_HASH_IP=m # Already set elsewhere
# CONFIG_NETFILTER_XT_TARGET_TPROXY=m # Already set elsewhere
CONFIG_NETFILTER_XT_TARGET_CT=m
# CONFIG_NETFILTER_XT_MATCH_MARK=m # Already set elsewhere
# CONFIG_NETFILTER_XT_MATCH_SOCKET=m # Already set elsewhere
CONFIG_XFRM=y
CONFIG_XFRM_OFFLOAD=y
CONFIG_XFRM_STATISTICS=y
CONFIG_XFRM_ALGO=m
CONFIG_XFRM_USER=m
CONFIG_INET{,6}_ESP=m
CONFIG_INET{,6}_IPCOMP=m
CONFIG_INET{,6}_XFRM_TUNNEL=m
CONFIG_INET{,6}_TUNNEL=m
CONFIG_INET_XFRM_MODE_TUNNEL=m
CONFIG_CRYPTO_AEAD=m
CONFIG_CRYPTO_AEAD2=m
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_SEQIV=m
CONFIG_CRYPTO_CBC=m
CONFIG_CRYPTO_HMAC=m
CONFIG_CRYPTO_SHA256=m
CONFIG_CRYPTO_AES=m
CONFIG_NET_SCH_FQ=m

# Cilium: undocumented necessary flags
# VXLAN
CONFIG_NET_CORE=y # Needed for vxlan
CONFIG_VXLAN=y

# Datapath configuration stuff needed by cilium to setup routes
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_MULTIPLE_TABLES=y

[mattrobinsonsre]

This was waaay more complex that I though. Many thanks @luna-duclos

[luna-duclos]

This was waaay more complex that I though. Many thanks @luna-duclos

No problem! I'm just happy to help get this support in on my mac :)

[luna-duclos]

Will you update this PR with the additional flags ?

[mattrobinsonsre]

Ah yes will do.

[mattrobinsonsre]

rebased

[spowelljr]

ok-to-build-iso

[spowelljr]

ok-to-build-iso

[minikube-bot]

Hi @mattrobinsonsre, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

[spowelljr]

ok-to-build-iso

[minikube-bot]

Hi @mattrobinsonsre, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

[minikube-pr-bot]

kvm2 driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 17206) |
+----------------+----------+---------------------+
| minikube start | 51.2s    | 50.6s               |
| enable ingress | 26.7s    | 25.8s               |
+----------------+----------+---------------------+

Times for minikube start: 49.2s 50.4s 51.0s 49.5s 55.6s
Times for minikube (PR 17206) start: 51.1s 47.5s 50.2s 51.1s 53.0s

Times for minikube ingress: 27.1s 27.6s 28.7s 23.1s 27.1s
Times for minikube (PR 17206) ingress: 27.1s 27.7s 23.6s 27.2s 23.6s

docker driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 17206) |
+----------------+----------+---------------------+
| minikube start | 23.1s    | 23.4s               |
| enable ingress | 20.5s    | 20.3s               |
+----------------+----------+---------------------+

Times for minikube start: 24.9s 22.3s 21.5s 22.1s 24.7s
Times for minikube (PR 17206) start: 21.2s 21.9s 24.8s 24.3s 25.0s

Times for minikube (PR 17206) ingress: 21.4s 20.8s 20.8s 20.8s 17.8s
Times for minikube ingress: 19.8s 19.8s 21.3s 20.8s 20.8s

docker driver with containerd runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 17206) |
+----------------+----------+---------------------+
| minikube start | 23.0s    | 22.3s               |
| enable ingress | 31.1s    | 32.3s               |
+----------------+----------+---------------------+

Times for minikube start: 23.6s 24.3s 21.2s 23.1s 23.0s
Times for minikube (PR 17206) start: 23.3s 23.5s 21.6s 22.6s 20.4s

Times for minikube ingress: 31.3s 31.3s 31.3s 31.3s 30.3s
Times for minikube (PR 17206) ingress: 31.3s 32.3s 19.3s 47.3s 31.3s

[minikube-pr-bot]

These are the flake rates of all failed tests.

Environment	Failed Tests	Flake Rate (%)
Docker_Linux_crio_arm64	TestScheduledStopUnix (gopogh)	0.00 (chart)
Docker_Linux_docker_arm64	TestStartStop/group/default-k8s-diff-port/serial/VerifyKubernetesImages (gopogh)	0.00 (chart)
none_Linux	TestDownloadOnly/v1.29.0-rc.0/binaries (gopogh)	0.00 (chart)
none_Linux	TestDownloadOnly/v1.29.0-rc.0/json-events (gopogh)	0.00 (chart)
Docker_Linux_docker_arm64	TestStartStop/group/default-k8s-diff-port/serial/AddonExistsAfterStop (gopogh)	0.62 (chart)
Docker_Linux_docker_arm64	TestStartStop/group/default-k8s-diff-port/serial/Pause (gopogh)	0.62 (chart)
Docker_Linux_docker_arm64	TestStartStop/group/default-k8s-diff-port/serial/SecondStart (gopogh)	0.62 (chart)
Docker_Linux_docker_arm64	TestStartStop/group/default-k8s-diff-port/serial/UserAppExistsAfterStop (gopogh)	0.62 (chart)
KVM_Linux_crio	TestNoKubernetes/serial/StartNoArgs (gopogh)	1.95 (chart)
KVM_Linux_crio	TestStartStop/group/newest-cni/serial/EnableAddonAfterStop (gopogh)	2.55 (chart)
KVM_Linux_crio	TestStartStop/group/newest-cni/serial/Stop (gopogh)	2.55 (chart)
Docker_Linux_crio	TestFunctional/parallel/ImageCommands/ImageLoadDaemon (gopogh)	8.75 (chart)

To see the flake rates of all tests by environment, click here.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mattrobinsonsre, spowelljr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [spowelljr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment