hubble: Decode Cilium encapsulated traffic in Hubble by kaworu · Pull Request #37634 · cilium/cilium

kaworu · 2025-02-14T10:28:34Z

~~Currently blocked by #37097 and need proper datapath support to signal whether the packet was encapsulated by Cilium.~~

Can be merged once #39650 lands.
The logic to push more bytes during trace notifications from datapath will be landed separately in #38984.

This PR implement Cilium VXLAN/Geneve decoding in Hubble/Monitor, allowing to surface the overlay information in Hubble flows.

Closes: #28001
Closes: #39029

Decode Cilium encapsulated traffic in Hubble/Monitor

kaworu · 2025-03-25T10:14:48Z

#37097 merged, but now waiting on #38368 to be merged as well before resolving conflicts.

github-actions · 2025-05-02T02:07:57Z

This pull request has been automatically marked as stale because it
has not had recent activity. It will be closed if no further activity
occurs. Thank you for your contributions.

smagnani96 · 2025-05-29T08:54:51Z

@kaworu as discussed, I've now:

rebased the PR
picked also changed to Monitor in this PR
rename FlowPB from Capsule to Tunnel
adjusted parsing logic: prior to this force-push, if overlay decoders were not decoding at least 3 layers we were not reporting the Tunnel info, but rather returning immediately. This means that ethernet, ip, l4 were referring to the outer Overlay packet (so all the subsequent logic such as ResolveEndpoint was running with the overlay addresses). It was ok-ish, but I feel like we should still return Tunnel plus unknown info for the inner packet. This would also cover the case in which we decode an Overlay packet carrying a pure ethernet packet (no IP). I'm open to discuss this though. We could also evaluate running the whole subsequent logic (ResolveEndpoint, etc.) for the Tunnel field too.
added a Test (feel free to add more)

The PR could be merged itself, but it makes sense waiting for #39650 lands.
Finally, planning to deliver the logic to push more bytes during trace notifications from datapath in a separate PR #38984.

kaworu · 2025-06-02T14:31:16Z

Awesome work @smagnani96 🙏

adjusted parsing logic: prior to this force-push, if overlay decoders were not decoding at least 3 layers we were not reporting the Tunnel info, but rather returning immediately. This means that ethernet, ip, l4 were referring to the outer Overlay packet (so all the subsequent logic such as ResolveEndpoint was running with the overlay addresses). It was ok-ish, but I feel like we should still return Tunnel plus unknown info for the inner packet.

I did originally defer thinking about this by requiring the expected overlay layers count and "falling back" to the behaviour before the patch, but you approach resetting the fields and passing on potentially partial but correct data seems best 👍

added a Test (feel free to add more)

Added a test case for Geneve and also ensure that we're only parsing overlay layers when we get the signal from datapath through the notification flag, see this force-push (I did a couple of other push but they were only rebase on top of main).

The PR could be merged itself, but it makes sense waiting for #39650 lands.
Finally, planning to deliver the logic to push more bytes during trace notifications from datapath in a separate PR #38984.

Yes, let's wait for theses two, no point in exposing this until the datapath bits are ready.

smagnani96 · 2025-06-19T09:50:40Z

Below there's an example of how an Hubble flow would look like.
Captured via hubble observe -f -o json -- the -o string option by default doesn't print the Tunnel info, but it only outputs the inner packet.

{
  "flow": {
    "time": "2025-06-19T09:42:34.302302406Z",
    "uuid": "f41cf402-7abd-4616-9e85-4c2793e055c4",
    "verdict": "FORWARDED",
    "ethernet": {
      "source": "52:10:6c:5f:00:ca",
      "destination": "d6:4f:7a:05:3d:04"
    },
    "IP": {
      "source": "10.244.1.46",
      "destination": "10.244.2.34",
      "ipVersion": "IPv4"
    },
    "l4": {
      "TCP": {
        "source_port": 8080,
        "destination_port": 36775,
        "flags": {
          "ACK": true
        }
      }
    },
    "tunnel": {
      "protocol": "VXLAN",
      "IP": {
        "source": "172.18.0.4",
        "destination": "172.18.0.3",
        "ipVersion": "IPv4"
      },
      "l4": {
        "UDP": {
          "source_port": 46439,
          "destination_port": 8472
        }
      }
    },
    "source": {
      "identity": 6,
      "namespace": "cilium-test-1",
      "labels": [
        "reserved:remote-node"
      ],
      "pod_name": "echo-other-node-b677895f7-82v2z"
    },
    "destination": {
      "ID": 394,
      "identity": 18623,
      "cluster_name": "default",
      "namespace": "cilium-test-1",
      "labels": [
        "k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/name=cilium-cli",
        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cilium-test-1",
        "k8s:io.cilium.k8s.policy.cluster=default",
        "k8s:io.cilium.k8s.policy.serviceaccount=client",
        "k8s:io.kubernetes.pod.namespace=cilium-test-1",
        "k8s:kind=client",
        "k8s:name=client"
      ],
      "pod_name": "client-85f8686bb-5wtrp",
      "workloads": [
        {
          "name": "client",
          "kind": "Deployment"
        }
      ]
    },
    "Type": "L3_L4",
    "node_name": "kind-worker",
    "node_labels": [
      "beta.kubernetes.io/arch=amd64",
      "beta.kubernetes.io/os=linux",
      "kubernetes.io/arch=amd64",
      "kubernetes.io/hostname=kind-worker",
      "kubernetes.io/os=linux"
    ],
    "event_type": {
      "type": 4,
      "sub_type": 12
    },
    "trace_observation_point": "FROM_CRYPTO",
    "interface": {
      "index": 5,
      "name": "cilium_wg0"
    },
    "Summary": "TCP Flags: ACK"
  },
  "node_name": "kind-worker",
  "time": "2025-06-19T09:42:34.302302406Z"
}

Adding release-blocker label: DP changes have been merged, but w/o this they would not be beneficial.
Also, going to force-push to address review.

smagnani96 · 2025-06-19T14:14:05Z

/test

LVH is currently broken in CI.

kaworu · 2025-06-19T15:40:21Z

@glibsm note that this PR is only about the parsing and emitting of tunnel info, the question of whether any filters needs to be added / modified is left for future work.

api/v1/flow/flow.proto

ldelossa

Changes look good to me.

This commit updates our current gopacket/gopacket dependency to the commit hash where we enabled decoding of Geneve layers by adding the CanDecode() function. This allows us to proceed from Hubble/monitor with the ability to decode such types of trace/drop events in subsequent commits. Signed-off-by: Simone Magnani <[email protected]>

This code will never be reached, as IPSecAH and IPSecESP are not decoding layers in gopacket. Therefore, the logic for decoding a packet from raw bytes will automatically stops after the IP header, and `cilium monitor` never reports such info. Signed-off-by: Simone Magnani <[email protected]>

We introduced in cilium#39650 the initial support to signal from the datapath trace/drop notify events related to overlay packets. This patch allows our Monitor tool to decode overlay packets and output additional information regarding the encap'd packet. Prior to these changes: ```bash -> network flow 0x4e41ca37 , identity host->unknown state unknown ifindex eth0 orig-ip 0.0.0.0: 10.244.2.63:4240 -> 10.244.1.6:41068 tcp ACK <- network flow 0xb55b35e9 , identity remote-node->unknown state unknown ifindex eth0 orig-ip 0.0.0.0: 10.244.1.6:41068 -> 10.244.2.63:4240 tcp ACK ``` After applying the patch: ```bash -> network flow 0x4e41ca37 , identity host->unknown state unknown ifindex eth0 orig-ip 0.0.0.0: 10.244.2.63:4240 -> 10.244.1.6:41068 tcp ACK [tunnel 172.18.0.4:47375 -> 172.18.0.2:8472 vxlan] <- network flow 0xb55b35e9 , identity remote-node->unknown state unknown ifindex eth0 orig-ip 0.0.0.0: 10.244.1.6:41068 -> 10.244.2.63:4240 tcp ACK [tunnel 172.18.0.2:46960 -> 172.18.0.4:8472 vxlan] ``` Signed-off-by: Simone Magnani <[email protected]>

Preparation work to enhance decoding encapsulated packets (see subsequent commits for further info). Signed-off-by: Alexandre Perrin <[email protected]> Signed-off-by: Simone Magnani <[email protected]> Co-authored-by: Simone Magnani <[email protected]>

This commit introduce a new flow protobuf Tunnel message in which Hubble will add Cilium tunnel information (see subsequent commit). Signed-off-by: Alexandre Perrin <[email protected]> Signed-off-by: Simone Magnani <[email protected]> Co-authored-by: Simone Magnani <[email protected]>

Before this patch, Hubble would generate flows for encapsulated traffic providing only the underlay info (e.g. node IPs, UDP and Cilium VXLAN port when `--routing-mode=tunnel tunnel-protocol=vxlan`). This patch introduces encapsulated traffic decoding in Hubble. When the trace notification includes encapsulated headers, the IP and l4 flow fields are now holding the overlay info, and the flow Tunnel message is filled with the underlay info. An example of an Overlay flow with VXLAN encapsulation in Hubble (json): ```json { "flow": { "time": "2025-06-19T09:42:34.302302406Z", "uuid": "f41cf402-7abd-4616-9e85-4c2793e055c4", "verdict": "FORWARDED", "ethernet": { "source": "52:10:6c:5f:00:ca", "destination": "d6:4f:7a:05:3d:04" }, "IP": { "source": "10.244.1.46", "destination": "10.244.2.34", "ipVersion": "IPv4" }, "l4": { "TCP": { "source_port": 8080, "destination_port": 36775, "flags": { "ACK": true } } }, "tunnel": { "protocol": "VXLAN", "IP": { "source": "172.18.0.4", "destination": "172.18.0.3", "ipVersion": "IPv4" }, "l4": { "UDP": { "source_port": 46439, "destination_port": 8472 } } }, "source": { "identity": 6, "namespace": "cilium-test-1", "labels": [ "reserved:remote-node" ], "pod_name": "echo-other-node-b677895f7-82v2z" }, "destination": { "ID": 394, "identity": 18623, "cluster_name": "default", "namespace": "cilium-test-1", "labels": [ "k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/name=cilium-cli", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cilium-test-1", "k8s:io.cilium.k8s.policy.cluster=default", "k8s:io.cilium.k8s.policy.serviceaccount=client", "k8s:io.kubernetes.pod.namespace=cilium-test-1", "k8s:kind=client", "k8s:name=client" ], "pod_name": "client-85f8686bb-5wtrp", "workloads": [ { "name": "client", "kind": "Deployment" } ] }, "Type": "L3_L4", "node_name": "kind-worker", "node_labels": [ "beta.kubernetes.io/arch=amd64", "beta.kubernetes.io/os=linux", "kubernetes.io/arch=amd64", "kubernetes.io/hostname=kind-worker", "kubernetes.io/os=linux" ], "event_type": { "type": 4, "sub_type": 12 }, "trace_observation_point": "FROM_CRYPTO", "interface": { "index": 5, "name": "cilium_wg0" }, "Summary": "TCP Flags: ACK" }, "node_name": "kind-worker", "time": "2025-06-19T09:42:34.302302406Z" } ``` Signed-off-by: Alexandre Perrin <[email protected]> Signed-off-by: Simone Magnani <[email protected]> Co-authored-by: Simone Magnani <[email protected]>

smagnani96 · 2025-06-20T17:03:09Z

/test

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](cilium/cilium@1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](cilium/cilium#38469), [@joamaki](https://github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](cilium/cilium#37723), [@ldelossa](https://github.com/ldelossa); [cilium/cilium#37346](cilium/cilium#37346), [@gyutaeb](https://github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](cilium/cilium#39304), [@carlos-abad](https://github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](cilium/cilium#36351), [@l1b0k](https://github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](cilium/cilium#38198), [@dylandreimerink](https://github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](cilium/cilium#39987), [@dylandreimerink](https://github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](cilium/cilium#38296), [cilium/cilium#39497](cilium/cilium#39497), [@pchaigno](https://github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](cilium/cilium#39074), [@pchaigno](https://github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](cilium/cilium#38249), [@caorui-io](https://github.com/caorui-io), [@kadevu](https://github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](cilium/cilium#38110), [@gentoo-root](https://github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](cilium/cilium#38452), [@rgo3](https://github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](cilium/cilium#39453), [@antonipp](https://github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](cilium/cilium#39902), [@squeed](https://github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](cilium/cilium#37634), [@kaworu](https://github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](cilium/cilium#39338), [@MrFreezeex](https://github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](cilium/cilium#36492), [cilium/cilium#37445](cilium/cilium#37445), [@squeed](https://github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://github.com/marseel), [cilium/cilium#40227](cilium/cilium#40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](cilium/cilium#40005), [@marseel](https://github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](cilium/cilium#39340), [@squeed](https://github.com/squeed); [cilium/cilium#40414](cilium/cilium#40414), [@marseel](https://github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](cilium/cilium#38596), [@MrFreezeex](https://github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](cilium/cilium#36471), [@HadrienPatte](https://github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](cilium/cilium#37714), [@giorio94](https://github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](cilium/cilium#36288), [@tommyp1ckles](https://github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](cilium/cilium#37601), [@aditighag](https://github.com/aditighag); [cilium/cilium#38031](cilium/cilium#38031), [@orange30](https://github.com/orange30); [cilium/cilium#36648](cilium/cilium#36648), [@wedaly](https://github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](cilium/cilium#36510), [@ovidiutirla](https://github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](cilium/cilium#38940), [@christarazi](https://github.com/christarazi); [cilium/cilium#39090](cilium/cilium#39090), [@pippolo84](https://github.com/pippolo84); [cilium/cilium#37765](cilium/cilium#37765), [@rastislavs](https://github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](cilium/cilium#40137), [@Murat](https://github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](cilium/cilium#39664), [@aanm](https://github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](cilium/cilium#39124), [cilium/cilium#40175](cilium/cilium#40175), [cilium/cilium#39632](cilium/cilium#39632), [@sayboras](https://github.com/sayboras); [cilium/cilium#38868](cilium/cilium#38868), [@squeed](https://github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](cilium/cilium#38308), [@julianwiedmann](https://github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](cilium/cilium#39590), [@sayboras](https://github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](cilium/cilium#37792), [cilium/cilium#37402](cilium/cilium#37402), [cilium/cilium#40138](cilium/cilium#40138), [@sayboras](https://github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](cilium/cilium#39922), [@youngnick](https://github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](cilium/cilium#37798), [@sayboras](https://github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](cilium/cilium#39678), [@41ks](https://github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](cilium/cilium#39638), [@pippolo84](https://github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](cilium/cilium#39442), [@pippolo84](https://github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](cilium/cilium#38483), [@pippolo84](https://github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](cilium/cilium#37275), [@romanspb80](https://github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](cilium/cilium#36414), [@dswaffordcw](https://github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](cilium/cilium#36451), [@yushoyamaguchi](https://github.com/yushoyamaguchi); [cilium/cilium#38300](cilium/cilium#38300), [@liyihuang](https://github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](cilium/cilium#37027), [@Joe](https://github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](cilium/cilium#40212), [@squeed](https://github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](cilium/cilium#38480), [cilium/cilium#39642](cilium/cilium#39642), [cilium/cilium#37418](cilium/cilium#37418), [@brb](https://github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1062 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

kaworu added kind/feature This introduces new functionality. release-note/minor This PR changes functionality that users may find relevant to operating Cilium. sig/hubble area/hubble Impacts hubble server or relay labels Feb 14, 2025

kaworu self-assigned this Feb 14, 2025

kaworu changed the title ~~hubble: Decode Cilium encapsulated in Hubble~~ hubble: Decode Cilium encapsulated traffic in Hubble Feb 14, 2025

kaworu force-pushed the pr/kaworu/hubble/vxlan-parsing branch from 7d612ba to 54ca6a2 Compare March 17, 2025 07:42

kaworu added dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. dont-merge/blocked Another PR must be merged before this one. labels Mar 25, 2025

kaworu force-pushed the pr/kaworu/hubble/vxlan-parsing branch from 54ca6a2 to 44db3c3 Compare April 1, 2025 11:40

kaworu removed the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Apr 1, 2025

smagnani96 mentioned this pull request Apr 11, 2025

bpf:trace: refactor L2/L3 packet check into classifiers #38723

Merged

smagnani96 mentioned this pull request Apr 28, 2025

monitor: Decode Cilium encapsulated traffic in Monitor #38975

Closed

github-actions bot added the stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. label May 2, 2025

julianwiedmann removed the stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. label May 8, 2025

joestringer removed the sig/hubble label May 23, 2025

smagnani96 force-pushed the pr/kaworu/hubble/vxlan-parsing branch from 44db3c3 to f3ef9f3 Compare May 29, 2025 08:42

smagnani96 self-assigned this May 29, 2025

kaworu force-pushed the pr/kaworu/hubble/vxlan-parsing branch 2 times, most recently from 8fa2281 to 973529f Compare June 2, 2025 14:14

kaworu added the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Jun 2, 2025

kaworu force-pushed the pr/kaworu/hubble/vxlan-parsing branch from 973529f to 719b7b7 Compare June 2, 2025 14:24

kaworu removed the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Jun 2, 2025

This was referenced Jun 4, 2025

bpf:classifiers: add Overlay VXLAN/Geneve classifiers #39650

Merged

monitor:hubble: incorrectly decoded TCPv6-over-vxlan #39030

Closed

bpf:trace: adjust TRACE_PAYLOAD_LEN for overlay packets #38984

Merged

github-project-automation bot moved this to Proposed in Release blockers Jun 19, 2025

smagnani96 force-pushed the pr/kaworu/hubble/vxlan-parsing branch from 5b24e0b to cc9e8af Compare June 19, 2025 10:24

glibsm approved these changes Jun 19, 2025

View reviewed changes

api/v1/flow/flow.proto Outdated Show resolved Hide resolved

ldelossa approved these changes Jun 20, 2025

View reviewed changes

smagnani96 and others added 5 commits June 20, 2025 16:39

smagnani96 force-pushed the pr/kaworu/hubble/vxlan-parsing branch from cc9e8af to c173a03 Compare June 20, 2025 14:56

smagnani96 force-pushed the pr/kaworu/hubble/vxlan-parsing branch from c173a03 to e5f05b2 Compare June 20, 2025 16:30

kaworu added this pull request to the merge queue Jun 21, 2025

maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jun 21, 2025

Merged via the queue into cilium:main with commit d291087 Jun 21, 2025
68 checks passed

kaworu deleted the pr/kaworu/hubble/vxlan-parsing branch June 21, 2025 15:09

github-project-automation bot moved this from Proposed to Done in Release blockers Jun 21, 2025

julianwiedmann mentioned this pull request Jan 5, 2026

hubble: add VNI information for Geneve and VXLAN to Hubble flow #43398

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

hubble: Decode Cilium encapsulated traffic in Hubble#37634

hubble: Decode Cilium encapsulated traffic in Hubble#37634
kaworu merged 6 commits intocilium:mainfrom
kaworu:pr/kaworu/hubble/vxlan-parsing

kaworu commented Feb 14, 2025 •

edited by smagnani96

Loading

Uh oh!

kaworu commented Mar 25, 2025

Uh oh!

github-actions bot commented May 2, 2025

Uh oh!

smagnani96 commented May 29, 2025

Uh oh!

kaworu commented Jun 2, 2025 •

edited

Loading

Uh oh!

smagnani96 commented Jun 19, 2025

Uh oh!

smagnani96 commented Jun 19, 2025 •

edited

Loading

Uh oh!

kaworu commented Jun 19, 2025

Uh oh!

Uh oh!

ldelossa left a comment

Uh oh!

smagnani96 commented Jun 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

kaworu commented Feb 14, 2025 • edited by smagnani96 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kaworu commented Mar 25, 2025

Uh oh!

github-actions bot commented May 2, 2025

Uh oh!

smagnani96 commented May 29, 2025

Uh oh!

kaworu commented Jun 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smagnani96 commented Jun 19, 2025

Uh oh!

smagnani96 commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kaworu commented Jun 19, 2025

Uh oh!

Uh oh!

ldelossa left a comment

Choose a reason for hiding this comment

Uh oh!

smagnani96 commented Jun 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

kaworu commented Feb 14, 2025 •

edited by smagnani96

Loading

kaworu commented Jun 2, 2025 •

edited

Loading

smagnani96 commented Jun 19, 2025 •

edited

Loading