Support tunnel routing in Multi-Pool IPAM mode by pippolo84 · Pull Request #38483 · cilium/cilium

pippolo84 · 2025-03-25T11:06:33Z

Rework of #38015 after the introduction of clusterID aware ipcache in #38379

The main difference with #38015 is commit fa35fa0 where we take advantage of the ClusterPrefix parameter type in ipcache API to enrich the node prefixes (namely, the CiliumInternalIP, the Ingress and health IPs and the v4/v6 allocation CIDRs) with the result of a customizable PrefixClusterMutatorFn. This guarantees feature parity with the tunnel map previously used for node allocation CIDRs.

Description of the previous version of the PR (#38015) below:

This PR introduces support for tunnel routing with the Multi-Pool IPAM mode. This is achieved by removing the reliance on the tunnel map as a fallback mechanism and instead use Pod CIDR entries in IPCache that act as this fallback. The pod CIDR entries contain the node's tunnel endpoint and encryption key and have the reserved:world identity (i.e. the same identity as the existing catch-all fallback, which would have been hit before this PR).

The bulk of the work in this PR was done by @pippolo84. This PR is a replacement for his PR #37146 with a few notable changes:

The first commit has been reworked to add unit tests and fix up some issues in the previous version (c.f. Use ipcache for tunneling #37146 (comment)).
A commit has been added adding some unit tests to the IPCache package emulating some of the expected corner cases.
Commit node: Remove insertions and deletions to tunnel map has been dropped. In other words, even though the tunnel map is no longer used in the main branch, we still populate it. This addresses concerns with regards to downgrades.
The Conformance Multi-Pool workflow has been extended to also test in tunnel mode.

This change will eventually allow us to remove the tunnel map completely (ref #20170).

Add support for tunnel routing in multi-pool IPAM mode

pippolo84 · 2025-03-25T12:49:53Z

/test

giorio94

Thanks! A couple of comments inline, besides that looks great to me.

pkg/node/manager/manager.go

daemon/cmd/daemon_main.go

.github/workflows/conformance-multi-pool.yaml

pkg/node/manager/manager.go

ghost

docs good

Artyop

besides Marco's review about waiting for image step, looks good for github-sec and ci-structure

giorio94

One more comment inline (above), looks good to me otherwise.

Multi-Pool IPAM is now compatible with tunneling, update the IPAM modes feature compatibility table accordingly. Related: cilium#38483 Signed-off-by: Fabio Falzoi <[email protected]>

Thanks to the VinE support added in #37723, when in tunnel mode we encrypt the traffic after the encapsulation, at the native egress device. Therefore, the only entries (policies and states) needed for the XFRM framework to encrypt the traffic are the ones related to the remote nodes, not the ones related to the remote pod CIDRs. As a consequence, the multi-pool IPAM mode is now supported when IPSec is enabled in tunnel mode, therefore, update the related startup check to stop the agent only when multi-pool IPAM and IPSec transparent encryption are enabled in native routing mode. Related: #38483, #37723 Signed-off-by: Fabio Falzoi <[email protected]>

Multi-Pool IPAM is now compatible with tunneling, update the IPAM modes feature compatibility table accordingly. Related: #38483 Signed-off-by: Fabio Falzoi <[email protected]>

Multi-Pool IPAM is now compatible with tunneling, update the IPAM modes feature compatibility table accordingly. Related: cilium#38483 Signed-off-by: Fabio Falzoi <[email protected]>

Thanks to the VinE support added in #37723, when in tunnel mode we encrypt the traffic after the encapsulation, at the native egress device. Therefore, the only entries (policies and states) needed for the XFRM framework to encrypt the traffic are the ones related to the remote nodes, not the ones related to the remote pod CIDRs. As a consequence, the multi-pool IPAM mode is now supported when IPSec is enabled in tunnel mode, therefore, update the related startup check to stop the agent only when multi-pool IPAM and IPSec transparent encryption are enabled in native routing mode. Related: #38483, #37723 Signed-off-by: Fabio Falzoi <[email protected]>

Multi-Pool IPAM is now compatible with tunneling too and it does not require native routing mode anymore. Therefore, in order to simplify the Multi-Pool IPAM tutorial in the docs, remove the options related to native routing. Related: #38483 Signed-off-by: Fabio Falzoi <[email protected]>

Multi-Pool IPAM is now compatible with tunneling too and it does not require native routing mode anymore. Therefore, in order to simplify the Multi-Pool IPAM tutorial in the docs, remove the options related to native routing. Related: cilium#38483 Signed-off-by: Fabio Falzoi <[email protected]>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](cilium/cilium@1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](cilium/cilium#38469), [@joamaki](https://github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](cilium/cilium#37723), [@ldelossa](https://github.com/ldelossa); [cilium/cilium#37346](cilium/cilium#37346), [@gyutaeb](https://github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](cilium/cilium#39304), [@carlos-abad](https://github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](cilium/cilium#36351), [@l1b0k](https://github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](cilium/cilium#38198), [@dylandreimerink](https://github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](cilium/cilium#39987), [@dylandreimerink](https://github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](cilium/cilium#38296), [cilium/cilium#39497](cilium/cilium#39497), [@pchaigno](https://github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](cilium/cilium#39074), [@pchaigno](https://github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](cilium/cilium#38249), [@caorui-io](https://github.com/caorui-io), [@kadevu](https://github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](cilium/cilium#38110), [@gentoo-root](https://github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](cilium/cilium#38452), [@rgo3](https://github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](cilium/cilium#39453), [@antonipp](https://github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](cilium/cilium#39902), [@squeed](https://github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](cilium/cilium#37634), [@kaworu](https://github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](cilium/cilium#39338), [@MrFreezeex](https://github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](cilium/cilium#36492), [cilium/cilium#37445](cilium/cilium#37445), [@squeed](https://github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://github.com/marseel), [cilium/cilium#40227](cilium/cilium#40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](cilium/cilium#40005), [@marseel](https://github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](cilium/cilium#39340), [@squeed](https://github.com/squeed); [cilium/cilium#40414](cilium/cilium#40414), [@marseel](https://github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](cilium/cilium#38596), [@MrFreezeex](https://github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](cilium/cilium#36471), [@HadrienPatte](https://github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](cilium/cilium#37714), [@giorio94](https://github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](cilium/cilium#36288), [@tommyp1ckles](https://github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](cilium/cilium#37601), [@aditighag](https://github.com/aditighag); [cilium/cilium#38031](cilium/cilium#38031), [@orange30](https://github.com/orange30); [cilium/cilium#36648](cilium/cilium#36648), [@wedaly](https://github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](cilium/cilium#36510), [@ovidiutirla](https://github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](cilium/cilium#38940), [@christarazi](https://github.com/christarazi); [cilium/cilium#39090](cilium/cilium#39090), [@pippolo84](https://github.com/pippolo84); [cilium/cilium#37765](cilium/cilium#37765), [@rastislavs](https://github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](cilium/cilium#40137), [@Murat](https://github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](cilium/cilium#39664), [@aanm](https://github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](cilium/cilium#39124), [cilium/cilium#40175](cilium/cilium#40175), [cilium/cilium#39632](cilium/cilium#39632), [@sayboras](https://github.com/sayboras); [cilium/cilium#38868](cilium/cilium#38868), [@squeed](https://github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](cilium/cilium#38308), [@julianwiedmann](https://github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](cilium/cilium#39590), [@sayboras](https://github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](cilium/cilium#37792), [cilium/cilium#37402](cilium/cilium#37402), [cilium/cilium#40138](cilium/cilium#40138), [@sayboras](https://github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](cilium/cilium#39922), [@youngnick](https://github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](cilium/cilium#37798), [@sayboras](https://github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](cilium/cilium#39678), [@41ks](https://github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](cilium/cilium#39638), [@pippolo84](https://github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](cilium/cilium#39442), [@pippolo84](https://github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](cilium/cilium#38483), [@pippolo84](https://github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](cilium/cilium#37275), [@romanspb80](https://github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](cilium/cilium#36414), [@dswaffordcw](https://github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](cilium/cilium#36451), [@yushoyamaguchi](https://github.com/yushoyamaguchi); [cilium/cilium#38300](cilium/cilium#38300), [@liyihuang](https://github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](cilium/cilium#37027), [@Joe](https://github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](cilium/cilium#40212), [@squeed](https://github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](cilium/cilium#38480), [cilium/cilium#39642](cilium/cilium#39642), [cilium/cilium#37418](cilium/cilium#37418), [@brb](https://github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1062 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

Multi-Pool IPAM is now compatible with tunneling too and it does not require native routing mode anymore. Therefore, in order to simplify the Multi-Pool IPAM tutorial in the docs, remove the options related to native routing. Related: cilium#38483 Signed-off-by: Fabio Falzoi <[email protected]>

pippolo84 force-pushed the pr/pippolo84/multi-pool-ipam-tunneling branch 2 times, most recently from 63bdfb7 to f6ea689 Compare March 25, 2025 11:23

pippolo84 marked this pull request as ready for review March 25, 2025 12:49

pippolo84 requested review from a team as code owners March 25, 2025 12:49

pippolo84 requested review from a user, Artyop, doniacld, giorio94 and joamaki March 25, 2025 12:49

This was referenced Mar 25, 2025

Support tunnel routing in Multi-Pool IPAM mode #38015

Closed

[WIP] Remove insertions and deletions to deprecated tunnel map #38153

Closed

Use ipcache for tunneling #37146

Closed

Remove insertions and deletions to deprecated tunnel map #38490

Merged

giorio94 requested changes Mar 25, 2025

View reviewed changes

ghost approved these changes Mar 25, 2025

View reviewed changes

Artyop approved these changes Mar 25, 2025

View reviewed changes

pippolo84 force-pushed the pr/pippolo84/multi-pool-ipam-tunneling branch from f6ea689 to 809bb31 Compare March 25, 2025 16:49

giorio94 approved these changes Mar 25, 2025

View reviewed changes

Merged via the queue into cilium:main with commit ecd49a6 Mar 31, 2025
67 checks passed

pippolo84 added the affects/v1.17 This issue affects v1.17 branch label Apr 4, 2025

julianwiedmann mentioned this pull request Apr 5, 2025

bpf: encap: clean up tunnel_map leftovers #38756

Merged

joestringer mentioned this pull request Apr 8, 2025

Deduplicate go build flags when building with CGO enabled #38322

Merged

8 tasks

pippolo84 mentioned this pull request Apr 10, 2025

Remove tunnel map #38839

Merged

tklauser mentioned this pull request Apr 23, 2025

Remove TUNNEL_MAP lookup #20170

Closed

pippolo84 mentioned this pull request May 13, 2025

docs/ipam: Update IPAM feature compatibility table #39513

Merged

pippolo84 mentioned this pull request May 13, 2025

Multi-pool IPAM with tunneling and IPSec support #39442

Merged

julianwiedmann mentioned this pull request May 16, 2025

wireguard: improve tracking of allowedIPs #35331

Closed

pippolo84 mentioned this pull request Sep 30, 2025

ipsec: add support for using remote PodCIDR entries #41519

Merged

julianwiedmann mentioned this pull request Oct 10, 2025

docs: encryption: mention per-node PodCIDRs improvements #42114

Closed

pippolo84 mentioned this pull request Oct 15, 2025

ipam/multipool: Promote the feature to stable #42191

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support tunnel routing in Multi-Pool IPAM mode#38483

Support tunnel routing in Multi-Pool IPAM mode#38483
dylandreimerink merged 9 commits intocilium:mainfrom
pippolo84:pr/pippolo84/multi-pool-ipam-tunneling

pippolo84 commented Mar 25, 2025 •

edited

Loading

Uh oh!

pippolo84 commented Mar 25, 2025

Uh oh!

giorio94 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ghost left a comment

Uh oh!

Artyop left a comment

Uh oh!

giorio94 left a comment •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

pippolo84 commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pippolo84 commented Mar 25, 2025

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

Artyop left a comment

Choose a reason for hiding this comment

Uh oh!

giorio94 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

pippolo84 commented Mar 25, 2025 •

edited

Loading

giorio94 left a comment •

edited

Loading