Merged
Conversation
pchaigno
added
area/datapath
julianwiedmann
added
the
area/loadbalancing
Member
julianwiedmann
left a comment
julianwiedmann
left a comment
There was a problem hiding this comment.
two minor comments, except that looks good! Adding the XDP support will be fun ...
pchaigno
force-pushed
the
pr/pchaigno/ipv6-underlay-kpr
branch
from
12ef4ab to
cb972d1
Compare
pchaigno
force-pushed
the
pr/pchaigno/ipv6-underlay-kpr
branch
from
cb972d1 to
c73cbe4
Compare
When using GENEVE tunneling, we can include options in the tunnel header. That is used by the NodePort logic in some cases. This commit adds support for doing this over an IPv6 underlay, by extending ctx_set_encap_info6 and introducing __encap_with_nodeid_opt6 to match their IPv4 counterparts. There are no functional changes in this commit because __encap_with_nodeid_opt6 isn't used yet. Signed-off-by: Paul Chaignon <[email protected]>
Encap functions nodeport_add_tunnel_encap{,_opt} currently take the
IPv4 tunnel endpoint address as anargument. These functions will need
to also support IPv6 addresses so let's first pass, as an argument, a
pointer to the whole ipcache value (i.e., struct remote_endpoint_info)
instead of the tunnel endpoint. It will be easier in subsequent commits
to retrieve either the IPv4 or IPv6 tunnel endpoint from the ipcache
value.
There are no functional changes in this commit.
Signed-off-by: Paul Chaignon <[email protected]>
Since the previous commit passes the whole ipcache value into
nodeport_add_tunnel_encap{,opt}, we don't need the dst_sec_identity
argument anymore. We can retrieve its value from the ipcache value.
This commit therefore removes the dst_sec_identity argument from the
nodeport_add_tunnel_encap{,opt} functions.
Signed-off-by: Paul Chaignon <[email protected]>
In tunneling mode with BPF NodePort, when DNATed packets are forwarded to a remote backend, they need to be encapsulated. This commit implements support for an IPv6 underlay in that case. Signed-off-by: Paul Chaignon <[email protected]>
Signed-off-by: Paul Chaignon <[email protected]>
Previous commits added support for IPv6 underlays with BPF NodePort so we can now allow users to enable those options together. This commit also switches the IPv6 underlay test case in end-to-end tests to use KPR and egress gateway. Signed-off-by: Paul Chaignon <[email protected]>
pchaigno
force-pushed
the
pr/pchaigno/ipv6-underlay-kpr
branch
from
c73cbe4 to
c803a4a
Compare
Member
Author
|
/test |
julianwiedmann
approved these changes
Apr 28, 2025
Member
julianwiedmann
left a comment
julianwiedmann
left a comment
There was a problem hiding this comment.
looks good, thank you!
viktor-kurchenko
approved these changes
Apr 29, 2025
maintainer-s-little-helper
bot
added
the
ready-to-merge
YutaroHayakawa
added a commit
to YutaroHayakawa/cilium
that referenced
this pull request
May 8, 2025
Currently, the nodeport_nat_egress_ipv4_hook in the tail_nodeport_nat_egress_ipv4 is broken in non-tunnel mode because info variable is not declared. Revert the changes made in the 3c4693f to make it work again. Fixes: cilium#39074 Signed-off-by: Yutaro Hayakawa <[email protected]>
This was referenced May 8, 2025
github-merge-queue bot
pushed a commit
that referenced
this pull request
May 12, 2025
Currently, the nodeport_nat_egress_ipv4_hook in the tail_nodeport_nat_egress_ipv4 is broken in non-tunnel mode because info variable is not declared. Revert the changes made in the 3c4693f to make it work again. Fixes: #39074 Signed-off-by: Yutaro Hayakawa <[email protected]>
hsalluri259
pushed a commit
to hsalluri259/cilium
that referenced
this pull request
May 14, 2025
Currently, the nodeport_nat_egress_ipv4_hook in the tail_nodeport_nat_egress_ipv4 is broken in non-tunnel mode because info variable is not declared. Revert the changes made in the 3c4693f to make it work again. Fixes: cilium#39074 Signed-off-by: Yutaro Hayakawa <[email protected]>
giorio94
added a commit
that referenced
this pull request
Jun 18, 2025
Now that the long standing tunneling + IPv6-only limitation has been lifted [1,2,3], let's enable this previously commented-out matrix entry of the conformance-clustermesh workflow. [1]: #38523 [2]: #38296 [3]: #39074 Signed-off-by: Marco Iorio <[email protected]>
giorio94
added a commit
that referenced
this pull request
Jun 18, 2025
Now that the long standing tunneling + IPv6-only limitation has been lifted [1,2,3], let's enable this previously commented-out matrix entry of the conformance-clustermesh workflow. [1]: #38523 [2]: #38296 [3]: #39074 Signed-off-by: Marco Iorio <[email protected]>
giorio94
added a commit
that referenced
this pull request
Jun 23, 2025
Now that the long standing tunneling + IPv6-only limitation has been lifted [1,2,3], let's enable this previously commented-out matrix entry of the conformance-clustermesh workflow. [1]: #38523 [2]: #38296 [3]: #39074 Signed-off-by: Marco Iorio <[email protected]>
giorio94
added a commit
that referenced
this pull request
Jun 23, 2025
Now that the long standing tunneling + IPv6-only limitation has been lifted [1,2,3], let's enable this previously commented-out matrix entry of the conformance-clustermesh workflow. [1]: #38523 [2]: #38296 [3]: #39074 Signed-off-by: Marco Iorio <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Jun 24, 2025
Now that the long standing tunneling + IPv6-only limitation has been lifted [1,2,3], let's enable this previously commented-out matrix entry of the conformance-clustermesh workflow. [1]: #38523 [2]: #38296 [3]: #39074 Signed-off-by: Marco Iorio <[email protected]>
wanglei4687
pushed a commit
to wanglei4687/cilium
that referenced
this pull request
Jun 26, 2025
Now that the long standing tunneling + IPv6-only limitation has been lifted [1,2,3], let's enable this previously commented-out matrix entry of the conformance-clustermesh workflow. [1]: cilium#38523 [2]: cilium#38296 [3]: cilium#39074 Signed-off-by: Marco Iorio <[email protected]>
github-merge-queue bot
pushed a commit
to chezmoidotsh/arcane
that referenced
this pull request
Jul 29, 2025
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | HelmChart | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@​joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@​ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@​gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@​carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@​l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@​pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@​pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@​caorui-io](https://redirect.github.com/caorui-io), [@​kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@​gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@​rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@​antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@​squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@​kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@​squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@​marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@​squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@​marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@​HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@​giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@​tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@​aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@​orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@​wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@​ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@​christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@​pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@​rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@​Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@​aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@​sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@​squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@​julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@​sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://appwritefunc.yet-another-testing-domain.com/api/gra
This pull request adds support for KPR when running with an IPv6 underlay. The first commit introduces an IPv6 version of the encapsulation function. The second commit performs some refactoring to ease readability of subsequent commits. The third commit removes a function argument that became unnecessary thanks to the previous commit. The fourth commit adds the support in the datapath. Fifth and last commit enable this in the agent and cover it in the CI.