[ upstream commit 0c97c19 ]

Previously the ingress annotation code for the external traffic policy was returning Cluster as a default. This would cause a reconciliation error when using the host network and prevent the service from being created. For the service to work in this mode, there should be no external traffic policy.

To support this, the ingress service template has to be adjusted to check the host network flag before setting the policy

Fixes: #34028

Signed-off-by: Rich Theobald <rich.theobald@gmail.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit d5b0ab2 ]

To mimic the same method provided by [netip.Addr]. Additionally, let's
reimplement the [AddrCluster.Less] on top of it.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit a36ae92 ]

Let's make use of the newly introduced [AddrCluster.Compare] function,
to ensure consistent ordering also when there are multiple backends
associated with the same IP, but different ClusterID.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit f28cb90 ]

Currently, the loadbalancer reconciler is affected by a bug causing the
incorrect pruning of backends if associated with a non-zero ClusterID,
because the ClusterID read from the map is ignored. Let's get this
fixed by unifying the [BackendValue.{GetAddress,GetIPCluster]] methods,
to ensure that all callers correctly account for the ClusterID.

Additionally, let's also extend the unit tests to cover this use-case
and prevent possible regressions.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 8e2f55d ]

The 50ms minimum retry leads to very high load if there are many
entries that do not fit into the LB BPF maps.

Since the probability of a BPF syscall failing without maps being
full is very unlikely, raise default to 1 second to avoid excessive
load in situations where BPF maps overflow.

Signed-off-by: Jussi Maki <jussi@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 47eda94 ]

The location of the extraEnv should be under the 'env:' section. Having
it out of place, causes the yaml to be incorrectly formatted preventing
the user from using this helm variable.

Fixes: a39087e ("helm: add readinessProbe to clustermesh-apiserver")
Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 1278c7d ]

This test open-coded the flags for connectivity test, which meant that
the flags were inconsistent in a few key areas like not gathering
sysdump on failure. Fix it by reusing the test flags from earlier in the
workflow.

Signed-off-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 5198d28 ]

[ backporter's note: The signature of the setupIPSecSuitePrivileged is
  different among upstream and v1.18. Adjust them. ]

This commit fixed some test name in the ipsec suite by adding the
"TestPrivileged" prefix, to make sure they're executed and not skipped.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

[ upstream commit 3829092 ]

Detect and show if endpoint slice is enabled in the agent.

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 5b0ae4d ]

[ backporter's note: Wireguard code got some major change in the main
  recently, but v1.18 doesn't have the change. Fixed conflicts caused by
  this. ]

Signed-off-by: André Martins <andre@cilium.io>

[ upstream commit 1c7b1d0 ]

[ backporter's note: Fixed a minor import conflict. ]

Signed-off-by: André Martins <andre@cilium.io>

[ upstream commit e574c08 ]

In some cases, the kernel version detection was not working. This commit
fixes these bugs and add the tests for the missing cases.

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 3a749b4 ]

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 1077bde ]

[ backporter's note: cilium-cli/features/status.go doesn't exist in
  v1.18 branch ]

Skip label value checks in checkLabels and checkLabelValues when the
allowed values set is empty, allowing unrestricted values for those labels.

Fixes: 6659745 ("metric: provide way to declare labels.")
Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit c697c7e ]

One of these was for _GKE_ v1.15 which is ancient, but all of the other
references to v1.15 are for Cilium and are also stale. Remove them.

Signed-off-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>