ipsec: keep SPI in sync between keyCustodian and BPF map #41456
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit is a small refactor to prepare for the subsequent one. There are no functional changes. It simply sets the keyfileWatcher and setIPSecSPI methods as private to the keyCustodian. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Prior to this commit, the SPI could've changed at runtime due to a new key being written in the watched file. However, that update would have affected only the underlying BPF map, and not the keyCustodian. It is true that the SPI() method of the keyCustodian seems to be called only during the daemon startup, but if in future we'd need to call it again and the key changed in the meantime the method would've returned an outdated SPI value. Let's fix this behavior. Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
|
/ci-runtime |
|
/test |
|
Merging this would unblock #41252 🙏🏼 @cilium/ipsec |
pchaigno
approved these changes
Sep 3, 2025
|
It's only a release-note/bug if it fixes a bug with user-visible impact. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
keyCustodian.SPI()method is used only in newDaemon to annotate the node.The thing is that subsequent changes to the SPI from the ipsec job would cause misalignment from the SPI in the BPF map (will contain the updated one) and the one stored in the ipsec agent (will contain the old one inferred during startup). No errors as of today though.
This is just so that we don't panic if we'll start using .SPI() in other places in the future and notice a different value.