[ upstream commit 4c68f8a ]

Signed-off-by: Gaurav Yadav <gaurav.dev.iiitm@gmail.com>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit 3d6cf1b ]

Signed-off-by: Gaurav Yadav <gaurav.dev.iiitm@gmail.com>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit d7433cf ]

In endpoint-routes mode, we encode the source identity in the ctx->mark
when locally routing the packet to the destination device for ingress
policy assessment. Previously we only encoded the local cluster
identity in the mark, thereby omitting the original cluster portion of
the identity.

Found by code inspection.

Fixes: 654303a ("bpf: Skip ingress policy at egress of source if egress prog is in use")
Signed-off-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit 8efceda ]

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit 3fb4d15 ]

When cross-building Cilium, like we do for the ARM64 image,
version.Version reports the GOOS/GOARCH of the build system (i.e.
linux/amd64) because it is set to the value of `go version` as run on
the build system.

Instead, report the Go version properties of the proper target system by
using the corresponding information from Go's runtime package. Mimic the
`go version` format to keep Cilium's version format backwards-compatible.

Fixes #13122

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit ed00ac6 ]

Signed-off-by: Gaurav Yadav <gaurav.dev.iiitm@gmail.com>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit bb9411b ]

From minikube 1.12.1+, cilium quick install can be enabled by passing flag
--network-cni=cilium

Signed-off-by: Tam Mach <sayboras@yahoo.com>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit dc6a065 ]

If kube-proxy is in use (no BPF-based masquerading), packets from pods may
be SNATed. The response packet will therefore have a host IP as the
destination IP. For example, if a pod connects to 1.1.1.1:

  # Pod sends a SYN.
  from-lxc: 10.8.0.1 -> 1.1.1.1
  # Src IP gets masqueraded to 192.168.33.11. We skip the host firewall
  # because the packet mark tells us this is not coming from hostns.
  to-netdev: 192.168.33.11 -> 1.1.1.1
  ...
  # SYN+ACK is sent to 192.168.33.11. This IP belongs to the host
  # endpoints, so we incorrectly enforce host policy on this packet.
  from-netdev: 1.1.1.1 -> 192.168.33.11

To avoid enforcing host policies for response packets to pods, we need to
create a CT entry for the forward, SNATed packet from the pod. Response
packets will thus match this CT entry and bypass host policies.

I tested this change by deploying the connectivity checks in the dev. VM
with kube-proxy and the lock-down-dev-vms.yaml host policy. A subsequent
commit also updates the CIDR+toPorts host policy test to run it when
kube-proxy is used. Finally, the pull request has label ci/host-firewall
to run all e2e CI tests on Jenkins with the host firewall enabled by
default.

Fixes: 88bf291 ("bpf: Enforce host policies for IPv4")
Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit 5b581f6 ]

Previous commit fixed the host firewall to work with kube-proxy. Thus,
we can now run the CIDR+toPorts test for the host firewall when
kube-proxy is enabled.

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit 3135759 ]

This includes allowing some services that were not present on the
release-channel=rapid GKE clusters.

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>

[ upstream commit 4028da9 ]

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>