[ upstream commit 511b15d ]

This fixes a bug in the reply filter on `reply=false` would report flows
for which we actually do not know if they were replies or not. Not all
trace points have connection tracking state available, thus looking at
the reply flag alone is not sufficent to tell if something a flow was a
reply or not.

Ideally, we would fix this in the parser and make the `reply` an
optional boolean, so we can distinguish between a `false` value and an
absent value. This however is a breaking change in the Hubble API, which
we want to avoid. Therefore, this commit modifies the reply filter to
only report flows here for which we know that the reply field is
reliable.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit 510566a ]

Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>
Co-authored-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit 01f8dcc ]

EKS needs some specific rules for NodePort traffic (see PR #12770, or
comments in the code, for details). The addition of part of these rules
were added to the body of the Reinitialize() function in the loader. To
make them easier to maintain or extend, let's move them to a dedicated
function called by Reinitialize(). No functional change.

Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit 09e9a46 ]

EKS needs some specific rules for asymmetric routing with multi-node
NodePort traffic. These rules are implemented only for IPv4, so we can
avoid installing them when IPv4 is disabled. This is what this commit
does.

Note that this check is, in fact, not necessary at the moment, because
as the config package says: "IPv6 cannot be enabled in ENI IPAM mode".
So we always run with IPv4. But let's have it for good measure, to avoid
issues if IPv6 support comes in the future.

For the same reason, we also do not have to implement equivalent rules
for IPv6 at the moment.

Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit a301853 ]

Multi-node NodePort traffic on EKS needs specific rules regarding
asymmetric routing. These rules were implemented for the eth0 interface
(namely), because this is what EKS uses. With the default Amazon Linux 2
distribution. But EKS can also run with Ubuntu for example, and the name
of the interface is not the same in that case.

Instead of "eth0", use the interface with the dafault route. This is a
quick fix, and longer term we want to add the rules to all relevant
interfaces, as discussed in #12770.

Fixes: #12770
Fixes: #13143
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit 815be6a ]

EKS requires some specific rules for asymmetric routing with multi-node
NodePort traffic. These rules relies on the xt_connmark kernel module,
which is usually loaded by iptables when necessary.

The rules are installed when the selected IPAM is ENI, meaning they are
installed on AWS (but not only EKS). The xt_connmark module should be
loaded in a similar way, unless loading modules after boot has been
disabled, in which case the setup fails and the agent crashes.

Add a comment to at least help debug the issue. Longer term, we may want
to add more explicit hints to the logs if too many users hit the issue,
but that would require parsing iptables' output for the specific error,
so let's see how it goes with a simple comment in the code for now.

Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit d888057 ]

* This commit fixes an issue in nodeport service revnat handling where
  the interface index was not properly restored from the Conntrack state
  leading to packet redirects to invalid interface.

Signed-off-by: Deepesh Pathak <deepshpathak@gmail.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>

[ upstream commit 5c6aad6 ]

This commit removes the ability to delete CRDs from Cilium because that
would delete all the CRs in the cluster.

Follow-up from:
#11477 (comment)

Updates: #12737

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>