[ upstream commit 3992048 ]

Istio 1.10 requires at least k8s version 1.17.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

…apache.org

[ upstream commit 712af8e ]

Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit 38994b0 ]

When running runtime tests locally sometimes the test fail as level=error
log entries are found that are the result of cilium-agent restarts during
provisioning.

This is similar to the fix done in cilium#14529.

Signed-off-by: Jussi Maki <jussi@isovalent.com>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit d3ff998 ]

Previously, the BPF-based masquerading (--enable-bpf-masquerade=true)
was wrongly masquerading replies from a pod to an outside when the
outside had initiated a connection. This was possible when e.g., the
outside had a route to the pod cidr.

To fix this, we introduce a lightweight CT lookup function
ct_is_reply4() which checks whether a given flow is a reply. The lookup
function is called in snat_v4_needed().

As a side note, I've tried to move the port extraction to a separate
function, but unfortunately it hits complexity issues on the 4.19
kernel in the "K8sDatapathConfig AutoDirectNodeRoutes Check direct
connectivity with per endpoint routes" suite:

    BPF program is too large. Processed 131073 insn
    libbpf: failed to load program 'handle_to_container'
    libbpf: failed to load object '624_next/bpf_lxc.o'

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit 55bfba9 ]

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit 4b92d2d ]

Previously, they were failing due to our datapath masquerading replies
from pod to outside. As it got fixed in the previous commit, we can
enable BPF-based masquerading.

This will also gives us some coverage for the fix.

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit 6418ade ]

This pulls in a few fixes around ioctl wrappers wrt. unsafe.Pointer
usage and fixes ifreqEthtool to be correctly padded.

Ref. golang/sys@e5e7981
Ref. golang/sys@b450225

Signed-off-by: Tobias Klauser <tobias@cilium.io>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit d82ac6f ]

Use the ioctl wrapper provided in the golang.org/x/sys/unix package with
the correctly padded ifreqData struct, rather than providing our own
wrapper and struct which is incorrectly padded.

Also add a simple unit test and make sure the package is only built on
Linux.

Signed-off-by: Tobias Klauser <tobias@cilium.io>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit 82469c3 ]

The egress gateway doesn't exactly require our kube-proxy replacement to
be enabled. It only requires BPF masquerading which itself requires BPF
NodePort. Enabling KPR is just an easy way to enable BPF NodePort.

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit e0da2e4 ]

Signed-off-by: Tom Payne <tom@isovalent.com>
Co-authored-by: Nicolas Busseneau <nicolas@isovalent.com>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>

[ upstream commit 2202dae ]

In cilium#16892, we switched from pinning CLI version in workflows to using
the latest stable version automatically. This can cause issues if a new
release does not play nice with the set of environments tested by the
workflows on `cilium/cilium`.

We are reverting to pinning CLI version so as to have better control
over the test environment, and avoid new CLI releases negatively
impacting `cilium/cilium` workflows immediately upon release.

With the CLI version pinned, any issues with the new version will be
detected in the PR bumping the pinned version, allowing us to fix them
prior to merging.

Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>