[ upstream commit f17a17a ]

The first step for building the cilium/docs-builder image, used for
building Cilium's documentation, consists in pre-pulling the image with
Docker (to avoid failures from buildkit). The relevant command is formed
by parsing the name of the Alpine image from the Dockerfile.

On some setups, for example on Ubuntu running in Windows WSL with the
Cilium repository mounted from a Windows partition, the Dockerfile may
contain DOS-style line breaks (CR-LF). The result from "grep" being
piped to xargs and passed to "docker pull", we get an error because
Docker cannot recognise a valid reference with this '\r' character at
the end of the string. Let's remove any carriage return characters
before feeding the line to xargs.

Reported-by: Yoyo Wu <yoyo19980720@163.com>
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 20f315d ]

The PR [1] added "-Wimplicit-int-conversion" which broke
____revalidate_data_pull(). The latter is used when attaching bpf_host
to a L3 netdev.

[1]: #18501

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 0b58178 ]

Configure the peerService to access hubble on the
hubble.peerService.targetPort rather than determining the port from
hubble.listenAddress which may be empty when using a sidecar to proxy to hubble.

Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit b13dc89 ]

The tc command prints out information not shown by bpftool.
As well, it is possible that we may need information about
tc entities that are not managed by Cilium when debugging
Cilium issues.

This adds extra bugtool commands to be run with cilium-bugtool.
Including listing tc qdisc and getting filter/class/chain info
for all network interfaces.

Fixes: #17468

Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 80092ce ]

Since commit 67f74ff ("images/cilium: remove cilium group from
Dockerfile") the cilium group is no longer created in the image running
the agent, resulting in the following log message on cilium-agent start:

level=info msg="Group not found" error="group: unknown group cilium" file-path=/var/run/cilium/cilium.sock group=cilium subsys=api

Change the log message to debug level to avoid confusion.

Suggested-by: André Martins <andre@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 54d708e ]

The SPI value is expected to take 4 bits at most so it's maximum value
should be 15 not 16. Let's fix that in the key rotation documentation.

The agent also rejects value 0, so allowed values are [1;15].

Reported-by: Odin Ugedal via Slack
Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 9c6e424 ]

Fixes: f6ce522 ("FQDN: Added garbage collector functions.")
Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 6260073 ]

The general idea is to remove the need for our permanent pool of GKE
clusters + management cluster (that manages the pool via Config
Connector).

Instead, we switch to ad-hoc clusters as we do on CI 3.0. This should:

- Remove the upper limit on the number of concurrent Jenkins GKE jobs.
- Remove the need for permanent clusters (reduce CI costs).
- Have no effect on the setup time required before the tests actually
  start running on GKE clusters.
- Improve control over GKE features (e.g. `DenyServiceExternalIPs`
  admission controller) that cannot be controlled via CNRM /
  Config Connector.

Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit b42e5a0 ]

New GKE clusters have the automatic labelling feature gate enabled by
default, so the labels used in the `Identity CLI testing` `K8sCLI` test
need to be updated with the additional
`k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name`
automatic label.

Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 078c052 ]

K8s cache is not fully synced also when k8sSyncedChecker is still nil.

Found during code inspection, not sure if this can manifest as a bug on
runtime.

Fixes: #17823
Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Signed-off-by: Gilberto Bertin <jibi@cilium.io>