[backport 1.11] envoy: Bump cilium envoy to latest version v1.21.3 #20146
Conversation
[ upstream commit 85819de ] The images digest is coming from below build. https://github.com/cilium/proxy/runs/6816960166?check_suite_focus=true. Release note: https://www.envoyproxy.io/docs/envoy/v1.21.3/version_history/current Signed-off-by: Tam Mach <tam.mach@cilium.io>
|
/test-backport-1.11 |
|
/test-backport-1.11 Job 'Cilium-PR-Runtime-net-next' failed: Click to show.Test NameFailure OutputIf it is a flake and a GitHub issue doesn't already exist to track it, comment Job 'Cilium-PR-Runtime-net-next' failed: Click to show.Test NameFailure OutputIf it is a flake and a GitHub issue doesn't already exist to track it, comment |
|
The CI failures are a bit suspect, are those passing on the v1.11 branch? 🤔
EDIT2: Never mind, the jobs that pass probably just don't run those tests. net-next also fails. Definitely looks like something gets messed up. Runtime test also looks weird, timed out after ten minutes? |
I'm not quite sure what this means or why it only shows up in 1.11, but it looks like an Envoy (maybe Envoy configuration from Cilium?) issue. |
|
seems like something goes wrong, all jobs are failing for below two jobs
Let me try to simulate locally |
|
/test-1.16-netnext |
|
/test-runtime |
[ upstream commit abfdcd2 ] Visibility annotation should add port rules to gain protocol/parser specific visibility, and not drop the allow-all policy generated without visibility policies. This did not matter when only port-specific traffic was redirected to Envoy, but with policy enforcement in L7 LB we explicitly need the allow-all rule to pass traffic for which no specific L7 policy applies. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
|
/test |
This was an unforeseen incompatibility with this change in cilium/proxy (made after v1.11) and this change to support visibility policies for proxylib parsers (in cilium v1.11). This latter change broke the assumption that Cilium agent always creates an allow-all policy when policy enforcement is disabled, and changed to create a port-specific rule instead, but only for proxylib parsers. For L7 LB we needed to actually rely on that assumption, removing a special case originally added for Istio sidecars that allowed traffic if no policy was found. Backporting envoy: Include allow-all policy with visibility policies as well fixed this in my local testing. Versions prior to v1.11 are not affected as they do not have the proxylib visibility support commit. |
|
/test-1.24-4.19 |
|
/test-runtime |
|
/test-backport-1.11 Job 'Cilium-PR-K8s-1.16-net-next' hit: #18889 (95.01% similarity) |
|
Some failures are shown mainly due to /test command was used instead of /test-backport-1-11:
|
Once this PR is merged, you can update the PR labels via: