[ upstream commit 4c2c244 ]

Use strings.Builder instead of fmt.Sprintf() and preallocate the size of
the string so that Go doesn't need to over-allocate if the string ends
up longer than what the buffer growth algorithm predicts.

Results:

```
$ go test -v -run '^$' -bench 'BenchmarkFQDNSelectorString' -benchmem ./pkg/policy/api > old.txt
$ go test -v -run '^$' -bench 'BenchmarkFQDNSelectorString' -benchmem ./pkg/policy/api > new.txt
$ benchcmp old.txt new.txt
benchmark                         old ns/op     new ns/op     delta
BenchmarkFQDNSelectorString-8     690           180           -73.97%

benchmark                         old allocs     new allocs     delta
BenchmarkFQDNSelectorString-8     9              4              -55.56%

benchmark                         old bytes     new bytes     delta
BenchmarkFQDNSelectorString-8     288           208           -27.78%
```

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 351c5d8 ]

SortedList() and FormatForKVStore() can be very hot code in environments
where there's constant policy churn, especially CIDR policies where
there can be a large number of CIDR labels.

This commit adds benchmarks for later commits to use as a baseline.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 0790e07 ]

FormatForKVStore() previously returned a string for no reason as every
caller converted the return value to a byte slice. This allows us to
eliminate string concatenation entirely and use the bytes.Buffer
directly.

Building on the above, given that SortedList() returns a byte slice and
calls FormatForKVStore() for its output, we can optimize it with the
same technique to eliminate string concatenation.

Here are the benchmark comparisons:

```
$ go test -v -run '^$' -bench 'BenchmarkLabels_SortedList|BenchmarkLabel_FormatForKVStore' -benchmem ./pkg/labels > old.txt
$ go test -v -run '^$' -bench 'BenchmarkLabels_SortedList|BenchmarkLabel_FormatForKVStore' -benchmem ./pkg/labels > new.txt
$ benchcmp old.txt new.txt
benchcmp is deprecated in favor of benchstat: https://pkg.go.dev/golang.org/x/perf/cmd/benchstat
benchmark                             old ns/op     new ns/op     delta
BenchmarkLabels_SortedList-8          2612          1120          -57.12%
BenchmarkLabel_FormatForKVStore-8     262           54.5          -79.18%

benchmark                             old allocs     new allocs     delta
BenchmarkLabels_SortedList-8          35             13             -62.86%
BenchmarkLabel_FormatForKVStore-8     4              1              -75.00%

benchmark                             old bytes     new bytes     delta
BenchmarkLabels_SortedList-8          1112          664           -40.29%
BenchmarkLabel_FormatForKVStore-8     96            48            -50.00%
```

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 5fa7ae2 ]

Advanced users can configure the LRU size for the cache holding the
compiled regex expressions of FQDN match{Pattern,Name}. This is useful
if users are experiencing high memory usage spikes with many FQDN
policies that have repeated matchPattern or matchName across many
different policies.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 38c0036 ]

When comparing efficieny of increasing the LRU size from 128 to 1024
with ~22k CNPs, we see the following results:

```
\# LRU size 128.
$ go test -tags privileged_tests -v -run '^$' -bench Benchmark_perEPAllow_setPortRulesForID_large -benchmem -benchtime 1x -memprofile memprofile.out ./pkg/fqdn/dnsproxy > old.txt

\# LRU size 1024.
$ go test -tags privileged_tests -v -run '^$' -bench Benchmark_perEPAllow_setPortRulesForID_large -benchmem -benchtime 1x -memprofile memprofile.out ./pkg/fqdn/dnsproxy > new.txt

$ benchcmp old.txt new.txt
benchcmp is deprecated in favor of benchstat: https://pkg.go.dev/golang.org/x/perf/cmd/benchstat
benchmark                                          old ns/op      new ns/op      delta
Benchmark_perEPAllow_setPortRulesForID_large-8     3954101340     3010934555     -23.85%

benchmark                                          old allocs     new allocs     delta
Benchmark_perEPAllow_setPortRulesForID_large-8     26480632       24167742       -8.73%

benchmark                                          old bytes      new bytes      delta
Benchmark_perEPAllow_setPortRulesForID_large-8     2899811832     1824062992     -37.10%
```

Here's the raw test run with LRU size at 128:

```
Before (N=1)
Alloc = 31 MiB  HeapInuse = 45 MiB      Sys = 1260 MiB  NumGC = 15
After (N=1)
Alloc = 445 MiB HeapInuse = 459 MiB     Sys = 1260 MiB  NumGC = 40
```

Here's the raw test run with LRU size at 1024:

```
Before (N=1)
Alloc = 31 MiB  HeapInuse = 48 MiB      Sys = 1177 MiB  NumGC = 17
After (N=1)
Alloc = 78 MiB  HeapInuse = 93 MiB      Sys = 1177 MiB  NumGC = 53
```

We can see that it's saving ~300MB.

Furthermore, if we compare the memprofiles from the benchmark run via

```
go tool pprof -http :8080 -diff_base memprofile.out memprofile.1024.out
```

we see an ~800MB reduction in the regex compilation.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit ce9583d ]

Following the previous commit's benchmark result, let's update the LRU
default size to be 1024, given that it only results in a few 10's of MBs
increase when the cache nears full.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 95362de ]

This commit adds a new convenience functions to get a count of
 * how many entries are inside the DNS cache (IPs)
 * and how many FQDNs are inside the DNS cache
It will be used by upcoming commits to expose these values as a metrics.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit d9ae1c4 ]

This commit contains no functional changes and is only cosmetic to ease
future commits when adding new FQDN-related metrics.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 47870fe ]

This commit exposes new metrics that show the number of active names and
IPs in the DNS cache, and number of alive FQDN connections that have
expired (aka zombies) per endpoint. This is useful to track the
endpoint's DNS cache and DNS zombie cache sizes over time.

Note that these metrics are only updated during the FQDN GC which is
currently invoked every minute.

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 044681a ]

This commit is to bump prometheus client library to the latest (e.g. v1.12.2)
which will have a better support for go collector of different go versions,
and fix NaN value.

Fixes: cilium#19985

Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit f439177 ]

This commit fixes a bug where the keys of the forward map inside the DNS
cache were never removed, causing the map to grow forever. By contrast,
the reverse map keys were being deleted.

For both the forward and reverse maps (which are both maps whose values
are another map), the inner map keys were being deleted.

In other words, the delete on the outer map key was missing for the
forward map.

In addition to fixing the bug, this commit expands the unit test
coverage to assert after any deletes (entries expiring or GC) that the
forward and reverse maps contain what we expect.

Particularly, in an environment where there are many unique DNS lookups
(unique FQDNs) being done, this forward map could grow quite large over
time, especially for a long-lived workload (endpoint). This fixes this
memory-leak-like bug.

Fixes: cf387ce ("fqdn: Introduce TTL-aware cache for DNS retention")
Fixes: f6ce522 ("FQDN: Added garbage collector functions.")

Signed-off-by: Chris Tarazi <chris@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 3500290 ]

This commit is to add ownerReferences for CiliumNodes created by
CiliumExternalWorkload, so that we don't unintentionally GC invalid CN.

Thanks to @nathanejohnson for reporting this issue.

Fixes: cilium#19907
Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit f9863ec ]

Signed-off-by: Vlad Ungureanu <ungureanuvladvictor@gmail.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit aa7572b ]

Signed-off-by: Vlad Ungureanu <ungureanuvladvictor@gmail.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>