Skip to content

helm: Guard apply sysctl init container #20643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 26, 2022
Merged

helm: Guard apply sysctl init container #20643

merged 1 commit into from
Jul 26, 2022

Conversation

sayboras
Copy link
Member

The newly added init container (e.g. sysctl init) requires hostproc
volume mount, however, this volume is only mounted based on the helm
flag .Values.cgroup.autoMount.enabled. This commit is to make sure
that such condition is added to avoid any failure.

Relates: #20072
Fixes: #20626
Signed-off-by: Tam Mach tam.mach@cilium.io

@sayboras
helm: Guard apply sysctl init container
8e92dfc 
The newly added init container (e.g. sysctl init) requires hostproc
volume mount, however, this volume is only mounted based on the helm
flag .Values.cgroup.autoMount.enabled. This commit is to make sure
that such condition is added to avoid any failure.

Relates: cilium#20072
Fixes: cilium#20626
Signed-off-by: Tam Mach <tam.mach@cilium.io>
@maintainer-s-little-helper maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 24, 2022
@sayboras sayboras added the release-note/bug This PR fixes an issue in a previous release of Cilium. label Jul 24, 2022
@maintainer-s-little-helper maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 24, 2022
@sayboras sayboras marked this pull request as ready for review July 24, 2022 12:28
@sayboras sayboras requested a review from a team July 24, 2022 12:28
@sayboras sayboras requested a review from a team as a code owner July 24, 2022 12:28
@sayboras sayboras requested review from tommyp1ckles and nebril July 24, 2022 12:28
joestringer
joestringer approved these changes Jul 25, 2022
View reviewed changes
Copy link
Member

@joestringer joestringer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🙏

@sayboras
Copy link
Member Author

sayboras commented Jul 26, 2022 •
edited by maintainer-s-little-helper bot
Loading

/test

Job 'Cilium-PR-K8s-1.16-kernel-4.9' failed:

Click to show.

Test Name

K8sVerifier Runs the kernel verifier against Cilium's BPF datapath

Failure Output

FAIL: Failed to load BPF program bpf_host with datapath configuration:

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.16-kernel-4.9 so I can create one.

@sayboras
Copy link
Member Author

Reviews are in, test-1.16-4.9 hit flake #20288

Marking this ready to merge.

@sayboras sayboras added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jul 26, 2022
@gandro gandro merged commit 6d920b2 into cilium:master Jul 26, 2022
@sayboras sayboras deleted the tam/issue-20626 branch July 27, 2022 11:42
@nbusseneau nbusseneau mentioned this pull request Aug 9, 2022
Merged
@nbusseneau nbusseneau mentioned this pull request Aug 9, 2022
Merged
@nbusseneau nbusseneau mentioned this pull request Aug 10, 2022
Merged
@tklauser tklauser added backport-done/1.11 The backport for Cilium 1.11.x for this PR is done. and removed backport-pending/1.11 labels Aug 11, 2022
@tklauser tklauser added backport-done/1.10 backport-done/1.12 The backport for Cilium 1.12.x for this PR is done. and removed backport-pending/1.10 labels Aug 11, 2022
This was referenced Aug 11, 2022
Merged
Merged
Merged
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 4, 2024
@YutaroHayakawa
helm: Decouple sysctlfix from cgroup.autoMount
8b16d6d 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
@YutaroHayakawa YutaroHayakawa mentioned this pull request Jun 4, 2024
Merged
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 4, 2024
@YutaroHayakawa
helm: Decouple sysctlfix from cgroup.autoMount
4db52de 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 4, 2024
@YutaroHayakawa
helm: Decouple sysctlfix from cgroup.autoMount
9c6d794 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 6, 2024
@YutaroHayakawa @youngnick
helm: Decouple sysctlfix from cgroup.autoMount
e25fef1 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 6, 2024
@YutaroHayakawa @youngnick
helm: Decouple sysctlfix from cgroup.autoMount
0b92154 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 7, 2024
@YutaroHayakawa @youngnick
helm: Decouple sysctlfix from cgroup.autoMount
03a5853 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
YutaroHayakawa added a commit to YutaroHayakawa/cilium that referenced this pull request Jun 7, 2024
@YutaroHayakawa @youngnick
helm: Decouple sysctlfix from cgroup.autoMount
cc341cf 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
github-merge-queue bot pushed a commit that referenced this pull request Jun 7, 2024
@YutaroHayakawa @youngnick
helm: Decouple sysctlfix from cgroup.autoMount
99f8871 
Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
giorio94 pushed a commit that referenced this pull request Jun 10, 2024
@YutaroHayakawa @youngnick @giorio94
helm: Decouple sysctlfix from cgroup.autoMount
1ddd81b 
[ upstream commit 99f8871 ]

[ backporter's notes: dropped the values.schema.json hunk, as not
  relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
giorio94 pushed a commit that referenced this pull request Jun 10, 2024
@YutaroHayakawa @youngnick @giorio94
helm: Decouple sysctlfix from cgroup.autoMount
524687f 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
giorio94 pushed a commit that referenced this pull request Jun 10, 2024
@YutaroHayakawa @youngnick @giorio94
helm: Decouple sysctlfix from cgroup.autoMount
a7e61e4 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
dylandreimerink pushed a commit that referenced this pull request Jun 12, 2024
@YutaroHayakawa @youngnick @dylandreimerink
helm: Decouple sysctlfix from cgroup.autoMount
9fa0677 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
giorio94 pushed a commit that referenced this pull request Jun 12, 2024
@YutaroHayakawa @youngnick @giorio94
helm: Decouple sysctlfix from cgroup.autoMount
bb3b565 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
giorio94 pushed a commit that referenced this pull request Jun 13, 2024
@YutaroHayakawa @youngnick @giorio94
helm: Decouple sysctlfix from cgroup.autoMount
1645ea6 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
aanm pushed a commit that referenced this pull request Jun 13, 2024
@YutaroHayakawa @youngnick @aanm
helm: Decouple sysctlfix from cgroup.autoMount
7678219 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: #20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
christarazi pushed a commit to christarazi/cilium that referenced this pull request Aug 1, 2024
@YutaroHayakawa @youngnick @giorio94
helm: Decouple sysctlfix from cgroup.autoMount
7e5b0a8 
[ upstream commit 99f8871 ]

[ backporter's notes: fixed trivial conflict in values.yaml.tmpl
  and dropped the values.schema.json hunk, as not relevant. ]

Currently, the sysctlfix is only enabled when cgroup.autoMount is
enabled which is not a directly-related feature. This dependency is
introduced because the host procfs mount is only enabled when
cgroup.autoMount is enabled.

Due to this limitation, we recently observed the issue that disabling
cgroup.autoMount in the environment that runs systemd 245+ makes a
connectivity loss between nodes in tunnel mode due to the rp_filter.

To fix the above issue, introduce a new configuration knob to
enable/disable sysctlfix individually. It is enabled by default.

Fixes: cilium#20643

Co-authored-by: Nick Young <inocuo@gmail.com>
Signed-off-by: Yutaro Hayakawa <yhayakawa3720@gmail.com>
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
(cherry picked from commit 9fa0677)
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gandro gandro gandro approved these changes

@joestringer joestringer joestringer approved these changes

@tommyp1ckles tommyp1ckles Awaiting requested review from tommyp1ckles

@nebril nebril Awaiting requested review from nebril nebril was automatically assigned from cilium/helm

Assignees
No one assigned
Labels
backport-done/1.11 The backport for Cilium 1.11.x for this PR is done. backport-done/1.12 The backport for Cilium 1.12.x for this PR is done. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/bug This PR fixes an issue in a previous release of Cilium.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Upgrading from 1.11.6 -> 1.11.7 or 1.12.0 Fails
5 participants
@sayboras @gandro @joestringer @tklauser @nbusseneau