Skip to content

v1.11 Backports 2023-06-08 #26007

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jun 9, 2023
Merged

v1.11 Backports 2023-06-08 #26007

merged 3 commits into from
Jun 9, 2023

Conversation

YutaroHayakawa
Copy link
Member

@YutaroHayakawa YutaroHayakawa commented Jun 8, 2023 •
edited by pchaigno
Loading

Dropped #25936 (@joamaki) since the task is taken over by #26021.

Once this PR is merged, you can update the PR labels via:

for pr in 25907 25893; do contrib/backporting/set-labels.py $pr done 1.11; done

or with

make add-labels BRANCH=v1.11 ISSUES=25907,25893

@YutaroHayakawa YutaroHayakawa added kind/backports This PR provides functionality previously merged into master. backport/1.11 labels Jun 8, 2023
@YutaroHayakawa YutaroHayakawa force-pushed the pr/v1.11-backport-2023-06-08 branch from c47939e to c3b6d78 Compare June 8, 2023 05:47
@YutaroHayakawa YutaroHayakawa marked this pull request as ready for review June 8, 2023 09:18
@YutaroHayakawa YutaroHayakawa requested a review from a team as a code owner June 8, 2023 09:18
@YutaroHayakawa
Copy link
Member Author

This is blocked by v1.11 complexity issue.

@YutaroHayakawa
Copy link
Member Author

/test-backport-1.11

@joamaki
Copy link
Contributor

joamaki commented Jun 8, 2023

I've added backport of #25936 to #26021. You can drop the commit from here.

@YutaroHayakawa YutaroHayakawa force-pushed the pr/v1.11-backport-2023-06-08 branch from c3b6d78 to 7cc992a Compare June 8, 2023 10:44
@aspsk aspsk force-pushed the pr/v1.11-backport-2023-06-08 branch from 7cc992a to d8fa43b Compare June 8, 2023 14:49
@aspsk
Copy link
Contributor

aspsk commented Jun 8, 2023

I've rebased on top of v1.11 so that broken parts of conformance-kind and smoke-test are disabled.

@aspsk
Copy link
Contributor

aspsk commented Jun 8, 2023 •
edited by maintainer-s-little-helper bot
Loading

/test-backport-1.11

Job 'Cilium-PR-K8s-1.21-kernel-5.4' failed:

Click to show.

Test Name

K8sDatapathConfig Host firewall With VXLAN

Failure Output

FAIL: Timed out after 240.001s.

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-5.4/20/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.21-kernel-5.4 so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.19-kernel-4.9' failed:

Click to show.

Test Name

K8sDatapathConfig Host firewall With VXLAN

Failure Output

FAIL: Failed to reach 192.168.56.11:80 from testserver-host-7hvc7

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.19-kernel-4.9/38/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.19-kernel-4.9 so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.23-kernel-4.9' has 1 failure but they might be new flake since it also hit 1 known flake: #24697 (85.37% similarity)

@aspsk
Copy link
Contributor

aspsk commented Jun 8, 2023

The same bad news: ci-multicluster-1.11 fails due to complexity

@maintainer-s-little-helper maintainer-s-little-helper bot mentioned this pull request Jun 8, 2023
Closed
@aspsk
Copy link
Contributor

aspsk commented Jun 9, 2023

The k8s-1.19-kernel-4.9 and k8s-1.21-kernel-5.4 and k8s-1.23-kernel-4.9 fail with #15455 (there's fix in master: #25323 not yet backported to v1.11)

@aspsk
Copy link
Contributor

aspsk commented Jun 9, 2023

/test-1.19-4.9

@aspsk
Copy link
Contributor

aspsk commented Jun 9, 2023

/test-1.23-4.9

@aspsk
Copy link
Contributor

aspsk commented Jun 9, 2023

/test-1.21-5.4

@aspsk
Copy link
Contributor

aspsk commented Jun 9, 2023

/test-upstream-k8s

@aspsk
Copy link
Contributor

aspsk commented Jun 9, 2023

The same bad news: ci-multicluster-1.11 fails due to complexity

However, can be ignored for now as it should be fixed by #25993 and is not marked as Required

@YutaroHayakawa YutaroHayakawa force-pushed the pr/v1.11-backport-2023-06-08 branch from d8fa43b to cdcf65f Compare June 9, 2023 08:32
jrajahalme and others added 3 commits June 9, 2023 17:36
@jrajahalme @YutaroHayakawa
install: Fail helm if kube-proxy-replacement is not valid
0fdb27d 
[ upstream commit f64e073 ]

[ backporter's note: Removed variables in the Helm templates that don't
  exist on this branch. Also, kubeProxyReplacement=probe is still valid
  in this branch, so I added it to the error condition. ]

Fail helm if kube-proxy-replacement is set or defaults to an invalid value.

kube-proxy-replacement can be defaulted to a deprecated (and since
removed) "probe" value. User can also set it into an incorrect value
explicitly. It is better to fail on helm than cilium agent failing to
start.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
@pchaigno @YutaroHayakawa
ipsec, option: Allow users to disable the IPsec key watcher
805e971 
[ upstream commit a579e9b ]

[ backporter's note: IPSec key duration option doesn't exist on this
  branch, so I removed them. Also, this PR contains the commit to add
  Helm option for ipsec key rotation duration. I talked with an original
  author and dropped that commit since it is accidentally introduced. ]

The IPsec key watcher is used to automatically detect and apply changes
in the key (typically during key rotations). Having this watcher avoids
having to restart the agents to apply the key change.

It can however be desired to only apply the key change when the agent is
restarted. It gives control to the user on when exactly the change
happens. It may also be used as a way to switch from one IPsec
implementation to another (XFRM configs specifically): the user rotates
the key just before the upgrade; on upgrade, the SPI is implicitly used
to distinguish between the old and new implementations as well as the
old and new keys.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
@pchaigno @YutaroHayakawa
helm: Value for enable-ipsec-key-watcher
cdb82a8 
[ upstream commit 3ee2fb7 ]

[ backporter's note: Fixed minor conflict in the Helm template ]

This commit adds a Helm value for the enable-ipsec-key-watcher agent
flag introduced in the previous commit.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>
@YutaroHayakawa YutaroHayakawa force-pushed the pr/v1.11-backport-2023-06-08 branch from cdcf65f to cdb82a8 Compare June 9, 2023 08:37
@YutaroHayakawa
Copy link
Member Author

Fixed the backport error in 0fdb27d. TL;DR: kubeProxyReplacement=probe is still valid in this branch.

@YutaroHayakawa
Copy link
Member Author

/test-backport-1.11

pchaigno
pchaigno approved these changes Jun 9, 2023
View reviewed changes
Copy link
Member

@pchaigno pchaigno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My PR looks good. Thanks!

@YutaroHayakawa
Copy link
Member Author

k8s-1.21-kernel-4.9: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-4.9/45/console

  • Timeout while waiting for VM provisioning. Let me retry.

k8s-1.21-kernel-5.4: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.21-kernel-5.4/28/testReport/junit/Suite-k8s-1/21/K8sDatapathConfig_Transparent_encryption_DirectRouting_Check_connectivity_with_transparent_encryption_and_direct_routing/

  • Concerning error observed. I'll retry to see it is flake or not and check sysdumps as well in parallel.

@YutaroHayakawa
Copy link
Member Author

/test-1.21-4.9

@YutaroHayakawa
Copy link
Member Author

/test-1.21-5.4

@YutaroHayakawa
Copy link
Member Author

For k8s-1.21-kernel-5.4, the same error with exactly the same test case was reported by Tobias last December (#17010 (comment)). Looks like the issue was closed as it did not happen for a while. I'll reopen the issue.

@michi-covalent
Copy link
Contributor

all the required tests passed. merging ✅

@michi-covalent michi-covalent merged commit a8f0b88 into v1.11 Jun 9, 2023
@michi-covalent michi-covalent deleted the pr/v1.11-backport-2023-06-08 branch June 9, 2023 17:26
@michi-covalent michi-covalent mentioned this pull request Jun 14, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pchaigno pchaigno pchaigno approved these changes

@michi-covalent michi-covalent michi-covalent approved these changes

@jrajahalme jrajahalme Awaiting requested review from jrajahalme

@joamaki joamaki Awaiting requested review from joamaki

Assignees
No one assigned
Labels
kind/backports This PR provides functionality previously merged into master.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@YutaroHayakawa @joamaki @aspsk @michi-covalent @pchaigno @jrajahalme