Skip to content

Conversation

qmonnet
Copy link
Member

@qmonnet qmonnet commented Nov 6, 2023

Related to

Once this PR is merged, you can update the PR labels via:

for pr in 27977 28016 29072 28815; do contrib/backporting/set-labels.py $pr done 1.13; done

or with

make add-labels BRANCH=v1.13 ISSUES=27977,28016,29072,28815

@qmonnet qmonnet added kind/backports This PR provides functionality previously merged into master. area/CI-improvement Topic or proposal to improve the Continuous Integration workflow area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. release-note/ci This PR makes changes to the CI. backport/1.13 labels Nov 6, 2023
@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch 2 times, most recently from bd42c3d to 1e28ee1 Compare November 9, 2023 13:06
@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch from 1e28ee1 to b0e2969 Compare November 16, 2023 17:21
@qmonnet
Copy link
Member Author

qmonnet commented Nov 16, 2023

/test-backport-1.13

@qmonnet
Copy link
Member Author

qmonnet commented Nov 16, 2023

/ci-ipsec-upgrade

@qmonnet
Copy link
Member Author

qmonnet commented Nov 20, 2023

Tests fail when upgrading from either minor or patch version on bpf-next, but I understand this has been the case before this PR. Other tests passed.

I need to rebase this one now that 751b7c4 was merged.

@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch from b0e2969 to f912898 Compare November 20, 2023 13:26
@qmonnet
Copy link
Member Author

qmonnet commented Nov 20, 2023

/test-backport-1.13

Job 'Cilium-PR-K8s-1.23-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathConfig MonitorAggregation Checks that monitor aggregation restricts notifications

Failure Output

FAIL: Error creating resource /home/jenkins/workspace/Cilium-PR-K8s-1.23-kernel-4.19/src/github.com/cilium/cilium/test/k8s/manifests/l3-policy-demo.yaml: Cannot retrieve cilium pod cilium-jl4vb policy revision: cannot get the revision 

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.23-kernel-4.19/468/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.23-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

@qmonnet
Copy link
Member Author

qmonnet commented Nov 20, 2023

/ci-ipsec-upgrade

@qmonnet qmonnet requested a review from brb November 20, 2023 13:26
@qmonnet qmonnet marked this pull request as ready for review November 20, 2023 13:26
@qmonnet qmonnet requested review from a team as code owners November 20, 2023 13:26
@qmonnet
Copy link
Member Author

qmonnet commented Nov 20, 2023

/test-1.24-4.19

@pchaigno pchaigno self-requested a review November 20, 2023 22:28
@qmonnet qmonnet removed the request for review from viktor-kurchenko November 22, 2023 09:58
@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch from f912898 to b3cbe89 Compare November 22, 2023 10:04
@qmonnet
Copy link
Member Author

qmonnet commented Nov 22, 2023

Incremental diff
diff --git a/.github/workflows/tests-ipsec-upgrade.yaml b/.github/workflows/tests-ipsec-upgrade.yaml
index f4bd133140ea..3132c58ae04b 100644
--- a/.github/workflows/tests-ipsec-upgrade.yaml
+++ b/.github/workflows/tests-ipsec-upgrade.yaml
@@ -272,7 +272,6 @@ jobs:
             mkdir -p cilium-junits
 
       - name: Wait for images to be available
-        if: ${{ matrix.mode != 'patch' }}
         timeout-minutes: 30
         shell: bash
         run: |

Motivation

/test-backport-1.13

@qmonnet
Copy link
Member Author

qmonnet commented Nov 22, 2023

/ci-ipsec-upgrade

Copy link
Member

@brb brb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My changes LGTM, thanks.

@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch from b3cbe89 to afb94d4 Compare November 22, 2023 15:06
@qmonnet
Copy link
Member Author

qmonnet commented Nov 22, 2023

/test-1.26-net-next

@qmonnet
Copy link
Member Author

qmonnet commented Nov 23, 2023

Failures on bpf-next are expected to be fixed with #29227.

Copy link
Contributor

@lmb lmb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎩

Copy link
Member

@pchaigno pchaigno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

net-next should now be fixed, so probably worth rebasing to ensure CI passes. Might also be worth updating the commits here with references to the now-merged upstream commits.

@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Nov 24, 2023
@pchaigno pchaigno added dont-merge/bad-bot To prevent MLH from marking ready-to-merge. and removed ready-to-merge This PR has passed all tests and received consensus from code owners to merge. labels Nov 24, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Nov 24, 2023
@pchaigno pchaigno removed the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Nov 24, 2023
[ upstream commit d51a932 ]

- Add a script to get the Cilium version to downgrade to instead of
  hardcoding it in the workflow file. The script uses the top-level
  VERSION file to infer the previous version.
- Check out the git branch to get the Helm chart instead of doing a wget
  to download the source archive.

Signed-off-by: Michi Mutsuzaki <michi@isovalent.com>
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch from afb94d4 to a413309 Compare November 27, 2023 13:41
@qmonnet
Copy link
Member Author

qmonnet commented Nov 27, 2023

/test-backport-1.13

@qmonnet qmonnet removed the dont-merge/bad-bot To prevent MLH from marking ready-to-merge. label Nov 27, 2023
qmonnet and others added 6 commits November 27, 2023 13:46
[ upstream commit 56dfec2 ]

Script contrib/scripts/print-downgrade-version.sh is used to derive the
name of the previous stable branch, based on the current version number
found in the repository. This is useful for testing upgrades and
dowgrades in CI, between the current branch and the previous stable
branch.

For some tests we need to perform similar checks between the current tip
of a branch and the latest patch release on the branch. For example,
when working on branch 1.14, we want to downgrade to the latest patch
release, 1.14.3 at this time, then upgrade back to the tip of 1.14. On
the main branch, this is not relevant, because we don't usually have
patch releases on that branch.

The current commit updates print-downgrade-version.sh to add support for
patch releases. When a user pass "patch" as first argument to the patch,
then instead of decrementing the minor version by one, the script
decrements the patch release number by one, and prints the results.

When the patch release number is 0 (new minor release) or 90 (release
preparation), the script returns an error, because it is non-trivial to
find the preceding patch release number in such cases (at least without
Git and the Git history). From the workflow's perspective (for
supporting upgrades from patch releases in a follow-up commit), for new
minor releases, update/downgrade is already covered in this case by
working with the previous stable branch; and for 90, we just don't have
an easy way to retrieve the previous number. We make the script print
errors on stderr, in order to make it easier to compare the string
returned on stdout (empty in case of error).

Some examples of numbers from VERSION and the corresponding values
returned:

    VERSION         Previous minor  Previous patch release

    1.14.3          v1.13           v1.14.2
    1.14.1          v1.13           v1.14.0
    1.14.0          v1.13           <error>
    1.14.1-dev      v1.13           v1.14.0
    1.15.0-dev      v1.14           <error>
    1.13.90         v1.12           <error>

In order to test the script easily, this commit also allows setting
$VERSION from the command line, defaulting to the content of file
VERSION if no value is provided.

Let's also add the errexit and nounset options to the script.

Signed-off-by: Quentin Monnet <quentin@isovalent.com>
[ upstream commit 31afd02 ]

Previously cilium-config action always generates helm-set flags for
image settings, but in some cases we can just rely on Chart.yaml since
we always set chart-dir. This helps when:

1. We want to install release version instead of ci version. Currently
   cilium-config action sets `cilium-ci` unconditionally.
2. We have complicated image tag requirements such as `v1.14.1-beta.1`.

[ Backport note: Addressed minor conflicts. ]

Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
[ upstream commit 502bbc7 ]

[1] changed the upgrade path from "v1.14 (branch tip) -> main -> v1.14
(branch tip)" to "v1.14.x (last release) -> main -> v1.14.x (last
release)". The downside of the former path is that we catch any
upgrade/downgrade regressions only after a release.

This commit brings back the previous path.

[1]: 31afd02

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
[ upstream commit ced884f ]

The downgrade is still affected [1].

[1]: #26739 (comment)

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
[ upstream commit ed59edc ]

Currently, we test upgrades and downgrades for IPsec against the
previous stable branch, for example:

    - On main branch (v1.15-dev):
            v1.14 (branch tip) -> main (PR HEAD) -> v1.14 (branch tip)

    - On older stable branches:
            v1.13 (branch tip) -> v1.14 (PR HEAD) -> v1.13 (branch tip)

For stable branches, this commit adds support for testing upgrades and
downgrades against the latest patch release as well, for example:

    - On v1.14:
            v1.14.4 (tag) -> v1.14 (PR HEAD) -> v1.14.4 (tag)

The workflow currently fails on the main branch (this case is covered by
the upgrade/downgrade test to the previous stable branch already). This
is addressed by skipping most of the steps on main branch, in a
follow-up commit.

Signed-off-by: Quentin Monnet <quentin@isovalent.com>
[ upstream commit c9dedb4 ]

Skip upgrade/downgrade test to patch release when we fail to retrieve
the number for the previous patch release. This happens mostly for the
main branch (where testing upgrades/downgrades is covered by the tests
to the previous stable (minor) release already). This may also happen on
top of release preparation commits, where we set the patch number to 90,
and where it is non-trivial to retrieve the previous patch release
number. This case doesn't matter much, because commits for preparing
releases are Not Expected To Break IPsec (TM).

Signed-off-by: Quentin Monnet <quentin@isovalent.com>
@qmonnet qmonnet force-pushed the pr/qmonnet/ipsec-patch-release-update_1.13 branch from a413309 to dd6090a Compare November 27, 2023 13:46
@qmonnet
Copy link
Member Author

qmonnet commented Nov 27, 2023

/test-backport-1.13

@qmonnet
Copy link
Member Author

qmonnet commented Nov 27, 2023

/test-1.18-4.19

@qmonnet
Copy link
Member Author

qmonnet commented Nov 27, 2023

/test-1.23-4.19

@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Nov 27, 2023
@youngnick youngnick merged commit 1193c98 into v1.13 Nov 28, 2023
@youngnick youngnick deleted the pr/qmonnet/ipsec-patch-release-update_1.13 branch November 28, 2023 03:22
@youngnick youngnick mentioned this pull request Nov 28, 2023
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/CI-improvement Topic or proposal to improve the Continuous Integration workflow area/encryption Impacts encryption support such as IPSec, WireGuard, or kTLS. kind/backports This PR provides functionality previously merged into master. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/ci This PR makes changes to the CI.
Projects
No open projects
Status: Released
Development

Successfully merging this pull request may close these issues.

7 participants