NodeMapV2: Introduce a V2 of the NodeMap which includes SPI values #31431
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7da59a0 to
13ef906
Compare
13ef906 to
761f226
Compare
dylandreimerink
approved these changes
Mar 25, 2024
f80d978 to
1493c34
Compare
pchaigno
approved these changes
Apr 3, 2024
|
@ldelossa I've labeled the PR according to our Slack discussion. |
|
After some further conversation with community team, we wont be back porting this into v1.15. |
7e0a51d to
c42eff2
Compare
|
/test |
This commit updates all references of NodeMap to NodeMapV2. The restoration of the NodeMapV2 is updated to take account of nodemap.NodeValueV2. The NodeMapV2 is now loaded with SPI values on (initial) NodeUpdates, supplying the SPI to the datapath. Tests are updated as well. Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com>
This commit adds a migration when the v1 NodeMap is detected. The migration first opens the ENCRYPT_MAP to obtain the local SPI. This SPI will be the same for all nodes as long as a key rotation is not occurring during an upgrade. Which should never occur. The values from the V1 map is then migrated to the V2 map and the SPI retrieved from the ENCRYPT_MAP is applied to all migrated values. The migrated map is then unpinned from bpffs after a successful migration. This migration is kicked off within the NodeMap's Cell onStart hook which should ensure it runs before the map is utilized by other Cilium components. Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com>
This commits updates the cilium-dbg command to list the SPI value of NodeMapV2's entries. Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com>
c42eff2 to
88316a6
Compare
|
/test |
Ah, I think that's now fully handled by the "mirror write" in |
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Mar 18, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Mar 18, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
Mar 26, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
May 28, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
May 28, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
May 28, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
julianwiedmann
added a commit
to julianwiedmann/cilium
that referenced
this pull request
May 28, 2025
cilium#31431 introduced v2 of the nodemap, and as of v1.16 the datapath only uses this v2 map. Hence it's safe to remove the agent logic that was still populating the v1 map. Fixes: cilium#34670 Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request adds a new V2 addition to the NodeMap.
The NodeMap is responsible for inventorying and restoration of allocated NodeIDs which are subsequently used to correctly match XFRM policies and states given the ultimate destination of IPSec encrypted traffic.
The v2 edition of NodeMap now associates each node entry with their SPI which is also used to correctly match XFRM policies and states given the ultimate destination of IPSec encrypted traffic.
However, by providing the SPI in NodeMap we can now query the SPI value associated with a Cilium managed node. Prior to this we could only query SPI on a per-pod basis.
This ability becomes especially useful when combined with the Encrypted Overlay feature, and provides us a way to retrieve SPI when only the destination Node address is obtainable, as opposed to the destination pod's address.
This PR includes an upgrade migration which will copy v1 map entries into the v2 map and fill in the current SPI.
This migration works on the assumption that the cluster has a stable SPI and no pending key rotation is occurring during the migration (Cilium upgrade in other words).
It is best to review this PR one commit at a time.