/test

Since commit 9c1031e ("bpf: fix missing ipv6 ct entry for snated traffic"), IPv6 BPF masquerading and the host firewall are compatible in the datapath. Let's allow them to be used together, and use the combination in tests.

From what I remember in #23165, we were concerned about HostFW and IPv6 BPF Masq interacting.

But turns out the problematic interaction was for HostFW and iptables Masquerading (ie. when BPF Masq is disabled). This is what #28813 fixed. So afaik there were no actual problems for HostFW and IPv6 BPF Masq, and 👍 on allowing this combo.

We could even backport, but at this point I don't see the need.

Hey @qmonnet @julianwiedmann , would it be possible to backport this to 1.15? We're currently facing problems when upgrading from a custom build image (based on 1.15.6 with this fix in it) to 1.16.

@sebastiangaiser This is not something that we expect to backport at the moment (see the backport criteria). I don't remember testing IPv6 masquerading with the Host Firewall on v1.15 so I'm not super keen.

What's your problem, and how would backporting to 1.15 solve it (considering you already have this commit in your own image, from what I understand)?

@qmonnet thank you for your answer. We're facing level=fatal msg="IPv6 BPF masquerade is not supported along with the host firewall." subsys=daemon since 1.15.6. So we decided to build our own image with this fix in it and hoped that it would get fixed in a later 1.15 version. After that, 1.16 was released which fixed the ipv6 masquerade problem but caused other issues for us. IIRC upgrades from one minor to the next are tested and supported only from the latest patch version which we try to do here.
So backporting this would allow us to follow that process.
I hope this was not written in an unmeaning full way.

Thank you, I see, but I'm still reluctant to backporting a new feature (or even the possibility to activate it) on v1.15. Given that you based your workflow on custom images, you're “outside” of the regular support path, and it's hard to justify making an exception here. How hard would it be to carry on the commit to a custom image based on the latest 1.15 release on your side? From there you should be able to move on to 1.16?