[ upstream commit ea9d3c6 ]

#32799 changed the error message,
adjust the documentation.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit ed34095 ]

Signed-off-by: Gilberto Bertin <jibi@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit abdaddc ]

When redirecting from a L3 device to the overlay interface, we need to
manually add a L2 header to the (inner) packet.

#33421 fixed this for the case of
Nodeport NAT traffic from the LB node to a backend. Generalize it so
that it helps all users of the nodeport_add_tunnel_encap() helper - for
example DSR-Geneve or EgressGW reply traffic.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit 677bcc1 ]

Validate that the from-netdev program adds a L2 header to the packet,
before redirecting it to the overlay interface.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit a26427b ]

This is to avoid the below failure while chmod-ing symlink.

```
chmod: cannot operate on dangling symlink '/usr/local/bin/now'
```

Sample run: https://github.com/cilium/cilium/actions/runs/11343796440/job/31547213730?pr=35397

Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit e08929b ]

The jq flag 'argfile' has been removed. The solution is
to use slurpfile instead.

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit 63cd391 ]

This package was added in 7a301a4 ("introduce ARM github workflows")
and it's no longer being used so we can remove it as it's not available
in ubuntu-latest (24.04).

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit 8549f07 ]

Properly inherit listener name and priority from the L3-wildcard rule to
L3 rule when auth types are different between them.

Fixes: #26331

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit 2c40eb1 ]

As multiple services can share the same VIP (e.g. using
lbipam.cilium.io/sharing-key), the service reconciliation logic
needs to be adapted to not withdraw a route to VIP that is
still in use by some other service.
To address that, this change introduces resource reference
counting by reconciling service advertisements.
This fix is specific to BGPv1 service reconciliation only.

Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit b3a3108 ]

Updates the BGPv1 advertisement tests to test a case where
multiple services share the same LoadBalancer VIP.

Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>
Signed-off-by: Tobias Klauser <tobias@cilium.io>

[ upstream commit f269eee ]

It is useful to keep the image digests as long as possible, thus this
commit removes the retention period of 10 days.

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>