[ upstream commit c321f90 ]

[ backporter's notes: manually resolved conflict in skipped features ]

Looking at #24622 this should now
be fixed.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>

[ upstream commit ed34095 ]

Signed-off-by: Gilberto Bertin <jibi@cilium.io>
Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>

[ upstream commit abdaddc ]

When redirecting from a L3 device to the overlay interface, we need to
manually add a L2 header to the (inner) packet.

#33421 fixed this for the case of
Nodeport NAT traffic from the LB node to a backend. Generalize it so
that it helps all users of the nodeport_add_tunnel_encap() helper - for
example DSR-Geneve or EgressGW reply traffic.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>

[ upstream commit 677bcc1 ]

Validate that the from-netdev program adds a L2 header to the packet,
before redirecting it to the overlay interface.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>

[ upstream commit 8190512 ]

This commit changes the builder image for cilium-operator to be the
cilium-builder image, rather than the golang image. This change will
allow for arm64 builds of the cilium-operator to be built with CGO
enabled due to the cilium-builder image containing multi-platform C
compilers. This build configuration is a stepping stone for other
build-time features, such as CGO binaries with race detection enabled.

Fixes: 35324

Signed-off-by: Ryan Drew <ryan.drew@isovalent.com>
Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>

[ upstream commit a55178f ]

[ backporter's notes:
  * fixed MTU argument to ReinstallRoutingRules in pkg/datapath/loader/base.go
  * resolved trivial conflict in Proxy interface in pkg/datapath/types/loader.go
]

This commit fixes the pod-to-pod traffic being dropped because of using a
higher MTU value. This is caused by a non-configuration of the default route
from proxy, in the routing table n. 2005 respectively. While the pod-to-pod
default route MTU is being adjusted according to the IPSec overhead and the
adjusted size of the authentication key, the from-proxy route is not changed
as well leading to connectivity issues when both ingress and egress policies
are in-place.

Fixes: #33168

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

[ upstream commit 3ccd76a ]

[ backporter's notes: resolved imports conflicts in pkg/proxy/routes_test.go ]

This commit extends the routes tests to check that, according to the previous
commit, the default route in the table 2005 is correctly installed with the
provided MTU. This is particularly useful as when enabling both ingress
and egress policies with IPSec, the default route has a lower MTU since
it needs to account also for the encryption overhead.
With this commit, in the tests we make sure that, when provided, the correct
value is used rather than the default one.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

[ upstream commit a4da426 ]

Tunnel routing support for the XDP LB was added back in v1.14, update
the docs. This was missed in #27091.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>