• datapath,endpoint: explicitly remove TC filters during endpoint teardown #32167 (@ti-mo) ⚠️ resolved conflicts
  • No removing of TCX hooks in Loader.Unload, as v1.14 does not need to support downgrading from v1.16. This basically means that this part here is not backported:

    cilium/pkg/datapath/loader/loader.go

    Lines 670 to 683 in a6fab19

    	// If Cilium and the kernel support tcx to attach TC programs to the
    	// endpoint's veth device, its bpf_link object is pinned to a per-endpoint
    	// bpffs directory. When the endpoint gets deleted, we can remove the whole
    	// directory to clean up any leftover pinned links and maps.
    	// Remove the links directory first to avoid removing program arrays before
    	// the entrypoints are detached.
    	if err := bpf.Remove(bpffsEndpointLinksDir(bpf.CiliumPath(), ep)); err != nil {
    	log.WithError(err)
    	}
    	// Finally, remove the endpoint's top-level directory.
    	if err := bpf.Remove(bpffsEndpointDir(bpf.CiliumPath(), ep)); err != nil {
    	log.WithError(err)
    	}

  • Fixed conflicts in pkg/endpoint/endpoint.go due to the fact that v1.14 uses !option.Config.DryMode rather than
    !e.isProperty(PropertyFakeEndpoint)
  • Minor conflicts in Endpoint.deleteMaps due to BW manager map removal logic being slightly different.
  • Minor conflicts due to bpf.RemoveTCFilters being an exported function in v1.14 (where as it it private in v1.15+).

Once this PR is merged, a GitHub action will update the labels of these PRs:

 32167