Skip to content

Conversation

giorio94
Copy link
Member

@giorio94 giorio94 commented Jan 7, 2025

The conformance external workloads workflow recently started failing consistently on the v1.15 branch with the following error:

msg="Failed to install iptables rules" error="cannot install static proxy rules: unable to run 'ip6tables -t mangle -A CILIUM_PRE_mangle -m socket --transparent -m mark ! --mark 0x00000e00/0x00000f00 -m mark ! --mark 0x00000800/0x00000f00 -m comment --comment cilium: any->pod redirect proxied traffic to host proxy -j MARK --set-mark 0x00000200' iptables command: exit status 1 stderr="Warning: Extension MARK revision 0 not supported, missing kernel module?\nip6tables: No chain/target/match by that name.\n"" subsys=iptables

This seems to be the consequence of a regression backported by Canonical into linux-image-5.15.0-127-generic. Let's circumvent this problem by upgrading the selected image family, which was now largely out of date.

Related: https://bugs.launchpad.net/ubuntu/+source/linux-meta-oracle-5.15/+bug/2091960

The conformance external workloads workflow recently started failing
consistently on the v1.15 branch with the following error:

> msg="Failed to install iptables rules" error="cannot install static proxy rules:
    unable to run 'ip6tables -t mangle -A CILIUM_PRE_mangle -m socket --transparent
    -m mark ! --mark 0x00000e00/0x00000f00 -m mark ! --mark 0x00000800/0x00000f00
    -m comment --comment cilium: any->pod redirect proxied traffic to host proxy
    -j MARK --set-mark 0x00000200' iptables command: exit status 1 stderr=\"Warning:
    Extension MARK revision 0 not supported, missing kernel module?\\nip6tables:
    No chain/target/match by that name.\\n\"" subsys=iptables

This seems to be the consequence of a regression backported by Canonical
into linux-image-5.15.0-127-generic. Let's circumvent this problem by
upgrading the selected image family, which was now largely out of date.

Related: https://bugs.launchpad.net/ubuntu/+source/linux-meta-oracle-5.15/+bug/2091960
Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
@giorio94 giorio94 added area/CI Continuous Integration testing issue or flake release-note/ci This PR makes changes to the CI. labels Jan 7, 2025
@giorio94 giorio94 requested review from a team as code owners January 7, 2025 10:36
@giorio94 giorio94 requested a review from brlbil January 7, 2025 10:36
@maintainer-s-little-helper maintainer-s-little-helper bot added backport/1.15 This PR represents a backport for Cilium 1.15.x of a PR that was merged to main. kind/backports This PR provides functionality previously merged into master. labels Jan 7, 2025
@giorio94
Copy link
Member Author

giorio94 commented Jan 7, 2025

/test

@julianwiedmann
Copy link
Member

Just for the record, it looks the fix is in the pipeline: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2091990

But ack that this is also good signal to move to a newer version :)

@giorio94
Copy link
Member Author

giorio94 commented Jan 7, 2025

But ack that this is also good signal to move to a newer version :)

Yeah, 20.04 feels unnecessarily old at this point, especially considering that we are not actually targeting a specific kernel version in this test. If everything works fine, I'm planning to forward-port this change to newer branches as well.

Copy link
Member

@sayboras sayboras left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot

@sayboras sayboras merged commit 91f0f9b into v1.15 Jan 7, 2025
72 checks passed
@sayboras sayboras deleted the pr/giorio94/v1.15/gha-external-workloads-bump-image branch January 7, 2025 11:09
@sayboras sayboras mentioned this pull request Jan 7, 2025
3 tasks
@giorio94 giorio94 changed the title gha: bump ubuntu version in conformance-externalworkloads [v1.15] gha: bump ubuntu version in conformance-externalworkloads Jan 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/CI Continuous Integration testing issue or flake backport/1.15 This PR represents a backport for Cilium 1.15.x of a PR that was merged to main. kind/backports This PR provides functionality previously merged into master. release-note/ci This PR makes changes to the CI.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants