[ upstream commit 603d505 ]

Match what we do for Cilium's Wireguard traffic that passes through
the to-netdev program on a native device.

Also clean up some whitespace damage while at it.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 6c39d72 ]

GAMMA is solely used for E-W traffic, hence the original source address
should be set. This will help to simplify the network policies as the
intermediate reserved:ingress will not be considered as compared to N-S
traffic.

Co-authored-by: Liyi Huang <liyi.huang@isovalent.com>
Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 2d8769d ]
[ backporter's note: fixed minor conflict due to missing slog changes ]

Since 7b92700 and e9438c2, egress policy programs are inserted
unconditionally, even when the L7 proxy is disabled. Unfortunately, the
teardown logic only runs when the proxy is enabled, causing all
handle_policy_egress programs to leak.

Double unfortunately, since this program doesn't reference any Cilium maps in
its attached-but-disabled state (it's an empty program), it doesn't show up in
Cilium's maps metrics, making the issue hard to spot. The latter is being
addressed in #39557.

This commit makes the removal unconditional, since the attachment is
also unconditional. I've decided against making both attachment and detachment
conditional, since that would still cause orphaned programs if the l7 proxy
was disabled on a running cluster. Endpoint teardown should always attempt to
remove all known policy programs for robustness.

Signed-off-by: Timo Beckers <timo@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit 51a87eb ]

Use `hubble.metrics.tls` instead of `hubble.tls` when setting the
hubble-metrics-tls projected secret source name in daemonset
helm template.

Signed-off-by: Alexandre Barone <abalexandrebarone@gmail.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>

[ upstream commit d09069d ]

When running the connectivity tests with the `conn-disrupt-test-check`
action, the concurrency needs to be expressed through a parameter to that
action. Otherwise it defaults to 1.

This fixes breakage from
23f5a36 ("github: conn-disrupt: add test-concurrency parameter").

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Signed-off-by: Jussi Maki <jussi@isovalent.com>