🚀 Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @youngnick; cilium/cilium#46827, cilium/cilium#47274, @arybolovlev)
👥 Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)
🔏 Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)
🔀 TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @eminaktas; cilium/cilium#4
## Cilium Feature Proposal Thanks for taking time to make a feature proposal for Cilium! If you have usage questions, please try the [slack channel](https://slack.cilium.io) and see the [FAQ](https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is:issue+label:kind/question+) first. Is your proposed feature related to a problem? The Kubernetes community i
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? By default the following policy will block traffic from pods in the `some-ns` namespace to nodes. That's because CIDR policies by default do not match node IPs and the policy below enables an im
Netlink is not reliable protocol, and recv without a timeout might block infinitely. See https://github.com/cilium/cilium/issues/14710 and https://github.com/cilium/cilium/issues/14746#issuecomment-781811881 for more ctx. The Go's stdlib `net.Interface*()` function family when built for Linux (https://github.com/golang/go/blob/master/src/net/interface_linux.
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? Upgrading from 1.19.6 to 1.20.0 on EKS with ENI IPAM, every `cilium-agent` pod `CrashLoopBackOff`s at startup: ``` level=fatal msg="Configured native routing CIDR does not overlap VPC CIDR" modu
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.18.5 and lower than v1.19.0 ### What happened? When using Gateway API with L7LB services, hairpin traffic from cluster-internal workloads (e.g., uptime-kuma self-monitoring) to gateway endpoints is intermittently denied by Envoy with "403 Ac
``` Even when BPF Host Routing is disabled (and we only have ENABLE_ROUTING), a local pod-to-pod delivery via the pod's ingress policy tailcall can *always* use bpf_redirect_peer() to push the packet into the pod netns. This is preferable to a plain bpf_redirect() + veth traversal. In order to allow this, slightly refactor the should_redirect_peer() helper.
ENI IPAM checks ipv4NativeRoutingCIDR against the VPC primary CIDR only. Pod subnets in a secondary CIDR association are rejected and every agent crash-loops on startup, with no way to disable the check. - Derive the secondary CIDR associations alongside the primary CIDR - Accept if the configured CIDR overlaps any of them; fatal only when none match - Subne
struct SockRevNat* is simply binary unmarshalled from ebpf map and seems to be read-only in agent, so I just keep Port network byte order Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All comm
- [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.4 and lower than v1.20.0 ### What happened? We use Cilium as standalone lb. in some cases, when we remove backends from the json state file, Cilium doesn't remove it from services ### How can we reproduce the issue? 1. Run cilium with opt
<!-- Description of change --> Add support of HTTP CONNECT method for L7 policies. Fixes: #24276 ```release-note envoy: Add support for HTTP CONNECT ``` AI disclosure: testing code was developed with LLM assistance, but i fully understand and stand by the code.
Consider scenarios where an established TCP connection switches to (a) [different backend](https://github.com/cilium/cilium/blob/d376efb53dd51c8355851ca8ddbec399bc5205f9/bpf/lib/lb.h#L2303), or (b) gets ECMP-routed through a different LB node. As we currently only send the DSR-info on the TCP-SYN packet, the newly selected backend has no way of replying with
using statedb to manage the agent state for devices removed the map based state tracking for allocations, replacing it with a statedb table cilium-dbg output: ``` -- [ { "Name": "dummy0", "Manager": "\"dummy\"", "Dev": { "Name": "dummy0", "HWAddr": "", "MTU": 0, "Flags": "" }, "Pool": "dt-dummy", "Attrs": [ { "k": "ifName", "v": { "string": "dummy0" } }, { "
In the current context, Cilium native routing mode with ebpf host routing only uses a single NIC. This patch intends to leverage on multiple NICs to aggregate throughput. In my understanding, there were two issues previously. Firstly, ENABLE_SKIP_FIB bypassed bpf_fib_lookup() entirely — fib_redirect_v4(), fib_redirect_v6(), and fib_redirect() would skip the
Fixes #44348 ## Description `sock4_skip_xlate()` / `sock6_skip_xlate()` reject ExternalIPs whose ipcache identity is not `HOST_ID`. That check is the MITM mitigation against arbitrary remote endpoints claiming a service ExternalIP. L2-announced ExternalIPs (`CiliumL2AnnouncementPolicy`) are added to the selected leader node's primary interface so the kernel
When the host firewall is enabled but the IPv6 datapath is compiled out (`enable-ipv6=false`), bpf_host drops all IPv6 packets on managed devices as `DROP_UNKNOWN_L3` ("Unsupported L3 protocol") — in both directions and before any policy evaluation. This breaks IPv6 neighbor discovery for the node and, with it, any node-level IPv6 connectivity, e.g. BGP unnu
## Description Under transparent DNS proxy mode (`dnsproxy-enable-transparent-mode: true`), the proxy binds upstream UDP sockets to the originating pod's `srcIP:srcPort`. Two bugs cause `EADDRINUSE` errors that cascade into DNS failures. ### Bug 1: kernel scheduling gap on port release When a `SharedClient` closes (refcount reaches zero), `conn.Close()` is c
Migrate the functions exposed from the k8s package to use the ClusterInfo struct to depends less on the legacy config. Sorry for the many codeowners involved, those k8s functions are called in a bunch of places unfortunately :sweat_smile:. I prepared this commit using AIL-2
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? I experimented with using ExternalAuth to protect a HTTPRoute with Authentik forward auth. While setting that up, I noticed that the route seems to effectively ignore the ExternalAuth filter whe
This is the route installation piece of Hybrid Routing [CFP](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-32810-hybrid-routing-mode.md), building on the prior parts that introduced the subnet BPF map + statedb table, the topology decoder, and the regeneration fence. What this PR adds 1. Subnet table wiring - linuxNodeHandler now takes the state
This is the datapath part of #44027. Cilium publishes demand, holds new connections while a service is cold, and an external autoscaler does the scaling. A service opts in with `service.cilium.io/scale-to-zero`. Cilium then exports a per-service gauge, `cilium_scale_to_zero_service_demand`, that an autoscaler such as KEDA reads to scale the workload to and f
This PR makes DNS redirection to the proxy for FQDN network policies configurable and automatic, replacing hardcoded rules and manual configurations. Summary of Changes - Added new flags to specify how to locate DNS servers in the cluster (via namespace/pod labels, a list of IP addresses, or a custom port). - Implemented GetFQDNPolicyDNSSelectors (with tests
The Go stdlib `net.Interface*` family talks to the kernel over a netlink socket with no timeout, so it can block forever. This PR converts the two remaining offenders to `netlink/safenetlink` and add a forbidigo rule so new ones don't creep back in. Fixes: #15051
There isn't currently an explicit mention of how cluster mesh affects the threat/security model of cilium. To clarify the assumptions the code already makes, make it explicit that there isn't a security boundary between clusters once meshed. We can think about "improving"/hardening, but fundamentally I do not believe it to be possible to fully withstand an a
The full set of BPF tests has become painfully slow to run as we add more tests. For example locally on my machine: ``` $ make -C bpf/ clean $ make -C bpf/tests clean $ time make run_bpf_tests [...] ┌──────────────────────────────────────────────────────────────────────────────────────────────┐ │ STATUS │ ELAPSED │ PACKAGE │ COVER │ PASS │ FAIL │ SKIP │ │───
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version v1.18.6 ### What happened? After bouncing cilium on a k8s `Node`, I get duplicate bpf programs create for the same `tc.name`: ``` # bpftool -j net show dev eth5 | jq [ { "xdp": [], "tc": [ { "devname": "eth5", "ifindex": 27, "kind": "tcx/ingress", "name": "cil_from
<!-- Description of change --> Move the `LocalNodeWatcher` from `pkg/hubble/observer` into `pkg/hubble/parser` and inject it into the `PayloadParser` to populate `node_labels` and `NodeName` during flow parsing, rather than via observer hooks - Add a `Run` method for lifecycle management via `job.OneShot` - Set `node_labels` and `NodeName` at the two flow pa
- [ ] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: <c
Under heavy outbound egress traffic, pods undergoing BPF masquerading can experience SNAT port exhaustion when restricted to the standard port range (`32768-65535`). This is a particular concern for users migrating from Kubernetes ip-masq-agent to Cilium eBPF masquerade, because the two have different default source port ranges: - Cilium eBPF masquerade sele
<!-- Description of change --> As noted in #47456, the node addresses all get added when hostNetwork is enabled. If a user enables Cilium + GWAPI with hostnetwork enabled and labels a node or nodes, then only those address should populate the gateway ip address. Adding in test case to ensure functionality Fixes: #47456 ```release-note gateway-api: node label
<!-- Description of change --> Fixes: #47740 ```release-note envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. ``` Changes: * Helm chart accepts a value of `0` for `envoy.httpUpstreamLingerTimeout` * Helm chart templates value of `0` into configmap cc @jrajahalme [AI Influence Level]: https://danielmiessler.com/blog/a
This is a small quality-of-life improvement for contributors working on the documentation on macOS. The alternative is to document a workaround, but that would require contributors to provide additional tar configuration manually. When `make render-docs` runs on macOS, BSD tar records the host-specific UID and GID in the Docker build context. These values ca
The endpoint policy debug logging assumes that the `policyDebugLog` field is set unconditionally. However, we didn't set the field when restoring the endpoint from JSON, leading to nil pointer exceptions when verbose policy logging was enabled. Prepared using AIL:2 - had AI analyze the stack trace and implemented the fix myself. The test is AI generated thou
We're on regular basis now encountering the situation where we would like to be able to fetch and watch information about individual Cilium nodes in the agent. Currently this requires implementing a `node.Handler` and subscribing with the `NodeManager` which is fair bit of boilerplate and annoying to test. It's even worse if all the rest of the code is inter
In ENI IPAM mode with `eni.subnetTagsFilter` set, a full ENI resync calls `DescribeNetworkInterfaces` and replaces the operator's entire instance cache with the ENIs discovered in the pod subnets. During a large scale-up, a freshly launched node whose pod subnet ENI has not been attached yet is not represented in that refreshed cache. Once the node disappear
Add a StateDB table for Cilium-managed endpoint metadata. The table is populated from CEP/CES resources and kvstore IPIdentityPair updates, and it stores per-producer source assertions so doublewrite mode can merge equivalent CRD/CES and kvstore entries without guessing by IP, identity, or labels. Kvstore IPIdentityPair metadata now carries the CEP name writ
# What is this This PR fixes three issues with IPv6 on ENI. 1. Fixes a bug where if the health check endpoint IP is an IPv6, the ENI specific routing for IPv6 would not be configured. This removes this limitation by filling the routing table for IPv6 health endpoints. 2. When IPSec is enabled on EKS, the pod subnets are determined using the routing info CIDR
Policy CIDR identities are shared across namespaces via a single consolidated ipcache metadata entry, guarded only by `prefixRefCounter`. The counter was keyed by the *raw* prefix from the update, while the metadata store keys entries by the *canonical* (masked, unmapped) prefix. This mismatch lets one namespace's policy deletion release a CIDR identity that
Add a merge_group trigger and update the concurrency group to match other lint workflows such as lint-go.yaml. Fixes: #47262 Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a
- [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: <c
`cilium connectivity perf` always reports "Cilium version: 0.0.0" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is ther
`LookupRegisteredEndpoint` reported a lookup miss as (nil, false, nil). The shared `ServeDNS` caller only inspects the returned error before using the endpoint, so it dereferenced the nil endpoint and panicked the whole proxy: ``` panic: runtime error: invalid memory address or nil pointer dereference github.com/cilium/cilium/pkg/endpoint.(*Endpoint).StringI
## Description `EnqueueRequestForBackendService` lists TLSRoutes immediately after HTTPRoutes, and the error path of the TLSRoute call was copied from the HTTPRoute one above it without changing the message. A failure to list TLSRoutes is reported as `Failed to get related HTTPRoutes`, which points anyone reading the log at the wrong index and the wrong CRD.
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
Decoupled BGP CP cell from the common daemon infra, moved bgp config flags from the common DaemonConfig to BGPConfig. Fixes: #45352 Signed-off-by: Dmytro Vachaiev <dvachaev@gmail.com>