🚀 Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @youngnick; cilium/cilium#46827, cilium/cilium#47274, @arybolovlev)
👥 Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)
🔏 Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)
🔀 TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @eminaktas; cilium/cilium#4
Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
This reverts commit c215742d866ef342303dcf224db69b29565c8885. The reverted commit removed the installation of LLVM and Clang from the integration tests workflow, under the assumption that they are not needed to run the Go based integration tests. However, it turns out that the TestObjectCache{,Parallel} tests actually invoke the compilation of a BPF program.
Integration test runs timed out due to a deadlock on shutting down the hive. When both queues are empty _and shutting down_ a `getQueue` call could get stuck waiting on the condition variable which was never broadcasted. AIL:2 - AI investigated CI logs and pointed towards the problem, I wrote the code. ```release-note Fix a deadlock in the shutdown of Cilium
The service export sync logic incorrectly finish the syncing process early when we weren't able to find the CRDs which could affect both CRD upgrade when the clustermesh-apiserver new version start before the cilium-operator had a chance to finish upgrading the CRDs or when enabling MCS-API on a running cluster with a similar configuration. This commit fixes
This PR ensures we correctly calculate the length of label selectors when doing validation, ensuring we support all valid kubernetes labels. See commit messages for more information. Also add a test to catch a potential regression. Fixes: #47817 ```release-note Fix bug causing policies using label selectors of long namespace labels being dropped ``` AIL 2/3:
Bumping cilium Envoy image to include the "ADS policy map lifetime fix" from [cilium/proxy#1982](https://github.com/cilium/proxy/pull/1982) for cilium 1.20 that fixes https://github.com/cilium/cilium/issues/47624
Let's avoid having a full IPv6 header on the stack, that's only used for then copying values further into the CT tuple. And instead copy those values over into the right place.
Explicitly configure a limit for the zstd decoder used to decode the ClusterEndpointSlice entries received over Cluster Mesh, to prevent the risk of unbounded memory usage in case of crafted payloads. I've marked the PR as `release-note/misc` because the logic ingesting ClusterEndpointSlices is incomplete and disabled behind a feature flag in v1.20. Reported
### Is there an existing issue for this? - https://github.com/cilium/cilium/issues/42325 ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? It is structured as follows. When the backend Pod and the assigned Envoy are on the same Node, the 3-way handshake between the Envoy and the Pod fails. As a result, the Envoy returns a 503
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? When loading identity-related label filters via `label-prefix-file` the label can only be provided as a string prefix and not as a regex. [The documentation](https://docs.cilium.io/en/latest/ope
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? Hubble Relay does not fully terminate after receiving SIGTERM. The Relay server shuts down and the log reports Server stopped, but the Relay process remains running until the Kubernetes terminat
We have been using a fork of `sigs.k8s.io/controller-tools` ever since we've been using controller-tools to generate our CRDs (#11607). The upstream project has evolved a lot in the last 5 years and now supports all the features we need, meaning we no longer need to use our forked version. See the following table for details of every single commit from our f
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
This change does not implement compile time cost limit for flow filter CEL Expressions. Currently the [flow proto types](https://github.com/fristonio/cilium/blob/0906ee16c4f4c01d98297cc520d0d5a821b6b085/api/v1/flow/flow.proto#L14) are not annotated with validation descriptors, so the size of strings/map/list are not known at compile time causing cost estimat
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
Implementation of BPF runtime statistics reporting CLI under `cilium-dbg bpf stats report`. Enabling and disabling BPF stats collection in the kernel is done through the daemon configuration option `enable-bpf-stats`. Statistics collection is performed by querying active BPF programs attached to endpoints (mapped to Kubernetes pods), native devices, and the
PR #46688 introduces disableDefaultVolumes=true to let `extraVolumes/extraVolumeMounts` provide TLS certificates. Since Cilium’s built-in certificates are no longer used, administrators do not need to configure `.Values.hubble.relay.tls.client.cert` and `.Values.hubble.relay.tls.client.key` Although these built-in secrets are no longer mounted into pod, thei
Motivation: The Ingress TLS termination example does not configure ALPN protocol negotiation in the generated Envoy CiliumEnvoyConfig. gRPC requires ALPN to select the h2 protocol during the TLS handshake, so gRPC clients that correctly enforce ALPN (per the gRPC spec) fail to connect through a TLS-terminating Ingress with errors such as "missing selected AL
This PR contains some enhancements to the eBPF compilation step to help improve the eBPF test suite build time in CI (related conversation in #45133). This change updates the BPF Checks workflow step to utilize all available CPU cores in the Github Actions runner to reduce build times for eBPF test targets in CI. AI Level: 1 Fixes: nobug [AI Influence Level]
### Description When `kubeProxyReplacement=true`, the runtime unconditionally enables Socket LB in `pkg/kpr/kpr.go`. However, the Helm chart currently renders `bpf-lb-sock` directly from `socketLB.enabled`, which defaults to `false`. As a result, the generated `cilium-config` ConfigMap can report: ```yaml bpf-lb-sock: "false" ``` even though Socket LB is ena
During workload churn, Hubble may report `DROP_EP_NOT_READY` when Envoy upstream TCP connections outlive the source endpoint. The behavioral change submitted in https://github.com/cilium/cilium/pull/46508 would likely add too much complexity for a somewhat cosmetic issue. This PR instead adds a note to the GAMMA docs to mention this caveat. Related to: #4197
Gateway and GAMMA infrastructure annotations originate from user-controlled resources and are propagated to generated CiliumEnvoyConfig metadata. This allowed those resources to set reserved cec.cilium.io controls that affect proxy and policy behavior. Filter the complete CEC annotation namespace while decorating generated CECs. Preserve internally generated
Replace the unsupported LLVM installer action in the lint and integration test workflows with a local Bash composite action. The local action preserves: - LLVM 19.1.7 installation - X64 and ARM64 archive selection - LLVM path and library environment exports - installed Clang version verification After #47780 restored LLVM and Clang installation in `integrati
<!-- Description of change --> The Rule struct is shared by both CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, and its NodeSelector field can only be used in CiliumClusterwideNetworkPolicies. ``` // https://github.com/cilium/cilium/blob/main/pkg/policy/api/rule.go#L76 type Rule struct { ... // NodeSelector selects all nodes which should be subject
Hubble currently identifies a Pod mainly by cluster, namespace, and name. Kubernetes permits a deleted object’s name to be reused, while its UID uniquely identifies that specific object lifetime. This matters especially for StatefulSet Pods, but applies to any recreated Pod. Adding the UID to endpoints permits correct flow attribution and lets consumers dist
The [UserEnforcePresence] function is responsible for creating the target user in etcd, if not present, and granting the specified roles. Let's extend it to additionally revoke any possible roles that had been previously granted to that user, and are not present in the list of roles anymore. While being there, let's also cover this logic with a dedicated uni
This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - ⚠️ WARN: Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAg
### Is your proposed feature related to a problem? ## Cilium Feature Proposal Design discussion doc: [Google-Doc](https://docs.google.com/document/d/1jzi3plui0wd4-dI8FnumtDLJJ-Mno7dJI7uiGmTIxxE/edit?usp=sharing) ### Summary This CFP proposes an opt-in way for backend pods of a Kubernetes `LoadBalancer` Service to use that Service's external LoadBalancer IP a
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? A bonded interface on the node was being torn down and recreated every ~34s (unrelated host misconfiguration). The bond carries three VLAN sub-interfaces, so each cycle removes and re-adds three
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? ## Potential issue with usePrimaryAddress ### Cilium v1.19.6, AWS `t3.small` On a `t3.small` instance using AWS ENI IPAM mode with `use-primary-address: true`, Cilium seems to cap max IPs at 9 w
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit
# Description This PR implements Part 5 of the hybrid routing mode feature ([CFP-32810](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-32810-hybrid-routing-mode.md)). It skips SNAT for same-subnet pod-to-remote-node traffic in hybrid overlay mode. ## Context In overlay mode, pod-to-remote-node traffic is normally masqueraded before leaving the ho
Add a probe for numeric iterators and define the HAVE_BPF_ITER_NUM macro in features.h if the corresponding kfuncs are supported by the kernel. (This macro will be used by future patches.)
## Description `validateListener` left the listener status `supportedKinds` field nil for listeners using an unsupported protocol. The Gateway API `ListenerStatus.SupportedKinds` field is serialized with `omitzero`, so a nil slice is dropped from the status entirely — the listener ended up with no `supportedKinds` key at all. The `allowedRoutes` and TLS-term
## Summary In DSR mode with Geneve dispatch, the Geneve option carrying the service VIP:port is attached only to the **SYN** of a TCP connection. A mid-flow packet that is re-routed to a **different LB node** (e.g. after an ECMP rehash on the upstream router when a BGP next-hop is added/removed) does `CT_NEW` on that new node, selects a backend via Maglev, a
This is initial PR to add Delta ADS support in cilium proxy. Followup PR will wire up config option with delta-ads mode, update docs and helm charts and exercise new mode in ci. Forward Delta request and response callbacks through the callback chain and correlate responses by stream, type URL, and nonce. Use that state to resolve the correct pending completi
Fix test flake due to 5-tuple collision. The flake happens in `l7-lb` test that intentionally accesses the same backend via both L7-LB service and normal L3/4 load balancer service when the pod happens to use the same source port for both: 1. Access via L7-LB service works, Envoy keeps the upstream connection open on the 5-tuple with the source pod IP/port a
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
When forwarding a DSR request to a remote backend, each egress path currently needs to have its own logic to extract the TCP flags and check for the SYN flag. But we already obtain the flag during the CT lookup. So let's just forward a "need_dsr_info" indication over the tailcall boundary, mixing it into the free part of the CB_PORT slot.
``` The DSR ingress path on a remote node currently expects DSR-info on both the SYN *and* the SYN-ACK. And clears the connection's DSR status if either of those packets doesn't carry DSR info. But it should actually be fine for the LB node to only send the DSR info on the SYN packet. So let's relax this check accordingly, and not require DSR info on the SYN
When a DSR-enabled node receives a TCP packet with SYN flag but *without* DSR info, it updates the connection's DSR status to 'false'. This addresses scenarios where a connection is re-opened by the same client, but this time directly towards the backend (without a service inbetween). But since we're using a CT tuple that hasn't been used for a CT lookup, it
In ENI IPAM mode the MTU auto detection excludes the secondary ENIs, which are managed by Cilium, and derives the base MTU from the primary ENI only. The primary ENI was told apart from the secondary ones by comparing ENI.IP with the first NodeInternalIP of the CiliumNode. ENI.IP is the primary private IPv4 address of the ENI, as reported by the EC2 API, so
In helm, `endpointPolicyUpdateTimeoutDuration` defaulted to null , so the generated values.schema.json typed it as "null" only. Helm validates --set /values input against this schema before rendering, so any real duration string (e.g. "30s" ) was rejected on install/upgrade. so, widen the schema to string so an explicit duration reaches the ConfigMap templat