From c99f908f9fd3627bf276229e1601642d4ce993fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=94=A1=E7=A7=80=E5=90=89?= <84045975+thc1006@users.noreply.github.com> Date: Fri, 13 Feb 2026 22:00:00 +0800 Subject: [PATCH] Bump custom_cni test Cilium version to 1.18.6 (#13002) Upgrade the Cilium version used in custom_cni tests from 1.16.3 to 1.18.6 to align with the current cilium_version in Kubespray. - Update custom_cni_chart_version in debian12-custom-cni-helm.yml - Regenerate static manifest in tests/files/custom_cni/cilium.yaml using helm template cilium/cilium --version 1.18.6 Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com> --- tests/files/custom_cni/cilium.yaml | 534 ++++++++--------------- tests/files/debian12-custom-cni-helm.yml | 2 +- 2 files changed, 186 insertions(+), 350 deletions(-) diff --git a/tests/files/custom_cni/cilium.yaml b/tests/files/custom_cni/cilium.yaml index c89ae15eb..1d9fcacd6 100644 --- a/tests/files/custom_cni/cilium.yaml +++ b/tests/files/custom_cni/cilium.yaml @@ -1,4 +1,13 @@ --- +# Source: cilium/templates/cilium-secrets-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium + annotations: +--- # Source: cilium/templates/cilium-agent/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount @@ -29,7 +38,8 @@ metadata: data: # Identity allocation mode selects how identities are shared between cilium - # nodes by setting how they are stored. The options are "crd" or "kvstore". + # nodes by setting how they are stored. The options are "crd", "kvstore" or + # "doublewrite-readkvstore" / "doublewrite-readcrd". # - "crd" stores identities in kubernetes as CRDs (custom resource definition). # These can be queried with: # kubectl get ciliumid @@ -38,7 +48,11 @@ data: # backend. Upgrades from these older cilium versions should continue using # the kvstore by commenting out the identity-allocation-mode below, or # setting it to "kvstore". + # - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful + # for seamless migrations from the kvstore mode to the crd mode. Consult the + # documentation for more information on how to perform the migration. identity-allocation-mode: crd + identity-heartbeat-timeout: "30m0s" identity-gc-interval: "15m0s" cilium-endpoint-gc-interval: "5m0s" @@ -47,6 +61,7 @@ data: # If you want to run cilium in debug mode change this value to true debug: "false" debug-verbose: "" + metrics-sampling-interval: "5m" # The agent can be put into the following three policy enforcement modes # default, always and never. # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes @@ -58,6 +73,9 @@ data: # is scheduled. operator-prometheus-serve-addr: ":9963" enable-metrics: "true" + enable-policy-secrets-sync: "true" + policy-secrets-only-from-secrets-namespace: "true" + policy-secrets-namespace: "cilium-secrets" # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4 # address. @@ -92,11 +110,18 @@ data: # bpf-policy-map-max specifies the maximum number of entries in endpoint # policy map (per endpoint) bpf-policy-map-max: "16384" + # bpf-policy-stats-map-max specifies the maximum number of entries in global + # policy stats map + bpf-policy-stats-map-max: "65536" # bpf-lb-map-max specifies the maximum number of entries in bpf lb service, # backend and affinity maps. bpf-lb-map-max: "65536" bpf-lb-external-clusterip: "false" + bpf-lb-source-range-all-types: "false" + bpf-lb-algorithm-annotation: "false" + bpf-lb-mode-annotation: "false" + bpf-distributed-lru: "false" bpf-events-drop-enabled: "true" bpf-events-policy-verdict-enabled: "true" bpf-events-trace-enabled: "true" @@ -119,7 +144,7 @@ data: preallocate-bpf-maps: "false" # Name of the cluster. Only relevant when building a mesh of clusters. - cluster-name: default + cluster-name: "default" # Unique ID of the cluster. Must be unique across all conneted clusters and # in the range of 1 and 255. Only relevant when building a mesh of clusters. cluster-id: "0" @@ -129,15 +154,15 @@ data: # - disabled # - vxlan (default) # - geneve - # Default case + routing-mode: "tunnel" tunnel-protocol: "vxlan" + tunnel-source-port-range: "0-0" service-no-backend-response: "reject" # Enables L7 proxy for L7 policy enforcement and visibility enable-l7-proxy: "true" - enable-ipv4-masquerade: "true" enable-ipv4-big-tcp: "false" enable-ipv6-big-tcp: "false" @@ -148,18 +173,15 @@ data: enable-xt-socket-fallback: "true" install-no-conntrack-iptables-rules: "false" + iptables-random-fully: "false" auto-direct-node-routes: "false" direct-routing-skip-unreachable: "false" - enable-local-redirect-policy: "false" - enable-runtime-device-detection: "true" + + kube-proxy-replacement: "false" - kube-proxy-replacement-healthz-bind-address: "" bpf-lb-sock: "false" - bpf-lb-sock-terminate-pod-connections: "false" - enable-host-port: "false" - enable-external-ips: "false" enable-node-port: "false" nodeport-addresses: "" enable-health-check-nodeport: "true" @@ -168,25 +190,30 @@ data: enable-auto-protect-node-port-range: "true" bpf-lb-acceleration: "disabled" enable-svc-source-range-check: "true" - enable-l2-neigh-discovery: "true" - arping-refresh-period: "30s" + enable-l2-neigh-discovery: "false" k8s-require-ipv4-pod-cidr: "false" k8s-require-ipv6-pod-cidr: "false" enable-k8s-networkpolicy: "true" + enable-endpoint-lockdown-on-policy-overflow: "false" # Tell the agent to generate and write a CNI configuration file write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist cni-exclusive: "true" cni-log-file: "/var/run/cilium/cilium-cni.log" enable-endpoint-health-checking: "true" enable-health-checking: "true" + health-check-icmp-failure-threshold: "3" enable-well-known-identities: "false" enable-node-selector-labels: "false" synchronize-k8s-nodes: "true" operator-api-serve-addr: "127.0.0.1:9234" + + enable-hubble: "false" ipam: "cluster-pool" ipam-cilium-node-update-rate: "15s" cluster-pool-ipv4-cidr: "{{ kube_pods_subnet }}" cluster-pool-ipv4-mask-size: "24" + + default-lb-service-ipam: "lbipam" egress-gateway-reconciliation-trigger-interval: "1s" enable-vtep: "false" vtep-endpoint: "" @@ -196,11 +223,9 @@ data: procfs: "/host/proc" bpf-root: "/sys/fs/bpf" cgroup-root: "/run/cilium/cgroupv2" - enable-k8s-terminating-endpoint: "true" - enable-sctp: "false" - k8s-client-qps: "10" - k8s-client-burst: "20" + identity-management-mode: "agent" + enable-sctp: "false" remove-cilium-node-taints: "true" set-cilium-node-taints: "true" set-cilium-is-up-condition: "true" @@ -210,10 +235,11 @@ data: dnsproxy-socket-linger-timeout: "10" tofqdns-dns-reject-response-code: "refused" tofqdns-enable-dns-compression: "true" - tofqdns-endpoint-max-ip-per-hostname: "50" + tofqdns-endpoint-max-ip-per-hostname: "1000" tofqdns-idle-connection-grace-period: "0s" tofqdns-max-deferred-connection-deletes: "10000" tofqdns-proxy-response-max-delay: "100ms" + tofqdns-preallocate-identities: "true" agent-not-ready-taint-key: "node.cilium.io/agent-not-ready" mesh-auth-enabled: "true" @@ -224,20 +250,29 @@ data: proxy-xff-num-trusted-hops-ingress: "0" proxy-xff-num-trusted-hops-egress: "0" proxy-connect-timeout: "2" + proxy-initial-fetch-timeout: "30" proxy-max-requests-per-connection: "0" proxy-max-connection-duration-seconds: "0" proxy-idle-timeout-seconds: "60" + proxy-max-concurrent-retries: "128" + http-retry-count: "3" + http-stream-idle-timeout: "300" external-envoy-proxy: "true" envoy-base-id: "0" - + envoy-access-log-buffer-size: "4096" envoy-keep-cap-netbindservice: "false" max-connected-clusters: "255" clustermesh-enable-endpoint-sync: "false" clustermesh-enable-mcs-api: "false" + policy-default-local-cluster: "false" nat-map-stats-entries: "32" nat-map-stats-interval: "30s" + enable-internal-traffic-policy: "true" + enable-lb-ipam: "true" + enable-non-default-deny-policies: "true" + enable-source-ip-verification: "true" # Extra config allows adding arbitrary properties to the cilium config. # By putting it at the end of the ConfigMap, it's also possible to override existing properties. @@ -249,324 +284,9 @@ metadata: name: cilium-envoy-config namespace: kube-system data: + # Keep the key name as bootstrap-config.json to avoid breaking changes bootstrap-config.json: | - { - "node": { - "id": "host~127.0.0.1~no-id~localdomain", - "cluster": "ingress-cluster" - }, - "staticResources": { - "listeners": [ - { - "name": "envoy-prometheus-metrics-listener", - "address": { - "socket_address": { - "address": "0.0.0.0", - "port_value": 9964 - } - }, - "filter_chains": [ - { - "filters": [ - { - "name": "envoy.filters.network.http_connection_manager", - "typed_config": { - "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager", - "stat_prefix": "envoy-prometheus-metrics-listener", - "route_config": { - "virtual_hosts": [ - { - "name": "prometheus_metrics_route", - "domains": [ - "*" - ], - "routes": [ - { - "name": "prometheus_metrics_route", - "match": { - "prefix": "/metrics" - }, - "route": { - "cluster": "/envoy-admin", - "prefix_rewrite": "/stats/prometheus" - } - } - ] - } - ] - }, - "http_filters": [ - { - "name": "envoy.filters.http.router", - "typed_config": { - "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router" - } - } - ], - "stream_idle_timeout": "0s" - } - } - ] - } - ] - }, - { - "name": "envoy-health-listener", - "address": { - "socket_address": { - "address": "127.0.0.1", - "port_value": 9878 - } - }, - "filter_chains": [ - { - "filters": [ - { - "name": "envoy.filters.network.http_connection_manager", - "typed_config": { - "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager", - "stat_prefix": "envoy-health-listener", - "route_config": { - "virtual_hosts": [ - { - "name": "health", - "domains": [ - "*" - ], - "routes": [ - { - "name": "health", - "match": { - "prefix": "/healthz" - }, - "route": { - "cluster": "/envoy-admin", - "prefix_rewrite": "/ready" - } - } - ] - } - ] - }, - "http_filters": [ - { - "name": "envoy.filters.http.router", - "typed_config": { - "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router" - } - } - ], - "stream_idle_timeout": "0s" - } - } - ] - } - ] - } - ], - "clusters": [ - { - "name": "ingress-cluster", - "type": "ORIGINAL_DST", - "connectTimeout": "2s", - "lbPolicy": "CLUSTER_PROVIDED", - "typedExtensionProtocolOptions": { - "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": { - "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions", - "commonHttpProtocolOptions": { - "idleTimeout": "60s", - "maxConnectionDuration": "0s", - "maxRequestsPerConnection": 0 - }, - "useDownstreamProtocolConfig": {} - } - }, - "cleanupInterval": "2.500s" - }, - { - "name": "egress-cluster-tls", - "type": "ORIGINAL_DST", - "connectTimeout": "2s", - "lbPolicy": "CLUSTER_PROVIDED", - "typedExtensionProtocolOptions": { - "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": { - "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions", - "commonHttpProtocolOptions": { - "idleTimeout": "60s", - "maxConnectionDuration": "0s", - "maxRequestsPerConnection": 0 - }, - "upstreamHttpProtocolOptions": {}, - "useDownstreamProtocolConfig": {} - } - }, - "cleanupInterval": "2.500s", - "transportSocket": { - "name": "cilium.tls_wrapper", - "typedConfig": { - "@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext" - } - } - }, - { - "name": "egress-cluster", - "type": "ORIGINAL_DST", - "connectTimeout": "2s", - "lbPolicy": "CLUSTER_PROVIDED", - "typedExtensionProtocolOptions": { - "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": { - "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions", - "commonHttpProtocolOptions": { - "idleTimeout": "60s", - "maxConnectionDuration": "0s", - "maxRequestsPerConnection": 0 - }, - "useDownstreamProtocolConfig": {} - } - }, - "cleanupInterval": "2.500s" - }, - { - "name": "ingress-cluster-tls", - "type": "ORIGINAL_DST", - "connectTimeout": "2s", - "lbPolicy": "CLUSTER_PROVIDED", - "typedExtensionProtocolOptions": { - "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": { - "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions", - "commonHttpProtocolOptions": { - "idleTimeout": "60s", - "maxConnectionDuration": "0s", - "maxRequestsPerConnection": 0 - }, - "upstreamHttpProtocolOptions": {}, - "useDownstreamProtocolConfig": {} - } - }, - "cleanupInterval": "2.500s", - "transportSocket": { - "name": "cilium.tls_wrapper", - "typedConfig": { - "@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext" - } - } - }, - { - "name": "xds-grpc-cilium", - "type": "STATIC", - "connectTimeout": "2s", - "loadAssignment": { - "clusterName": "xds-grpc-cilium", - "endpoints": [ - { - "lbEndpoints": [ - { - "endpoint": { - "address": { - "pipe": { - "path": "/var/run/cilium/envoy/sockets/xds.sock" - } - } - } - } - ] - } - ] - }, - "typedExtensionProtocolOptions": { - "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": { - "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions", - "explicitHttpConfig": { - "http2ProtocolOptions": {} - } - } - } - }, - { - "name": "/envoy-admin", - "type": "STATIC", - "connectTimeout": "2s", - "loadAssignment": { - "clusterName": "/envoy-admin", - "endpoints": [ - { - "lbEndpoints": [ - { - "endpoint": { - "address": { - "pipe": { - "path": "/var/run/cilium/envoy/sockets/admin.sock" - } - } - } - } - ] - } - ] - } - } - ] - }, - "dynamicResources": { - "ldsConfig": { - "apiConfigSource": { - "apiType": "GRPC", - "transportApiVersion": "V3", - "grpcServices": [ - { - "envoyGrpc": { - "clusterName": "xds-grpc-cilium" - } - } - ], - "setNodeOnFirstMessageOnly": true - }, - "resourceApiVersion": "V3" - }, - "cdsConfig": { - "apiConfigSource": { - "apiType": "GRPC", - "transportApiVersion": "V3", - "grpcServices": [ - { - "envoyGrpc": { - "clusterName": "xds-grpc-cilium" - } - } - ], - "setNodeOnFirstMessageOnly": true - }, - "resourceApiVersion": "V3" - } - }, - "bootstrapExtensions": [ - { - "name": "envoy.bootstrap.internal_listener", - "typed_config": { - "@type": "type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener" - } - } - ], - "layeredRuntime": { - "layers": [ - { - "name": "static_layer_0", - "staticLayer": { - "overload": { - "global_downstream_max_connections": 50000 - } - } - } - ] - }, - "admin": { - "address": { - "pipe": { - "path": "/var/run/cilium/envoy/sockets/admin.sock" - } - } - } - } + {"admin":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} --- # Source: cilium/templates/cilium-agent/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -745,6 +465,7 @@ rules: resources: # to check apiserver connectivity - namespaces + - secrets verbs: - get - list @@ -834,6 +555,13 @@ rules: - watch - delete - patch +- apiGroups: + - cilium.io + resources: + - ciliumbgpclusterconfigs/status + - ciliumbgppeerconfigs/status + verbs: + - update - apiGroups: - apiextensions.k8s.io resources: @@ -863,7 +591,6 @@ rules: - ciliumendpoints.cilium.io - ciliumendpointslices.cilium.io - ciliumenvoyconfigs.cilium.io - - ciliumexternalworkloads.cilium.io - ciliumidentities.cilium.io - ciliumlocalredirectpolicies.cilium.io - ciliumnetworkpolicies.cilium.io @@ -872,6 +599,7 @@ rules: - ciliumcidrgroups.cilium.io - ciliuml2announcementpolicies.cilium.io - ciliumpodippools.cilium.io + - ciliumgatewayclassconfigs.cilium.io - apiGroups: - cilium.io resources: @@ -880,6 +608,7 @@ rules: - ciliumbgppeeringpolicies - ciliumbgpclusterconfigs - ciliumbgpnodeconfigoverrides + - ciliumbgppeerconfigs verbs: - get - list @@ -961,6 +690,43 @@ rules: - list - watch --- +# Source: cilium/templates/cilium-agent/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch +--- +# Source: cilium/templates/cilium-operator/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-operator-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - update + - patch +--- # Source: cilium/templates/cilium-agent/rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -978,6 +744,40 @@ subjects: name: "cilium" namespace: kube-system --- +# Source: cilium/templates/cilium-agent/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-tlsinterception-secrets +subjects: +- kind: ServiceAccount + name: "cilium" + namespace: kube-system +--- +# Source: cilium/templates/cilium-operator/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-operator-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-operator-tlsinterception-secrets +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system +--- # Source: cilium/templates/cilium-envoy/service.yaml apiVersion: v1 kind: Service @@ -1024,6 +824,7 @@ spec: template: metadata: annotations: + kubectl.kubernetes.io/default-container: cilium-agent labels: k8s-app: cilium app.kubernetes.io/name: cilium-agent @@ -1032,9 +833,11 @@ spec: securityContext: appArmorProfile: type: Unconfined + seccompProfile: + type: Unconfined containers: - name: cilium-agent - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent command: - cilium-agent @@ -1049,7 +852,7 @@ spec: httpHeaders: - name: "brief" value: "true" - failureThreshold: 105 + failureThreshold: 300 periodSeconds: 2 successThreshold: 1 initialDelaySeconds: 5 @@ -1062,6 +865,8 @@ spec: httpHeaders: - name: "brief" value: "true" + - name: "require-k8s-connectivity" + value: "false" periodSeconds: 30 successThreshold: 1 failureThreshold: 10 @@ -1097,6 +902,10 @@ spec: resourceFieldRef: resource: limits.memory divisor: '1' + - name: KUBE_CLIENT_BACKOFF_BASE + value: "1" + - name: KUBE_CLIENT_BACKOFF_DURATION + value: "120" lifecycle: postStart: exec: @@ -1170,6 +979,9 @@ spec: mountPropagation: HostToContainer - name: cilium-run mountPath: /var/run/cilium + - name: cilium-netns + mountPath: /var/run/cilium/netns + mountPropagation: HostToContainer - name: etc-cni-netd mountPath: /host/etc/cni/net.d - name: clustermesh-secrets @@ -1183,9 +995,10 @@ spec: mountPath: /run/xtables.lock - name: tmp mountPath: /tmp + initContainers: - name: config - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent command: - cilium-dbg @@ -1208,7 +1021,7 @@ spec: # Required to mount cgroup2 filesystem on the underlying Kubernetes node. # We use nsenter command with host's cgroup and mount namespaces enabled. - name: mount-cgroup - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent env: - name: CGROUP_ROOT @@ -1245,7 +1058,7 @@ spec: drop: - ALL - name: apply-sysctl-overwrites - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent env: - name: BIN_PATH @@ -1283,7 +1096,7 @@ spec: # from a privileged container because the mount propagation bidirectional # only works from privileged containers. - name: mount-bpf-fs - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent args: - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf' @@ -1299,7 +1112,7 @@ spec: mountPath: /sys/fs/bpf mountPropagation: Bidirectional - name: clean-cilium-state - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent command: - /init-container.sh @@ -1346,7 +1159,7 @@ spec: mountPath: /var/run/cilium # wait-for-kube-proxy # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent - name: install-cni-binaries - image: "quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28" + image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4" imagePullPolicy: IfNotPresent command: - "/install-plugin.sh" @@ -1371,6 +1184,7 @@ spec: automountServiceAccountToken: true terminationGracePeriodSeconds: 1 hostNetwork: true + affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: @@ -1391,6 +1205,11 @@ spec: hostPath: path: /var/run/cilium type: DirectoryOrCreate + # To exec into pod network namespaces + - name: cilium-netns + hostPath: + path: /var/run/netns + type: DirectoryOrCreate # To keep state between restarts / upgrades for bpf maps - name: bpf-maps hostPath: @@ -1509,7 +1328,7 @@ spec: type: Unconfined containers: - name: cilium-envoy - image: "quay.io/cilium/cilium-envoy:v1.29.9-1728346947-0d05e48bfbb8c4737ec40d5781d970a550ed2bbd@sha256:42614a44e508f70d03a04470df5f61e3cffd22462471a0be0544cf116f2c50ba" + image: "quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86" imagePullPolicy: IfNotPresent command: - /usr/bin/cilium-envoy-starter @@ -1518,7 +1337,6 @@ spec: - '-c /var/run/cilium/envoy/bootstrap-config.json' - '--base-id 0' - '--log-level info' - - '--log-format [%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v' startupProbe: httpGet: host: "127.0.0.1" @@ -1631,7 +1449,7 @@ spec: type: DirectoryOrCreate - name: envoy-config configMap: - name: cilium-envoy-config + name: "cilium-envoy-config" # note: the leading zero means this number is in octal representation: do not remove it defaultMode: 0400 items: @@ -1683,9 +1501,12 @@ spec: app.kubernetes.io/part-of: cilium app.kubernetes.io/name: cilium-operator spec: + securityContext: + seccompProfile: + type: RuntimeDefault containers: - name: cilium-operator - image: "quay.io/cilium/operator-generic:v1.16.3@sha256:6e2925ef47a1c76e183c48f95d4ce0d34a1e5e848252f910476c3e11ce1ec94b" + image: "quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af" imagePullPolicy: IfNotPresent command: - cilium-operator-generic @@ -1737,6 +1558,11 @@ spec: - name: cilium-config-path mountPath: /tmp/cilium/config-map readOnly: true + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL terminationMessagePolicy: FallbackToLogsOnError hostNetwork: true restartPolicy: Always @@ -1755,7 +1581,17 @@ spec: nodeSelector: kubernetes.io/os: linux tolerations: - - operator: Exists + - key: node-role.kubernetes.io/control-plane + operator: Exists + - key: node-role.kubernetes.io/master + operator: Exists + - key: node.kubernetes.io/not-ready + operator: Exists + - key: node.cloudprovider.kubernetes.io/uninitialized + operator: Exists + - key: node.cilium.io/agent-not-ready + operator: Exists + volumes: # To read the configuration from the config map - name: cilium-config-path diff --git a/tests/files/debian12-custom-cni-helm.yml b/tests/files/debian12-custom-cni-helm.yml index f0a5666d2..8549524cc 100644 --- a/tests/files/debian12-custom-cni-helm.yml +++ b/tests/files/debian12-custom-cni-helm.yml @@ -10,7 +10,7 @@ custom_cni_chart_release_name: cilium custom_cni_chart_repository_name: cilium custom_cni_chart_repository_url: https://helm.cilium.io custom_cni_chart_ref: cilium/cilium -custom_cni_chart_version: 1.16.3 +custom_cni_chart_version: 1.18.6 custom_cni_chart_values: cluster: name: kubespray