{"push_id":2484229605,"size":6,"distinct_size":1,"ref":"refs/heads/npds-l3","head":"855196ea28e443762a1d39ac475e1f565ecb2b2e","before":"43af48b60add17b2c1126f91feb5ec75f39d92ee","commits":[{"sha":"645afa10741355d6fcd09c316ac01def0024a928","author":{"name":"André Martins","email":"bc9800b9d52a24cce72a73dd528afed53f10e5fc@cilium.io"},"message":"test: fix star wars demo\n\nOnce a new endpoint is created, it can trigger regeneration for all the\nremaining endpoints. By not checking if all of them were in ready state\nbefore testing the connection all the traffic could potentially be\ndropped until the security labels are assigned to that particular endpoint.\n\nSince the communication was always denied, before the endpoint had its\nsecurity ID assigned, the tests would always fail as it was expecting\nthe connection to be successfull.\n\nFor this reason we should wait for all endpoints to be in ready state\nbefore testing out any connection tests.\n\nAs an example for endpoint 36125 the monitor would show the following:\n\n```\n<- endpoint 36125 flow 0xfd750d60 identity 0->0 state new ifindex 0: 9a:1a:e4:12:33:29 -> ff:ff:ff:ff:ff:ff ARP\n-> lxc8d11b: ca:f4:2e:75:46:11 -> 9a:1a:e4:12:33:29 ARP\n<- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\nxx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\n<- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\nxx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\n<- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\nxx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\n<- endpoint 36125 flow 0xae0d91ac identity 0->0 state new ifindex 0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\nxx drop (Policy denied (L3)) flow 0xae0d91ac to endpoint 0, identity 0->0: 10.1.139.2:45668 -> 172.20.0.10:53 udp\n>> Endpoint regenerated: 36125 (k8s:class=spaceship,k8s:org=alliance,k8s:io.kubernetes.pod.namespace=default)\n<- endpoint 56687 flow 0xb1f87f1 identity 21577->0 state new ifindex 0: fe80::c41d:a6ff:fef1:7998 -> ff02::2 RouterSolicitation\n```\n\nSigned-off-by: André Martins <andre@cilium.io>","distinct":false,"url":"https://api.github.com/repos/cilium/cilium/commits/645afa10741355d6fcd09c316ac01def0024a928"},{"sha":"ce741afa31adcc7fb39939112f64fc2e3c757d0d","author":{"name":"Jarno Rajahalme","email":"0f1ab0ac7dffd9db21aa539af2fd4bb04abc3ad4@covalent.io"},"message":"bpf: Honor DROP_ALL also in ingress to a container.\n\nEven if DROP_ALL is defined, the bpf program can be compiled so that\nthe actual ingress policy check returns OK (e.g., POLICY_INGRESS not\ndefined). Check for DROP_ALL in higher level code that is not\nconditional to any other compile time definitions.\n\nFixes: https://github.com/cilium/cilium/issues/3731\nSigned-off-by: Jarno Rajahalme <jarno@covalent.io>","distinct":false,"url":"https://api.github.com/repos/cilium/cilium/commits/ce741afa31adcc7fb39939112f64fc2e3c757d0d"},{"sha":"786376ee9c1489505f722f20e5b20e35f7b7e9ad","author":{"name":"Jarno Rajahalme","email":"0f1ab0ac7dffd9db21aa539af2fd4bb04abc3ad4@covalent.io"},"message":"bpf: Make all funtions in lib/policy.h conditional on DROP_ALL\n\nMake all policy decision functions conditional on DROP_ALL to avoid regressions in future.\n\nSuggested-by: Thomas Graf <thomas@cilium.io>\nSigned-off-by: Jarno Rajahalme <jarno@covalent.io>","distinct":false,"url":"https://api.github.com/repos/cilium/cilium/commits/786376ee9c1489505f722f20e5b20e35f7b7e9ad"},{"sha":"5209ca47da1971aa4acaa452be7b76402b068020","author":{"name":"Romain Lenglet","email":"b8aabb4b95c817d9df69b6be95b2b94d6b1efe17@covalent.io"},"message":"test: Fix Star Wars demo test\n\nSigned-off-by: Romain Lenglet <romain@covalent.io>","distinct":false,"url":"https://api.github.com/repos/cilium/cilium/commits/5209ca47da1971aa4acaa452be7b76402b068020"},{"sha":"083f9d798e2ee3baefe288260a509896c44434f0","author":{"name":"Romain Lenglet","email":"b8aabb4b95c817d9df69b6be95b2b94d6b1efe17@covalent.io"},"message":"policy: Synthesize wildcard L7 rules for L3-only rules\n\nSigned-off-by: Romain Lenglet <romain@covalent.io>","distinct":false,"url":"https://api.github.com/repos/cilium/cilium/commits/083f9d798e2ee3baefe288260a509896c44434f0"},{"sha":"855196ea28e443762a1d39ac475e1f565ecb2b2e","author":{"name":"Romain Lenglet","email":"b8aabb4b95c817d9df69b6be95b2b94d6b1efe17@covalent.io"},"message":"envoy: Translate L3-only rules into wildcard L4 rules\n\nOptimize the policies generated for NPDS: simplify or eliminate\nL7 rules that are already covered by L4-only rules, and simplify\nor eliminate L4/L7 rules that are already covered by L3-only\nrules.\n\nSigned-off-by: Romain Lenglet <romain@covalent.io>","distinct":true,"url":"https://api.github.com/repos/cilium/cilium/commits/855196ea28e443762a1d39ac475e1f565ecb2b2e"}]}
{"actor":{"display_login":"rlenglet"}}